@linxin666/dsh-remote-web-ui 0.3.24 → 0.4.1

package/lib/types/index.js

@@ -26,6 +26,7 @@ import { isHttpUrl, tunnelPlanOf } from "./tunnel-plan.js";
 import { loadRelayIdentity, RelayRegistrar } from "./relay-registry.js";
 import { desiredBindHost, desiredBindPort, firewallActionNeeded, pendingRestartOf } from "./lan-bind-plan.js";
 import { createInnerAuth } from "./inner-auth.js";
+import { withIdentityEncoding } from "./http.js";
 import { TunnelManager } from "./tunnel.js";
 import { PublicBaseKeeper } from "./public-base.js";
 import { checkUpdates, fetchGitHubReleaseNotes, fetchLatestVersion, RELEASE_NOTES_CACHE_TTL_MS, resolveAnchorManifest, resolveUpdateTarget, runUpdateVerified, } from "./update.js";
@@ -38,9 +39,12 @@ export const name = 'remote-web-ui';
 /** Services required before the pairing surfaces can mount. */
 export const inject = ['webServer', 'typertGateway', 'connection'];
 /**
- * Settings namespace of the remote-control capability — the section the web
- * settings surface edits. Spelled here rather than imported: the browser
- * half spells the same value and must not depend on a Host package.
+ * Settings namespace of the remote-control capability. Under the 0.1.7
+ * settings model the namespace IS the Host profile entry id, so this is also
+ * the id the browser half asks `ctx.configForms` for (the family binder
+ * resolves the same value to the owning entry). Spelled here rather than
+ * imported: the browser half spells the same value and must not depend on a
+ * Host package.
  */
 export const REMOTE_WEB_UI_SETTINGS_NAMESPACE = 'remote-web-ui';
 export const Config = z.object({
@@ -62,11 +66,16 @@ export const Config = z.object({
 });
 /** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
 const SWEEP_INTERVAL_MS = 10_000;
+/**
+ * How long one update-status probe answer is reused. The probe fans out one
+ * registry GET per family package plus a GitHub call, and the sidebar update
+ * entry asks for the status on every GUI page load.
+ */
+const UPDATE_STATUS_TTL_MS = 60_000;
 /**
  * The single mapping from resolved plugin config to the pairing service
- * config. Both the constructed service and every live settings sync reuse
- * it, so no field can be silently dropped when the web settings surface
- * pushes a new value into the running service.
+ * config. Both the constructed service and every later apply of this row
+ * reuse it, so no field can be silently dropped.
  */
 export function pairingConfigOf(resolved) {
     return {
@@ -125,30 +134,12 @@ function applyImpl(ctx, config) {
         profile: config?.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
         enabled: config?.enabled ?? DEFAULTS.enabled,
     };
-    // The live source the pairing service and the gate read: the settings
-    // section once the web settings surface is served, the composition entry
-    // otherwise (installSection swaps it when the namespace registers).
-    let current = () => config ?? {};
-    const resolve = () => {
-        const value = current();
-        return {
-            tokenTtlMs: value.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
-            offlineAfterMs: value.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
-            maxDevices: value.maxDevices ?? DEFAULTS.maxDevices,
-            idleExpireMs: value.idleExpireMs ?? DEFAULTS.idleExpireMs,
-            cookieName: value.cookieName ?? DEFAULTS.cookieName,
-            requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-            publicBaseUrl: value.publicBaseUrl ?? envPublicBase,
-            trustedHosts: value.trustedHosts,
-            devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
-            autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
-            tunnelToken: value.tunnelToken,
-            relay: value.relay ?? DEFAULTS.relay,
-            lanBind: value.lanBind,
-            profile: value.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
-            enabled: value.enabled ?? DEFAULTS.enabled,
-        };
-    };
+    // The effective configuration this activation runs on: under the 0.1.7
+    // settings model the plugin's own Config IS its settings document, so the
+    // Host serves the settings page from this schema and reloads the row after a
+    // save — a live edit re-enters apply() with the new value instead of being
+    // pushed into a running instance.
+    const resolve = () => resolved;
     const service = new PairingService(pairingConfigOf(resolved));
     // ── auto tunnel ─────────────────────────────────────────────────────────
     // The minted public URL becomes the QR base (and the pairing fence's
@@ -271,13 +262,14 @@ function applyImpl(ctx, config) {
             : [];
         service.setLanBases(lanBases);
     }
-    // Push a committed settings section into the service and gate. The service
+    // Push the effective configuration into the service and gate. The service
     // config object is read per operation (token mint, touch, sweep), and the
