@songsid/agend 2.1.6-beta.1 → 2.1.6-beta.2

package/dist/tunnel/cloudflared.js

@@ -0,0 +1,447 @@
+/**
+ * Cloudflare Quick Tunnel as a transport, and only a transport.
+ *
+ * The URL this produces is not a credential and nothing here authorizes
+ * anything. What it must get right is narrower and harder: never run a shell,
+ * never hand the child an environment it does not need, never believe a word of
+ * its output that has not been through the validator, and never report a death
+ * it has not proven.
+ *
+ * Verified flag shape against cloudflared's documented Quick Tunnel invocation;
+ * `--config /dev/null` is load-bearing, because Cloudflare's own docs say a
+ * `~/.cloudflared/config.yaml` can stop quick tunnels working, and we cannot
+ * assume the operator's home is empty.
+ */
+import { spawn } from "node:child_process";
+import { accessSync, constants as fsConstants } from "node:fs";
+import { delimiter, isAbsolute, join } from "node:path";
+import { probeProcess } from "../web-terminal.js";
+import { TunnelStartError, TUNNEL_STARTUP_DEADLINE_MS, TUNNEL_STOP_GRACE_MS, } from "./types.js";
+/** A Quick Tunnel hostname is one label under trycloudflare.com. Nothing else. */
+const QUICK_TUNNEL_HOST = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/;
+/**
+ * Everything the child is allowed to inherit.
+ *
+ * It would otherwise get the whole environment of the shell that ran
+ * `agend setup`, which on a developer machine routinely holds cloud
+ * credentials. A tunnel needs to reach the internet; it does not need
+ * AWS_SECRET_ACCESS_KEY to do it.
+ */
+const ENV_ALLOW_LIST = [
+    "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+    "http_proxy", "https_proxy", "no_proxy",
+    "SSL_CERT_FILE", "SSL_CERT_DIR",
+];
+export function minimalChildEnv(env = process.env) {
+    const out = {};
+    for (const key of ENV_ALLOW_LIST) {
+        const value = env[key];
+        if (typeof value === "string" && value !== "")
+            out[key] = value;
+    }
+    return out;
+}
+/**
+ * The one URL shape this provider will accept.
+ *
+ * Strict on purpose, and against the whole token rather than a match inside it:
+ * `https://evil.example/?next=https://x.trycloudflare.com/` contains a perfectly
+ * good quick-tunnel URL and must still be refused, because what the child
+ * actually printed was a link to evil.example.
+ */
+export function validateQuickTunnelUrl(candidate) {
+    if (candidate.length > 200)
+        return null;
+    // Control characters never appear in a URL; their presence means the token
+    // came out of an escape sequence or a mangled line, not a URL.
+    if (/[\u0000-\u001f\u007f]/.test(candidate))
+        return null;
+    let url;
+    try {
+        url = new URL(candidate);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "https:")
+        return null;
+    if (url.username || url.password)
+        return null;
+    if (url.port)
+        return null;
+    if (url.search || url.hash)
+        return null;
+    if (url.pathname !== "/")
+        return null;
+    if (!QUICK_TUNNEL_HOST.test(url.hostname))
+        return null;
+    return `https://${url.hostname}`;
+}
+/**
+ * Pull candidate URLs out of a chunk of child output.
+ *
+ * Whatever a token is, it has to be the *complete* thing the child printed —
+ * validating a fragment is how `https://evil.example/?u=https://x.trycloudflare.com/`
+ * becomes acceptable. So the two output shapes are handled as what they are
+ * rather than smashed through one splitter:
+ *
+ * - A JSON log line is parsed as JSON, and each string value is a whole token.
+ *   Splitting it on quotes and commas instead would pull a hostname out of a
+ *   query string and call it the tunnel.
+ * - Plain text is split on whitespace and `|` only, because that is what
+ *   cloudflared draws its box with and neither can occur inside a URL. Quotes
+ *   and commas are deliberately NOT separators: they can appear in a URL, so
+ *   splitting on them shortens a hostile token into an acceptable one.
+ */
+export function extractTunnelUrl(text) {
+    // Strip ANSI first so colouring around the URL does not become part of it.
