@linxin666/dsh-remote-web-ui 0.3.6 → 0.3.9

package/lib/types/firewall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall.d.ts","sourceRoot":"","sources":["../../src/firewall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,yBAAyB,CAAA;AAExD,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,UAAU,CAAA;AAEhF,2EAA2E;AAC3E,eAAO,MAAM,WAAW,EAAE,aAazB,CAAA;AAED,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACjC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAClC;AA4ED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,GAAG,GAAE,aAA2B,GAC/B,eAAe,GAAG,SAAS,CAW7B;AAID,+DAA+D;AAC/D,wBAAgB,eAAe,IAAI,eAAe,GAAG,SAAS,CAM7D;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,EAAE,EAAE,OAAO,CAAA;IACX,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKxD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,eAAe,GAAG,SAAS,GACnC,eAAe,CAGjB;AAED,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAI7C,4DAA4D;AAC5D,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,eAAe,CASlF"}

package/lib/types/firewall.js

@@ -0,0 +1,184 @@
+/**
+ * Host firewall management for the LAN bind toggle: while LAN access is on,
+ * keep one inbound allow rule for the bound port; when it turns off, remove
+ * the rule. Windows manages the Windows Defender Firewall rule via netsh;
+ * Linux uses the first available manager among firewalld / ufw / iptables.
+ * On every other platform (macOS included) the plugin reports the firewall
+ * as unmanaged: the port usually needs no rule there, and managing pf or the
+ * application firewall is out of scope for a distributable plugin.
+ *
+ * Ported from the dsh-LAN reference implementation (MIT), adapted to this
+ * package's structure and test seams.
+ */
+import { spawnSync } from 'node:child_process';
+/** Rule name shared by every backend so re-runs recreate the same rule. */
+export const FIREWALL_RULE_NAME = 'remote-web-ui (auto)';
+/** Production runner: spawn without a shell, capture text, 20s timeout. */
+export const spawnRunner = (cmd, args) => {
+    const result = spawnSync(cmd, args, {
+        shell: false,
+        encoding: 'utf8',
+        windowsHide: process.platform === 'win32',
+        timeout: 20_000,
+    });
+    return {
+        ok: result.status === 0,
+        out: result.stdout ?? '',
+        err: result.stderr ?? '',
+        missing: result.error !== undefined,
+    };
+};
+function netshBackend(run) {
+    // `show rule name=` exits 0 even when nothing matches (the localized "no
+    // rules match" note), so exit-code-only probes always report the rule as
+    // present. The verbose listing echoes the full rule name — the one
+    // locale-independent field — and is matched literally instead.
+    const show = () => {
+        const result = run('netsh', ['advfirewall', 'firewall', 'show', 'rule', `name=${FIREWALL_RULE_NAME}`, 'verbose']);
+        return result.ok && result.out.includes(FIREWALL_RULE_NAME);
+    };
+    return {
+        label: 'netsh',
+        ruleExists: show,
+        addRule: (port) => run('netsh', [
+            'advfirewall', 'firewall', 'add', 'rule', `name=${FIREWALL_RULE_NAME}`,
+            'dir=in', 'action=allow', 'protocol=TCP', `localport=${String(port)}`, 'profile=private,domain',
+        ]).ok,
+        removeRule: () => {
+            if (!show())
+                return true;
+            return run('netsh', ['advfirewall', 'firewall', 'delete', 'rule', `name=${FIREWALL_RULE_NAME}`]).ok;
+        },
+    };
+}
+function firewalldBackend(run) {
+    return {
+        label: 'firewalld',
+        ruleExists: (port) => run('firewall-cmd', ['--permanent', '--query-port', `${String(port)}/tcp`]).ok,
+        addRule: (port) => {
+            const add = run('firewall-cmd', ['--permanent', '--add-port', `${String(port)}/tcp`]);
+            const reload = run('firewall-cmd', ['--reload']);
+            return add.ok && reload.ok;
+        },
+        removeRule: (port) => {
+            const del = run('firewall-cmd', ['--permanent', '--remove-port', `${String(port)}/tcp`]);
+            const reload = run('firewall-cmd', ['--reload']);
+            return del.ok && reload.ok;
+        },
+    };
+}
+function ufwBackend(run) {
+    return {
+        label: 'ufw',
+        ruleExists: (port) => {
+            const result = run('ufw', ['status']);
+            // Anchored so a superset port's row (1443/tcp) cannot satisfy the
+            // probe for a shorter one (443/tcp).
