dsh-zen-remote 2.2.9 → 2.3.2

package/lib/wizard/cloudflare.js

@@ -0,0 +1,334 @@
+/**
+ * Cloudflare API v4 client (GW-7) — the whole tunnel path (路 C) talks to
+ * this module: account lookup, zone lookup, tunnel create/list, ingress
+ * configuration, the CNAME that points the public hostname at the tunnel,
+ * and the composed "is this domain on Cloudflare already" check.
+ *
+ * Transport rules the ticket pins down:
+ *
+ *   - Plain `fetch`, no third-party dependency; the token rides the
+ *     `Authorization: Bearer` header and is NEVER logged, echoed into an
+ *     error, or written into any returned structure.
+ *   - Every failure is a typed {@link CloudflareError} whose `code` the UI
+ *     classifies on (`cf-auth-failed`, `cf-zone-not-found`,
+ *     `cf-tunnel-conflict`, `cf-dns-conflict`, `cf-network`, and the
+ *     catch-all `cf-api`). Raw response bodies never pass through — the
+ *     message carries only the API's short error summary, truncated,
+ *     which is what the design's 「兜底显示原始错误码」 wants.
+ *   - The client is stateless: a factory binds the token (plus injectable
+ *     `fetchImpl` / `baseUrl` for the mock-server tests); every method
+ *     takes the ids it needs. The module-level `cf*` wrappers are one-call
+ *     conveniences over the factory.
+ *
+ * Conflict classification matches the well-known numeric codes where they
+ * exist and falls back to the API's error text (`already exists`
+ * wordings), so an upstream renumber degrades to the generic envelope
+ * instead of a wrong verdict.
+ */
+import { hostOf } from '../config.js';
+export const CLOUDFLARE_API_BASE = 'https://api.cloudflare.com/client/v4';
+/**
+ * One refused API call. Fields are assigned in the constructor body (the
+ * check scripts' strip-only type stripping rejects parameter properties).
+ */
+export class CloudflareError extends Error {
+    code;
+    status;
+    /** The API's own numeric error code(s), when the envelope carried any. */
+    apiCodes;
+    constructor(code, message, status = null, apiCodes = [], options) {
+        super(message, options);
+        this.name = 'CloudflareError';
+        this.code = code;
+        this.status = status;
+        this.apiCodes = apiCodes;
+    }
+}
+/** Tunnel name conflict: Cloudflare rejects duplicate names (documented
+ * code 10405; deployments also word it in the message text). The text
+ * fallback names its SUBJECT — "already exists" alone matches the DNS
+ * wording just as well, so the two classifiers must stay scoped. */
+function isTunnelConflict(apiCodes, text) {
+    return apiCodes.includes(10405) || (/tunnel/i.test(text) && /already exists/i.test(text));
+}
+/** DNS record conflict: the documented codes are 81053 / 81057. */
+function isDnsConflict(apiCodes, text) {
+    return apiCodes.includes(81053) || apiCodes.includes(81057) || (/record/i.test(text) && /already exists/i.test(text));
+}
+/** The API's error summary: message strings only, joined, truncated —
+ * never the raw body, never the request's token. */
+function summarize(errors, fallback) {
+    const codes = [];
+    const parts = [];
+    for (const entry of errors) {
+        if (entry !== null && typeof entry === 'object') {
+            const record = entry;
+            if (typeof record.code === 'number')
+                codes.push(record.code);
+            if (typeof record.message === 'string' && record.message !== '')
+                parts.push(record.message);
+        }
+    }
+    return { text: (parts.join('; ') || fallback).slice(0, 200), codes };
+}
+/** Tunnel names we mint: short, safe in a URL path. */
+const TUNNEL_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/;
+/** A `service:` URL inside a tunnel ingress: http(s) to host[:port]. */
+const SERVICE_URL_PATTERN = /^https?:\/\/[A-Za-z0-9.[\]:-]+$/;
+/** Path segments are ids we received from the API or names we minted —
+ * encoded anyway, so a hostile value cannot change the request shape. */
+const seg = (value) => encodeURIComponent(value);
+/** Page-size + page ceiling for the two list endpoints: 5 pages of 50 is
+ * 250 accounts/tunnels — far past anything a wizard user has, and the hard
+ * stop means a broken pagination answer can never loop forever. */
+const PAGE_SIZE = 50;
+const PAGE_LIMIT = 5;
+/**
+ * The ancestor chain of one hostname, itself first: `dsh.example.com` →
+ * `dsh.example.com`, `example.com`, `com`. Cloudflare zones are apex
+ * domains, so a wizard lookup for `dsh.example.com` must find the zone
+ * named `example.com` (GW-fix-2/H1) — exact-name matching walks this chain
+ * level by level.
