@songsid/agend 2.1.5 → 2.1.6-beta.2

package/dist/setup-host.js

@@ -0,0 +1,496 @@
+/**
+ * The form that runs before there is a fleet.
+ *
+ * This process exists only to collect what `agend quickstart` collects, write
+ * it, and hand the port to the real fleet. Three properties matter more than
+ * anything it does:
+ *
+ * - **It cannot reach the fleet.** Its imports stop at the config and the
+ *   provider probes; `tests/prefleet-host.test.ts` asserts the graph never
+ *   reaches fleet-manager, daemon or instance-lifecycle. A pre-fleet surface
+ *   that could start or stop agents would be a much larger thing to defend.
+ * - **It lets go of the port before the fleet is started.** The fleet's
+ *   health-port takeover is not a safety net: on a busy port it signals
+ *   whatever fleet.pid names and then disables the dashboard for the rest of
+ *   its life. So the listener is closed — including its open connections —
+ *   and only then is the fleet spawned.
+ * - **It goes away on its own.** A setup form left open is an unauthenticated-
+ *   by-default surface waiting for someone to find it, so it exits on its TTL
+ *   and on idleness as readily as on success.
+ *
+ * Hardened ahead of being reachable from outside (see
+ * `docs/design/setup-host-tunnel.zh-TW.md`): the page lives under a random sid
+ * so a scanner cannot find it, the credential is a short code typed into the
+ * page rather than anything in the URL, the cookie is derived from a freshly
+ * minted 256-bit secret rather than from that code, and every presented-and-
+ * wrong credential spends one of five shared attempts.
+ */
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadFleetConfig } from "./config.js";
+import { acquireFleetLock, releaseFleetLock } from "./fleet-lock.js";
+import { handleQuickstartRequest } from "./quickstart-api.js";
+import { markSetupComplete } from "./setup-marker.js";
+import { isSameOriginRequest, parseCookieHeader } from "./web-auth.js";
+import { buildSetupCookie, SetupCredentials, SETUP_COOKIE_NAME, } from "./setup-auth.js";
+import { SETUP_CODE_PAGE_HTML, SETUP_FORM_HTML } from "./setup-form.js";
+import { ManagedTunnel } from "./tunnel/manager.js";
+import { leasePath } from "./tunnel/lease.js";
+import { CloudflaredProvider } from "./tunnel/cloudflared.js";
+import yaml from "js-yaml";
+import { writeFileSync } from "node:fs";
+/** How long the form may stay open at all. */
+export const SETUP_HOST_TTL_MS = 15 * 60_000;
+/**
+ * …and how long it may stay open with nobody touching it.
+ *
+ * Strictly shorter than the TTL, which it was not: both were fifteen minutes,
+ * so the idle timer could never fire first and the page always stayed open for
+ * the full quarter hour whether anyone was using it or not.
+ */
+export const SETUP_HOST_IDLE_MS = 10 * 60_000;
+/**
+ * The port a setup host may bind.
+ *
+ * In tunnel mode it is always zero. Not "unless `--port` was given", and not
+ * "unless fleet.yaml names a health port" — those are the two ways a fixed
+ * port creeps back behind a tunnel, and the second one needs no flag at all.
+ * Whatever the fleet would later bind must never be the thing the tunnel is
+ * pointed at.
+ */
+export function resolvePort(opts) {
+    if (opts.tunnel)
+        return 0;
+    return opts.port ?? opts.healthPort ?? 19280;
+}
+function defaultSpawnFleet() {
+    const cliEntry = join(dirname(fileURLToPath(import.meta.url)), "cli.js");
+    const child = spawn(process.execPath, [cliEntry, "start"], { detached: true, stdio: "ignore" });
+    child.unref();
+}
+export class SetupHost {
+    opts;
+    server = null;
+    lock;
+    ttlTimer = null;
+    idleTimer = null;
+    stopping = false;
+    credentials;
+    /** Where this page lives. Random, and not a credential — see setup-auth.ts. */
+    sid;
+    /** What the person types. Printed by the CLI; never put in a URL. */
+    code;
+    constructor(opts) {
+        this.opts = opts;
+        this.credentials = opts.credentials ?? new SetupCredentials();
+        this.sid = this.credentials.sid;
+        this.code = this.credentials.code;
+    }
+    /** The page's own path. Everything outside it is not this page. */
+    get basePath() { return `/s/${this.sid}/`; }
+    managedTunnel = null;
+    tunnelHandle = null;
+    /** The exact host the tunnel answers on; nothing else is added to the set. */
+    externalHost = null;
+    tunnelStopResult = "none";
+    /**
+     * Set when the wizard asked to hand over, so a shutdown that started for
+     * another reason still completes it.
