dsh-zen-remote 2.2.9 → 2.3.1

package/lib/wizard/caddy-process.js

@@ -0,0 +1,162 @@
+/**
+ * Managed-Caddy process lifecycle (GW-3). The Caddyfile's content is
+ * caddy.ts's job; this module owns everything with a heartbeat:
+ *
+ *   start: ensureBinary (GW-2, cached after the first download) →
+ *          generateCaddyfile (typed refusals) → write the Caddyfile as a
+ *          `.part` sibling → `caddy validate --config <part> --adapter
+ *          caddyfile` → only on a clean validate rename it to the real
+ *          path → `caddy run --config <Caddyfile>`. The ticket's "validate
+ *          before write" is honored as validate-before-PUBLISH: the final
+ *          Caddyfile on disk only ever holds bytes Caddy accepted, and a
+ *          failed validate leaves neither a start nor a published file.
+ *
+ *   The Cloudflare API token travels in the child's ENVIRONMENT
+ *   (`CF_API_TOKEN`, what the generated `{env.CF_API_TOKEN}` placeholder
+ *   reads) — never in argv, which other processes on the machine can see.
+ *
+ *   Idempotency: start with a live process refuses (`already-running`) —
+ *   switching configuration stops first (design: 切换路时先停旧进程再启新的).
+ *   stop is idempotent; an exited child clears its own slot so a later
+ *   start works. The host wiring hands stop to ctx.effect, so the row's
+ *   disposal kills Caddy too.
+ *
+ * The subprocess service is structural (the tests feed a recorder), and
+ * `fetch` is injectable for the ensureBinary step.
+ */
+import { mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { ensureBinary, BinaryDownloadError } from './binary-io.js';
+import { caddyDataDir, caddyfilePath, ingressDir } from './binary.js';
+import { generateCaddyfile } from './caddy.js';
+export function createCaddyManager(options) {
+    const { subprocess, dshHome } = options;
+    const maxLogBytes = options.maxLogBytes ?? 64 * 1024;
+    let handle = null;
+    let caddyfileArg;
+    let startedOnce = false;
+    // GW-fix-2/L3: a WHITELIST, not the host's full environment — the host
+    // process carries the relay secret and DSH's own credentials in env, and
+    // a child that only needs to reach the internet and the local disk has
+    // no business inheriting them. Include Windows system/profile variables so
+    // Go's TLS root-cert store and winsock initialize cleanly on Windows.
+    const childEnv = (cfToken) => {
+        const env = {};
+        for (const key of [
+            'PATH', 'HOME', 'TMPDIR', 'LANG', 'TZ',
+            'SystemRoot', 'SYSTEMROOT', 'windir', 'WINDIR',
+            'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PROGRAMDATA', 'TEMP', 'TMP',
+        ]) {
+            if (process.env[key] !== undefined)
+                env[key] = process.env[key];
+        }
+        // The one secret this child needs, by env only (the Caddyfile reads
+        // {env.CF_API_TOKEN}) — never argv.
+        env.CF_API_TOKEN = cfToken;
+        return env;
+    };
+    const spawnChild = (argv, env) => subprocess.spawn({
+        argv,
+        cwd: dshHome,
+        env,
+        stdio: {
+            stdin: 'ignore',
+            stdout: { maxBytes: maxLogBytes },
+            stderr: { maxBytes: maxLogBytes },
+        },
+        graceMs: 3000,
+    });
+    return {
+        async start(input) {
+            if (handle !== null)
+                return { ok: false, error: 'already-running' };
+            const cfToken = typeof input.cfToken === 'string' && input.cfToken.trim() !== '' ? input.cfToken : undefined;
+            if (cfToken === undefined)
+                return { ok: false, error: 'missing-token' };
+            const generated = generateCaddyfile({ ...input, storageDir: caddyDataDir(dshHome) });
+            if (!generated.ok)
+                return { ok: false, error: 'bad-config', detail: generated.error };
+            let binaryPath;
+            try {
+                binaryPath = (await ensureBinary(dshHome, 'caddy', {
+                    fetchImpl: options.fetchImpl,
+                    platform: options.platform,
+                    onProgress: options.onProgress,
+                })).path;
+            }
+            catch (error) {
+                if (error instanceof BinaryDownloadError) {
+                    return { ok: false, error: 'download-failed', detail: error.message, installUrl: error.installUrl };
+                }
+                return { ok: false, error: 'download-failed', detail: String(error?.message ?? error) };
+            }
+            // Write → validate → publish: the `.part` file carries the exact
+            // bytes under validation, so what lands at the real path is exactly
+            // what Caddy accepted.
