dodo-mcp 1.0.0

package/dist/tunnel/log.js

@@ -0,0 +1,84 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { ensurePrivateDirectory, assertPrivatePath } from '../platform/privateFs.js';
+import { renameWithRetry } from '../platform/fsRetry.js';
+import { logLine } from '../security/redact.js';
+const LOG_BYTES = 512 * 1024;
+function tailUtf8(input, limit) {
+    if (input.length <= limit)
+        return input;
+    let start = input.length - limit;
+    while (start < input.length && (input[start] & 0xc0) === 0x80)
+        start++;
+    return input.subarray(start);
+}
+function writePrivateAtomic(file, bytes) {
+    try {
+        assertPrivatePath(file);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const temporary = path.join(path.dirname(file), `.tunnel-log-${randomBytes(12).toString('hex')}.tmp`);
+    try {
+        fs.writeFileSync(temporary, bytes, { mode: 0o600, flag: 'wx' });
+        renameWithRetry(temporary, file);
+        if (process.platform !== 'win32')
+            fs.chmodSync(file, 0o600);
+    }
+    finally {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* renamed or absent */ }
+    }
+}
+/** Private bounded tunnel diagnostics. Exact credential removal happens before
+ * generic redaction and before any byte reaches disk or the owner terminal. */
+export class TunnelLog {
+    credential;
+    file;
+    bytes = Buffer.alloc(0);
+    constructor(directory, credential) {
+        this.credential = credential;
+        ensurePrivateDirectory(directory);
+        this.file = path.join(directory, 'cloudflared.log');
+        try {
+            assertPrivatePath(this.file);
+            this.bytes = tailUtf8(fs.readFileSync(this.file), LOG_BYTES);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    append(source, value) {
+        const withoutCredential = this.credential ? value.split(this.credential).join('[REDACTED_TUNNEL_TOKEN]') : value;
+        const line = `${new Date().toISOString()} ${source} ${logLine(withoutCredential)}\n`;
+        this.bytes = tailUtf8(Buffer.concat([this.bytes, Buffer.from(line, 'utf8')]), LOG_BYTES);
+        writePrivateAtomic(this.file, this.bytes);
+    }
+    read(lineLimit = 200) {
+        const all = this.bytes.toString('utf8').split(/\r?\n/).filter(Boolean);
+        const limit = Math.max(1, Math.min(500, Math.trunc(lineLimit)));
+        return { lines: all.slice(-limit), truncated: all.length > limit || this.bytes.length >= LOG_BYTES };
+    }
+}
+export function readTunnelLog(directory, lineLimit = 200) {
+    const file = path.join(directory, 'cloudflared.log');
+    try {
+        assertPrivatePath(file);
+        const bytes = tailUtf8(fs.readFileSync(file), LOG_BYTES);
+        const all = bytes.toString('utf8').split(/\r?\n/).filter(Boolean);
+        const limit = Math.max(1, Math.min(500, Math.trunc(lineLimit)));
+        return { lines: all.slice(-limit), truncated: all.length > limit || bytes.length >= LOG_BYTES };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { lines: [], truncated: false };
+        throw error;
+    }
+}
+//# sourceMappingURL=log.js.map

package/dist/tunnel/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/tunnel/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;AAE7B,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa;IAC5C,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;IACjC,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,KAAK,EAAE,CAAC;IACxE,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAA8B;IACtE,IAAI,CAAC;QAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAChC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtG,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAAC,CAAC;AACnF,CAAC;AAED;+EAC+E;AAC/E,MAAM,OAAO,SAAS;IAI4B;IAHvC,IAAI,CAAS;IACd,KAAK,GAA4B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzD,YAAY,SAAiB,EAAmB,UAAmB;QAAnB,eAAU,GAAV,UAAU,CAAS;QACjE,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAoC,EAAE,KAAa;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjH,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,MAAM,IAAI,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACrF,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACzF,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,SAAS,GAAG,GAAG;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IACvG,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,SAAS,GAAG,GAAG;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/F,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/tunnel/runtime.js

@@ -0,0 +1,55 @@
+import { DodoError } from '../errors.js';
+import { startManagedTunnel } from './supervisor.js';
+/**
+ * Owns at most one cloudflared supervisor for the lifetime of one DODO HTTP
+ * process. It stores no credential: callers provide a run-scoped token for
+ * each start, and the value is forwarded directly to the supervisor.