+     *
+     * Without this the tunnel dying in the moment between "finish" answering and
+     * the handover beginning would take the `stopping` flag first, and the
+     * handover would silently return: configuration written, page saying
+     * "starting", and no fleet.
+     */
+    handoverRequested = false;
+    get ttlMs() { return this.opts.ttlMs ?? SETUP_HOST_TTL_MS; }
+    get idleMs() { return this.opts.idleMs ?? SETUP_HOST_IDLE_MS; }
+    log(message) { (this.opts.log ?? console.log)(message); }
+    /** The config the wizard edits: a file if there is one, otherwise a blank. */
+    readConfig() {
+        try {
+            return loadFleetConfig(this.opts.configPath);
+        }
+        catch {
+            return { defaults: {}, instances: {} };
+        }
+    }
+    context() {
+        const config = this.readConfig();
+        return {
+            fleetConfig: config,
+            dataDir: this.opts.dataDir,
+            logger: { info: () => { }, warn: () => { } },
+            // Nothing to preserve: before a fleet there are no comments and no hand
+            // edits to keep, so a plain dump is the whole writer.
+            saveFleetConfig: () => {
+                writeFileSync(this.opts.configPath, yaml.dump(config, { quotingType: '"', forceQuotes: false }), { mode: 0o600 });
+            },
+            // No fleet, so nothing is polling any bot token.
+        };
+    }
+    async start() {
+        // This host writes fleet.yaml by dumping the loader's output, which expands
+        // every default and drops every comment. That is fine for a file it is
+        // creating and destructive to one somebody already has — and an existing
+        // installation should be using the panel's wizard anyway, which edits the
+        // document in place.
+        const existing = this.readConfig();
+        if (Object.keys(existing.instances ?? {}).length > 0) {
+            throw new Error("This installation already has agents configured. Open Settings in the dashboard and use the setup wizard there — it edits your fleet.yaml in place.");
+        }
+        // Refuses while a fleet runs, and — since the record carries a role — is
+        // equally refused to a fleet that starts while this host is up.
+        this.lock = acquireFleetLock(this.opts.dataDir, { role: "setup-host", ...this.opts.lockProbe });
+        const server = createServer((req, res) => this.handle(req, res));
+        this.server = server;
+        // Zero in tunnel mode, and the caller cannot override it: `resolvePort` is
+        // the only thing that decides, so a flag or a config value cannot put a
+        // fixed port behind a tunnel.
+        const bindPort = this.opts.tunnel ? 0 : this.opts.port;
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(bindPort, "127.0.0.1", () => { server.removeListener("error", reject); resolve(); });
+        });
+        this.ttlTimer = setTimeout(() => { void this.shutdown(false, "ttl"); }, this.ttlMs);
+        this.ttlTimer.unref?.();
+        this.boundPort = server.address().port;
+        this.touch();
+        const publicUrl = this.opts.tunnel ? await this.openTunnel() : null;
+        return { port: this.boundPort, sid: this.sid, code: this.code, path: this.basePath, publicUrl };
+    }
+    /**
+     * Put the page behind a tunnel, or say why it is not.
+     *
+     * Three outcomes, and the third is the one that matters: a start that failed
+     * while leaving a process it could not account for is not a fallback, it is a
+     * stop. Carrying on would mean serving this page on loopback while something
+     * we cannot see may still be exposing it.