-    // gate re-reads its fence flag per request, so a live edit takes effect
-    // without a restart. When `enabled` turns off, the pairing routes and
-    // sweep timer are dropped and all device/token state is revoked, but the
-    // gate listener stays mounted so a LAN-exposed /api stays behind pairing
-    // (now vetoing every non-loopback request) instead of opening the fence.
+    // gate re-reads its fence flag per request, so a saved edit takes effect
+    // without a restart (the Host reloads this row, and apply re-runs). When
+    // `enabled` is off, the pairing routes and sweep timer are dropped and all
+    // device/token state is revoked, but the gate listener stays mounted so a
+    // LAN-exposed /api stays behind pairing (now vetoing every non-loopback
+    // request) instead of opening the fence.
     let disposeRoutes;
     let disposeSweep;
     // ── remote update ────────────────────────────────────────────────────────
@@ -308,16 +300,34 @@ function applyImpl(ctx, config) {
         releaseNotesCache.set(version, { at: Date.now(), notes });
         return notes;
     };
-    const updateRoutes = makeUpdateRoutes({
-        // Control endpoints are host-surface only: a LAN/phone origin must never
-        // trigger a real install on this machine.
-        fence: request => isTrustedApiRequest(request, []),
-        check: () => checkUpdates({
+    // The status probe fans out one registry GET per family package (plus a
+    // GitHub release-notes call), and the sidebar update entry asks for it on
+    // every GUI page load — so the answer is memoized briefly and concurrent
+    // callers share one probe. A completed update invalidates it.
+    let updateStatusCache;
+    let updateStatusInFlight;
+    const checkStatusCached = () => {
+        const cached = updateStatusCache;
+        if (cached !== undefined && Date.now() - cached.at < UPDATE_STATUS_TTL_MS)
+            return Promise.resolve(cached.value);
+        if (updateStatusInFlight !== undefined)
+            return updateStatusInFlight;
+        updateStatusInFlight = checkUpdates({
             anchorManifestPath: resolveAnchorPath(),
             resolve: hostResolve,
             fetchLatest: name => fetchLatestVersion(name, fetch),
             fetchReleaseNotes: fetchReleaseNotesCached,
-        }),
+        }).then((value) => {
+            updateStatusCache = { at: Date.now(), value };
+            return value;
+        }).finally(() => { updateStatusInFlight = undefined; });
+        return updateStatusInFlight;
+    };
+    const updateRoutes = makeUpdateRoutes({
+        // Control endpoints are host-surface only: a LAN/phone origin must never
+        // trigger a real install on this machine.
+        fence: request => isTrustedApiRequest(request, []),
+        check: () => checkStatusCached(),
         run: async () => {
             const target = resolveUpdateTarget({ anchorManifestPath: resolveAnchorPath() });
             if ('error' in target) {
@@ -334,7 +344,7 @@ function applyImpl(ctx, config) {
             // 11 minimumReleaseAge gate can silently keep the installed versions
             // (same-day releases), which a plain exit-0 check would report as
             // success — the user then restarts and nothing changed.
-            return runUpdateVerified({
+            const result = await runUpdateVerified({
                 run: { profileDir: target.profileDir, packages: target.packages },
                 check: {
                     anchorManifestPath: resolveAnchorPath(),
@@ -343,6 +353,9 @@ function applyImpl(ctx, config) {
                     fetchReleaseNotes: fetchReleaseNotesCached,
                 },
             });
+            // The install moved (or failed) the versions the cached status reported.
+            updateStatusCache = undefined;
+            return result;
         },
     });
     // LAN-bind facts for the settings card, re-read per request so a hot
@@ -416,11 +429,17 @@ function applyImpl(ctx, config) {
             return appShellCache.html;
         const cookie = await innerAuth.ready();
         try {
-            const response = await fetch(`http://127.0.0.1:${String(ctx.webServer.port)}/`, {
+            const response = await fetch(`http://127.0.0.1:${String(ctx.webServer.port)}/`, withIdentityEncoding({
                 headers: cookie !== undefined ? { cookie } : undefined,
-            });
-            if (!response.ok)
+            }));
+            if (!response.ok) {
+                // A stale credential (secret rotation, 30-day TTL) must not wedge every
+                // later landing: drop it so the next attempt re-redeems, exactly as the
+                // proxy path does on an upstream 401.
+                if (response.status === 401 || response.status === 403)
+                    innerAuth.invalidate();
                 return undefined;
+            }
             const html = await response.text();
             appShellCache = { at: Date.now(), html };
             return html;