+            const finalPath = caddyfilePath(dshHome);
+            const partPath = `${finalPath}.part`;
+            try {
+                mkdirSync(ingressDir(dshHome), { recursive: true });
+                writeFileSync(partPath, generated.caddyfile, { mode: 0o600 });
+                const validate = spawnChild([binaryPath, 'validate', '--config', partPath, '--adapter', 'caddyfile'], childEnv(cfToken));
+                const outcome = await validate.done;
+                if ((outcome.exitCode ?? 1) !== 0) {
+                    rmSync(partPath, { force: true });
+                    return { ok: false, error: 'validate-failed' };
+                }
+                renameSync(partPath, finalPath);
+            }
+            catch (error) {
+                rmSync(partPath, { force: true });
+                return { ok: false, error: 'spawn-failed', detail: String(error?.message ?? error) };
+            }
+            const env = childEnv(cfToken);
+            try {
+                const child = spawnChild([binaryPath, 'run', '--config', finalPath], env);
+                handle = child;
+                caddyfileArg = finalPath;
+                startedOnce = true;
+                // An exited child clears its own slot: isRunning() goes honest and
+                // a later start() works without a manual stop.
+                void child.done.then(() => {
+                    if (handle === child) {
+                        handle = null;
+                        caddyfileArg = undefined;
+                    }
+                }).catch(() => {
+                    if (handle === child) {
+                        handle = null;
+                        caddyfileArg = undefined;
+                    }
+                });
+                return { ok: true, binaryPath, caddyfile: finalPath, alreadyRunning: false };
+            }
+            catch (error) {
+                handle = null;
+                caddyfileArg = undefined;
+                return { ok: false, error: 'spawn-failed', detail: String(error?.message ?? error) };
+            }
+        },
+        stop() {
+            if (handle === null)
+                return;
+            const child = handle;
+            handle = null;
+            caddyfileArg = undefined;
+            try {
+                void child.terminate();
+            }
+            catch {
+                // A dead child's terminate is a no-op or a throw — either way done.
+            }
+        },
+        isRunning: () => handle !== null,
+        runningCaddyfile: () => caddyfileArg,
+        /** Whether a start has EVER succeeded in this row's lifetime — the
+         * three-state status needs it to tell 已退出 (degraded) from 未启动. */
+        hasStarted: () => startedOnce,
+    };
+}
+/** Re-exported so the wiring (and later the routes) need one import for
+ * the whole ingress-directory layout. */
+export { caddyDataDir, caddyfilePath, ingressDir };
+//# sourceMappingURL=caddy-process.js.map

package/lib/wizard/caddy-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy-process.js","sourceRoot":"","sources":["../../src/wizard/caddy-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAyB,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAuB,MAAM,aAAa,CAAA;AAC1F,OAAO,EAAE,iBAAiB,EAAuB,MAAM,YAAY,CAAA;AAkEnE,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,CAAA;IACpD,IAAI,MAAM,GAAgC,IAAI,CAAA;IAC9C,IAAI,YAAgC,CAAA;IACpC,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAqB,EAAE;QACtD,MAAM,GAAG,GAAsB,EAAE,CAAA;QACjC,KAAK,MAAM,GAAG,IAAI;YAChB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;YACtC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ;YAC9C,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK;SACvE,EAAE,CAAC;YACF,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjE,CAAC;QACD,oEAAoE;QACpE,oCAAoC;QACpC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAA;QAC1B,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,GAAsB,EAAwB,EAAE,CAClF,UAAU,CAAC,KAAK,CAAC;QACf,IAAI;QACJ,GAAG,EAAE,OAAO;QACZ,GAAG;QACH,KAAK,EAAE;YACL,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;YACjC,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAClC;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IAEJ,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;YACnE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5G,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YACvE,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACpF,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CAAA;YAErF,IAAI,UAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE;oBACjD,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC,CAAC,IAAI,CAAA;YACV,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;oBACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;gBACrG,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACpG,CAAC;YAED,iEAAiE;YACjE,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAA;YACpC,IAAI,CAAC;gBACH,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACnD,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;gBACxH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAA;gBACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;oBACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;gBAChD,CAAC;gBACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACjG,CAAC;YAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC7B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;gBACzE,MAAM,GAAG,KAAK,CAAA;gBACd,YAAY,GAAG,SAAS,CAAA;gBACxB,WAAW,GAAG,IAAI,CAAA;gBAClB,mEAAmE;gBACnE,+CAA+C;gBAC/C,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;oBACxB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,MAAM,GAAG,IAAI,CAAA;wBACb,YAAY,GAAG,SAAS,CAAA;oBAC1B,CAAC;gBACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACZ,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,MAAM,GAAG,IAAI,CAAA;wBACb,YAAY,GAAG,SAAS,CAAA;oBAC1B,CAAC;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAA;gBACb,YAAY,GAAG,SAAS,CAAA;gBACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACjG,CAAC;QACH,CAAC;QAED,IAAI;YACF,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAM;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAA;YACpB,MAAM,GAAG,IAAI,CAAA;YACb,YAAY,GAAG,SAAS,CAAA;YACxB,IAAI,CAAC;gBACH,KAAK,KAAK,CAAC,SAAS,EAAE,CAAA;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI;QAChC,gBAAgB,EAAE,GAAG,EAAE,CAAC,YAAY;QACpC;0EACkE;QAClE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW;KAC9B,CAAA;AACH,CAAC;AAED;yCACyC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA"}

package/lib/wizard/caddy.js

@@ -0,0 +1,80 @@
+/**
+ * Caddyfile generation (GW-3), pure logic — every byte the managed Caddy
+ * will run comes out of {@link generateCaddyfile}, so the validation and
+ * the injection guards live HERE and the process half (caddy-process.ts)
+ * only writes, validates and spawns what this answered.