+     */
+    async openTunnel() {
+        const managed = new ManagedTunnel({ dataDir: this.opts.dataDir, log: m => this.log(m) });
+        this.managedTunnel = managed;
+        const provider = this.opts.tunnelProvider ?? new CloudflaredProvider();
+        const result = await managed.start(provider, {
+            sid: this.sid,
+            origin: new URL(`http://127.0.0.1:${this.boundPort}`),
+            pagePath: this.basePath,
+            readinessMarker: this.credentials.readinessMarker,
+            expiresAt: (this.opts.now ?? Date.now)() + this.ttlMs,
+            signal: new AbortController().signal,
+            // The provider's own readiness probe arrives here under the public
+            // hostname, so it has to be on the list before that probe runs. Exactly
+            // the one host the validator just accepted — the alternative shortcuts,
+            // accepting any Host during startup or any `*.trycloudflare.com`, are
+            // each a hole that outlives the ten seconds they would save.
+            onCandidateHost: host => { this.externalHost = host; },
+        });
+        if (result.ok) {
+            this.tunnelHandle = result.handle;
+            this.externalHost = new URL(result.handle.baseUrl).host;
+            // The page is gone the moment the tunnel is, and a session whose
+            // hostname has changed underneath it is not a session to keep.
+            result.handle.onUnexpectedExit(() => {
+                this.log("The tunnel closed unexpectedly. Run `agend setup --tunnel` again for a new link.");
+                void this.shutdown(false, "tunnel died");
+            });
+            return result.handle.pageUrl;
+        }
+        // Whatever happens below, a host that never became a working tunnel does
+        // not stay on the list.
+        if (!result.ok)
+            this.externalHost = null;
+        if (result.leaseHeld) {
+            // Fail closed: a tunnel process we cannot account for may still be
+            // pointed at this listener, so there is no honest "falling back to
+            // localhost" to announce.
+            await this.shutdown(false, "tunnel could not be cleaned up");
+            throw new Error(`Could not open a tunnel, and could not confirm it was cleaned up: ${result.message}`);
+        }
+        this.log(`No public tunnel: ${result.message}`);
+        this.log("The link below only works on this machine — a phone will not be able to open it.");
+        return null;
+    }
+    boundPort = 0;
+    /**
+     * The hosts this listener will answer to.
+     *
+     * Origin==Host alone accepts any Host at all, which was harmless while the
+     * only way in was loopback. It stops being harmless the moment something in
+     * front of the listener can set it, so the set is named rather than inferred.
+     */
+    allowedHosts() {
+        const hosts = [`127.0.0.1:${this.boundPort}`, `localhost:${this.boundPort}`, `[::1]:${this.boundPort}`];
+        // Exactly the host this tunnel answers on, and only while it is ours. An
+        // ephemeral port can be handed to a later listener, and a tunnel nobody
+        // cleaned up would then be pointed at that one — this list is what makes
+        // the zombie's requests 403 instead of reaching a stranger's page.
+        if (this.externalHost)
+            hosts.push(this.externalHost);
+        return hosts;
+    }
+    /**
+     * Whether the browser reached this over TLS.
+     *
+     * Derived from what this process knows it is serving, never from
+     * `X-Forwarded-Proto`: that header is set by whatever is in front, including
+     * an attacker, and a cookie's Secure attribute is not something to take on
+     * trust from a request.
+     */
+    get endpointIsHttps() { return this.externalHost !== null; }
+    touch() {
+        if (this.idleTimer)
+            clearTimeout(this.idleTimer);
+        this.idleTimer = setTimeout(() => { void this.shutdown(false, "idle"); }, this.idleMs);
+        this.idleTimer.unref?.();
+    }
+    /**
+     * The answer for anything that is not this page.
+     *
+     * Byte-identical whatever the reason, because the difference between "wrong
+     * sid" and "no such path" is precisely how a sid gets found.