+ */
+export function ancestorHosts(domain) {
+    const labels = domain.split('.');
+    const chain = [];
+    for (let index = 0; index < labels.length; index++)
+        chain.push(labels.slice(index).join('.'));
+    return chain;
+}
+export function createCloudflareApi(options) {
+    const baseUrl = options.baseUrl ?? CLOUDFLARE_API_BASE;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const token = options.token;
+    if (typeof token !== 'string' || token === '') {
+        throw new CloudflareError('cf-auth-failed', 'no Cloudflare API token');
+    }
+    /** One authenticated v4 call: Bearer header, envelope unwrapping, typed
+     * failures. The token never appears in any error path. Returns the
+     * result PLUS the pagination envelope (the list endpoints page). */
+    const call = async (method, path, body) => {
+        let response;
+        try {
+            response = await fetchImpl(`${baseUrl}${path}`, {
+                method,
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch (cause) {
+            throw new CloudflareError('cf-network', `the Cloudflare API call failed before an answer arrived (${path})`, null, [], { cause });
+        }
+        let envelope;
+        try {
+            envelope = await response.json();
+        }
+        catch {
+            throw new CloudflareError('cf-network', `the Cloudflare API answered unparsable JSON (${path})`, response.status);
+        }
+        const errors = Array.isArray(envelope?.errors) ? envelope.errors : [];
+        const summary = summarize(errors, `HTTP ${response.status}`);
+        if (response.status === 401 || response.status === 403) {
+            throw new CloudflareError('cf-auth-failed', summary.text, response.status, summary.codes);
+        }
+        if (envelope?.success !== true) {
+            let code = 'cf-api';
+            if (isTunnelConflict(summary.codes, summary.text))
+                code = 'cf-tunnel-conflict';
+            else if (isDnsConflict(summary.codes, summary.text))
+                code = 'cf-dns-conflict';
+            throw new CloudflareError(code, summary.text, response.status, summary.codes);
+        }
+        // A missing or junk total_pages reads as a single page — old mocks and
+        // tolerant callers keep working, pagination simply never continues.
+        const totalPages = typeof envelope.result_info?.total_pages === 'number' && envelope.result_info.total_pages >= 1
+            ? envelope.result_info.total_pages
+            : 1;
+        return { result: envelope.result, totalPages };
+    };
+    const requireString = (value, what) => {
+        if (typeof value !== 'string' || value === '')
+            throw new CloudflareError('cf-api', `the Cloudflare API answered without ${what}`);
+        return value;
+    };
+    const requireId = (value, what) => {
+        if (typeof value !== 'string' || value === '')
+            throw new CloudflareError('cf-api', `${what} is required`);
+        return value;
+    };
+    return {
+        async listAccounts() {
+            const accounts = [];
+            for (let page = 1; page <= PAGE_LIMIT; page++) {
+                const { result, totalPages } = await call('GET', `/accounts?per_page=${PAGE_SIZE}&page=${page}`);
+                if (!Array.isArray(result))
+                    throw new CloudflareError('cf-api', 'the accounts answer had no list');
+                accounts.push(...result.map((account) => requireString(account?.id, 'an account id')));
+                if (page >= totalPages || result.length === 0)
+                    break;
+            }
+            return accounts;
+        },
+        async getZone(accountId, domain) {
+            const host = hostOf(domain);
+            if (host === undefined)
+                throw new CloudflareError('cf-api', 'the domain is not a bare hostname');
+            const id = requireId(accountId, 'the account id');
+            const { result } = await call('GET', `/zones?name=${seg(host)}&account.id=${seg(id)}`);
+            // Exact-match on the zone NAME client-side: the query filter is
+            // advisory, the verdict is ours.
+            const zones = Array.isArray(result) ? result : [];
+            const zone = zones.find((candidate) => candidate?.name === host);
+            if (zone === undefined)
+                throw new CloudflareError('cf-zone-not-found', `no Cloudflare zone named ${host}`);
+            return requireString(zone.id, 'a zone id');
+        },
+        async createTunnel(accountId, name) {
+            const id = requireId(accountId, 'the account id');
+            if (typeof name !== 'string' || !TUNNEL_NAME_PATTERN.test(name)) {
+                throw new CloudflareError('cf-api', 'the tunnel name is not a safe label');
+            }
+            // config_src cloudflare makes the create response carry the connector
+            // token directly — the second round-trip (GET .../token) is spared.