+ */
+export class TunnelRuntime {
+    configDir;
+    onLog;
+    supervisor;
+    lastStatus = null;
+    constructor(configDir, onLog) {
+        this.configDir = configDir;
+        this.onLog = onLog;
+    }
+    status() {
+        const current = this.supervisor?.status() ?? null;
+        return { available: true, running: current?.running === true, current, lastKnown: current ?? this.lastStatus };
+    }
+    async start(config, temporaryToken) {
+        if (this.supervisor?.status().running) {
+            throw new DodoError('CONFLICT', 'Cloudflare Tunnel is already attached to this DODO process');
+        }
+        const supervisor = await startManagedTunnel({
+            configDir: this.configDir,
+            config,
+            temporaryToken,
+            ...(this.onLog ? { onLog: this.onLog } : {}),
+        });
+        this.supervisor = supervisor;
+        const initial = supervisor.status();
+        void supervisor.wait().then(() => {
+            this.lastStatus = supervisor.status();
+            if (this.supervisor === supervisor)
+                this.supervisor = undefined;
+        });
+        return initial;
+    }
+    async stop() {
+        const supervisor = this.supervisor;
+        if (!supervisor)
+            return this.lastStatus;
+        supervisor.stop();
+        await supervisor.wait();
+        this.lastStatus = supervisor.status();
+        if (this.supervisor === supervisor)
+            this.supervisor = undefined;
+        return this.lastStatus;
+    }
+    close() {
+        return this.stop();
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/tunnel/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/tunnel/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAmD,MAAM,iBAAiB,CAAC;AAEtG;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAKL;IACA;IALX,UAAU,CAAsC;IAChD,UAAU,GAAwB,IAAI,CAAC;IAE/C,YACmB,SAAiB,EACjB,KAA8B;QAD9B,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAyB;IAC9C,CAAC;IAEJ,MAAM;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC;QAClD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;IACjH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAoB,EAAE,cAAsB;QACtD,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,4DAA4D,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC;YAC1C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM;YACN,cAAc;YACd,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACpC,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;gBAAE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QACxC,UAAU,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAChE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/tunnel/supervisor.js

@@ -0,0 +1,280 @@
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import net from 'node:net';
+import { z } from 'zod';
+import { validatePublicUrl } from '../config/globalConfig.js';
+import { ipcSocketPath, statePaths } from '../config/paths.js';
+import { DodoError } from '../errors.js';
+import { startIpcServer } from '../ipc/server.js';
+import { resolveTrustedExecutable } from '../platform/execResolve.js';
+import { renameWithRetry } from '../platform/fsRetry.js';
+import { ensurePrivateDirectory } from '../platform/privateFs.js';
+import { signalOwnedProcess } from '../platform/processTree.js';
+import { buildChildEnv } from '../security/env.js';
+import { readTunnelCredential, validateTunnelToken } from './credentials.js';
+import { TunnelLog } from './log.js';
+export const TunnelStatusSchema = z.object({
+    mode: z.literal('managed'),
+    running: z.boolean(),
+    phase: z.enum(['starting', 'connecting', 'connected', 'backoff', 'stopping', 'stopped', 'failed']),
+    connected: z.boolean(),
+    startedAt: z.string().datetime(),
+    updatedAt: z.string().datetime(),
+    restarts: z.number().int().min(0).max(5),
+    maxRestarts: z.number().int().min(0).max(5),
+    metricsUrl: z.string().url().max(2048),
+    publicOrigin: z.string().url().max(2048),
+    credentialSource: z.enum(['temporary', 'configured']),
+    lastExitCode: z.number().int().nullable(),
+    lastError: z.string().max(500).nullable(),
+}).strict();
+function securityWorkspaceRoot() { return fs.realpathSync.native(process.cwd()); }
+export function tunnelIpcPath(configDir) {
+    return ipcSocketPath(configDir, 'tunnel-supervisor', { createDirectory: false });
+}
+export function resolveCloudflared(config, exclusionRoot = securityWorkspaceRoot()) {
+    if (config.tunnel.executable) {
+        return resolveTrustedExecutable(config.tunnel.executable, exclusionRoot, { allowAbsolute: true, allowBatch: false });