+     */
+    notFound(res) {
+        res.setHeader("Content-Type", "application/json");
+        res.writeHead(404);
+        res.end(JSON.stringify({ error: "not found" }));
+    }
+    deny(res, status, error) {
+        res.setHeader("Content-Type", "application/json");
+        res.writeHead(status);
+        res.end(JSON.stringify({ error }));
+    }
+    hostAllowed(req) {
+        const host = req.headers.host;
+        return typeof host === "string" && this.allowedHosts().includes(host);
+    }
+    presentedCookie(req) {
+        return parseCookieHeader(req.headers.cookie).get(SETUP_COOKIE_NAME);
+    }
+    /** Spend an attempt's worth of consequence: at zero the page is over. */
+    afterFailure(res, kind, attemptsLeft) {
+        if (kind === "locked") {
+            this.deny(res, 410, "too many failed attempts — run `agend setup` again on the host");
+            setTimeout(() => { void this.shutdown(false, "lockout"); }, 10);
+            return;
+        }
+        this.deny(res, 401, `incorrect — ${attemptsLeft} attempt${attemptsLeft === 1 ? "" : "s"} left`);
+    }
+    handle(req, res) {
+        res.setHeader("Referrer-Policy", "no-referrer");
+        res.setHeader("Vary", "Cookie");
+        // On every response, not just the redirect that used to carry it: a shared
+        // cache in front of this — which is what a tunnel edge is — must never keep
+        // a copy of a page or an answer belonging to one setup session.
+        res.setHeader("Cache-Control", "no-store");
+        const url = new URL(req.url ?? "/", `http://127.0.0.1:${this.boundPort}`);
+        // Everything below the sid, and nothing else. Checked before the idle timer
+        // is touched, or a scanner that cannot find the page could still keep it
+        // open forever by knocking on the wrong paths.
+        const segments = url.pathname.split("/");
+        if (segments[1] !== "s" || !this.credentials.matchesSid(segments[2] ?? "")) {
+            this.notFound(res);
+            return;
+        }
+        const rest = `/${segments.slice(3).join("/")}`;
+        if (!isSameOriginRequest(req) || !this.hostAllowed(req)) {
+            this.deny(res, 403, "cross-site request rejected");
+            return;
+        }
+        // The two unauthenticated endpoints: the page that asks for the code, and
+        // the exchange itself. Everything else needs the cookie.
+        if (req.method === "GET" && (rest === "/" || rest === "")) {
+            const signedIn = this.credentials.checkCookie(this.presentedCookie(req)).kind === "ok";
+            // Only a session that exists keeps the page alive. Reloading the code
+            // prompt is not use of the page, and treating it as such would let
+            // anyone holding the link hold the window open indefinitely.
+            if (signedIn)
+                this.touch();
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.writeHead(200);
+            // The wizard itself is only served to a session that has the cookie; an
+            // unauthenticated visitor gets the code prompt and nothing about this
+            // machine.
+            res.end(signedIn
+                ? SETUP_FORM_HTML
+                : SETUP_CODE_PAGE_HTML.replace("__AGEND_SETUP_MARKER__", this.credentials.readinessMarker));
+            return;
+        }
+        if (req.method === "POST" && rest === "/open") {
+            this.redeem(req, res);
+            return;
+        }
+        const verdict = this.credentials.checkCookie(this.presentedCookie(req));
+        if (verdict.kind === "locked") {
+            this.afterFailure(res, "locked", 0);
+            return;
+        }
+        if (verdict.kind === "rejected") {
+            this.afterFailure(res, "rejected", verdict.attemptsLeft);
+            return;
+        }
+        if (verdict.kind === "unauthenticated") {
+            this.deny(res, 401, "enter the setup code first");
+            return;
+        }
+        // Only now: an authorized request is the only kind that should be able to
+        // keep this page alive.
+        this.touch();
+        if (req.method === "GET" && rest === "/setup/status") {
+            res.setHeader("Content-Type", "application/json");
+            res.writeHead(200);
+            res.end(JSON.stringify({ pre_fleet: true, ttl_ms: this.ttlMs }));
+            return;
+        }
+        if (req.method === "POST" && rest === "/setup/finish") {
+            res.setHeader("Content-Type", "application/json");
+            res.writeHead(202);
+            // `watch` is false behind a tunnel: this page is about to stop existing
+            // along with the hostname it is served on, so polling would only produce
+            // a false alarm. The dashboard is not an answer either — it binds
+            // loopback, so a link to it would be one a phone cannot open.
