dsh-zen-remote 2.2.9 → 2.3.2

package/lib/wizard/proxy-snippets.js

@@ -0,0 +1,112 @@
+/**
+ * Reverse-proxy configuration snippets (GW-5, 路 B) — for the user who
+ * ALREADY runs their own proxy, the wizard hands out copy-paste material
+ * instead of managing a process. Everything here is pure text generation:
+ * every interpolated value passes a charset gate (the domain through
+ * config.ts's `hostOf`, the upstream host likewise, the port in [1,
+ * 65535]), so a hostile form value cannot smuggle a directive into
+ * anyone's nginx.
+ *
+ * The upstream port is the gateway's ACTUAL port — the caller reads it
+ * from the running gateway (it may have retried past the configured one),
+ * never from config.
+ */
+import { hostOf } from '../config.js';
+/** Integers in [1, 65535] only. */
+function portOf(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= 65535 ? value : undefined;
+}
+function validatedParts(input) {
+    const domain = hostOf(input.domain);
+    if (domain === undefined)
+        return { error: { ok: false, error: 'bad-domain' } };
+    const upstream = hostOf(input.upstreamHost);
+    if (upstream === undefined)
+        return { error: { ok: false, error: 'bad-upstream-host' } };
+    const port = portOf(input.upstreamPort);
+    if (port === undefined)
+        return { error: { ok: false, error: 'bad-upstream-port' } };
+    return { domain, upstream, port };
+}
+/**
+ * nginx: a complete server block. The WebSocket upgrade map sits outside
+ * the server (http-level context) — the snippet says so in a comment, the
+ * user pastes it into the http/server scope their setup offers. Long
+ * idle tunnels need the 3600s read/send timeouts, uploads the 128m
+ * client body cap, and streaming the buffering switch — all three are
+ * the shapes DSH's relay traffic actually needs.
+ */
+export function nginxSnippet(input) {
+    const parts = validatedParts(input);
+    if ('error' in parts)
+        return parts.error;
+    const { domain, upstream, port } = parts;
+    const text = [
+        '# 这段放在 http {} 层（若已有同名 map 则跳过）',
+        'map $http_upgrade $connection_upgrade {',
+        '    default upgrade;',
+        "    ''      close;",
+        '}',
+        '',
+        'server {',
+        '    listen 443 ssl;',
+        `    server_name ${domain};`,
+        '',
+        '    location / {',
+        `        proxy_pass http://${upstream}:${port};`,
+        '        proxy_http_version 1.1;',
+        '        proxy_set_header Upgrade $http_upgrade;',
+        '        proxy_set_header Connection $connection_upgrade;',
+        '        proxy_set_header Host $host;',
+        '        proxy_set_header X-Real-IP $remote_addr;',
+        '        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;',
+        '        proxy_set_header X-Forwarded-Proto $scheme;',
+        '        proxy_buffering off;',
+        '        client_max_body_size 128m;',
+        '        proxy_read_timeout 3600s;',
+        '        proxy_send_timeout 3600s;',
+        '    }',
+        '}',
+        '',
+    ].join('\n');
+    return { ok: true, text };
+}
+/**
+ * Caddy (user-operated, not the wizard-managed one): the site block is
+ * one `reverse_proxy` line — Caddy routes the rest itself.
+ */
+export function caddySnippet(input) {
+    const parts = validatedParts(input);
+    if ('error' in parts)
+        return parts.error;
+    const { domain, upstream, port } = parts;
+    const text = [
+        `${domain} {`,
+        `    reverse_proxy ${upstream}:${port}`,
+        '}',
+        '',
+    ].join('\n');
+    return { ok: true, text };
+}
+/**
+ * Lucky (Web 服务反代) three steps: listen 443, proxy to the upstream,
+ * flip the catch-all switch. Text only — Lucky has no config file format
+ * to generate.
+ */
+export function luckySteps(input) {
+    const upstream = hostOf(input.upstreamHost);
+    if (upstream === undefined)
+        return { ok: false, error: 'bad-upstream-host' };
+    const port = portOf(input.upstreamPort);
+    if (port === undefined)
+        return { ok: false, error: 'bad-upstream-port' };
+    return {
+        ok: true,
+        steps: [
+            '在 Lucky 的「Web 服务」里新建一条规则，监听 443 端口，绑定你的域名。',
+            `后端（反代目标）填 http://${upstream}:${port}，开启 WebSocket 支持。`,
+            '打开「万事大吉」开关（放行全部路径），保存即可生效。',
+        ],
+    };
+}
+//# sourceMappingURL=proxy-snippets.js.map