+    const plain = text.replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, "");
+    for (const line of plain.split(/\r?\n/)) {
+        const found = jsonLineUrl(line) ?? plainLineUrl(line);
+        if (found)
+            return found;
+    }
+    return null;
+}
+function plainLineUrl(line) {
+    for (const token of line.split(/[\s|]+/)) {
+        const valid = validateQuickTunnelUrl(token);
+        if (valid)
+            return valid;
+    }
+    return null;
+}
+/** Depth-bounded: a log line is not a place to walk an arbitrary object graph. */
+function jsonLineUrl(line) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("{"))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+    const walk = (value, depth) => {
+        if (depth > 4)
+            return null;
+        if (typeof value === "string")
+            return validateQuickTunnelUrl(value);
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                const hit = walk(item, depth + 1);
+                if (hit)
+                    return hit;
+            }
+            return null;
+        }
+        if (value && typeof value === "object") {
+            for (const item of Object.values(value)) {
+                const hit = walk(item, depth + 1);
+                if (hit)
+                    return hit;
+            }
+            return null;
+        }
+        return null;
+    };
+    return walk(parsed, 0);
+}
+/** Bounded: a child that never prints a URL must not grow our memory. */
+const MAX_BUFFERED_OUTPUT = 64 * 1024;
+function resolveBinary(name, env) {
+    if (name.includes("/"))
+        return isAbsolute(name) ? name : null;
+    for (const dir of (env.PATH ?? "").split(delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = join(dir, name);
+        try {
+            accessSync(candidate, fsConstants.X_OK);
+            return candidate;
+        }
+        catch { /* keep looking */ }
+    }
+    return null;
+}
+export class CloudflaredProvider {
+    opts;
+    name = "cloudflared";
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    get env() { return this.opts.env ?? process.env; }
+    get binaryName() { return this.opts.binaryName ?? "cloudflared"; }
+    async preflight(signal) {
+        if (signal.aborted)
+            return { ok: false, errorKind: "cancelled", detail: "cancelled before preflight" };
+        const path = resolveBinary(this.binaryName, this.env);
+        if (!path) {
+            return {
+                ok: false,
+                errorKind: "binary-missing",
+                detail: `${this.binaryName} is not on PATH. Install it from Cloudflare's documentation; AgEnD never downloads it for you.`,
+            };
+        }
+        try {
+            accessSync(path, fsConstants.X_OK);
+        }
+        catch {
+            return { ok: false, errorKind: "binary-not-executable", detail: `${path} is not executable` };
+        }
+        return { ok: true, binaryPath: path };
+    }
+    async start(ctx) {
+        const now = this.opts.now ?? Date.now;
+        const deadlineMs = this.opts.deadlineMs ?? TUNNEL_STARTUP_DEADLINE_MS;
+        // One budget for spawn, URL and readiness together. Per-step timeouts are
+        // how a startup that "never times out" happens: each step resets the clock.
+        const deadline = Math.min(now() + deadlineMs, ctx.expiresAt);
+        if (ctx.origin.hostname !== "127.0.0.1" || ctx.origin.protocol !== "http:") {
+            throw new TunnelStartError("bad-url", `refusing to expose ${ctx.origin.origin}: only http://127.0.0.1:<port> may be tunnelled`);
+        }
+        const pre = await this.preflight(ctx.signal);
+        if (!pre.ok)
+            throw new TunnelStartError(pre.errorKind, pre.detail);
+        const spawnProcess = this.opts.spawnProcess ?? spawn;
+        let child;
+        try {
+            child = spawnProcess(pre.binaryPath, [
+                "tunnel",
+                "--no-autoupdate",
+                "--config", "/dev/null",
+                "--url", ctx.origin.origin,
+            ], {
+                // No shell, ever: the arguments are fixed and one of them is an origin.
+                shell: false,
+                env: minimalChildEnv(this.env),
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        }
+        catch (err) {
+            throw new TunnelStartError("spawn-failed", `could not start ${this.binaryName}: ${err.message}`);
+        }
+        const state = new CloudflaredHandle(child, this.opts);
+        try {
+            const base = await state.awaitUrl(deadline, ctx.signal, now);
+            const pageUrl = `${base}${ctx.pagePath}`;
+            // After the validator, before the probe: cloudflared passes the public
+            // Host through to the origin, so the origin has to be expecting it or it
+            // will refuse our own readiness check.