@@ -458,15 +477,15 @@ function applyImpl(ctx, config) {
                 return list;
             },
         }),
-        // The remote desktop channel: policy-gated `/remote` prefix that
-        // re-issues fenced paths to loopback (see remote-api.ts). The live
-        // requirePairingForLan is re-read per request, same as the gate listener
-        // and routes above, so a stale client rewrite on an open-LAN deployment
-        // proxies instead of 403ing.
+        // The remote desktop channel: a paired-credential-gated `/remote` prefix
+        // that re-issues fenced paths to loopback (see remote-api.ts). The gate is
+        // unconditional — requirePairingForLan governs the plain /api surface and
+        // the desktop's client-side rewrite only; it is never an authorization
+        // input here, because this channel attaches the process's own browser
+        // credential to everything it forwards (issue #1665).
         ...makeRemoteApiRoutes({
             service,
             port: ctx.webServer.port,
-            requirePairingForLan: () => resolve().requirePairingForLan,
             auth: innerAuth,
         }),
         ...updateRoutes,
@@ -474,7 +493,6 @@ function applyImpl(ctx, config) {
     const upgrades = makeRemoteApiUpgradeRoutes({
         service,
         port: ctx.webServer.port,
-        requirePairingForLan: () => resolve().requirePairingForLan,
         auth: innerAuth,
     });
     const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
@@ -559,6 +577,9 @@ function applyImpl(ctx, config) {
     if (ctx.webServer.host === '0.0.0.0') {
         console.warn('remote-web-ui: LAN-exposed bind — pairing gates the /remote channel; direct /api stays under the harness fence + browser auth (stop() does not revoke an already-redeemed browser credential)');
     }
+    // Apply the effective configuration to the running surfaces once per
+    // activation: the service tunables, the LAN-bind block/firewall, the tunnel
+    // plan, the pairing routes, the presence sweep, and the posture probe.
     const sync = () => {
         const value = resolve();
         service.config = pairingConfigOf(value);
@@ -655,6 +676,10 @@ function applyImpl(ctx, config) {
                 : { kind: 'quick', targetUrl: plan.targetUrl, originHostHeader });
         }
         else if (plan.mode === 'named') {
+            // The hostname is fixed and known before the process runs, so publish it
+            // now: a named tunnel that fails to start must not leave the previous
+            // mode's ephemeral host as the QR and fence base.
+            publicBase.markRunning(plan.publicUrl);
             tunnel.start({ kind: 'named', token: plan.token, publicUrl: plan.publicUrl });
         }
         else {
@@ -676,8 +701,17 @@ function applyImpl(ctx, config) {
             }
         }
         const enabled = value.enabled;
-        if (!enabled)
+        if (!enabled) {
             service.stop();
+            // The tunnel branch above follows the plan, not the master switch, so an
+            // explicit "off" must also drop the public ingress it started: otherwise
+            // the cloudflared child keeps a live public URL (and the relay keeps its
+            // stable row) while the panel says remote control is stopped. The relay
+            // row is deliberately kept so re-enabling reuses the same origin.
+            tunnel.stop();
+            disposeRelayRegistrar();
+            publicBase.reset();
+        }
         if (disposeRoutes === undefined && enabled) {
             disposeRoutes = ctx.effect(() => {
                 const disposers = [
@@ -726,27 +760,8 @@ function applyImpl(ctx, config) {
             return;
         table.push({ kind: 'script', placement: 'head', text: REMOTE_CHANNEL_BOOT_SCRIPT });
     }), 'remote-web-ui: remote channel boot patch');
-    ctx.inject(['settings'], (settingsCtx) => {
-        try {
-            if (typeof settingsCtx.settings?.installSection === 'function') {
-                settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
-                    setSource: (source) => {
-                        current = source;
-                        sync();
-                    },
-                    onChange: sync,
-                });
-            }
-            else if (typeof settingsCtx.settings?.register === 'function') {
-                const scope = settingsCtx.settings.register(REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, { base: config ?? {} });
-                current = () => scope?.get?.() ?? (config ?? {});
-                scope?.watch?.(() => { sync(); });
-                sync();
-            }
-        }
-        catch {
-            // Defensive fallback against settings registration differences
-        }
-    });
+    // No settings registration: the Host derives this plugin's settings page
+    // from the exported `Config` schema and reloads the row after a save, so
+    // every write re-enters apply() with the new config (see `resolve`).
     sync();
 }