package/lib/wizard/proxy-snippets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-snippets.js","sourceRoot":"","sources":["../../src/wizard/proxy-snippets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAgBrC,mCAAmC;AACnC,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACjH,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAA;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAA;IACvF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACvC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAA;IACnF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAA;IACxC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACxC,MAAM,IAAI,GAAG;QACX,iCAAiC;QACjC,yCAAyC;QACzC,sBAAsB;QACtB,oBAAoB;QACpB,GAAG;QACH,EAAE;QACF,UAAU;QACV,qBAAqB;QACrB,mBAAmB,MAAM,GAAG;QAC5B,EAAE;QACF,kBAAkB;QAClB,6BAA6B,QAAQ,IAAI,IAAI,GAAG;QAChD,iCAAiC;QACjC,iDAAiD;QACjD,0DAA0D;QAC1D,sCAAsC;QACtC,kDAAkD;QAClD,sEAAsE;QACtE,qDAAqD;QACrD,8BAA8B;QAC9B,oCAAoC;QACpC,mCAAmC;QACnC,mCAAmC;QACnC,OAAO;QACP,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAA;IACxC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACxC,MAAM,IAAI,GAAG;QACX,GAAG,MAAM,IAAI;QACb,qBAAqB,QAAQ,IAAI,IAAI,EAAE;QACvC,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC3B,CAAC;AAMD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAuD;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACvC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACxE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,4CAA4C;YAC5C,oBAAoB,QAAQ,IAAI,IAAI,mBAAmB;YACvD,4BAA4B;SAC7B;KACF,CAAA;AACH,CAAC"}