+ *
+ * Shape (design.md 路 A), with one deliberate correction to the design
+ * sketch: the global DNS-01 option in a real Caddyfile is `acme_dns
+ * <provider> <token-placeholder>` — the sketch's bare `dns cloudflare`
+ * line is site-block `tls` syntax and is not valid as a global option.
+ * The DNS-01 challenge itself is the point: the certificate is ordered
+ * through Cloudflare's API (the token rides the `CF_API_TOKEN`
+ * environment variable, never the file), so neither 80 nor 443 needs to
+ * be reachable from outside for issuance; only the HTTPS service port
+ * must be.
+ *
+ * Injection posture: every interpolated value passes a charset gate —
+ * the domain through config.ts's `hostOf` (the exact validator the row
+ * layer applies), the storage path free of control characters, quotes and
+ * braces (Caddyfile's block delimiters), the env-var name as a legal
+ * POSIX name. Nothing else from the outside world reaches the output.
+ */
+import { hostOf } from '../config.js';
+/** The default environment variable the Cloudflare token rides in on. */
+export const CF_TOKEN_ENV_DEFAULT = 'CF_API_TOKEN';
+/** Integers in [1, 65535] only. */
+function portOf(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= 65535 ? value : undefined;
+}
+/** Storage paths go into the Caddyfile quoted; anything that could break
+ * out of the quoting or forge a block delimiter is refused — control
+ * characters (newlines foremost), quotes, braces. */
+function storageDirOf(value) {
+    if (typeof value !== 'string' || value === '')
+        return undefined;
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f"{}]/.test(value))
+        return undefined;
+    return value;
+}
+/** Env names: POSIX uppercase convention, strictly. */
+const ENV_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+/**
+ * Build the complete Caddyfile for the managed Caddy. Refuses (typed)
+ * instead of throwing so the caller can map each refusal to a form error.
+ */
+export function generateCaddyfile(input) {
+    const domain = hostOf(input.domain);
+    if (domain === undefined)
+        return { ok: false, error: 'bad-domain' };
+    const httpsPort = portOf(input.httpsPort);
+    if (httpsPort === undefined)
+        return { ok: false, error: 'bad-https-port' };
+    const gatewayPort = portOf(input.gatewayPort);
+    if (gatewayPort === undefined)
+        return { ok: false, error: 'bad-gateway-port' };
+    const storageDir = storageDirOf(input.storageDir);
+    if (storageDir === undefined)
+        return { ok: false, error: 'bad-storage' };
+    const tokenEnv = typeof input.cfTokenEnvName === 'string' && ENV_NAME_PATTERN.test(input.cfTokenEnvName)
+        ? input.cfTokenEnvName
+        : CF_TOKEN_ENV_DEFAULT;
+    if (input.cfTokenEnvName !== undefined && input.cfTokenEnvName !== '' && tokenEnv !== input.cfTokenEnvName) {
+        return { ok: false, error: 'bad-token-env' };
+    }
+    const caddyfile = [
+        '{',
+        `\tacme_dns cloudflare {env.${tokenEnv}}`,
+        `\tstorage file_system "${storageDir}"`,
+        '\tadmin off',
+        '}',
+        '',
+        `https://${domain}:${httpsPort} {`,
+        `\treverse_proxy 127.0.0.1:${gatewayPort}`,
+        '}',
+        '',
+    ].join('\n');
+    return { ok: true, caddyfile, domain, httpsPort, gatewayPort };
+}
+//# sourceMappingURL=caddy.js.map

package/lib/wizard/caddy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../../src/wizard/caddy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAoBlD,mCAAmC;AACnC,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACjH,CAAC;AAED;;qDAEqD;AACrD,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC/D,4CAA4C;IAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5D,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,oBAAoB,CAAA;AAE7C;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACzC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;IAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC7C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;IACxE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QACtG,CAAC,CAAC,KAAK,CAAC,cAAc;QACtB,CAAC,CAAC,oBAAoB,CAAA;IACxB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,IAAI,QAAQ,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAC3G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC9C,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,GAAG;QACH,8BAA8B,QAAQ,GAAG;QACzC,0BAA0B,UAAU,GAAG;QACvC,aAAa;QACb,GAAG;QACH,EAAE;QACF,WAAW,MAAM,IAAI,SAAS,IAAI;QAClC,6BAA6B,WAAW,EAAE;QAC1C,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AAChE,CAAC"}