+    }
+    return resolveTrustedExecutable('cloudflared', exclusionRoot, { allowBatch: false });
+}
+function writeState(directory, state) {
+    ensurePrivateDirectory(directory);
+    const target = path.join(directory, 'state.json');
+    const temporary = path.join(directory, `.state-${randomBytes(12).toString('hex')}.tmp`);
+    try {
+        fs.writeFileSync(temporary, JSON.stringify(state, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+        renameWithRetry(temporary, target);
+        if (process.platform !== 'win32')
+            fs.chmodSync(target, 0o600);
+    }
+    finally {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* renamed or absent */ }
+    }
+}
+export function probeTunnelReady(port, timeoutMs = 1500) {
+    return new Promise(resolve => {
+        let settled = false;
+        const finish = (value) => { if (settled)
+            return; settled = true; resolve(value); };
+        const request = http.get({ host: '127.0.0.1', port, path: '/ready', timeout: timeoutMs, headers: { Host: `127.0.0.1:${port}` } }, response => {
+            response.resume();
+            response.once('end', () => finish(response.statusCode === 200));
+        });
+        request.once('timeout', () => { request.destroy(); finish(false); });
+        request.once('error', () => finish(false));
+    });
+}
+function delay(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+function assertMetricsPortAvailable(port) {
+    return new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.unref();
+        server.once('error', () => reject(new DodoError('CONFLICT', `tunnel metrics port ${port} is already in use`, { recovery: 'choose another owner-only loopback port with dodo tunnel configure --metrics-port <port>' })));
+        server.listen(port, '127.0.0.1', () => server.close(() => resolve()));
+    });
+}
+export async function startManagedTunnel(options) {
+    const configDir = path.resolve(options.configDir);
+    const config = options.config;
+    if (config.tunnel.mode !== 'managed')
+        throw new DodoError('CONFLICT', 'tunnel mode is external', { recovery: 'run dodo tunnel configure --managed first' });
+    if (!options.temporaryToken && !config.tunnel.credentialRef)
+        throw new DodoError('NOT_FOUND', 'no temporary or configured Cloudflare Tunnel credential is available');
+    if (!config.publicUrl)
+        throw new DodoError('NOT_FOUND', 'public origin is not configured', { recovery: 'run dodo init --public-url https://your-host first' });
+    const publicOrigin = validatePublicUrl(config.publicUrl, config.dangerouslyAllowInsecurePublicUrl).origin;
+    const executable = resolveCloudflared(config);
+    const credential = options.temporaryToken
+        ? validateTunnelToken(options.temporaryToken)
+        : await readTunnelCredential(config.tunnel.credentialRef, options.env ?? process.env);
+    const paths = statePaths(configDir);
+    ensurePrivateDirectory(paths.tunnelDir);
+    const log = new TunnelLog(paths.tunnelDir, credential);
+    const metricsUrl = `http://127.0.0.1:${config.tunnel.metricsPort}/ready`;
+    let status = {
+        mode: 'managed', running: true, phase: 'starting', connected: false,
+        startedAt: new Date().toISOString(), updatedAt: new Date().toISOString(), restarts: 0,
+        maxRestarts: config.tunnel.maxRestarts, metricsUrl, publicOrigin,
+        credentialSource: options.temporaryToken ? 'temporary' : 'configured',
+        lastExitCode: null, lastError: null,
+    };
+    let child;
+    let ipcServer;
+    let stopping = false;
+    let finished = false;
+    let resolveWait;
+    const waitPromise = new Promise(resolve => { resolveWait = resolve; });
+    const update = (patch) => {
+        status = { ...status, ...patch, updatedAt: new Date().toISOString() };
+        try {
+            writeState(paths.tunnelDir, status);
+        }
+        catch {
+            status = { ...status, lastError: 'private tunnel state could not be written' };
+        }
+    };
+    const appendLog = (source, line) => {
+        try {
+            log.append(source, line);
+        }
+        catch {
+            status = { ...status, lastError: 'private tunnel diagnostics could not be written', updatedAt: new Date().toISOString() };
+        }
+    };
+    const ownerLog = (line) => { appendLog('dodo', line); options.onLog?.(line); };
+    const requestStop = () => {
+        if (stopping || finished)
+            return;
+        stopping = true;
+        update({ phase: 'stopping', connected: false });
+        ownerLog('stop requested by authenticated local owner');