+            res.end(JSON.stringify({ starting: true, watch: this.externalHost === null }));
+            // Recorded before the timer, not inside it: the tunnel can die in
+            // between, and whichever shutdown runs first has to know a handover was
+            // asked for.
+            this.handoverRequested = true;
+            // After the response, so the browser has its answer before the port goes.
+            setTimeout(() => { void this.shutdown(true, "finished"); }, 10);
+            return;
+        }
+        // The wizard API is mounted under the sid too, so its paths are rewritten
+        // rather than exposed at the root where a scanner could reach them.
+        const inner = new URL(rest + url.search, "http://127.0.0.1");
+        if (handleQuickstartRequest(req, res, inner, this.context()))
+            return;
+        this.notFound(res);
+    }
+    /** Exchange the typed code for a session cookie. The only way in. */
+    redeem(req, res) {
+        let body = "";
+        req.on("data", chunk => {
+            body += String(chunk);
+            if (body.length > 4096) {
+                req.destroy();
+            }
+        });
+        req.on("end", () => {
+            let provided = "";
+            try {
+                provided = String(JSON.parse(body || "{}").code ?? "");
+            }
+            catch { /* empty */ }
+            const verdict = this.credentials.redeem(provided);
+            if (verdict.kind === "ok" && verdict.secret) {
+                this.touch();
+                res.setHeader("Set-Cookie", buildSetupCookie(verdict.secret, {
+                    path: this.basePath,
+                    secure: this.endpointIsHttps,
+                    maxAgeSeconds: Math.ceil(this.ttlMs / 1000),
+                }));
+                res.setHeader("Content-Type", "application/json");
+                res.writeHead(200);
+                res.end(JSON.stringify({ ok: true }));
+                return;
+            }
+            if (verdict.kind === "locked") {
+                this.afterFailure(res, "locked", 0);
+                return;
+            }
+            if (verdict.kind === "rejected") {
+                this.afterFailure(res, "rejected", verdict.attemptsLeft);
+                return;
+            }
+            this.deny(res, 400, "enter the setup code");
+        });
+    }
+    /**
+     * Let go of the port, then hand it over.
+     *
+     * `closeAllConnections()` first, and not as a nicety: a browser polling for
+     * the fleet holds a connection open, and `close()` waits for it. Measured, a
+     * single open poll stops the close from ever completing — so the form would
+     * hang at "starting…" and the fleet would never be spawned.
+     */
+    async shutdown(spawnSuccessor, reason) {
+        if (this.stopping)
+            return;
+        this.stopping = true;
+        // A handover asked for by the wizard survives a shutdown that began for a
+        // different reason.
+        const handOver = spawnSuccessor || this.handoverRequested;
+        if (this.ttlTimer)
+            clearTimeout(this.ttlTimer);
+        if (this.idleTimer)
+            clearTimeout(this.idleTimer);
+        // 1. Capability first. Anything still in flight — including a request
+        //    arriving through a tunnel that is still up — is already unauthorized
+        //    from here, so the order below can take its time without a window.
+        this.credentials.revoke();
+        // 2. The listener, and its open connections. From this point the public URL
+        //    reaches nothing, whatever the tunnel is doing.
+        const server = this.server;
+        this.server = null;
+        if (server) {
+            server.closeAllConnections?.();
+            await new Promise(resolve => server.close(() => resolve()));
+        }
+        // 3. The tunnel, with proof.
+        if (this.managedTunnel && this.tunnelHandle) {
+            const stopped = await this.managedTunnel.stop(reason);
+            this.tunnelStopResult = stopped.confirmed ? "confirmed" : "unconfirmed";
+            if (!stopped.confirmed) {
+                this.log(`The tunnel could not be confirmed closed${stopped.pid !== null ? ` (pid ${stopped.pid})` : ""}: ${stopped.reason}. `
+                    + "That URL may keep answering 'origin unavailable' for a while; nothing behind it is reachable. "
+                    + `To clean up by hand, kill ${stopped.pid !== null ? `pid ${stopped.pid}` : "the cloudflared process"}. `
+                    + "No new tunnel will be opened until this is resolved.");
+            }
+        }
+        releaseFleetLock(this.lock);
+        this.lock = undefined;
+        if (!handOver) {
+            this.log(`Setup host stopped (${reason}). Run \`agend setup\` again to reopen it.`);
+            return;
+        }
+        if (this.tunnelStopResult === "unconfirmed" && !this.mayHandOverWithUnconfirmedTunnel()) {
+            // Fail closed. The config is written; what is missing is a process this
+            // one is not willing to start while a tunnel it cannot account for could
+            // still be pointed at the port that process would bind.