+            return result.ok && new RegExp(`(^|\\s)${String(port)}/tcp\\s+ALLOW`, 'i').test(result.out);
+        },
+        addRule: (port) => run('ufw', ['allow', `${String(port)}/tcp`]).ok,
+        removeRule: (port) => run('ufw', ['delete', 'allow', `${String(port)}/tcp`]).ok,
+    };
+}
+function iptablesBackend(run) {
+    const rule = (port) => ['INPUT', '-p', 'tcp', '--dport', String(port), '-j', 'ACCEPT'];
+    return {
+        label: 'iptables',
+        ruleExists: (port) => run('iptables', ['-C', ...rule(port)]).ok,
+        addRule: (port) => run('iptables', ['-A', ...rule(port)]).ok,
+        removeRule: (port) => run('iptables', ['-D', ...rule(port)]).ok,
+    };
+}
+function toolAvailable(run, cmd) {
+    try {
+        // A missing binary reports through the runner's missing flag (spawnSync
+        // sets result.error for ENOENT); any graceful answer counts as present.
+        return run(cmd, ['--version']).missing !== true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Detect the platform firewall manager. Returns undefined when the platform
+ * has no supported manager (macOS, unknown Linux without tools): the port
+ * then usually needs no rule and the UI reports "unmanaged".
+ */
+export function detectFirewallBackend(platform, run = spawnRunner) {
+    if (platform === 'win32')
+        return netshBackend(run);
+    if (platform !== 'linux')
+        return undefined;
+    if (toolAvailable(run, 'firewall-cmd')) {
+        // firewalld only counts when its daemon answers; an installed-but-idle
+        // firewall-cmd would otherwise claim management it cannot exercise.
+        if (run('firewall-cmd', ['--state']).ok)
+            return firewalldBackend(run);
+    }
+    if (toolAvailable(run, 'ufw'))
+        return ufwBackend(run);
+    if (toolAvailable(run, 'iptables'))
+        return iptablesBackend(run);
+    return undefined;
+}
+let cachedBackend;
+/** Cached detection for the running platform (per process). */
+export function firewallBackend() {
+    const platform = process.platform;
+    if (cachedBackend === undefined || cachedBackend.platform !== platform) {
+        cachedBackend = { platform, backend: detectFirewallBackend(platform) };
+    }
+    return cachedBackend.backend;
+}
+/**
+ * Delete-and-add: recreating the rule is idempotent and locale-proof (netsh
+ * output is localized, so parsing the live rule's port is fragile; the Linux
+ * backends follow the same recreate pattern).
+ */
+export function ensureFirewallRule(port) {
+    invalidateFirewallSummary();
+    const backend = firewallBackend();
+    if (backend === undefined)
+        return true;
+    backend.removeRule(port);
+    return backend.addRule(port);
+}
+export function removeFirewallRule(port) {
+    invalidateFirewallSummary();
+    const backend = firewallBackend();
+    if (backend === undefined)
+        return true;
+    return backend.removeRule(port);
+}
+/**
+ * Human-readable firewall state for the status endpoint. A missing backend
+ * means the platform has nothing to manage; detection stays at the call site
+ * so an explicit undefined cannot silently re-probe the real OS mid-test.
+ */
+export function computeFirewallSummary(port, lanEnabled, backend) {
+    if (backend === undefined)
+        return { ok: true, managed: false };
+    return { ok: lanEnabled ? backend.ruleExists(port) : !backend.ruleExists(port), managed: true, note: backend.label };
+}
+/** How long a firewallSummary answer is reused before the backend is probed again. */
+export const FIREWALL_SUMMARY_TTL_MS = 30_000;
+let summaryCache;
+/** Forget the cached summary (rule mutations call this). */
+export function invalidateFirewallSummary() {
+    summaryCache = undefined;
+}
+/**
+ * The settings card polls this every ten seconds; the probes are blocking
+ * spawnSync subprocesses on managed platforms, so short-TTL memoization
+ * keeps one poll from freezing the host event loop per request.
+ */
+export function firewallSummary(port, lanEnabled) {
+    const key = `${String(port)}|${lanEnabled ? '1' : '0'}`;
+    const now = Date.now();
+    if (summaryCache !== undefined && summaryCache.key === key && now - summaryCache.at < FIREWALL_SUMMARY_TTL_MS) {
+        return summaryCache.value;
+    }
+    const value = computeFirewallSummary(port, lanEnabled, firewallBackend());
+    summaryCache = { key, at: now, value };
+    return value;
+}

