dsh-zen-remote 1.1.16 → 2.0.0

package/lib/client-pairing.js

@@ -0,0 +1,224 @@
+/**
+ * Pure pairing/probe logic for the sub-client half (T16): the address
+ * normalizer the claim route validates user input with, and the two
+ * classifiers that turn one HTTP round-trip each into a shape the settings
+ * block can render. No I/O, no clocks, no process reads — the route module
+ * owns the sockets and the timeouts, this module owns the decisions.
+ *
+ * IPv4/IPv6 range checks are hand-rolled because the address arrives as a
+ * STRING inside an already-parsed URL and the point is to keep the private-
+ * network allowance of `normalizeServerUrl` exactly as narrow as specified
+ * (172.16/12, 100.64/10 etc. — off-by-one range bugs here would either lock
+ * LAN users out or open plain-http pairing to the public internet).
+ */
+import { unwrapVolatile } from './config.js';
+/** The gateway claim endpoint, resolved against the normalized server URL. */
+export const CLAIM_PATH = '/lan-gate/pair/claim-desktop';
+/** The relay ping path the client backend probes (the gateway admits this
+ * prefix for desktop-client devices and forwards to the host relay route). */
+export const RELAY_PING_PATH = '/_dsh/zen-remote/relay/ping';
+/** One private-network allowance for plain http, as (label, predicate). IPv4
+ * ranges are `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`,
+ * `100.64.0.0/10` (CGNAT/Tailscale), `127.0.0.0/8`; IPv6: `::1`, `fc00::/7`,
+ * `fe80::/10`; plus the hostnames `localhost` and `*.local`. */
+function isHttpAllowedHost(hostname) {
+    if (hostname === 'localhost' || hostname.endsWith('.local'))
+        return true;
+    if (hostname.includes(':'))
+        return isAllowedIpv6(hostname);
+    return isAllowedIpv4(hostname);
+}
+/** Dotted-quad check against the allowed ranges. The hostname comes from a
+ * parsed URL, so it is already canonical (the WHATWG parser folds exotic
+ * spellings like `010.0x0A.0.3` into plain decimal before we ever see it). */
+function isAllowedIpv4(hostname) {
+    const parts = hostname.split('.');
+    if (parts.length !== 4)
+        return false;
+    const bytes = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return false;
+        const value = Number(part);
+        if (value > 255)
+            return false;
+        bytes.push(value);
+    }
+    const [a, b] = bytes;
+    if (a === 10 || a === 127)
+        return true; // 10.0.0.0/8, 127.0.0.0/8
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // 100.64.0.0/10
+    return false;
+}
+/** IPv6 check against `::1`, `fc00::/7` and `fe80::/10`. Hostnames of parsed
+ * URLs keep the square brackets; the zone suffix (`%25…`) is rejected —
+ * link-local with a zone id is a machine-local spelling anyway. */
+function isAllowedIpv6(bracketed) {
+    const host = bracketed.startsWith('[') && bracketed.endsWith(']') ? bracketed.slice(1, -1) : bracketed;
+    if (!host.includes('%') && host === '::1')
+        return true;
+    const groups = ipv6Groups(host);
+    if (groups === undefined)
+        return false;
+    const first = groups[0];
+    return (first >= 0xfc00 && first <= 0xfdff) || (first >= 0xfe80 && first <= 0xfebf);
+}
+/** Expand an IPv6 string into its 8 numeric groups, honoring one `::`.
+ * Anything malformed — a second `::`, a non-hex or over-long group, more
+ * than 8 groups without `::` — is rejected (undefined), never guessed. */
+function ipv6Groups(host) {
+    const halves = host.split('::');
+    if (halves.length > 2)
+        return undefined;
+    const parseGroups = (text) => {
+        if (text === '')
+            return [];
+        const groups = [];
+        for (const raw of text.split(':')) {
+            if (!/^[0-9a-fA-F]{1,4}$/.test(raw))
+                return undefined;
+            groups.push(parseInt(raw, 16));
+        }
+        return groups;
+    };
+    const head = parseGroups(halves[0]);
+    if (head === undefined)
+        return undefined;
+    const tail = halves.length === 2 ? parseGroups(halves[1]) : [];
+    if (tail === undefined)
+        return undefined;
+    const missing = 8 - head.length - tail.length;
+    if (missing < 0 || (halves.length === 1 && missing !== 0))
+        return undefined;
+    return [...head, ...new Array(missing).fill(0), ...tail];
+}
+/**
+ * Normalize one user-typed server address to the exact string the client
+ * stores and probes: surrounding whitespace and trailing slashes gone, no
+ * path (beyond `/`), no query, no fragment, no embedded credentials, and a
+ * scheme of `http:` (private hosts only) or `https:` (always).
+ */
+export function normalizeServerUrl(input) {
+    if (typeof input !== 'string')
+        return { ok: false, reason: 'invalid' };
+    let parsed;
+    try {
+        parsed = new URL(input.trim().replace(/\/+$/u, ''));
+    }
+    catch {
+        return { ok: false, reason: 'invalid' };
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return { ok: false, reason: 'invalid' };
+    if (parsed.pathname !== '/' || parsed.search !== '' || parsed.hash !== '')
+        return { ok: false, reason: 'invalid' };
+    if (parsed.username !== '' || parsed.password !== '')
+        return { ok: false, reason: 'invalid' };
+    if (parsed.protocol === 'http:' && !isHttpAllowedHost(parsed.hostname)) {
+        return { ok: false, reason: 'insecure-http' };
+    }
+    return { ok: true, url: parsed.origin };
+}
+/**
+ * The volatile row field's current server address, read through the loader's
+ * `{ get() }` wrapper and normalized exactly like the claim route validates
+ * user input. undefined when the field is unset or no longer legal: a
+ * hand-edited row must never have the pairing token sent to an address the
+ * claim route would have refused. Used by the relay client's address getter
+ * in src/index.ts; the status route reads the row itself because it needs
+ * the unset / invalid distinction its own two states answer with.
+ */
+export function normalizedRowServerUrl(row) {
+    const record = row !== null && typeof row === 'object' && !Array.isArray(row) ? row : {};
+    const value = unwrapVolatile(record.serverUrl);
+    const serverUrl = typeof value === 'string' ? value.trim() : '';
+    if (serverUrl === '')
+        return undefined;
+    const normalized = normalizeServerUrl(serverUrl);
+    return normalized.ok ? normalized.url : undefined;
+}
+/** First string value of a possibly-unknown field, for the success shape. */
+function stringOf(value) {
+    return typeof value === 'string' ? value : '';
+}
+/**
+ * Classify one claim round-trip. `body` may be anything the server returned
+ * (including unparsable garbage — the route passes `undefined` then): only
+ * the exact happy shape counts as success, everything else lands in the four
+ * refusal buckets the settings block has copy for.
+ */
+export function classifyClaimResponse(status, body) {
+    const record = body !== null && typeof body === 'object' && !Array.isArray(body)
+        ? body
+        : {};
+    if (status >= 200 && status < 300 && record.ok === true) {
+        const token = stringOf(record.token);
+        if (token === '')
+            return { ok: false, code: 'unexpected' };
+        return {
+            ok: true,
+            token,
+            deviceId: stringOf(record.id),
+            deviceName: stringOf(record.name),
+        };
+    }
+    if (status === 403 && record.reason === 'role-mismatch') {
+        const message = stringOf(record.message);
+        return message === '' ? { ok: false, code: 'role-mismatch' } : { ok: false, code: 'role-mismatch', message };
+    }
+    if (status === 403 && record.reason === 'bad-code')
+        return { ok: false, code: 'bad-code' };
+    if (status === 429 && record.reason === 'locked') {
+        const retryAfterMs = typeof record.retryAfterMs === 'number' && Number.isFinite(record.retryAfterMs)
+            ? Math.max(0, record.retryAfterMs)
+            : 0;
+        return { ok: false, code: 'locked', retryAfterMs };
+    }
+    return { ok: false, code: 'unexpected' };
+}
+/**
+ * Classify one probe of `<serverUrl>${RELAY_PING_PATH}`:
+ *
+ * - no HTTP answer at all → `unreachable` (down, wrong address, timeout);
+ * - 401 with the relay route's own `relay-unauthorized` error → `unexpected`
+ *   (T23a-fix): the gateway ACCEPTED the token but the server's internal
+ *   secret disagrees — a server-side fault that must not unpair a valid
+ *   device; only the gateway's own pairing wall (`reason: 'unpaired'`) is
+ *   a dead token;
+ * - any other 401 → `revoked` — the gateway treats an invalid or revoked
+ *   desktop-client token as unpaired and answers its 401 wall;
+ * - 403 with `reason: 'relay-only'` → `unexpected`: the token was ACCEPTED
+ *   but the server refuses the relay prefix — only possible when the server
+ *   is not running the 2.0.0 gateway;
+ * - any other status (200 ping ok, 404 from a pre-relay server, even 3xx)
+ *   means the gateway accepted the token → `connected`.
+ */
+export function classifyProbe(result) {
+    if (result.kind === 'error')
+        return 'unreachable';
+    if (result.status === 401) {
+        const body = result.body !== null && typeof result.body === 'object' && !Array.isArray(result.body)
+            ? result.body
+            : undefined;
+        const error = body !== undefined && body.error !== null && typeof body.error === 'object' && !Array.isArray(body.error)
+            ? body.error
+            : undefined;
+        if (error !== undefined && error.code === 'relay-unauthorized')
+            return 'unexpected';
+        return 'revoked';
+    }
+    if (result.status === 403) {
+        const reason = result.body !== null && typeof result.body === 'object' && !Array.isArray(result.body)
+            ? result.body.reason
+            : undefined;
+        if (reason === 'relay-only')
+            return 'unexpected';
+    }
+    return 'connected';
+}
+//# sourceMappingURL=client-pairing.js.map