+        if (child) {
+            const owned = child;
+            try {
+                signalOwnedProcess(owned, 'SIGTERM', true);
+            }
+            catch {
+                update({ lastError: 'owned cloudflared process termination was not confirmed' });
+            }
+            if (process.platform !== 'win32') {
+                const force = setTimeout(() => {
+                    if (child === owned && owned.exitCode === null && owned.signalCode === null) {
+                        try {
+                            signalOwnedProcess(owned, 'SIGKILL', true);
+                        }
+                        catch {
+                            update({ lastError: 'owned cloudflared process did not stop within the bounded grace period' });
+                        }
+                    }
+                }, 5000);
+                force.unref();
+            }
+        }
+    };
+    const finish = async (code, phase, error) => {
+        if (finished)
+            return;
+        finished = true;
+        update({ running: false, connected: false, phase, ...(error ? { lastError: error } : {}) });
+        if (ipcServer)
+            await new Promise(resolve => ipcServer.close(() => resolve()));
+        resolveWait(code);
+    };
+    try {
+        ipcServer = await startIpcServer(tunnelIpcPath(configDir), async (cmd, args) => {
+            if (cmd === 'status')
+                return { ...status };
+            if (cmd === 'logs')
+                return log.read(typeof args['lines'] === 'number' ? args['lines'] : 200);
+            if (cmd === 'stop') {
+                setImmediate(requestStop);
+                return { stopping: true };
+            }
+            throw new DodoError('INVALID_INPUT', 'unsupported tunnel owner command');
+        }, { replaceExisting: false, stableWindowsEndpoint: true });
+    }
+    catch {
+        throw new DodoError('CONFLICT', 'a DODO-managed tunnel supervisor is already running or left an owner-private IPC endpoint', {
+            recovery: 'run dodo tunnel status; if a crashed POSIX process left a stale socket, remove only the reported private tunnel IPC files after local inspection',
+        });
+    }
+    try {
+        await assertMetricsPortAvailable(config.tunnel.metricsPort);
+    }
+    catch (error) {
+        await new Promise(resolve => ipcServer.close(() => resolve()));
+        throw error;
+    }
+    update({ phase: 'starting' });
+    ownerLog(`managed tunnel supervisor started; cloudflared=${path.basename(executable)} metrics=${metricsUrl}`);
+    const args = ['tunnel', '--no-autoupdate', '--loglevel', 'info', '--output', 'json', '--metrics', `127.0.0.1:${config.tunnel.metricsPort}`, 'run'];
+    const runChild = () => new Promise(resolve => {
+        const env = buildChildEnv({ parentEnv: options.env ?? process.env, workspaceRoot: securityWorkspaceRoot(), extraAllowlist: [] });
+        env['TUNNEL_TOKEN'] = credential;
+        child = spawn(executable, args, { cwd: configDir, env, shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
+        let settled = false;
+        const done = (code) => { if (settled)
+            return; settled = true; child = undefined; resolve(code); };
+        const pending = { stdout: '', stderr: '' };
+        const stream = (source, chunk) => {
+            pending[source] += chunk.toString('utf8');
+            if (Buffer.byteLength(pending[source], 'utf8') > 64 * 1024) {
+                pending[source] = '';
+                appendLog(source, '[oversized cloudflared log line dropped]');
+                return;
+            }
+            let newline;
+            while ((newline = pending[source].indexOf('\n')) !== -1) {
+                const line = pending[source].slice(0, newline).replace(/\r$/, '');
+                pending[source] = pending[source].slice(newline + 1);
+                if (line)
+                    appendLog(source, line);
+            }
+        };
+        const flush = () => {
+            for (const source of ['stdout', 'stderr'])
+                if (pending[source]) {
+                    appendLog(source, pending[source]);
+                    pending[source] = '';
+                }
+        };
+        child.stdout?.on('data', (chunk) => stream('stdout', chunk));
+        child.stderr?.on('data', (chunk) => stream('stderr', chunk));
+        child.once('spawn', () => update({ phase: 'connecting', connected: false, lastError: null }));
+        child.once('error', () => { flush(); update({ lastError: 'cloudflared process could not start' }); done(null); });