package/lib/types/inner-auth.d.ts

@@ -7,8 +7,9 @@
  * therefore redeems its own launch token (the same one-time exchange every
  * paired device's first navigation performs) and attaches the resulting
  * cookie to inner requests. The credential is only ever exercised behind the
- * pairing gate: while requirePairingForLan is on, every proxied call already
- * carried a live paired-device cookie before this module is consulted.
+ * pairing gate: the `/remote` channel always requires a live paired-device
+ * credential before this module is consulted, regardless of the
+ * requirePairingForLan LAN policy (issue #1665).
  */
 /** Browser-auth credential the proxy attaches to loopback-bound requests. */
 export interface InnerAuth {

package/lib/types/inner-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inner-auth.d.ts","sourceRoot":"","sources":["../../src/inner-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACpC,+DAA+D;IAC/D,UAAU,IAAI,IAAI,CAAA;CACnB;AAKD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,EACnC,SAAS,GAAE,OAAO,KAAa,GAC9B,SAAS,CA8CX"}
+{"version":3,"file":"inner-auth.d.ts","sourceRoot":"","sources":["../../src/inner-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACpC,+DAA+D;IAC/D,UAAU,IAAI,IAAI,CAAA;CACnB;AAKD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,EACnC,SAAS,GAAE,OAAO,KAAa,GAC9B,SAAS,CA8CX"}

package/lib/types/inner-auth.js

@@ -7,8 +7,9 @@
  * therefore redeems its own launch token (the same one-time exchange every
  * paired device's first navigation performs) and attaches the resulting
  * cookie to inner requests. The credential is only ever exercised behind the
- * pairing gate: while requirePairingForLan is on, every proxied call already
- * carried a live paired-device cookie before this module is consulted.
+ * pairing gate: the `/remote` channel always requires a live paired-device
+ * credential before this module is consulted, regardless of the
+ * requirePairingForLan LAN policy (issue #1665).
  */
 /** The harness browser-auth cookie name prefix (see dsh-client-connection). */
 const BROWSER_AUTH_COOKIE_PREFIX = 'dsh-auth-';