package/lib/wizard/cloudflare.js

@@ -0,0 +1,334 @@
+/**
+ * Cloudflare API v4 client (GW-7) — the whole tunnel path (路 C) talks to
+ * this module: account lookup, zone lookup, tunnel create/list, ingress
+ * configuration, the CNAME that points the public hostname at the tunnel,
+ * and the composed "is this domain on Cloudflare already" check.
+ *
+ * Transport rules the ticket pins down:
+ *
+ *   - Plain `fetch`, no third-party dependency; the token rides the
+ *     `Authorization: Bearer` header and is NEVER logged, echoed into an
+ *     error, or written into any returned structure.
+ *   - Every failure is a typed {@link CloudflareError} whose `code` the UI
+ *     classifies on (`cf-auth-failed`, `cf-zone-not-found`,
+ *     `cf-tunnel-conflict`, `cf-dns-conflict`, `cf-network`, and the
+ *     catch-all `cf-api`). Raw response bodies never pass through — the
+ *     message carries only the API's short error summary, truncated,
+ *     which is what the design's 「兜底显示原始错误码」 wants.
+ *   - The client is stateless: a factory binds the token (plus injectable
+ *     `fetchImpl` / `baseUrl` for the mock-server tests); every method
+ *     takes the ids it needs. The module-level `cf*` wrappers are one-call
+ *     conveniences over the factory.
+ *
+ * Conflict classification matches the well-known numeric codes where they
+ * exist and falls back to the API's error text (`already exists`
+ * wordings), so an upstream renumber degrades to the generic envelope
+ * instead of a wrong verdict.
+ */
+import { hostOf } from '../config.js';
+export const CLOUDFLARE_API_BASE = 'https://api.cloudflare.com/client/v4';
+/**
+ * One refused API call. Fields are assigned in the constructor body (the
+ * check scripts' strip-only type stripping rejects parameter properties).
+ */
+export class CloudflareError extends Error {
+    code;
+    status;
+    /** The API's own numeric error code(s), when the envelope carried any. */
+    apiCodes;
+    constructor(code, message, status = null, apiCodes = [], options) {
+        super(message, options);
+        this.name = 'CloudflareError';
+        this.code = code;
+        this.status = status;
+        this.apiCodes = apiCodes;
+    }
+}
+/** Tunnel name conflict: Cloudflare rejects duplicate names (documented
+ * code 10405; deployments also word it in the message text). The text
+ * fallback names its SUBJECT — "already exists" alone matches the DNS
+ * wording just as well, so the two classifiers must stay scoped. */
+function isTunnelConflict(apiCodes, text) {
+    return apiCodes.includes(10405) || (/tunnel/i.test(text) && /already exists/i.test(text));
+}
+/** DNS record conflict: the documented codes are 81053 / 81057. */
+function isDnsConflict(apiCodes, text) {
+    return apiCodes.includes(81053) || apiCodes.includes(81057) || (/record/i.test(text) && /already exists/i.test(text));
+}
+/** The API's error summary: message strings only, joined, truncated —
+ * never the raw body, never the request's token. */
+function summarize(errors, fallback) {
+    const codes = [];
+    const parts = [];
+    for (const entry of errors) {
+        if (entry !== null && typeof entry === 'object') {
+            const record = entry;
+            if (typeof record.code === 'number')
+                codes.push(record.code);
+            if (typeof record.message === 'string' && record.message !== '')
+                parts.push(record.message);
+        }
+    }
+    return { text: (parts.join('; ') || fallback).slice(0, 200), codes };
+}
+/** Tunnel names we mint: short, safe in a URL path. */
+const TUNNEL_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/;
+/** A `service:` URL inside a tunnel ingress: http(s) to host[:port]. */
+const SERVICE_URL_PATTERN = /^https?:\/\/[A-Za-z0-9.[\]:-]+$/;
+/** Path segments are ids we received from the API or names we minted —
+ * encoded anyway, so a hostile value cannot change the request shape. */
+const seg = (value) => encodeURIComponent(value);
+/** Page-size + page ceiling for the two list endpoints: 5 pages of 50 is
+ * 250 accounts/tunnels — far past anything a wizard user has, and the hard
+ * stop means a broken pagination answer can never loop forever. */
+const PAGE_SIZE = 50;
+const PAGE_LIMIT = 5;
+/**
+ * The ancestor chain of one hostname, itself first: `dsh.example.com` →
+ * `dsh.example.com`, `example.com`, `com`. Cloudflare zones are apex
+ * domains, so a wizard lookup for `dsh.example.com` must find the zone
+ * named `example.com` (GW-fix-2/H1) — exact-name matching walks this chain
+ * level by level.