+        child.once('close', code => { flush(); done(code); });
+    });
+    void (async () => {
+        let readyTimer;
+        try {
+            while (!stopping) {
+                const readiness = async () => {
+                    if (stopping || !child)
+                        return;
+                    const connected = await probeTunnelReady(config.tunnel.metricsPort);
+                    if (connected !== status.connected) {
+                        update({ connected, phase: connected ? 'connected' : 'connecting' });
+                        ownerLog(connected ? 'cloudflared readiness endpoint reports connected' : 'cloudflared readiness endpoint is not connected');
+                    }
+                };
+                readyTimer = setInterval(() => void readiness(), 1000);
+                readyTimer.unref();
+                const code = await runChild();
+                clearInterval(readyTimer);
+                readyTimer = undefined;
+                update({ connected: false, lastExitCode: code });
+                if (stopping)
+                    break;
+                if (status.restarts >= status.maxRestarts) {
+                    ownerLog(`cloudflared exited after ${status.restarts} bounded restart(s)`);
+                    await finish(1, 'failed', 'cloudflared exhausted the bounded restart policy');
+                    return;
+                }
+                const restarts = status.restarts + 1;
+                const waitMs = Math.min(8000, (options.retryDelayMs ?? 1000) * 2 ** (restarts - 1));
+                update({ phase: 'backoff', restarts, lastError: 'cloudflared exited before stop was requested' });
+                ownerLog(`cloudflared exited; restart ${restarts}/${status.maxRestarts} in ${waitMs}ms`);
+                await delay(waitMs);
+            }
+            if (readyTimer)
+                clearInterval(readyTimer);
+            await finish(0, 'stopped');
+        }
+        catch {
+            if (readyTimer)
+                clearInterval(readyTimer);
+            await finish(1, 'failed', 'tunnel supervisor failed without exposing child diagnostics');
+        }
+    })();
+    return { status: () => ({ ...status }), stop: requestStop, wait: () => waitPromise };
+}
+//# sourceMappingURL=supervisor.js.map

package/dist/tunnel/supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../src/tunnel/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClG,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC,MAAM,EAAE,CAAC;AAUZ,SAAS,qBAAqB,KAAa,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,aAAa,CAAC,SAAS,EAAE,mBAAmB,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,aAAa,GAAG,qBAAqB,EAAE;IAC9F,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,wBAAwB,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAmB;IACxD,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAS,GAAG,IAAI;IAC7D,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,OAAO;YAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE;YAC3I,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,uBAAuB,IAAI,oBAAoB,EAAE,EAAE,QAAQ,EAAE,0FAA0F,EAAE,CAAC,CAAC,CAAC,CAAC;QACzN,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAQxC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,yBAAyB,EAAE,EAAE,QAAQ,EAAE,2CAA2C,EAAE,CAAC,CAAC;IAC5J,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,sEAAsE,CAAC,CAAC;IACtK,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,iCAAiC,EAAE,EAAE,QAAQ,EAAE,oDAAoD,EAAE,CAAC,CAAC;IAC/J,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,iCAAiC,CAAC,CAAC,MAAM,CAAC;IAC1G,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc;QACvC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC;QAC7C,CAAC,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,aAAc,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACpC,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,oBAAoB,MAAM,CAAC,MAAM,CAAC,WAAW,QAAQ,CAAC;IACzE,IAAI,MAAM,GAAiB;QACzB,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK;QACnE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC;QACrF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY;QAChE,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;QACrE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;KACpC,CAAC;IACF,IAAI,KAA+B,CAAC;IACpC,IAAI,SAAiC,CAAC;IACtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAoC,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,OAAO,CAAC,EAAE,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,CAAC,KAA4B,EAAE,EAAE;QAC9C,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtE,IAAI,CAAC;YAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAC5C,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,2CAA2C,EAAE,CAAC;QAAC,CAAC;IAC3F,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAoC,EAAE,IAAY,EAAE,EAAE;QACvE,IAAI,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACjC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,iDAAiD,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAAC,CAAC;IACtI,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,QAAQ,IAAI,QAAQ;YAAE,OAAO;QACjC,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,QAAQ,CAAC,6CAA6C,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;YACnD,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE,SAAS,EAAE,yDAAyD,EAAE,CAAC,CAAC;YAAC,CAAC;YAC3F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;wBAC5E,IAAI,CAAC;4BAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;wBAAC,CAAC;wBACnD,MAAM,CAAC;4BAAC,MAAM,CAAC,EAAE,SAAS,EAAE,wEAAwE,EAAE,CAAC,CAAC;wBAAC,CAAC;oBAC5G,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC;gBACT,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,KAA2B,EAAE,KAAc,EAAE,EAAE;QACjF,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,IAAI,SAAS;YAAE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,SAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrF,WAAW,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC7E,IAAI,GAAG,KAAK,QAAQ;gBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;YAC3C,IAAI,GAAG,KAAK,MAAM;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7F,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAC7E,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QAC3E,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,2FAA2F,EAAE;YAC3H,QAAQ,EAAE,kJAAkJ;SAC7J,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;IACpE,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,SAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9B,QAAQ,CAAC,kDAAkD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;IAE9G,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IACnJ,MAAM,QAAQ,GAAG,GAA2B,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QACnE,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,qBAAqB,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;QACjI,GAAG,CAAC,cAAc,CAAC,GAAG,UAAU,CAAC;QACjC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrK,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAE,EAAE,GAAG,IAAI,OAAO;YAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,OAAO,GAAwC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAE,KAAa,EAAE,EAAE;YAC5D,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC3D,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBACrB,SAAS,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,IAAI,OAAe,CAAC;YACpB,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAClE,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBACrD,IAAI,IAAI;oBAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU;gBAAE,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;oBAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC;QACxI,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,UAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;oBAC3B,IAAI,QAAQ,IAAI,CAAC,KAAK;wBAAE,OAAO;oBAC/B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBACpE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;wBACnC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC;oBAC/H,CAAC;gBACH,CAAC,CAAC;gBACF,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;gBACvD,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;gBAC9B,aAAa,CAAC,UAAU,CAAC,CAAC;gBAAC,UAAU,GAAG,SAAS,CAAC;gBAClD,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,IAAI,QAAQ;oBAAE,MAAM;gBACpB,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC1C,QAAQ,CAAC,4BAA4B,MAAM,CAAC,QAAQ,qBAAqB,CAAC,CAAC;oBAC3E,MAAM,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,kDAAkD,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpF,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,8CAA8C,EAAE,CAAC,CAAC;gBAClG,QAAQ,CAAC,+BAA+B,QAAQ,IAAI,MAAM,CAAC,WAAW,OAAO,MAAM,IAAI,CAAC,CAAC;gBACzF,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,UAAU;gBAAE,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,UAAU;gBAAE,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,6DAA6D,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AACvF,CAAC"}

package/dist/util/bytes.js

@@ -0,0 +1,53 @@
+/** Byte-oriented text helpers. All truncation is explicit — never silent. */
+/**
+ * Truncate a UTF-8 buffer at or before `maxBytes` without splitting a
+ * multi-byte sequence. Returns the sliced buffer and whether truncation happened.