+            const { result } = await call('POST', `/accounts/${seg(id)}/cfd_tunnel`, { name, config_src: 'cloudflare' });
+            const record = result;
+            return { id: requireString(record?.id, 'a tunnel id'), token: requireString(record?.token, 'a tunnel token') };
+        },
+        async getTunnelToken(accountId, tunnelId) {
+            const id = requireId(accountId, 'the account id');
+            const tunnel = requireId(tunnelId, 'the tunnel id');
+            const { result } = await call('GET', `/accounts/${seg(id)}/cfd_tunnel/${seg(tunnel)}/token`);
+            const tokenValue = typeof result === 'string'
+                ? result
+                : result?.token;
+            return requireString(tokenValue, 'a tunnel token');
+        },
+        async listTunnels(accountId) {
+            const id = requireId(accountId, 'the account id');
+            const tunnels = [];
+            for (let page = 1; page <= PAGE_LIMIT; page++) {
+                const { result, totalPages } = await call('GET', `/accounts/${seg(id)}/cfd_tunnel?is_deleted=false&per_page=${PAGE_SIZE}&page=${page}`);
+                if (!Array.isArray(result))
+                    throw new CloudflareError('cf-api', 'the tunnels answer had no list');
+                tunnels.push(...result.map((tunnel) => {
+                    const record = tunnel;
+                    return {
+                        id: requireString(record?.id, 'a tunnel id'),
+                        name: typeof record?.name === 'string' ? record.name : '',
+                        status: typeof record?.status === 'string' ? record.status : '',
+                    };
+                }));
+                if (page >= totalPages || result.length === 0)
+                    break;
+            }
+            return tunnels;
+        },
+        async configureIngress(accountId, tunnelId, domain, serviceUrl) {
+            const accountIdSafe = requireId(accountId, 'the account id');
+            const tunnelIdSafe = requireId(tunnelId, 'the tunnel id');
+            const host = hostOf(domain);
+            if (host === undefined)
+                throw new CloudflareError('cf-api', 'the domain is not a bare hostname');
+            if (typeof serviceUrl !== 'string' || !SERVICE_URL_PATTERN.test(serviceUrl)) {
+                throw new CloudflareError('cf-api', 'the service URL is not a plain http(s) origin');
+            }
+            await call('PUT', `/accounts/${seg(accountIdSafe)}/cfd_tunnel/${seg(tunnelIdSafe)}/configurations`, {
+                config: {
+                    ingress: [
+                        { hostname: host, service: serviceUrl },
+                        { service: 'http_status:404' },
+                    ],
+                },
+            });
+        },
+        async listDnsRecords(zoneId, name) {
+            const zone = requireId(zoneId, 'the zone id');
+            const recordName = hostOf(name);
+            if (recordName === undefined)
+                throw new CloudflareError('cf-api', 'the record name is not a bare hostname');
+            const { result } = await call('GET', `/zones/${seg(zone)}/dns_records?type=CNAME&name=${seg(recordName)}&per_page=${50}&page=${1}`);
+            if (!Array.isArray(result))
+                throw new CloudflareError('cf-api', 'the DNS records answer had no list');
+            return result.map((record) => {
+                const entry = record;
+                return {
+                    id: requireString(entry?.id, 'a DNS record id'),
+                    name: typeof entry?.name === 'string' ? entry.name : '',
+                    content: typeof entry?.content === 'string' ? entry.content : '',
+                };
+            });
+        },
+        async createDnsRecord(zoneId, subdomain, target) {
+            const zone = requireId(zoneId, 'the zone id');
+            const name = hostOf(subdomain);
+            if (name === undefined)
+                throw new CloudflareError('cf-api', 'the record name is not a bare hostname');
+            if (typeof target !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}\.cfargotunnel\.com$/.test(target)) {
+                throw new CloudflareError('cf-api', 'the CNAME target is not a tunnel hostname');
+            }
+            const { result } = await call('POST', `/zones/${seg(zone)}/dns_records`, {
+                type: 'CNAME',
+                name,
+                content: target,
+                proxied: true,
+                ttl: 1,
+            });
+            return requireString(result?.id, 'a DNS record id');
+        },
+        async checkDomainOnCloudflare(domain) {
+            const host = hostOf(domain);
+            if (host === undefined)
+                throw new CloudflareError('cf-api', 'the domain is not a bare hostname');
+            // Zones are APEX domains: the user's `dsh.example.com` lives in the
+            // zone named `example.com`, so the exact-name lookup walks the
+            // ancestor chain (GW-fix-2/H1). First hit wins.