+ */
+export function ancestorHosts(domain) {
+    const labels = domain.split('.');
+    const chain = [];
+    for (let index = 0; index < labels.length; index++)
+        chain.push(labels.slice(index).join('.'));
+    return chain;
+}
+export function createCloudflareApi(options) {
+    const baseUrl = options.baseUrl ?? CLOUDFLARE_API_BASE;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const token = options.token;
+    if (typeof token !== 'string' || token === '') {
+        throw new CloudflareError('cf-auth-failed', 'no Cloudflare API token');
+    }
+    /** One authenticated v4 call: Bearer header, envelope unwrapping, typed
+     * failures. The token never appears in any error path. Returns the
+     * result PLUS the pagination envelope (the list endpoints page). */
+    const call = async (method, path, body) => {
+        let response;
+        try {
+            response = await fetchImpl(`${baseUrl}${path}`, {
+                method,
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch (cause) {
+            throw new CloudflareError('cf-network', `the Cloudflare API call failed before an answer arrived (${path})`, null, [], { cause });
+        }
+        let envelope;
+        try {
+            envelope = await response.json();
+        }
+        catch {
+            throw new CloudflareError('cf-network', `the Cloudflare API answered unparsable JSON (${path})`, response.status);
+        }
+        const errors = Array.isArray(envelope?.errors) ? envelope.errors : [];
+        const summary = summarize(errors, `HTTP ${response.status}`);
+        if (response.status === 401 || response.status === 403) {
+            throw new CloudflareError('cf-auth-failed', summary.text, response.status, summary.codes);
+        }
+        if (envelope?.success !== true) {
+            let code = 'cf-api';
+            if (isTunnelConflict(summary.codes, summary.text))
+                code = 'cf-tunnel-conflict';
+            else if (isDnsConflict(summary.codes, summary.text))
+                code = 'cf-dns-conflict';
+            throw new CloudflareError(code, summary.text, response.status, summary.codes);
+        }
+        // A missing or junk total_pages reads as a single page — old mocks and
+        // tolerant callers keep working, pagination simply never continues.
+        const totalPages = typeof envelope.result_info?.total_pages === 'number' && envelope.result_info.total_pages >= 1
+            ? envelope.result_info.total_pages
+            : 1;
+        return { result: envelope.result, totalPages };
+    };
+    const requireString = (value, what) => {
+        if (typeof value !== 'string' || value === '')
+            throw new CloudflareError('cf-api', `the Cloudflare API answered without ${what}`);
+        return value;
+    };
+    const requireId = (value, what) => {
+        if (typeof value !== 'string' || value === '')
+            throw new CloudflareError('cf-api', `${what} is required`);
+        return value;
+    };
+    return {
+        async listAccounts() {
+            const accounts = [];
+            for (let page = 1; page <= PAGE_LIMIT; page++) {
+                const { result, totalPages } = await call('GET', `/accounts?per_page=${PAGE_SIZE}&page=${page}`);
+                if (!Array.isArray(result))
+                    throw new CloudflareError('cf-api', 'the accounts answer had no list');
+                accounts.push(...result.map((account) => requireString(account?.id, 'an account id')));
+                if (page >= totalPages || result.length === 0)
+                    break;
+            }
+            return accounts;
+        },
+        async getZone(accountId, domain) {
+            const host = hostOf(domain);
+            if (host === undefined)
+                throw new CloudflareError('cf-api', 'the domain is not a bare hostname');
+            const id = requireId(accountId, 'the account id');
+            const { result } = await call('GET', `/zones?name=${seg(host)}&account.id=${seg(id)}`);
+            // Exact-match on the zone NAME client-side: the query filter is
+            // advisory, the verdict is ours.