+            ctx.onCandidateHost?.(new URL(base).host);
+            await this.probeReady(pageUrl, ctx, deadline, now);
+            state.publish(base, pageUrl);
+            return state;
+        }
+        catch (err) {
+            // A child exists. Its death has to be proven before this failure can be
+            // reported as a clean one, or a fallback would run beside a live tunnel.
+            const stopped = await state.stop("startup failed");
+            if (!stopped.confirmed) {
+                throw new TunnelStartError(err instanceof TunnelStartError ? err.errorKind : "spawn-failed", `${err.message}; and the tunnel process could not be confirmed stopped`, { pid: stopped.pid, identity: stopped.identity });
+            }
+            throw err;
+        }
+    }
+    async probeReady(pageUrl, ctx, deadline, now) {
+        const fetchPage = this.opts.fetchPage ?? defaultFetchPage;
+        let lastDetail = "no attempt completed";
+        while (now() < deadline) {
+            if (ctx.signal.aborted)
+                throw new TunnelStartError("cancelled", "cancelled during readiness probe");
+            const attempt = new AbortController();
+            const timer = setTimeout(() => attempt.abort(), Math.max(1, Math.min(5_000, deadline - now())));
+            try {
+                const res = await fetchPage(pageUrl, attempt.signal);
+                if (res.status === 200 && res.contentType.startsWith("text/html") && res.body.includes(ctx.readinessMarker)) {
+                    return;
+                }
+                lastDetail = `status ${res.status}, content-type ${res.contentType || "(none)"}`;
+            }
+            catch (err) {
+                lastDetail = err.message;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            // The edge takes a moment to learn the hostname; a failure here is
+            // expected early and only fatal at the deadline.
+            await new Promise(r => setTimeout(r, 500));
+        }
+        throw new TunnelStartError("readiness-failed", `the public URL never served this page (${lastDetail})`);
+    }
+}
+async function defaultFetchPage(url, signal) {
+    // `manual`: a redirect is not this page, and following one would let the edge
+    // decide what we call ready.
+    const res = await fetch(url, { signal, redirect: "manual", cache: "no-store" });
+    return {
+        status: res.status,
+        contentType: res.headers.get("content-type") ?? "",
+        body: res.status === 200 ? await res.text() : "",
+    };
+}
+class CloudflaredHandle {
+    child;
+    opts;
+    provider = "cloudflared";
+    visibility = "public";
+    baseUrl = "";
+    pageUrl = "";
+    pid;
+    identity;
+    buffered = "";
+    urlResolved = null;
+    foundBase = null;
+    exit = null;
+    /**
+     * A spawn that failed before a process existed.
+     *
+     * Node reports this as `error` and never as `exit`, and leaves `pid`
+     * undefined. Without handling it the start waits out its whole deadline and
+     * then cannot prove a death — for a process that was never created, which
+     * would hold the lease and block every later tunnel over nothing.
+     */
+    spawnError = null;
+    exitListeners = new Set();
+    published = false;
+    stopping = null;
+    constructor(child, opts) {
+        this.child = child;
+        this.opts = opts;
+        this.pid = child.pid ?? null;
+        // Recorded now, not at stop time: the fingerprint of the process we
+        // actually started is the only thing that makes a later kill safe.
+        const probeFn = opts.probe ?? probeProcess;
+        const probe = (this.pid !== null ? probeFn(this.pid) : { kind: "unknown" });
+        this.identity = probe.kind === "identified" ? probe.identity : null;
+        const absorb = (chunk) => {
+            if (this.foundBase)
+                return;
+            this.buffered = (this.buffered + String(chunk)).slice(-MAX_BUFFERED_OUTPUT);
+            const base = extractTunnelUrl(this.buffered);
+            if (!base)
+                return;
+            this.foundBase = base;
+            this.urlResolved?.(base);
+        };
+        child.stdout?.on("data", absorb);
+        child.stderr?.on("data", absorb);
+        child.on("exit", (code, signal) => {
+            this.exit = { code, signal };
+            if (this.published)
+                for (const listener of this.exitListeners)
+                    listener(this.exit);
+        });
+        child.on("error", err => {
+            this.spawnError = err;
+            if (this.pid === null)
+                this.spawnFailed?.(this.spawnError);
+        });
+    }
+    spawnFailed = null;
+    /** True when we can prove no process was ever created. */
+    get neverStarted() {
+        return this.pid === null && this.spawnError !== null;
+    }
+    publish(base, pageUrl) {
+        this.baseUrl = base;
+        this.pageUrl = pageUrl;
+        this.published = true;
+    }
+    async awaitUrl(deadline, signal, now) {
+        if (this.foundBase)
+            return this.foundBase;
+        if (this.neverStarted) {
+            throw new TunnelStartError("spawn-failed", `could not start cloudflared: ${this.spawnError.message}`);
+        }
+        return new Promise((resolve, reject) => {
+            const settle = (fn) => { cleanup(); fn(); };
+            const timer = setTimeout(() => settle(() => reject(new TunnelStartError("timeout", "cloudflared did not print a usable tunnel URL in time"))), Math.max(1, deadline - now()));
+            const onAbort = () => settle(() => reject(new TunnelStartError("cancelled", "cancelled while waiting for the tunnel URL")));
+            const onExit = () => settle(() => reject(new TunnelStartError("no-url", "cloudflared exited before printing a tunnel URL")));
+            // A spawn that never produced a process must not wait out the deadline:
+            // there is nothing to wait for, and the delay is what turns a missing
+            // binary into a blocked lease.