+            const chain = ancestorHosts(host);
+            for (const accountId of await this.listAccounts()) {
+                for (const candidate of chain) {
+                    try {
+                        const zoneId = await this.getZone(accountId, candidate);
+                        return { onCloudflare: true, zoneId, accountId };
+                    }
+                    catch (error) {
+                        if (error instanceof CloudflareError && error.code === 'cf-zone-not-found')
+                            continue;
+                        throw error;
+                    }
+                }
+            }
+            return { onCloudflare: false, zoneId: null, accountId: null };
+        },
+    };
+}
+export function cfListAccounts(token, opts) {
+    return createCloudflareApi({ token, ...opts }).listAccounts();
+}
+export function cfGetZone(token, accountId, domain, opts) {
+    return createCloudflareApi({ token, ...opts }).getZone(accountId, domain);
+}
+export function cfCreateTunnel(token, accountId, name, opts) {
+    return createCloudflareApi({ token, ...opts }).createTunnel(accountId, name);
+}
+export function cfListTunnels(token, accountId, opts) {
+    return createCloudflareApi({ token, ...opts }).listTunnels(accountId);
+}
+export function cfGetTunnelToken(token, accountId, tunnelId, opts) {
+    return createCloudflareApi({ token, ...opts }).getTunnelToken(accountId, tunnelId);
+}
+export function cfConfigureIngress(token, accountId, tunnelId, domain, serviceUrl, opts) {
+    return createCloudflareApi({ token, ...opts }).configureIngress(accountId, tunnelId, domain, serviceUrl);
+}
+export function cfCreateDnsRecord(token, zoneId, subdomain, target, opts) {
+    return createCloudflareApi({ token, ...opts }).createDnsRecord(zoneId, subdomain, target);
+}
+export function cfListDnsRecords(token, zoneId, name, opts) {
+    return createCloudflareApi({ token, ...opts }).listDnsRecords(zoneId, name);
+}
+export function cfCheckDomainOnCloudflare(token, domain, opts) {
+    return createCloudflareApi({ token, ...opts }).checkDomainOnCloudflare(domain);
+}
+//# sourceMappingURL=cloudflare.js.map

package/lib/wizard/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/wizard/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAA;AAUzE;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAqB;IACzB,MAAM,CAAe;IAC9B,0EAA0E;IACjE,QAAQ,CAAmB;IAEpC,YAAY,IAAyB,EAAE,OAAe,EAAE,SAAwB,IAAI,EAAE,WAA8B,EAAE,EAAE,OAA6B;QACnJ,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED;;;oEAGoE;AACpE,SAAS,gBAAgB,CAAC,QAA2B,EAAE,IAAY;IACjE,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,QAA2B,EAAE,IAAY;IAC9D,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACvH,CAAC;AAED;oDACoD;AACpD,SAAS,SAAS,CAAC,MAA0B,EAAE,QAAgB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,KAA8C,CAAA;YAC7D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC5D,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAA;AACtE,CAAC;AAkDD,uDAAuD;AACvD,MAAM,mBAAmB,GAAG,iCAAiC,CAAA;AAE7D,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,iCAAiC,CAAA;AAE7D;yEACyE;AACzE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;AAEhE;;mEAEmE;AACnE,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,UAAU,GAAG,CAAC,CAAA;AAEpB;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7F,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAA;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAE3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAA;IACxE,CAAC;IAED;;wEAEoE;IACpE,MAAM,IAAI,GAAG,KAAK,EAAE,MAA8B,EAAE,IAAY,EAAE,IAAc,EAAoD,EAAE;QACpI,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC9C,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;iBACtE;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,4DAA4D,IAAI,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACnI,CAAC;QACD,IAAI,QAA4G,CAAA;QAChH,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,gDAAgD,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QACnH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QACrE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,IAAI,GAAwB,QAAQ,CAAA;YACxC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC;gBAAE,IAAI,GAAG,oBAAoB,CAAA;iBACzE,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC;gBAAE,IAAI,GAAG,iBAAiB,CAAA;YAC7E,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/E,CAAC;QACD,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,WAAW,EAAE,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,WAAW,IAAI,CAAC;YAC/G,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW;YAClC,CAAC,CAAC,CAAC,CAAA;QACL,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,CAAA;IAChD,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,IAAY,EAAU,EAAE;QAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,uCAAuC,IAAI,EAAE,CAAC,CAAA;QACjI,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,IAAY,EAAU,EAAE;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,cAAc,CAAC,CAAA;QACzG,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,MAAM,QAAQ,GAAa,EAAE,CAAA;YAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,sBAAsB,SAAS,SAAS,IAAI,EAAE,CAAC,CAAA;gBAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAA;gBAClG,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAE,OAA4B,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,CAAA;gBAC5G,IAAI,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAK;YACtD,CAAC;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAA;YAChG,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YACtF,gEAAgE;YAChE,iCAAiC;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAsD,CAAC,CAAC,CAAC,EAAE,CAAA;YAClG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