+            const zones = Array.isArray(result) ? result : [];
+            const zone = zones.find((candidate) => candidate?.name === host);
+            if (zone === undefined)
+                throw new CloudflareError('cf-zone-not-found', `no Cloudflare zone named ${host}`);
+            return requireString(zone.id, 'a zone id');
+        },
+        async createTunnel(accountId, name) {
+            const id = requireId(accountId, 'the account id');
+            if (typeof name !== 'string' || !TUNNEL_NAME_PATTERN.test(name)) {
+                throw new CloudflareError('cf-api', 'the tunnel name is not a safe label');
+            }
+            // config_src cloudflare makes the create response carry the connector
+            // token directly — the second round-trip (GET .../token) is spared.
+            const { result } = await call('POST', `/accounts/${seg(id)}/cfd_tunnel`, { name, config_src: 'cloudflare' });
+            const record = result;
+            return { id: requireString(record?.id, 'a tunnel id'), token: requireString(record?.token, 'a tunnel token') };
+        },
+        async getTunnelToken(accountId, tunnelId) {
+            const id = requireId(accountId, 'the account id');
+            const tunnel = requireId(tunnelId, 'the tunnel id');
+            const { result } = await call('GET', `/accounts/${seg(id)}/cfd_tunnel/${seg(tunnel)}/token`);
+            const tokenValue = typeof result === 'string'
+                ? result
+                : result?.token;
+            return requireString(tokenValue, 'a tunnel token');
+        },
+        async listTunnels(accountId) {
+            const id = requireId(accountId, 'the account id');
+            const tunnels = [];
+            for (let page = 1; page <= PAGE_LIMIT; page++) {
+                const { result, totalPages } = await call('GET', `/accounts/${seg(id)}/cfd_tunnel?is_deleted=false&per_page=${PAGE_SIZE}&page=${page}`);
+                if (!Array.isArray(result))
+                    throw new CloudflareError('cf-api', 'the tunnels answer had no list');
+                tunnels.push(...result.map((tunnel) => {
+                    const record = tunnel;
+                    return {
+                        id: requireString(record?.id, 'a tunnel id'),
+                        name: typeof record?.name === 'string' ? record.name : '',
+                        status: typeof record?.status === 'string' ? record.status : '',
+                    };
+                }));
+                if (page >= totalPages || result.length === 0)
+                    break;
+            }
+            return tunnels;
+        },
+        async configureIngress(accountId, tunnelId, domain, serviceUrl) {
+            const accountIdSafe = requireId(accountId, 'the account id');
+            const tunnelIdSafe = requireId(tunnelId, 'the tunnel id');
+            const host = hostOf(domain);
+            if (host === undefined)
+                throw new CloudflareError('cf-api', 'the domain is not a bare hostname');
+            if (typeof serviceUrl !== 'string' || !SERVICE_URL_PATTERN.test(serviceUrl)) {
+                throw new CloudflareError('cf-api', 'the service URL is not a plain http(s) origin');
+            }
+            await call('PUT', `/accounts/${seg(accountIdSafe)}/cfd_tunnel/${seg(tunnelIdSafe)}/configurations`, {
+                config: {
+                    ingress: [
+                        { hostname: host, service: serviceUrl },
+                        { service: 'http_status:404' },
+                    ],
+                },
+            });
+        },
+        async listDnsRecords(zoneId, name) {
+            const zone = requireId(zoneId, 'the zone id');
+            const recordName = hostOf(name);
+            if (recordName === undefined)
+                throw new CloudflareError('cf-api', 'the record name is not a bare hostname');
+            const { result } = await call('GET', `/zones/${seg(zone)}/dns_records?type=CNAME&name=${seg(recordName)}&per_page=${50}&page=${1}`);
+            if (!Array.isArray(result))
+                throw new CloudflareError('cf-api', 'the DNS records answer had no list');
+            return result.map((record) => {
+                const entry = record;
+                return {
+                    id: requireString(entry?.id, 'a DNS record id'),
+                    name: typeof entry?.name === 'string' ? entry.name : '',
+                    content: typeof entry?.content === 'string' ? entry.content : '',
+                };
+            });
+        },
+        async createDnsRecord(zoneId, subdomain, target) {
+            const zone = requireId(zoneId, 'the zone id');
+            const name = hostOf(subdomain);
+            if (name === undefined)
+                throw new CloudflareError('cf-api', 'the record name is not a bare hostname');
+            if (typeof target !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}\.cfargotunnel\.com$/.test(target)) {
+                throw new CloudflareError('cf-api', 'the CNAME target is not a tunnel hostname');
+            }
+            const { result } = await call('POST', `/zones/${seg(zone)}/dns_records`, {
+                type: 'CNAME',
+                name,
+                content: target,
+                proxied: true,
+                ttl: 1,
+            });
+            return requireString(result?.id, 'a DNS record id');
+        },
+        async checkDomainOnCloudflare(domain) {
+            const host = hostOf(domain);
+            if (host === undefined)
+                throw new CloudflareError('cf-api', 'the domain is not a bare hostname');
+            // Zones are APEX domains: the user's `dsh.example.com` lives in the
+            // zone named `example.com`, so the exact-name lookup walks the
+            // ancestor chain (GW-fix-2/H1). First hit wins.