package/lib/types/gate.d.ts

@@ -6,9 +6,15 @@
  *
  * Policy: loopback requests (the desktop) pass without a device identity;
  * every non-loopback /api request must carry a live, non-revoked device
- * cookie. This makes the QR the only way into a LAN-exposed dsh web and
- * gives "停止" real teeth: revoked devices 403 on their next request,
- * including the mux/SSE stream (which then dies on reconnect).
+ * cookie — intended to make the QR the only way into a LAN-exposed dsh web
+ * and to give "停止" real teeth for direct /api callers.
+ *
+ * Cohort reality (0.1.2-alpha.2): NOTHING emits api/gate in the official
+ * runtime, so this listener never fires there and direct /api is governed
+ * solely by the harness fence + browser-auth cookie. The pairing gate with
+ * real teeth lives on the plugin's own /remote channel (remote-api.ts); the
+ * listener stays wired for cohort lines that do carry the seam, and the
+ * README security model states the gap plainly.
  */
 import type { IncomingMessage } from 'node:http';
 import type { PairingService } from './pairing.ts';
@@ -52,8 +58,8 @@ export declare function isLoopbackClient(request: IncomingMessage): boolean;
 export declare function makeGateListener(service: PairingService, requirePairingForLan?: boolean | (() => boolean), enabled?: boolean | (() => boolean)): (request: IncomingMessage, method: string | undefined, next: () => boolean | Promise<boolean>) => boolean | Promise<boolean>;
 /**
  * Whether a request carries a live, non-revoked paired-device cookie for
- * this service. Sibling host routes outside /api (aionui-panel, etc.) use
- * the same check via the remoteWebUiPairing service.
+ * this service. Sibling host routes outside /api (the right-panel
+ * /sidebar/* routes, etc.) use the same check via the remoteWebUiPairing service.
  * @param service - the pairing service that owns the device table.
  * @param request - the incoming HTTP request.
  * @returns true when the cookie names a live session (and lastSeenAt was refreshed).

package/lib/types/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAGlD;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASvF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAQvE;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAKlE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,EACvB,oBAAoB,GAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAQ,EACtD,OAAO,GAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAQ,GACxC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAc9H;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAIhG"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAGlD;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASvF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAQvE;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAKlE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,EACvB,oBAAoB,GAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAQ,EACtD,OAAO,GAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAQ,GACxC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAc9H;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAIhG"}

package/lib/types/gate.js

@@ -6,9 +6,15 @@
  *
  * Policy: loopback requests (the desktop) pass without a device identity;
  * every non-loopback /api request must carry a live, non-revoked device
- * cookie. This makes the QR the only way into a LAN-exposed dsh web and
- * gives "停止" real teeth: revoked devices 403 on their next request,
- * including the mux/SSE stream (which then dies on reconnect).
+ * cookie — intended to make the QR the only way into a LAN-exposed dsh web
+ * and to give "停止" real teeth for direct /api callers.
+ *
+ * Cohort reality (0.1.2-alpha.2): NOTHING emits api/gate in the official
+ * runtime, so this listener never fires there and direct /api is governed
+ * solely by the harness fence + browser-auth cookie. The pairing gate with
+ * real teeth lives on the plugin's own /remote channel (remote-api.ts); the
+ * listener stays wired for cohort lines that do carry the seam, and the
+ * README security model states the gap plainly.
  */
 import { isLoopbackAddress, isLoopbackHostname } from "./loopback.js";
 /**
@@ -96,8 +102,8 @@ export function makeGateListener(service, requirePairingForLan = true, enabled =
 }
 /**
  * Whether a request carries a live, non-revoked paired-device cookie for
- * this service. Sibling host routes outside /api (aionui-panel, etc.) use
- * the same check via the remoteWebUiPairing service.
+ * this service. Sibling host routes outside /api (the right-panel
+ * /sidebar/* routes, etc.) use the same check via the remoteWebUiPairing service.
  * @param service - the pairing service that owns the device table.
  * @param request - the incoming HTTP request.
  * @returns true when the cookie names a live session (and lastSeenAt was refreshed).