,KAAK,IAAI,CAAC,CAAA;YAChE,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,4BAA4B,IAAI,EAAE,CAAC,CAAA;YAC1G,OAAO,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI;YAChC,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,qCAAqC,CAAC,CAAA;YAC5E,CAAC;YACD,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAA;YAC5G,MAAM,MAAM,GAAG,MAA2C,CAAA;YAC1D,OAAO,EAAE,EAAE,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAA;QAChH,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ;YACtC,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;YACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5F,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ;gBAC3C,CAAC,CAAC,MAAM;gBACR,CAAC,CAAE,MAA8B,EAAE,KAAK,CAAA;YAC1C,OAAO,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;QACpD,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,SAAS;YACzB,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YACjD,MAAM,OAAO,GAA8B,EAAE,CAAA;YAC7C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,CAAC,EAAE,CAAC,yCAAyC,SAAS,SAAS,IAAI,EAAE,CAAC,CAAA;gBACvI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAA;gBACjG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;oBACpC,MAAM,MAAM,GAAG,MAA4D,CAAA;oBAC3E,OAAO;wBACL,EAAE,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,CAAC;wBAC5C,IAAI,EAAE,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;wBACzD,MAAM,EAAE,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;qBAChE,CAAA;gBACH,CAAC,CAAC,CAAC,CAAA;gBACH,IAAI,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAK;YACtD,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;YAC5D,MAAM,aAAa,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;YAC5D,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;YACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAA;YAChG,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAA;YACtF,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,CAAC,aAAa,CAAC,eAAe,GAAG,CAAC,YAAY,CAAC,iBAAiB,EAAE;gBAClG,MAAM,EAAE;oBACN,OAAO,EAAE;wBACP,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE;wBACvC,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBAC/B;iBACF;aACF,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YAC/B,IAAI,UAAU,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;YAC3G,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;YACnI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,oCAAoC,CAAC,CAAA;YACrG,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC3B,MAAM,KAAK,GAAG,MAA6D,CAAA;gBAC3E,OAAO;oBACL,EAAE,EAAE,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,iBAAiB,CAAC;oBAC/C,IAAI,EAAE,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;oBACvD,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;iBACjE,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM;YAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;YACrG,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrG,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,2CAA2C,CAAC,CAAA;YAClF,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE;gBACvE,IAAI,EAAE,OAAO;gBACb,IAAI;gBACJ,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE,CAAC;aACP,CAAC,CAAA;YACF,OAAO,aAAa,CAAE,MAA2B,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAA;QAC3E,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,MAAM;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAA;YAChG,oEAAoE;YACpE,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;YACjC,KAAK,MAAM,SAAS,IAAI,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBAClD,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;wBACvD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;oBAClD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB;4BAAE,SAAQ;wBACpF,MAAM,KAAK,CAAA;oBACb,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAC/D,CAAC;KACF,CAAA;AACH,CAAC;AAMD,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAoB;IAChE,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,SAAiB,EAAE,MAAc,EAAE,IAAoB;IAC9F,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAY,EAAE,IAAoB;IACjG,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAoB;IAClF,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,SAAiB,EAAE,QAAgB,EAAE,IAAoB;IACvG,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,MAAc,EACd,UAAkB,EAClB,IAAoB;IAEpB,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAC1G,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAc,EAAE,SAAiB,EAAE,MAAc,EAAE,IAAoB;IACtH,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;AAC3F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY,EAAE,IAAoB;IAChG,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc,EAAE,IAAoB;IAC3F,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAA;AAChF,CAAC"}

package/lib/wizard/cloudflared.js

@@ -0,0 +1,158 @@
+/**
+ * cloudflared process lifecycle (GW-7, 路 C's last mile). The tunnel's
+ * connector runs in the foreground (`tunnel run`) as a child of the DSH
+ * host, managed through the same subprocess service as the gateway child
+ * and the managed Caddy.
+ *
+ * The connector secret NEVER touches argv (visible to every process on
+ * the machine via ps) and is never an environment variable either — it is
+ * written to `<DSH_HOME>/zen-remote-ingress/tunnel-token`, mode 0600,
+ * through a temp-file-then-rename so a crash mid-write can never leave a
+ * half token at the real path, and handed to cloudflared with
+ * `--token-file`.
+ *
+ * Idempotency and cleanup mirror caddy-process.ts: a live child refuses a
+ * second start (stop first to switch tunnels), stop is idempotent, and an
+ * exited child clears its own slot. The host wiring hands stop to
+ * ctx.effect so the row's disposal kills cloudflared too.