+            const onSpawnFail = (err) => settle(() => reject(new TunnelStartError("spawn-failed", `could not start cloudflared: ${err.message}`)));
+            const cleanup = () => {
+                clearTimeout(timer);
+                signal.removeEventListener("abort", onAbort);
+                this.child.off("exit", onExit);
+                this.urlResolved = null;
+                this.spawnFailed = null;
+            };
+            this.urlResolved = base => settle(() => resolve(base));
+            this.spawnFailed = onSpawnFail;
+            signal.addEventListener("abort", onAbort, { once: true });
+            this.child.on("exit", onExit);
+            if (this.exit)
+                onExit();
+            else if (this.neverStarted)
+                onSpawnFail(this.spawnError);
+            else if (signal.aborted)
+                onAbort();
+        });
+    }
+    onUnexpectedExit(listener) {
+        this.exitListeners.add(listener);
+        return () => { this.exitListeners.delete(listener); };
+    }
+    /** Single-flight: a second caller joins the first rather than re-signalling. */
+    stop(reason) {
+        this.stopping ??= this.doStop(reason);
+        return this.stopping;
+    }
+    async doStop(reason) {
+        void reason;
+        this.exitListeners.clear();
+        if (this.exit)
+            return { confirmed: true };
+        // Proven, not assumed: Node reported the spawn itself failed and never
+        // handed us a pid, so there is no process. Reporting this as unconfirmed
+        // would hold the lease against a child that does not exist.
+        if (this.neverStarted)
+            return { confirmed: true };
+        if (this.pid === null) {
+            return { confirmed: false, reason: "the process was never given a pid", pid: null, identity: null };
+        }
+        const probe = this.opts.probe ?? probeProcess;
+        const graceMs = this.opts.graceMs ?? TUNNEL_STOP_GRACE_MS;
+        for (const signal of ["SIGTERM", "SIGKILL"]) {
+            try {
+                this.child.kill(signal);
+            }
+            catch { /* may have exited between checks */ }
+            const exited = await this.waitForExit(graceMs);
+            if (exited)
+                return { confirmed: true };
+            const after = probe(this.pid);
+            if (after.kind === "gone")
+                return { confirmed: true };
+            // The pid belongs to something else now, so ours is gone — and we must
+            // not send it the next signal.
+            if (after.kind === "identified" && this.identity && after.identity !== this.identity) {
+                return { confirmed: true };
+            }
+        }
+        return {
+            confirmed: false,
+            // Never "stopped": a kill() that did not throw proves nothing, and this
+            // sentence is what stops a caller writing "closed safely" in a log.