+            this.log("Your configuration has been saved, but AgEnD was NOT started: a tunnel could not be confirmed closed "
+                + "and this host is not on an ephemeral port, so starting the fleet could put its dashboard behind that tunnel. "
+                + "Kill the cloudflared process, then run `agend start` on this machine.");
+            return;
+        }
+        markSetupComplete(this.opts.dataDir);
+        this.log("Setup complete — starting AgEnD.");
+        (this.opts.spawnFleet ?? defaultSpawnFleet)();
+    }
+    /**
+     * Whether an unconfirmed tunnel may be left behind while the fleet starts.
+     *
+     * Ruled on by fable, and conditional by construction. The reasoning only
+     * holds because a leftover tunnel points at an ephemeral port this process
+     * owned and nothing will deliberately bind again — so the damage of being
+     * wrong is a URL that answers "unavailable", not a public dashboard.
+     *
+     * **If anyone puts this host back on the health port, this ruling is void**
+     * and the path must return to refusing the handover. That is the first
+     * condition below rather than a note in a comment, precisely so the change
+     * that breaks the reasoning also flips the behaviour.
+     */
+    mayHandOverWithUnconfirmedTunnel() {
+        // Each of these reads the thing itself rather than a flag set alongside it.
+        // A boolean assigned on the same line that does the work is true whenever
+        // the line ran, which makes "all four conditions are checked" a sentence
+        // about nothing — remove the work and the flag goes with it.
+        const onEphemeralPort = this.opts.tunnel === true && this.opts.port === 0;
+        const listenerClosed = this.server === null;
+        const credentialsRevoked = this.credentials.revokedNow;
+        const leaseKept = existsSync(leasePath(this.opts.dataDir));
+        return onEphemeralPort && listenerClosed && credentialsRevoked && leaseKept;
+    }
+}
+//# sourceMappingURL=setup-host.js.map

package/dist/setup-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-host.js","sourceRoot":"","sources":["../src/setup-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAA6C,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,uBAAuB,EAA6B,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EACL,gBAAgB,EAGhB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AA4B9C;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAA8D;IACxF,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChG,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,SAAS;IAYS;IAXrB,MAAM,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAA8B;IAClC,QAAQ,GAAyC,IAAI,CAAC;IACtD,SAAS,GAAyC,IAAI,CAAC;IACvD,QAAQ,GAAG,KAAK,CAAC;IACR,WAAW,CAAmB;IAC/C,+EAA+E;IACtE,GAAG,CAAS;IACrB,qEAAqE;IAC5D,IAAI,CAAS;IAEtB,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;QACjD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAC9D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,mEAAmE;IACnE,IAAY,QAAQ,KAAa,OAAO,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpD,aAAa,GAAyB,IAAI,CAAC;IAC3C,YAAY,GAAwB,IAAI,CAAC;IACjD,8EAA8E;IACtE,YAAY,GAAkB,IAAI,CAAC;IACnC,gBAAgB,GAAyC,MAAM,CAAC;IACxE;;;;;;;;OAQG;IACK,iBAAiB,GAAG,KAAK,CAAC;IAElC,IAAY,KAAK,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC,CAAC;IAC5E,IAAY,MAAM,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,OAAe,IAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAE/E,8EAA8E;IACtE,UAAU;QAChB,IAAI,CAAC;YAAC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QACrD,MAAM,CAAC;YAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAAC,CAAC;IACnD,CAAC;IAEO,OAAO;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,WAAW,EAAE,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;YAC1C,wEAAwE;YACxE,sDAAsD;YACtD,eAAe,EAAE,GAAG,EAAE;gBACpB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpH,CAAC;YACD,iDAAiD;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,qBAAqB;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,qJAAqJ,CACtJ,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAEhG,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,2EAA2E;QAC3E,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACvD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClG,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,UAAU;QACtB,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC;YACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe;YACjD,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK;YACrD,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;YACpC,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,6DAA6D;YAC7D,eAAe,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;SACvD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;YAClC,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;YACxD,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBAClC,IAAI,