package/lib/types/index.d.ts

@@ -9,6 +9,7 @@
  */
 import type { IncomingMessage } from 'node:http';
 import type { Context } from '@deepseek-ai/cordis';
+import type { SettingsNamespace } from '@deepseek-ai/dsh-settings';
 import z from 'schemastery';
 import { type PairingConfig } from './pairing.ts';
 declare module '@deepseek-ai/cordis' {
@@ -18,6 +19,12 @@ declare module '@deepseek-ai/cordis' {
          * fires this per /api request before bridging to the API proxy on
          * deployments that carry the pairing/revocation seam; call `next()` to
          * delegate, return false (without calling it) to veto with 403.
+         *
+         * Cohort note (0.1.2-alpha.2): the official runtime ships NO emitter
+         * for this event, so the listener below never fires there and direct
+         * /api stays under the harness fence + browser auth. It is wired anyway
+         * so cohort lines that do carry the seam get pairing enforcement on
+         * direct /api without a plugin change.
          */
         'api/gate'(this: Context, request: IncomingMessage, method: string | undefined, next: () => boolean | Promise<boolean>): boolean | Promise<boolean>;
     }
@@ -31,7 +38,7 @@ export declare const inject: string[];
  * settings surface edits. Spelled here rather than imported: the browser
  * half spells the same value and must not depend on a Host package.
  */
-export declare const REMOTE_WEB_UI_SETTINGS_NAMESPACE: import("@deepseek-ai/dsh-settings").SettingsNamespace;
+export declare const REMOTE_WEB_UI_SETTINGS_NAMESPACE: SettingsNamespace;
 /** Plugin config, validated by the same-named schemastery schema. */
 export interface Config {
     /** Token lifetime in ms; the QR link dies after this. */
@@ -50,9 +57,14 @@ export interface Config {
     /**
      * When true (default), a desktop Web GUI opened at a non-loopback origin
      * rides the gated `/remote/api` channel and must carry a live paired-device
-     * cookie — the QR is the only way into remote desktop, and stop() cuts
-     * paired devices off. Set false to keep the desktop on plain `/api`
-     * (only useful when that origin is already trusted for `/api`).
+     * cookie — the QR is the only way into remote desktop, and stop()/revoke()
+     * cut the /remote channel and the pairing cookie off immediately. Scope
+     * note for this cohort: direct /api is governed by the harness fence +
+     * browser-auth cookie (the api/gate seam has no emitter on 0.1.2-alpha.2),
+     * so a harness browser credential a device has already redeemed is not
+     * invalidated by stop() — see the README security model. Set false to keep
+     * the desktop on plain `/api` (only useful when that origin is already
+     * trusted for `/api`).
      */
     requirePairingForLan?: boolean;
     /**
@@ -80,12 +92,26 @@ export interface Config {
      */
     autoTunnel?: boolean;
     /**
-     * Mobile composer behavior: when true (default), a plain Enter in the
-     * phone chat textarea sends the prompt and Shift+Enter inserts a newline.
-     * When false, plain Enter inserts a newline and only the send button
-     * sends (Shift+Enter keeps inserting a newline).
+     * LAN bind toggle. When the user flips it (true or false) the plugin
+     * writes the managed webserver block into the profile patch — true pins
+     * the bind default to 0.0.0.0 (an explicit --host flag still wins), false
+     * pins it back to 127.0.0.1 — and maintains the matching host firewall
+     * rule (Windows netsh; Linux firewalld/ufw/iptables; other platforms
+     * report the firewall as unmanaged). The block takes effect when the
+     * process next applies the profile — the live patch watcher recomposes on
+     * some profile shapes, otherwise on the next start — and the settings
+     * card reports the divergence (pendingRestart) instead of guessing.
+     * While the toggle has never been set (undefined), the plugin does not
+     * touch the patch file at all.
      */
-    mobileEnterToSend?: boolean;
+    lanBind?: boolean;
+    /**
+     * The profile whose cordis.patch.yml the LAN bind toggle manages.
+     * Defaults to the DSH_PROFILE environment variable, then "web". Must be
+     * a single safe path segment (the DSH_PROFILE env fallback bypasses this
+     * schema, so the path builder asserts containment independently).
+     */
+    profile?: string;
     /** Master switch for the plugin (browser half + host pairing surfaces). */
     enabled?: boolean;
 }
@@ -95,9 +121,12 @@ export declare const Config: z<Config>;
  * which legitimately resolves to `undefined` when unset (the schema keeps it
  * optional, so `Required` alone would over-narrow it to `string`).
  */
-type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'devicesFile'>> & {
+type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'devicesFile' | 'lanBind' | 'profile'>> & {
     publicBaseUrl: string | undefined;
     devicesFile: string;
+    /** undefined until the user flips the toggle once; undefined never writes the patch. */
+    lanBind: boolean | undefined;
+    profile: string;
 };
 /**
  * The single mapping from resolved plugin config to the pairing service

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,CAAC,MAAM,aAAa,CAAA;AAI3B,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AA6BzF,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;WAKG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAAkD,CAAA;AAErE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,uDAAqC,CAAA;AAElF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAY3B,CAAA;AAKF;;;;GAIG;AACH,KAAK,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,aAAa,CAAC,CAAC,GAAG;IAC9E,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAC5C,cAAc,EACd,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,aAAa,CAC/F,GAAG,aAAa,CAShB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEnE;AAiBD;;;;GAIG;AACH,eAAO,MAAM,KAAK,kBAAuD,CAAA;AAEzE,iBAAS,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAwVtD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,CAAC,MAAM,aAAa,CAAA;AAO3B,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AA8BzF,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;;;;;;;WAWG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA+C,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAsB,iBAAiB,CAAA;AAEpF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAa3B,CAAA;AAKF;;;;GAIG;AACH,KAAK,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG;IACtG,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAC5C,cAAc,EACd,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,aAAa,CAC/F,GAAG,aAAa,CAShB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEnE;AAkBD;;;;GAIG;AACH,eAAO,MAAM,KAAK,kBAAuD,CAAA;AAEzE,iBAAS,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAgetD"}