package/lib/types/pair-grant.d.ts

@@ -0,0 +1,66 @@
+/**
+ * One-time pairing grants for the /pair-app landing.
+ *
+ * The QR entry (`/pair-accept?pair=<token>`) used to hand the freshly minted
+ * device id to the app landing in its own URL (`/pair-app?device=<id>`). A
+ * device id is a live session credential: the channel gate authorizes every
+ * gated request by it and the cookie it mirrors lives a year, so a URL carrying
+ * it leaks that credential into browser history, the address bar, and every log
+ * on the path. The landing is reached with a one-time grant instead — 256 bits
+ * of entropy, a short TTL, and single-consume semantics — and the device id
+ * reaches the client only inside the server-rendered shell (the capture script
+ * the landing patches in).
+ *
+ * Consume semantics follow the reference implementation's one-time host
+ * capability (zcode `packages/server/src/hostCapability.ts`): the record is
+ * deleted on EVERY consume attempt — success, expiry, or replay — so a captured
+ * grant is worthless after its first use and a replayed one can never resolve,
+ * and only a first use inside the TTL yields a device.
+ *
+ * @module @linxin666/dsh-remote-web-ui/pair-grant
+ */
+/**
+ * Default grant lifetime. The grant only has to survive one redirect chain
+ * from the accept page to the app landing, tunnel round trips included, so it
+ * is far shorter than the device session it stands in for.
+ */
+export declare const DEFAULT_PAIR_GRANT_TTL_MS = 60000;
+/**
+ * Cap on live grants. The accept page is rate-limited per source, but the
+ * table is still caller-driven, so it stays bounded (oldest evicted first)
+ * exactly like the device table.
+ */
+export declare const MAX_LIVE_GRANTS = 256;
+/** Clock/entropy injection for tests. */
+export interface PairGrantStoreOptions {
+    /** Grant lifetime in ms (default {@link DEFAULT_PAIR_GRANT_TTL_MS}). */
+    ttlMs?: number;
+    /** Clock seam (default Date.now). */
+    now?: () => number;
+    /** Entropy seam (default 32 random bytes, base64url). */
+    createGrant?: () => string;
+}
+/** One issued grant and its absolute expiry (both non-secret to the issuer). */
+export interface PairGrantRecord {
+    /** The one-time secret carried in the /pair-app URL. */
+    grant: string;
+    /** Absolute expiry (ms epoch); a consume past this resolves to nothing. */
+    expiresAt: number;
+}
+/** The grant table surface the routes consume. */
+export interface PairGrantStore {
+    /** Mint one grant bound to a device session. */
+    issue(deviceId: string): PairGrantRecord;
+    /** Redeem a grant once, returning its device id (undefined when unusable). */
+    consume(grant: string | undefined): string | undefined;
+    /** Liveness check that does not spend the grant (the fence fallback). */
+    peek(grant: string | undefined): string | undefined;
+    /** Live grant count (tests/diagnostics). */
+    readonly size: number;
+}
+/**
+ * Build the grant table. Pure TypeScript with injected clock/randomness so the
+ * whole one-time semantics are unit-testable without a server.
+ */
+export declare function createPairGrantStore(options?: PairGrantStoreOptions): PairGrantStore;
+//# sourceMappingURL=pair-grant.d.ts.map

package/lib/types/pair-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair-grant.d.ts","sourceRoot":"","sources":["../../src/pair-grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAE/C;;;;GAIG;AACH,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC,yCAAyC;AACzC,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAAA;IACxC,8EAA8E;IAC9E,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAA;IACtD,yEAAyE;IACzE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAA;IACnD,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAQD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAoDxF"}

package/lib/types/pair-grant.js

@@ -0,0 +1,95 @@
+/**
+ * One-time pairing grants for the /pair-app landing.