+ */
+export function utf8SafeSlice(buf, start, maxBytes) {
+    const from = clampContinuationForward(buf, Math.max(0, Math.min(start, buf.length)));
+    let end = Math.min(buf.length, from + Math.max(0, maxBytes));
+    end = clampContinuationBackward(buf, end);
+    if (end < from)
+        end = from;
+    return { bytes: buf.subarray(from, end), end };
+}
+function isContinuation(byte) {
+    return (byte & 0xc0) === 0x80;
+}
+/** Move forward past continuation bytes so we start on a character boundary. */
+function clampContinuationForward(buf, pos) {
+    let p = pos;
+    while (p < buf.length && isContinuation(buf[p] ?? 0))
+        p += 1;
+    return p;
+}
+/** Move backward so we do not end mid-character. */
+function clampContinuationBackward(buf, pos) {
+    let p = pos;
+    while (p > 0 && p < buf.length && isContinuation(buf[p] ?? 0))
+        p -= 1;
+    return p;
+}
+/** Truncate a string to at most maxBytes of UTF-8, appending a marker when cut. */
+export function truncateUtf8(text, maxBytes) {
+    const buf = Buffer.from(text, 'utf8');
+    if (buf.length <= maxBytes)
+        return { text, truncated: false };
+    const { bytes } = utf8SafeSlice(buf, 0, maxBytes);
+    return { text: bytes.toString('utf8'), truncated: true };
+}
+/** Strict UTF-8 decode: returns undefined if the bytes are not valid UTF-8. */
+export function decodeUtf8Strict(buf) {
+    try {
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(buf);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Heuristic binary detection: NUL byte in the first 8 KiB. */
+export function looksBinary(buf) {
+    const probe = buf.subarray(0, 8192);
+    return probe.includes(0);
+}
+//# sourceMappingURL=bytes.js.map

package/dist/util/bytes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.js","sourceRoot":"","sources":["../../src/util/bytes.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;IACxE,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,GAAG,GAAG,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,IAAI;QAAE,GAAG,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,SAAS,wBAAwB,CAAC,GAAW,EAAE,GAAW;IACxD,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oDAAoD;AACpD,SAAS,yBAAyB,CAAC,GAAW,EAAE,GAAW;IACzD,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC"}

package/dist/util/hash.js

@@ -0,0 +1,53 @@
+import { createHash, randomBytes } from 'node:crypto';
+/** SHA-256 of raw bytes, formatted as `sha256:<hex>` (spec §10.3: no newline normalization). */
+export function sha256Bytes(data) {
+    const h = createHash('sha256');
+    h.update(typeof data === 'string' ? Buffer.from(data, 'utf8') : data);
+    return `sha256:${h.digest('hex')}`;
+}
+/**
+ * Canonical JSON: object keys sorted recursively, no whitespace. Used for
+ * idempotency payload hashes and approval action digests so logically equal
+ * payloads hash equal.
+ */
+export function canonicalJson(value) {
+    return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+    if (Array.isArray(value))
+        return value.map(sortValue);
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const v = value[key];
+            if (v !== undefined)
+                out[key] = sortValue(v);
+        }
+        return out;
+    }
+    return value;
+}
+export function digestOf(value) {
+    return sha256Bytes(canonicalJson(value));
+}
+const ID_ALPHABET = '0123456789abcdefghjkmnpqrstvwxyz'; // Crockford-ish, lowercase, unambiguous
+export function newId(prefix, bytes = 10) {
+    const raw = randomBytes(bytes);
+    let out = '';
+    for (const b of raw)
+        out += ID_ALPHABET[b % 32];
+    return `${prefix}_${out}`;
+}
+/** Three human-checkable words derived from an id, for OAuth consent phrase matching. */
+export function phraseFor(id) {
+    const WORDS = [
+        'amber', 'bison', 'cedar', 'delta', 'ember', 'fjord', 'gecko', 'harbor',
+        'igloo', 'jade', 'kelp', 'lotus', 'mango', 'nova', 'onyx', 'pine',
+        'quartz', 'raven', 'sage', 'tiger', 'umber', 'violet', 'willow', 'xenon',
+        'yarrow', 'zephyr', 'basil', 'coral', 'dune', 'elm', 'fern', 'grove',
+    ];
+    const digest = createHash('sha256').update(id).digest();
+    const pick = (i) => WORDS[(digest[i] ?? 0) % WORDS.length];
+    return `${pick(0)}-${pick(1)}-${pick(2)}`;
+}
+//# sourceMappingURL=hash.js.map

package/dist/util/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/util/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,gGAAgG;AAChG,MAAM,UAAU,WAAW,CAAC,IAAyB;IACnD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,WAAW,GAAG,kCAAkC,CAAC,CAAC,wCAAwC;AAEhG,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE;IAC9C,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,GAAG,IAAI,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ;QACvE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QACjE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;QACxE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;KACrE,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC"}