+            const chain = ancestorHosts(host);
+            for (const accountId of await this.listAccounts()) {
+                for (const candidate of chain) {
+                    try {
+                        const zoneId = await this.getZone(accountId, candidate);
+                        return { onCloudflare: true, zoneId, accountId };
+                    }
+                    catch (error) {
+                        if (error instanceof CloudflareError && error.code === 'cf-zone-not-found')
+                            continue;
+                        throw error;
+                    }
+                }
+            }
+            return { onCloudflare: false, zoneId: null, accountId: null };
+        },
+    };
+}
+export function cfListAccounts(token, opts) {
+    return createCloudflareApi({ token, ...opts }).listAccounts();
+}
+export function cfGetZone(token, accountId, domain, opts) {
+    return createCloudflareApi({ token, ...opts }).getZone(accountId, domain);
+}
+export function cfCreateTunnel(token, accountId, name, opts) {
+    return createCloudflareApi({ token, ...opts }).createTunnel(accountId, name);
+}
+export function cfListTunnels(token, accountId, opts) {
+    return createCloudflareApi({ token, ...opts }).listTunnels(accountId);
+}
+export function cfGetTunnelToken(token, accountId, tunnelId, opts) {
+    return createCloudflareApi({ token, ...opts }).getTunnelToken(accountId, tunnelId);
+}
+export function cfConfigureIngress(token, accountId, tunnelId, domain, serviceUrl, opts) {
+    return createCloudflareApi({ token, ...opts }).configureIngress(accountId, tunnelId, domain, serviceUrl);
+}
+export function cfCreateDnsRecord(token, zoneId, subdomain, target, opts) {
+    return createCloudflareApi({ token, ...opts }).createDnsRecord(zoneId, subdomain, target);
+}
+export function cfListDnsRecords(token, zoneId, name, opts) {
+    return createCloudflareApi({ token, ...opts }).listDnsRecords(zoneId, name);
+}
+export function cfCheckDomainOnCloudflare(token, domain, opts) {
+    return createCloudflareApi({ token, ...opts }).checkDomainOnCloudflare(domain);
+}
+//# sourceMappingURL=cloudflare.js.map

package/lib/wizard/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/wizard/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAA;AAUzE;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAqB;IACzB,MAAM,CAAe;IAC9B,0EAA0E;IACjE,QAAQ,CAAmB;IAEpC,YAAY,IAAyB,EAAE,OAAe,EAAE,SAAwB,IAAI,EAAE,WAA8B,EAAE,EAAE,OAA6B;QACnJ,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED;;;oEAGoE;AACpE,SAAS,gBAAgB,CAAC,QAA2B,EAAE,IAAY;IACjE,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,QAA2B,EAAE,IAAY;IAC9D,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACvH,CAAC;AAED;oDACoD;AACpD,SAAS,SAAS,CAAC,MAA0B,EAAE,QAAgB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,KAA8C,CAAA;YAC7D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC5D,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAA;AACtE,CAAC;AAkDD,uDAAuD;AACvD,MAAM,mBAAmB,GAAG,iCAAiC,CAAA;AAE7D,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,iCAAiC,CAAA;AAE7D;yEACyE;AACzE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;AAEhE;;mEAEmE;AACnE,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,UAAU,GAAG,CAAC,CAAA;AAEpB;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7F,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAA;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAE3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAA;IACxE,CAAC;IAED;;wEAEoE;IACpE,MAAM,IAAI,GAAG,KAAK,EAAE,MAA8B,EAAE,IAAY,EAAE,IAAc,EAAoD,EAAE;QACpI,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC9C,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;iBACtE;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,4DAA4D,IAAI,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACnI,CAAC;QACD,IAAI,QAA4G,CAAA;QAChH,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,gDAAgD,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QACnH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QACrE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,IAAI,GAAwB,QAAQ,CAAA;YACxC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC;gBAAE,IAAI,GAAG,oBAAoB,CAAA;iBACzE,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC;gBAAE,IAAI,GAAG,iBAAiB,CAAA;YAC7E,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/E,CAAC;QACD,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,WAAW,EAAE,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,WAAW,IAAI,CAAC;YAC/G,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW;YAClC,CAAC,CAAC,CAAC,CAAA;QACL,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,CAAA;IAChD,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,IAAY,EAAU,EAAE;QAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,uCAAuC,IAAI,EAAE,CAAC,CAAA;QACjI,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,IAAY,EAAU,EAAE;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,cAAc,CAAC,CAAA;QACzG,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,MAAM,QAAQ,GAAa,EAAE,CAAA;YAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,sBAAsB,SAAS,SAAS,IAAI,EAAE,CAAC,CAAA;gBAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAA;gBAClG,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAE,OAA4B,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,CAAA;gBAC5G,IAAI,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAK;YACtD,CAAC;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAA;YAChG,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YACtF,gEAAgE;YAChE,iCAAiC;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAsD,CAAC,CAAC,CAAC,EAAE,CAAA;YAClG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,KAAK,IAAI,CAAC,CAAA;YAChE,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,4BAA4B,IAAI,EAAE,CAAC,CAAA;YAC1G,OAAO,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI;YAChC,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,qCAAqC,CAAC,CAAA;YAC5E,CAAC;YACD,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAA;YAC5G,MAAM,MAAM,GAAG,MAA2C,CAAA;YAC1D,OAAO,EAAE,EAAE,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAA;QAChH,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ;YACtC,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;YACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5F,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ;gBAC3C,CAAC,CAAC,MAAM;gBACR,CAAC,CAAE,MAA8B,EAAE,KAAK,CAAA;YAC1C,OAAO,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;QACpD,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,SAAS;YACzB,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjD,MAAM,OAAO,GAA8B,EAAE,CAAA;YAC7C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC,yCAAyC,SAAS,SAAS,IAAI,EAAE,CAAC,CAAA;gBACvI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAA;gBACjG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;oBACpC,MAAM,MAAM,GAAG,MAA4D,CAAA;oBAC3E,OAAO;wBACL,EAAE,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,CAAC;wBAC5C,IAAI,EAAE,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;wBACzD,MAAM,EAAE,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;qBAChE,CAAA;gBACH,CAAC,CAAC,CAAC,CAAA;gBACH,IAAI,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAK;YACtD,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;YAC5D,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YAC5D,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;YACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAA;YAChG,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAA;YACtF,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,CAAC,aAAa,CAAC,eAAe,GAAG,CAAC,YAAY,CAAC,iBAAiB,EAAE;gBAClG,MAAM,EAAE;oBACN,OAAO,EAAE;wBACP,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE;wBACvC,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBAC/B;iBACF;aACF,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YAC/B,IAAI,UAAU,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;YAC3G,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;YACnI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,oCAAoC,CAAC,CAAA;YACrG,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC3B,MAAM,KAAK,GAAG,MAA6D,CAAA;gBAC3E,OAAO;oBACL,EAAE,EAAE,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,iBAAiB,CAAC;oBAC/C,IAAI,EAAE,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;oBACvD,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;iBACjE,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM;YAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;YACrG,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrG,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,2CAA2C,CAAC,CAAA;YAClF,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE;gBACvE,IAAI,EAAE,OAAO;gBACb,IAAI;gBACJ,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE,CAAC;aACP,CAAC,CAAA;YACF,OAAO,aAAa,CAAE,MAA2B,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAA;QAC3E,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,MAAM;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAA;YAChG,oEAAoE;YACpE,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;YACjC,KAAK,MAAM,SAAS,IAAI,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBAClD,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;wBACvD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;oBAClD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB;4BAAE,SAAQ;wBACpF,MAAM,KAAK,CAAA;oBACb,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAC/D,CAAC;KACF,CAAA;AACH,CAAC;AAMD,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAoB;IAChE,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,SAAiB,EAAE,MAAc,EAAE,IAAoB;IAC9F,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAY,EAAE,IAAoB;IACjG,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAoB;IAClF,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,SAAiB,EAAE,QAAgB,EAAE,IAAoB;IACvG,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,MAAc,EACd,UAAkB,EAClB,IAAoB;IAEpB,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAC1G,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAc,EAAE,SAAiB,EAAE,MAAc,EAAE,IAAoB;IACtH,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;AAC3F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY,EAAE,IAAoB;IAChG,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc,EAAE,IAAoB;IAC3F,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAA;AAChF,CAAC"}