+ *
+ * The QR entry (`/pair-accept?pair=<token>`) used to hand the freshly minted
+ * device id to the app landing in its own URL (`/pair-app?device=<id>`). A
+ * device id is a live session credential: the channel gate authorizes every
+ * gated request by it and the cookie it mirrors lives a year, so a URL carrying
+ * it leaks that credential into browser history, the address bar, and every log
+ * on the path. The landing is reached with a one-time grant instead — 256 bits
+ * of entropy, a short TTL, and single-consume semantics — and the device id
+ * reaches the client only inside the server-rendered shell (the capture script
+ * the landing patches in).
+ *
+ * Consume semantics follow the reference implementation's one-time host
+ * capability (zcode `packages/server/src/hostCapability.ts`): the record is
+ * deleted on EVERY consume attempt — success, expiry, or replay — so a captured
+ * grant is worthless after its first use and a replayed one can never resolve,
+ * and only a first use inside the TTL yields a device.
+ *
+ * @module @linxin666/dsh-remote-web-ui/pair-grant
+ */
+import { randomBytes } from 'node:crypto';
+/**
+ * Default grant lifetime. The grant only has to survive one redirect chain
+ * from the accept page to the app landing, tunnel round trips included, so it
+ * is far shorter than the device session it stands in for.
+ */
+export const DEFAULT_PAIR_GRANT_TTL_MS = 60_000;
+/**
+ * Cap on live grants. The accept page is rate-limited per source, but the
+ * table is still caller-driven, so it stays bounded (oldest evicted first)
+ * exactly like the device table.
+ */
+export const MAX_LIVE_GRANTS = 256;
+/**
+ * Build the grant table. Pure TypeScript with injected clock/randomness so the
+ * whole one-time semantics are unit-testable without a server.
+ */
+export function createPairGrantStore(options = {}) {
+    const ttlMs = options.ttlMs ?? DEFAULT_PAIR_GRANT_TTL_MS;
+    const now = options.now ?? (() => Date.now());
+    const createGrant = options.createGrant ?? (() => randomBytes(32).toString('base64url'));
+    const entries = new Map();
+    const purgeExpired = (at) => {
+        for (const [grant, entry] of entries) {
+            if (entry.expiresAt <= at)
+                entries.delete(grant);
+        }
+    };
+    return {
+        issue(deviceId) {
+            const issuedAt = now();
+            purgeExpired(issuedAt);
+            while (entries.size >= MAX_LIVE_GRANTS) {
+                const oldest = entries.keys().next().value;
+                if (oldest === undefined)
+                    break;
+                entries.delete(oldest);
+            }
+            const grant = createGrant();
+            const expiresAt = issuedAt + ttlMs;
+            entries.set(grant, { deviceId, expiresAt });
+            return { grant, expiresAt };
+        },
+        consume(grant) {
+            if (grant === undefined || grant === '')
+                return undefined;
+            const consumedAt = now();
+            const entry = entries.get(grant);
+            // Delete before validating: a replayed grant must never resolve, and an
+            // expired one must not linger in the table.
+            entries.delete(grant);
+            purgeExpired(consumedAt);
+            if (entry === undefined || entry.expiresAt <= consumedAt)
+                return undefined;
+            return entry.deviceId;
+        },
+        peek(grant) {
+            if (grant === undefined || grant === '')
+                return undefined;
+            const at = now();
+            const entry = entries.get(grant);
+            if (entry === undefined)
+                return undefined;
+            if (entry.expiresAt <= at) {
+                entries.delete(grant);
+                return undefined;
+            }
+            return entry.deviceId;
+        },
+        get size() {
+            return entries.size;
+        },
+    };
+}