+            reason: "the process did not exit after SIGTERM and SIGKILL, and is still running under its original identity",
+            pid: this.pid,
+            identity: this.identity,
+        };
+    }
+    waitForExit(ms) {
+        if (this.exit)
+            return Promise.resolve(true);
+        return new Promise(resolve => {
+            const timer = setTimeout(() => { this.child.off("exit", onExit); resolve(false); }, ms);
+            const onExit = () => { clearTimeout(timer); resolve(true); };
+            this.child.once("exit", onExit);
+        });
+    }
+}
+//# sourceMappingURL=cloudflared.js.map

package/dist/tunnel/cloudflared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared.js","sourceRoot":"","sources":["../../src/tunnel/cloudflared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,GAOrB,MAAM,YAAY,CAAC;AAEpB,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,4DAA4D,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG;IACrB,YAAY,EAAE,aAAa,EAAE,UAAU;IACvC,YAAY,EAAE,aAAa,EAAE,UAAU;IACvC,eAAe,EAAE,cAAc;CACvB,CAAC;AAEX,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,WAAW,GAAG,CAAC,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,KAAa,EAAiB,EAAE;QAC5D,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YAAC,CAAC;YACpG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAS,aAAa,CAAC,IAAY,EAAE,GAAsB;IACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAgBD,MAAM,OAAO,mBAAmB;IAGD;IAFpB,IAAI,GAAG,aAAa,CAAC;IAE9B,YAA6B,OAA2B,EAAE;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,IAAY,GAAG,KAAwB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAY,UAAU,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC;IAElF,KAAK,CAAC,SAAS,CAAC,MAAmB;QACjC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QACvG,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,gGAAgG;aAC3H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAuB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,0BAA0B,CAAC;QACtE,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAE7D,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC3E,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,sBAAsB,GAAG,CAAC,MAAM,CAAC,MAAM,iDAAiD,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;QACrD,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE;gBACnC,QAAQ;gBACR,iBAAiB;gBACjB,UAAU,EAAE,WAAW;gBACvB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;aAC3B,EAAE;gBACD,wEAAwE;gBACxE,KAAK,EAAE,KAAK;gBACZ,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,mBAAmB,IAAI,CAAC,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9G,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YACzC,uEAAuE;YACvE,yEAAyE;YACzE,uCAAuC;YACvC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YACnD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,gBAAgB,CACxB,GAAG,YAAY,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,EAChE,GAAI,GAAa,CAAC,OAAO,yDAAyD,EAClF,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CACjD,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAuB,EAAE,QAAgB,EAAE,GAAiB;QACpG,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;QAC1D,IAAI,UAAU,GAAG,sBAAsB,CAAC;QACxC,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAC;YACpG,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACrD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC5G,OAAO;gBACT,CAAC;gBACD,UAAU,GAAG,UAAU,GAAG,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAAW,IAAI,QAAQ,EAAE,CAAC;YACnF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,GAAI,GAAa,CAAC,OAAO,CAAC;YACtC,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YACD,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,0CAA0C,UAAU,GAAG,CAAC,CAAC;IAC1G,CAAC;CACF;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAmB;IAC9D,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAChF,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAClD,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB;IA0BF;IACA;IA1BV,QAAQ,GAAG,aAAa,CAAC;IACzB,UAAU,GAAG,QAAiB,CAAC;IACxC,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,GAAG,EAAE,CAAC;IACJ,GAAG,CAAgB;IACnB,QAAQ,CAAgB;IAEzB,QAAQ,GAAG,EAAE,CAAC;IACd,WAAW,GAAoC,IAAI,CAAC;IACpD,SAAS,GAAkB,IAAI,CAAC;IAChC,IAAI,GAAsB,IAAI,CAAC;IACvC;;;;;;;OAOG;IACK,UAAU,GAAiB,IAAI,CAAC;IAChC,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,SAAS,GAAG,KAAK,CAAC;IAClB,QAAQ,GAAqC,IAAI,CAAC;IAE1D,YACmB,KAAmB,EACnB,IAAwB;QADxB,UAAK,GAAL,KAAK,CAAc;QACnB,SAAI,GAAJ,IAAI,CAAoB;QAEzC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAEpE,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,EAAE;YACxC,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YAC3B,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,SAAS;gBAAE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,aAAa;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACtB,IAAI,CAAC,UAAU,GAAG,GAAY,CAAC;YAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;gBAAE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,GAAkC,IAAI,CAAC;IAE1D,0DAA0D;IAC1D