+ */
+import { mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ensureBinary, BinaryDownloadError } from './binary-io.js';
+import { ingressDir } from './binary.js';
+/** Where the connector secret lives (design.md: 不进 Config 的字段). */
+export function tunnelTokenPath(dshHome) {
+    return join(ingressDir(dshHome), 'tunnel-token');
+}
+/** Whether a non-empty tunnel-token file exists (the projection's boolean
+ * only — GW-fix-4/M1: the manager's EXISTENCE says nothing about whether a
+ * token has been stored). */
+export function tunnelTokenConfigured(dshHome) {
+    try {
+        return statSync(tunnelTokenPath(dshHome)).isFile() && readFileSync(tunnelTokenPath(dshHome), 'utf8').trim() !== '';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Persist the tunnel connector secret: 0600, atomic (write the `.part`
+ * sibling, then rename over the real path).
+ */
+export function writeTunnelTokenFile(dshHome, token) {
+    const finalPath = tunnelTokenPath(dshHome);
+    const partPath = `${finalPath}.part`;
+    try {
+        mkdirSync(ingressDir(dshHome), { recursive: true });
+        writeFileSync(partPath, token, { mode: 0o600 });
+        try {
+            renameSync(partPath, finalPath);
+        }
+        catch {
+            writeFileSync(finalPath, token, { mode: 0o600 });
+            rmSync(partPath, { force: true });
+        }
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        throw error;
+    }
+    return finalPath;
+}
+export function createCloudflaredManager(options) {
+    const { subprocess, dshHome } = options;
+    const maxLogBytes = options.maxLogBytes ?? 64 * 1024;
+    let handle = null;
+    let startedOnce = false;
+    // GW-fix-2/L3: whitelist env — the host process carries the relay secret
+    // and DSH's own credentials, and cloudflared needs none of them (its
+    // connector secret comes through the 0600 token file). Include Windows
+    // system/profile variables so Go's TLS root-cert store and winsock
+    // initialize cleanly on Windows.
+    const childEnv = () => {
+        const env = {};
+        for (const key of [
+            'PATH', 'HOME', 'TMPDIR', 'LANG', 'TZ',
+            'SystemRoot', 'SYSTEMROOT', 'windir', 'WINDIR',
+            'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PROGRAMDATA', 'TEMP', 'TMP',
+        ]) {
+            if (process.env[key] !== undefined)
+                env[key] = process.env[key];
+        }
+        return env;
+    };
+    const spawnChild = (argv) => subprocess.spawn({
+        argv,
+        cwd: dshHome,
+        // GW-fix-2/L3: whitelist env — the token rides the 0600 file, so the
+        // child needs nothing from the host's environment beyond the basics.
+        env: childEnv(),
+        stdio: {
+            stdin: 'ignore',
+            stdout: { maxBytes: maxLogBytes },
+            stderr: { maxBytes: maxLogBytes },
+        },
+        graceMs: 3000,
+    });
+    const clearSlot = (child) => {
+        if (handle === child)
+            handle = null;
+    };
+    return {
+        async start(input) {
+            if (handle !== null)
+                return { ok: false, error: 'already-running' };
+            const tunnelToken = typeof input.tunnelToken === 'string' && input.tunnelToken.trim() !== '' ? input.tunnelToken : undefined;
+            if (tunnelToken === undefined)
+                return { ok: false, error: 'missing-token' };
+            let binaryPath;
+            try {
+                binaryPath = (await ensureBinary(dshHome, 'cloudflared', {
+                    fetchImpl: options.fetchImpl,
+                    platform: options.platform,
+                    onProgress: options.onProgress,
+                })).path;
+            }
+            catch (error) {
+                if (error instanceof BinaryDownloadError) {
+                    return { ok: false, error: 'download-failed', detail: error.message, installUrl: error.installUrl };
+                }
+                return { ok: false, error: 'download-failed', detail: String(error?.message ?? error) };
+            }
+            let tokenFile;
+            try {
+                tokenFile = writeTunnelTokenFile(dshHome, tunnelToken);
+            }
+            catch (error) {
+                return { ok: false, error: 'spawn-failed', detail: String(error?.message ?? error) };
+            }
+            try {
+                const child = spawnChild([binaryPath, 'tunnel', 'run', '--token-file', tokenFile]);
+                handle = child;
+                startedOnce = true;
+                void child.done.then(() => clearSlot(child)).catch(() => clearSlot(child));
+                return { ok: true, binaryPath, tokenFile, alreadyRunning: false };
+            }
+            catch (error) {
+                handle = null;
+                return { ok: false, error: 'spawn-failed', detail: String(error?.message ?? error) };
+            }
+        },
+        stop() {
+            if (handle === null)
+                return;
+            const child = handle;
+            handle = null;
+            try {
+                void child.terminate();
+            }
+            catch {
+                // A dead child's terminate is a no-op or a throw — either way done.