package/lib/types/pairing.d.ts

@@ -7,9 +7,9 @@
  * Security invariants:
  * - One active token at a time; `issue()` replaces it, so a refreshed QR
  *   immediately invalidates the previous link.
- * - A token stays re-usable until it expires or is replaced: the first
- *   successful `accept()` marks it consumed, but the same link may pair
- *   again within the window (each re-accept mints a fresh device session).
+ * - A token is a bearer credential for its whole window: it is refused only
+ *   when unknown, expired, or after `stop()`, and the same link may pair
+ *   repeatedly within that window (each accept mints a fresh device session).
  *   Mobile flows routinely split across cookie contexts (camera preview to
  *   in-app browser to the system browser), and the later context must be
  *   able to complete its own pairing from the same link.
@@ -39,8 +39,6 @@ export interface TokenRecord {
     issuedAt: number;
     /** Absolute expiry (ms epoch); accept() past this is refused. */
     expiresAt: number;
-    /** Consumed by the first successful accept(). */
-    consumed: boolean;
     /** Opaque, non-secret identifier surfaced in snapshots (never the pairing secret). */
     id: string;
     /** Workspace the QR link should land the phone in (optional). */
@@ -150,13 +148,17 @@ export interface PairingConfig {
      */
     devicesFile?: string;
 }
-/** Result of one accept() attempt. */
+/**
+ * Result of one accept() attempt. A token is a bearer credential for its whole
+ * window (see the module doc), so the only refusal is `invalid`: unknown,
+ * expired, or after stop(). There is no "already used" outcome.
+ */
 export type AcceptResult = {
     ok: true;
     deviceId: string;
 } | {
     ok: false;
-    code: 'invalid' | 'used';
+    code: 'invalid';
 };
 /** Thrown by issue() for an address outside the sampled LAN literals. */
 export declare class UnknownLanAddressError extends Error {
@@ -170,6 +172,11 @@ export interface PairingClock {
     now(): number;
     randomToken(): string;
 }
+/** File-operation seam for the revocation-durability step (tests). */
+export interface PairingFsSeams {
+    /** Remove the stale device store (defaults to fs.rmSync with force). */
+    removeFile?(path: string): void;
+}
 /** Real clock/entropy: 32 random hex chars per token. */
 export declare const defaultClock: PairingClock;
 /**
@@ -184,6 +191,7 @@ export declare const defaultClock: PairingClock;
 export declare class PairingService {
     config: PairingConfig;
     private readonly clock;
+    private readonly fs;
     private readonly tokens;
     private readonly devices;
     private readonly listeners;
@@ -206,7 +214,7 @@ export declare class PairingService {
      * the current one.
      * @param clock - clock/entropy source (injectable for tests).
      */
-    constructor(config: PairingConfig, clock?: PairingClock);
+    constructor(config: PairingConfig, clock?: PairingClock, fs?: PairingFsSeams);
     /**
      * Restore device sessions persisted by a previous process run. A corrupt
      * or missing file is tolerated (an empty device table, never a throw) —
@@ -228,6 +236,16 @@ export declare class PairingService {
      * atomic rename; a crash mid-write can never leave a half-written store.
      */
     private persist;
+    /**
+     * Persist a table change that REVOKES access (stop, per-device revoke, idle
+     * eviction). A failed write would leave the revoked session on disk, and
+     * {@link loadPersisted} restores that file verbatim on the next start — the
+     * device's still-valid cookie would authorize again after an explicit
+     * revocation. When the write cannot be made durable, the stale store is
+     * removed instead (a missing file already loads as an empty table), so the
+     * failure costs a re-pair rather than silently undoing the revocation.
+     */
+    private persistRevocation;
     /** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
     get lanBaseUrl(): string | undefined;
     /** The LAN base URL for one specific literal (undefined when not constructible). */
@@ -241,7 +259,12 @@ export declare class PairingService {
     }[]): void;
     /** The configured public (tunneled) base URL, when present. */
     get publicBaseUrl(): string | undefined;
-    /** Set or clear the public base URL (a tunnel in front of this server). */
+    /**
+     * Set or clear the public base URL (a tunnel in front of this server). The
+     * value is canonicalized to its origin: a trailing slash (what a browser
+     * address-bar copy produces) or a path would mint a dead `//pair-accept`
+     * link, which WHATWG resolves as an authority rather than a path.
+     */
     setPublicBaseUrl(url: string | undefined): void;
     /** Set or clear the auto-tunnel status frame (undefined when the feature is off). */
     setTunnelStatus(status: TunnelStatus | undefined): void;
@@ -266,9 +289,11 @@ export declare class PairingService {
         expiresAt: number;
     };
     /**
-     * Consume a token and bind a device session. One-time: the second
-     * successful call for the same token is impossible because the first
-     * consumes it.
+     * Redeem a token and bind a device session. The token is a bearer
+     * credential for its whole window, not a single-use nonce: it is refused
+     * only when unknown, past its expiry, or after stop(), and every successful
+     * call — including a repeat within the same window — mints a fresh device
+     * session (see the module doc for the mobile cookie-context rationale).
      * @param token - the token secret from the QR link.
      * @param userAgent - optional User-Agent header captured at accept.
      * @returns the new device id, or a refusal code.
@@ -327,6 +352,13 @@ export declare class PairingService {
     private isOnlineAt;
     private notify;
 }
+/**
+ * Canonical origin of a public base URL. An unparsable value is returned
+ * verbatim so the caller's malformed-base warning stays the single owner of
+ * that case.
+ * @param url - the configured public base.
+ */
+export declare function canonicalBaseUrl(url: string): string;
 /** Strip control characters and cap the User-Agent stored with a session. */
 export declare function sanitizeUserAgent(raw: string | undefined): string | undefined;
 //# sourceMappingURL=pairing.d.ts.map

package/lib/types/pairing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAK9D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAA;IACV,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,EAAE,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAA;IACnD,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,uEAAuE;IACvE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,sCAAsC;AACtC,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,CAAA;AAE3C,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAyBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAzBxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,OAAO,CAA6B;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAQ;IAErB;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B;IAKrD;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA6BrB,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB;IAOzB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAajB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAgBf,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED,2EAA2E;IAC3E,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD,iFAAiF;IACjF,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAKrD,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAwBnF;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IA6BvD;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQjC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAMb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAsB3B,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf;AA+CD,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK7E"}
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAK9D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAA;IACV,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,EAAE,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAA;IACnD,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,uEAAuE;IACvE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAElC,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAyBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE;IA1BrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,OAAO,CAA6B;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAQ;IAErB;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B,EAClC,EAAE,GAAE,cAAmB;IAK1C;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA6BrB,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB;IAOzB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAajB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAkBf;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAazB,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD,iFAAiF;IACjF,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAKrD,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAuBnF;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IA0BvD;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQjC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAOb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAsB3B,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf;AA+CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK7E"}