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IACvD,CAAC;IAED,OAAO,CAAC,IAAY,EAAE,OAAe;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,MAAmB,EAAE,GAAiB;QACrE,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,gCAAgC,IAAI,CAAC,UAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,SAAS,EAAE,uDAAuD,CAAC,CAAC,CAAC,EACpH,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,CAC9B,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAC,CAAC,CAAC;YAC5H,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC,CAAC,CAAC;YAC7H,wEAAwE;YACxE,sEAAsE;YACtE,+BAA+B;YAC/B,MAAM,WAAW,GAAG,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CACrD,IAAI,gBAAgB,CAAC,cAAc,EAAE,gCAAgC,GAAG,CAAC,OAAO,EAAE,CAAC,CACpF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAC1B,CAAC,CAAC;YACF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YAC/B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM,EAAE,CAAC;iBACnB,IAAI,IAAI,CAAC,YAAY;gBAAE,WAAW,CAAC,IAAI,CAAC,UAAW,CAAC,CAAC;iBACrD,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,QAAoC;QACnD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,gFAAgF;IAChF,IAAI,CAAC,MAAc;QACjB,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAc;QACjC,KAAK,MAAM,CAAC;QACZ,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC1C,uEAAuE;QACvE,yEAAyE;QACzE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACtG,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;QAE1D,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;YACrD,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,MAAM;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACtD,uEAAuE;YACvE,+BAA+B;YAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,EAAE,sGAAsG;YAC9G,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,EAAU;QAC5B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,IAAI,OAAO,CAAU,OAAO,CAAC,EAAE;YACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/tunnel/lease.d.ts

@@ -0,0 +1,75 @@
+import { probeProcess } from "../web-terminal.js";
+export interface TunnelLease {
+    readonly sid: string;
+    readonly provider: string;
+    readonly originPort: number;
+    /** Null only in the instant between reserving the lease and the spawn returning. */
+    readonly providerPid: number | null;
+    /** `probeProcess` identity at spawn. Null on platforms that cannot produce one. */
+    readonly strongIdentity: string | null;
+    readonly expiresAt: number;
+    /** The process that owns this lease; a live owner means it is not ours to reap. */
+    readonly ownerPid: number;
+    /**
+     * The owner's own fingerprint at the time it wrote the lease.
+     *
+     * Without it, "the owner pid is alive" is a guess: after a crash the number
+     * can belong to something entirely unrelated, and the lease would then be
+     * held forever by a process that has never heard of it. Ticket 5 had the same
+     * trap in `fleet.lock`.
+     */
+    readonly ownerIdentity: string | null;
+}
+export declare function leasePath(dataDir: string): string;
+/**
+ * Atomic, owner-only, and on disk before the call returns.
+ *
+ * The fsync is not ceremony: the lease has to survive the crash that makes it
+ * matter, and a rename that is only in page cache does not.
+ */
+export declare function writeLease(dataDir: string, lease: TunnelLease): void;
+export declare function readLease(dataDir: string): TunnelLease | null;
+export declare function clearLease(dataDir: string): void;
+export type ReapOutcome = 
+/** No lease; a new managed tunnel may start. */
+{
+    readonly kind: "clear";
+}
+/** A live owner holds it. Not ours to reap, and not ours to replace. */
+ | {
+    readonly kind: "held";
+    readonly ownerPid: number;
+}
+/** The process was already gone, or was killed and proven gone. Lease removed. */
+ | {
+    readonly kind: "reaped";
+    readonly how: "already-gone" | "pid-reused" | "killed";
+    readonly pid: number | null;
+}
+/** Could not prove death. Lease kept, and it keeps blocking. */
+ | {
+    readonly kind: "manual";
+    readonly reason: string;
+    readonly pid: number | null;
+    readonly leasePath: string;
+};
+export interface ReapOptions {
+    now?: () => number;
+    /** Injected so a test never signals a real process. */
+    probe?: typeof probeProcess;
+    kill?: (pid: number, signal: NodeJS.Signals) => void;
+    /** Injected so the grace periods do not make tests slow. */
+    wait?: (ms: number) => Promise<void>;
+    graceMs?: number;
+}
+/**
+ * Resolve whatever the last run left behind, before anything new is started.
+ *
+ * Runs from any process — the fleet at startup and the pre-fleet setup host
+ * both call it, which is why it takes a directory rather than a manager.
+ */
+export declare function reapStaleTunnel(dataDir: string, opts?: ReapOptions): Promise<ReapOutcome>;
+/** What to tell a human when a lease could not be resolved. Never "closed safely". */
+export declare function manualCleanupMessage(outcome: Extract<ReapOutcome, {
+    kind: "manual";
+}>): string;