+            }
+        },
+        isRunning: () => handle !== null,
+        /** Whether any start has succeeded in this manager's lifetime. */
+        hasStarted: () => startedOnce,
+    };
+}
+//# sourceMappingURL=cloudflared.js.map

package/lib/wizard/cloudflared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared.js","sourceRoot":"","sources":["../../src/wizard/cloudflared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC9F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAyB,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,UAAU,EAAuB,MAAM,aAAa,CAAA;AAG7D,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAA;AAClD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IACpH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAa;IACjE,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAA;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/C,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAChD,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAqCD,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,CAAA;IACpD,IAAI,MAAM,GAAgC,IAAI,CAAA;IAC9C,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,iCAAiC;IACjC,MAAM,QAAQ,GAAG,GAAsB,EAAE;QACvC,MAAM,GAAG,GAAsB,EAAE,CAAA;QACjC,KAAK,MAAM,GAAG,IAAI;YAChB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;YACtC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ;YAC9C,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK;SACvE,EAAE,CAAC;YACF,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,IAAc,EAAwB,EAAE,CAC1D,UAAU,CAAC,KAAK,CAAC;QACf,IAAI;QACJ,GAAG,EAAE,OAAO;QACZ,qEAAqE;QACrE,qEAAqE;QACrE,GAAG,EAAE,QAAQ,EAAE;QACf,KAAK,EAAE;YACL,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;YACjC,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAClC;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IAEJ,MAAM,SAAS,GAAG,CAAC,KAA2B,EAAQ,EAAE;QACtD,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM,GAAG,IAAI,CAAA;IACrC,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;YACnE,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5H,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YAE3E,IAAI,UAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE;oBACvD,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC,CAAC,IAAI,CAAA;YACV,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;oBACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;gBACrG,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACpG,CAAC;YAED,IAAI,SAAiB,CAAA;YACrB,IAAI,CAAC;gBACH,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACjG,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAA;gBAClF,MAAM,GAAG,KAAK,CAAA;gBACd,WAAW,GAAG,IAAI,CAAA;gBAClB,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;YACnE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAA;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACjG,CAAC;QACH,CAAC;QAED,IAAI;YACF,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAM;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAA;YACpB,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,CAAC;gBACH,KAAK,KAAK,CAAC,SAAS,EAAE,CAAA;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI;QAChC,kEAAkE;QAClE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW;KAC9B,CAAA;AACH,CAAC"}

package/lib/wizard/probe.js

@@ -0,0 +1,118 @@
+/**
+ * hostPath probe (GW-8): the server machine walks its OWN public URL and
+ * classifies what answers, so the wizard can say something sharper than
+ * "it didn't work" — the pairing page showing up means TLS + proxying to
+ * the gateway both work; the admin surface answering 200 means the proxy
+ * is DROPPING the forwarded headers the gateway trusts; a redirect smells
+ * like Cloudflare Access or a proxy rewriting to a login page.
+ *
+ * Split exactly as the ticket asks: the two `classify*Response` functions
+ * are pure (the check scripts can drive them), `probeHostPath` owns the
+ * fetch I/O — `redirect: 'manual'` so a proxy's 3xx is SEEN, never
+ * followed — with the URL admission reusing client-pairing's
+ * `normalizeServerUrl` (https anywhere; plain http only for the explicit
+ * private-network allowances) and a 10 s ceiling per request.
+ */
+import { normalizeServerUrl } from '../client-pairing.js';
+/**
+ * `GET /`: the ONE right answer is the gateway's pairing page — 401,
+ * text/html, carrying the claim-endpoint marker the page's own script
+ * posts to. A 200 means the URL belongs to something else entirely.
+ */
+export function classifyRootResponse(status, contentType, body) {
+    if (status === 401) {
+        if (contentType.includes('text/html') && body.includes('/lan-gate/pair/claim'))
+            return 'gateway-pairing-page';
+        return 'unexpected-401';
+    }
+    if (status >= 200 && status < 300)
+        return 'unexpected-200';
+    if (status >= 300 && status < 400)
+        return 'redirect';
+    return 'unexpected';
+}
+/**
+ * `GET /lan-gate/admin`: right is the gateway's own 403 JSON — a public
+ * visitor must not get in. 200 + HTML is the DANGEROUS shape: something
+ * answered with a page, meaning the proxy forwarded without the
+ * forwarded headers and the gateway's local-only wall never saw a
+ * proxied request (the admin page leaked). 403 + HTML smells like
+ * Cloudflare Access interposing its own login.