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;gBAC7F,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,CAAC;QAED,yEAAyE;QACzE,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAEzC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,mEAAmE;YACnE,mEAAmE;YACnE,0BAA0B;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qEAAqE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,GAAG,CAAC,CAAC;IAEtB;;;;;;OAMG;IACK,YAAY;QAClB,MAAM,KAAK,GAAG,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACxG,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,IAAI,CAAC,YAAY;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,IAAY,eAAe,KAAc,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC;IAErE,KAAK;QACX,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,GAAmB;QAClC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,KAAa;QAC7D,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAEO,WAAW,CAAC,GAAoB;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAEO,eAAe,CAAC,GAAoB;QAC1C,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACtE,CAAC;IAED,yEAAyE;IACjE,YAAY,CAAC,GAAmB,EAAE,IAA2B,EAAE,YAAoB;QACzF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,gEAAgE,CAAC,CAAC;YACtF,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,YAAY,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;IAClG,CAAC;IAEO,MAAM,CAAC,GAAoB,EAAE,GAAmB;QACtD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAChD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChC,2EAA2E;QAC3E,4EAA4E;QAC5E,gEAAgE;QAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1E,4EAA4E;QAC5E,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAE/C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,yDAAyD;QACzD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YACvF,sEAAsE;YACtE,mEAAmE;YACnE,6DAA6D;YAC7D,IAAI,QAAQ;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,wEAAwE;YACxE,sEAAsE;YACtE,WAAW;YACX,GAAG,CAAC,GAAG,CAAC,QAAQ;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACtG,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,wBAAwB;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YACtD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,8DAA8D;YAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/E,kEAAkE;YAClE,wEAAwE;YACxE,aAAa;YACb,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,0EAA0E;YAC1E,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC7D,IAAI,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO;QAErE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,qEAAqE;IAC7D,MAAM,CAAC,GAAoB,EAAE,GAAmB;QACtD,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACrB,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC;gBAAC,QAAQ,GAAG,MAAM,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAwB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;YAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE;oBAC3D,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,MAAM,EAAE,IAAI,CAAC,eAAe;oBAC5B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;iBAC5C,CAAC,CAAC,CAAC;gBACJ,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/E,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACtG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,cAAuB,EAAE,MAAc;QACpD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,0EAA0E;QAC1E,oBAAoB;QACpB,MAAM,QAAQ,GAAG,cAAc,IAAI,IAAI,CAAC,iBAAiB,CAAC;QAC1D,IAAI,IAAI,CAAC,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEjD,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAE1B,4EAA4E;QAC5E,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,GAAG,CACN,2CAA2C,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,IAAI;sBACnH,gGAAgG;sBAChG,6BAA6B,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,yBAAyB,IAAI;sBACxG,sDAAsD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QAEtB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,uBAAuB,MAAM,4CAA4C,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC;YACxF,wEAAwE;YACxE,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,CAAC,GAAG,CACN,uGAAuG;kBACrG,+GAA+G;kBAC/G,uEAAuE,CAC1E,CAAC;YACF,OAAO;QACT,CAAC;QAED,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,gCAAgC;QACtC,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;QAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAC5C,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;QACvD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,OAAO,eAAe,IAAI,cAAc,IAAI,kBAAkB,IAAI,SAAS,CAAC;IAC9E,CAAC;CACF"}

package/dist/setup-marker.d.ts

@@ -0,0 +1,8 @@
+export interface SetupRecord {
+    completedAt: string;
+    version?: string;
+}
+export declare function isSetupComplete(dataDir: string): boolean;
+export declare function markSetupComplete(dataDir: string, version?: string): void;
+/** Only `agend setup --reset` calls this; no route may. */
+export declare function clearSetupComplete(dataDir: string): boolean;

package/dist/setup-marker.js

@@ -0,0 +1,39 @@
+/**
+ * "Setup has been done once."