package/lib/client-pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-pairing.js","sourceRoot":"","sources":["../src/client-pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAA;AAExD;8EAC8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,6BAA6B,CAAA;AAU5D;;;gEAGgE;AAChE,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC1D,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED;;8EAE8E;AAC9E,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,KAAK,CAAA;QAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAyC,CAAA;IACxD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,0BAA0B;IACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;IACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,iBAAiB;IACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;mEAEmE;AACnE,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACvB,OAAO,CAAC,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,CAAA;AACrF,CAAC;AAED;;0EAE0E;AAC1E,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAwB,EAAE;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1B,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC7C,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3E,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACtE,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACxG,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAClH,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC7F,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAA;IACrH,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/D,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAChD,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACnD,CAAC;AAqBD,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,IAAa;IACjE,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9E,CAAC,CAAC,IAA+B;QACjC,CAAC,CAAC,EAAE,CAAA;IACN,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QAC1D,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;SAClC,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACxC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAA;IAC9G,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC1F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;YAClG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC,CAAC,CAAA;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;IACpD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;AAC1C,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,aAAa,CAAA;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACjG,CAAC,CAAE,MAAM,CAAC,IAAgC;YAC1C,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACrH,CAAC,CAAE,IAAI,CAAC,KAAiC;YACzC,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;YAAE,OAAO,YAAY,CAAA;QACnF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACnG,CAAC,CAAE,MAAM,CAAC,IAAgC,CAAC,MAAM;YACjD,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,MAAM,KAAK,YAAY;YAAE,OAAO,YAAY,CAAA;IAClD,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}