+ */
+export function classifyAdminResponse(status, contentType, body) {
+    const isHtml = contentType.includes('text/html');
+    if (status === 403) {
+        if (isHtml)
+            return 'proxy-403';
+        if (contentType.includes('application/json')) {
+            try {
+                const parsed = JSON.parse(body);
+                if (parsed !== null && typeof parsed === 'object' && parsed.ok === false) {
+                    return 'gateway-admin-403';
+                }
+            }
+            catch {
+                // JSON-shaped header with a non-JSON body: not our gateway's answer.
+            }
+        }
+        return 'unexpected';
+    }
+    if (status >= 200 && status < 300 && isHtml)
+        return 'admin-exposed';
+    return 'unexpected';
+}
+/** One manual-redirect GET, classified. Sends a browser-shaped `Accept:
+ * text/html` (never `application/json`, which tells `lan-gate-server.cjs`
+ * the caller is an XHR/API client and makes `GET /` answer 401 JSON
+ * `{"ok":false,"reason":"unpaired"}` instead of the HTML pairing page;
+ * `/lan-gate/admin` answers 403 JSON regardless of `Accept`). */
+async function probeOnce(fetchImpl, url, timeoutMs) {
+    const response = await fetchImpl(url, {
+        redirect: 'manual',
+        signal: AbortSignal.timeout(timeoutMs),
+        headers: { Accept: 'text/html' },
+    });
+    const body = await response.text();
+    return { status: response.status, contentType: String(response.headers.get('content-type') ?? ''), body };
+}
+/**
+ * Probe the machine's public URL from here: both the root path and the
+ * admin surface, never following a redirect. The two requests run
+ * concurrently; the answer carries both classifications and the elapsed
+ * time. Every failure mode is a VALUE (`kind: 'unreachable'`), never a
+ * throw — the wizard routes render whichever verdict arrived.
+ */
+export async function probeHostPath(publicUrl, options = {}) {
+    const started = (options.now ?? Date.now)();
+    const elapsed = () => (options.now ?? Date.now)() - started;
+    // Same admission the client pairing uses: https anywhere, plain http
+    // only into the explicit private-network allowances.
+    const normalized = normalizeServerUrl(typeof publicUrl === 'string' ? publicUrl : '');
+    if (!normalized.ok) {
+        return { kind: 'unreachable', reason: normalized.reason === 'insecure-http' ? 'insecure-http' : 'invalid-url', ms: 0 };
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    try {
+        const [root, admin] = await Promise.all([
+            probeOnce(fetchImpl, `${normalized.url}/`, timeoutMs),
+            probeOnce(fetchImpl, `${normalized.url}/lan-gate/admin`, timeoutMs),
+        ]);
+        return {
+            kind: 'reached',
+            root: classifyRootResponse(root.status, root.contentType, root.body),
+            admin: classifyAdminResponse(admin.status, admin.contentType, admin.body),
+            ms: elapsed(),
+        };
+    }
+    catch (error) {
+        const name = error?.name;
+        return {
+            kind: 'unreachable',
+            reason: name === 'TimeoutError' || name === 'AbortError' ? 'timeout' : 'network',
+            detail: String(error?.message ?? error),
+            ms: elapsed(),
+        };
+    }
+}
+//# sourceMappingURL=probe.js.map

package/lib/wizard/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/wizard/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAiBzD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAY;IACpF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO,sBAAsB,CAAA;QAC7G,OAAO,gBAAgB,CAAA;IACzB,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAA;IAC1D,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,UAAU,CAAA;IACpD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAY;IACrF,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAChD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,MAAM;YAAE,OAAO,WAAW,CAAA;QAC9B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAK,MAA2B,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;oBAC/F,OAAO,mBAAmB,CAAA;gBAC5B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM;QAAE,OAAO,eAAe,CAAA;IACnE,OAAO,YAAY,CAAA;AACrB,CAAC;AA6BD;;;;iEAIiE;AACjE,KAAK,UAAU,SAAS,CACtB,SAAuB,EACvB,GAAW,EACX,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACpC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;KACjC,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;AAC3G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAkB,EAAE,UAAwB,EAAE;IAChF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,CAAA;IAC3D,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACrF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,CAAA;IACxH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAA;IAC7C,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtC,SAAS,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,GAAG,EAAE,SAAS,CAAC;YACrD,SAAS,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,iBAAiB,EAAE,SAAS,CAAC;SACpE,CAAC,CAAA;QACF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;YACpE,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC;YACzE,EAAE,EAAE,OAAO,EAAE;SACd,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAAe,EAAE,IAAI,CAAA;QACnC,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAChF,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC;YAClD,EAAE,EAAE,OAAO,EAAE;SACd,CAAA;IACH,CAAC;AACH,CAAC"}