+ *
+ * Deliberately not fleet.yaml's existence: a user who deletes or moves
+ * fleet.yaml — or whose disk hands back an empty one — would otherwise reopen a
+ * pre-fleet setup host, which is an unauthenticated-by-default surface. The
+ * marker is its own file and only `agend setup --reset` clears it.
+ */
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const FILE = "setup-complete.json";
+function path(dataDir) {
+    return join(dataDir, FILE);
+}
+export function isSetupComplete(dataDir) {
+    try {
+        const parsed = JSON.parse(readFileSync(path(dataDir), "utf-8"));
+        return typeof parsed.completedAt === "string";
+    }
+    catch {
+        // Unreadable is not "not done". A corrupt marker must not reopen setup;
+        // `agend setup --reset` is the way back, and it is a local command.
+        return existsSync(path(dataDir));
+    }
+}
+export function markSetupComplete(dataDir, version) {
+    writeFileSync(path(dataDir), JSON.stringify({ completedAt: new Date().toISOString(), version }) + "\n", { mode: 0o600 });
+}
+/** Only `agend setup --reset` calls this; no route may. */
+export function clearSetupComplete(dataDir) {
+    try {
+        unlinkSync(path(dataDir));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=setup-marker.js.map

package/dist/setup-marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-marker.js","sourceRoot":"","sources":["../src/setup-marker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,qBAAqB,CAAC;AAOnC,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAyB,CAAC;QACxF,OAAO,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,oEAAoE;QACpE,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAgB;IACjE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAwB,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,CAAC;QAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzE,CAAC"}

package/dist/setup-tunnel-consent.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The question asked before a setup page is put on the public internet.
+ *
+ * It is asked every single time. There is no configuration that turns it off
+ * and no flag that answers it in advance: `allow_public` defaults to true
+ * because opening from a phone is the product, not because the consequences
+ * stop mattering after the first time. And a pre-fleet host has no chat channel
+ * to put a confirmation button in, so the only place this can be asked is the
+ * terminal that ran the command.
+ *
+ * Which means a run with no terminal cannot be consented to, and is refused.
+ * Not "defaults to allow because nobody is there to object" — nobody being
+ * there is the reason to refuse.
+ *
+ * The wording is deliberately not sol's Web Terminal text. That one covers a
+ * terminal session that ends; this one carries a long-lived bot token and an
+ * admin id through somebody else's edge, which is a different thing to consent
+ * to and has to say so.
+ */
+export interface ConsentIo {
+    readonly isTTY: boolean;
+    ask(question: string): Promise<string>;
+    say(line: string): void;
+}
+export type ConsentResult = {
+    readonly granted: true;
+} | {
+    readonly granted: false;
+    readonly reason: "declined" | "no-tty";
+};
+/**
+ * Everything a person needs to decide, in the order they need it.
+ *
+ * Each line is here because leaving it out would make the answer uninformed:
+ * the token really does cross Cloudflare, the page really can be closed by a
+ * stranger, and the link really does work for anyone who sees it.
+ */
+export declare function publicTunnelWarning(ttlMinutes: number): string[];
+/**
+ * Ask, and treat anything that is not a clear yes as a no.
+ *
+ * Including the empty answer: a person who presses enter to get past a prompt
+ * has not read it, and this is not a prompt to get past.
+ */
+export declare function confirmPublicTunnel(io: ConsentIo, ttlMinutes: number): Promise<ConsentResult>;
+/**
+ * What the CLI adds when a tunnel was asked for and there is none.
+ *
+ * The host already says the link is local-only and a phone cannot open it —
+ * that is true wherever SetupHost is used. What only the CLI can usefully add
+ * is what to do about it, so it does not repeat the rest.
+ */
+export declare function noTunnelBinaryMessage(): string[];