package/lib/wizard/routes.js

@@ -0,0 +1,462 @@
+/**
+ * Wizard route skeleton (GW-4, extended by GW-5): every
+ * `/_dsh/zen-remote/admin/wizard/*` route the gateway wizard serves, with
+ * the security walls applied to ALL of them, in this order:
+ *
+ *   1. `connection.admit` — webServer-registered routes skip DSH's `/api`
+ *      authentication, so each request asks the connection service first;
+ *      its rejection is relayed verbatim (401/403).
+ *   2. The gateway marker. A request wearing `x-zen-remote-via` came
+ *      THROUGH the gateway from a remote device. Unlike the admin status
+ *      route there is no read-only exception: the wizard is a server-owner
+ *      surface, and a remote device gets a flat 403 `via-gateway` — GET
+ *      included. The marker wall runs BEFORE same-origin because a
+ *      forwarded request presents as same-origin (the gateway rewrites
+ *      Origin/Host onto the upstream origin); the marker is the only thing
+ *      identifying it.
+ *   3. `sameOriginPost` for every POST.
+ *
+ * Real routes: `GET /wizard/status` (the sanitized projection from
+ * status.ts — reads only, never mutates) and, since GW-5, `POST
+ * /wizard/trust-proxy` (merge one detected proxy IP into the persisted
+ * `trustedProxies` list). Every other POST under the prefix is a 501
+ * placeholder; later tasks fill those in. GET /status answers from a
+ * per-request config resolution and the injected runtime probe; a throwing
+ * runtime probe degrades to "nothing configured" instead of failing the
+ * read.
+ *
+ * The handler is built by a factory so the tests drive it over a real
+ * socket with mock admit/config (same seam as the admin routes).
+ */
+import { responseJson, sameOriginPost } from '../http.js';
+import { hostOf } from '../config.js';
+import { normalizeTrustedIp, mergeProxyList, parseProxyList } from './source-detect.js';
+import { projectWizardStatus } from './status.js';
+/** Prefix all wizard routes live under (one webServer prefix registration;
+ * the host web server matches longest-prefix-first, so these win over the
+ * plain admin prefix registration). */
+export const WIZARD_ROUTE_PREFIX = '/_dsh/zen-remote/admin/wizard';
+/** GET: the sanitized wizard status projection. */
+export const WIZARD_STATUS_ROUTE = `${WIZARD_ROUTE_PREFIX}/status`;
+/** POST `{ip}`: merge one detected reverse-proxy IP into the persisted
+ * trustedProxies (GW-5). */
+export const WIZARD_TRUST_PROXY_ROUTE = `${WIZARD_ROUTE_PREFIX}/trust-proxy`;
+/** POST `{publicUrl}`: start the final verification — mint the web pairing
+ * code (GW-9). GET: poll its status. */
+export const WIZARD_VERIFY_ROUTE = `${WIZARD_ROUTE_PREFIX}/verify`;
+/** POST `{token}`: store the Cloudflare API token 0600 on this machine;
+ * DELETE: stop the consumers and remove it (GW-13a). */
+export const WIZARD_CF_TOKEN_ROUTE = `${WIZARD_ROUTE_PREFIX}/cf-token`;
+/** POST `{token}`: store the cloudflared connector token (GW-13a). */
+export const WIZARD_TUNNEL_TOKEN_ROUTE = `${WIZARD_ROUTE_PREFIX}/tunnel-token`;
+/** POST: start the managed Caddy from the saved row config; POST (stop)
+ * terminates it; GET answers its three-state (GW-13a). */
+export const WIZARD_CADDY_START_ROUTE = `${WIZARD_ROUTE_PREFIX}/caddy/start`;
+export const WIZARD_CADDY_STOP_ROUTE = `${WIZARD_ROUTE_PREFIX}/caddy/stop`;
+export const WIZARD_CADDY_STATUS_ROUTE = `${WIZARD_ROUTE_PREFIX}/caddy/status`;
+/** POST `{domain}`: the zone/account probe the migration card re-checks;
+ * POST `{domain, tunnelId?}`: the full tunnel setup; POST (stop) and GET
+ * (three-state) mirror the Caddy pair (GW-13b). */
+export const WIZARD_TUNNEL_CHECK_ROUTE = `${WIZARD_ROUTE_PREFIX}/tunnel/check-domain`;
+export const WIZARD_TUNNEL_SETUP_ROUTE = `${WIZARD_ROUTE_PREFIX}/tunnel/setup`;
+export const WIZARD_TUNNEL_STOP_ROUTE = `${WIZARD_ROUTE_PREFIX}/tunnel/stop`;
+export const WIZARD_TUNNEL_STATUS_ROUTE = `${WIZARD_ROUTE_PREFIX}/tunnel/status`;
+/** Inbound body cap — the wizard forms send a few hundred bytes. */
+const MAX_BODY_BYTES = 16 * 1024;
+/**
+ * Read the whole body under the cap and demand one JSON object. An empty
+ * body counts as `{}`. Answers null for anything malformed — the route
+ * maps that to 400.
+ */
+async function readJsonObject(req) {
+    const declared = req.headers['content-length'];
+    const expected = declared === undefined ? undefined : Number(declared);
+    if (expected !== undefined && Number.isSafeInteger(expected) && expected > MAX_BODY_BYTES)
+        return null;
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += bytes.length;
+        if (size > MAX_BODY_BYTES)
+            return null;
+        chunks.push(bytes);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    if (text.trim() === '')
+        return {};
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the wizard route handler for one plugin row. The returned handler
+ * owns the full response lifecycle of every request under
+ * {@link WIZARD_ROUTE_PREFIX} and never throws.
+ */
+export function createWizardHandler(options) {
+    return async (req, res) => {
+        // EVERYTHING rides inside the one guard (GW-fix-1/L1): a malformed
+        // req.url explodes in `new URL`, and a broken connection service can
+        // throw out of admit — neither may escape as an unhandled rejection,
+        // the handler owns the full response lifecycle, always.
+        try {
+            // Wall 1 first: DSH's own admission.
+            const admission = options.admit(req);
+            if ('rejection' in admission) {
+                responseJson(res, admission.rejection, {
+                    ok: false,
+                    error: { code: admission.rejection === 401 ? 'unauthorized' : 'forbidden' },
+                });
+                return;
+            }
+            const url = new URL(req.url ?? '/', 'http://dsh.internal');
+            const route = url.pathname;
+            const method = req.method ?? 'GET';
+            // Wall 2, on EVERY wizard route before anything else: unlike
+            // admin/status there is no remote-readable exception — the wizard is
+            // a server-owner surface, GET included. This runs BEFORE same-origin
+            // because a forwarded request presents as same-origin (the gateway
+            // rewrites Origin/Host); the marker is the identifying signal.
+            if (req.headers['x-zen-remote-via'] !== undefined) {
+                responseJson(res, 403, {
+                    ok: false,
+                    error: { code: 'via-gateway', message: '配置引导只能在服务端本机操作' },
+                });
+                return;
+            }
+            if (route === WIZARD_STATUS_ROUTE && method === 'GET') {
+                let runtime = {};
+                try {
+                    runtime = (await options.getRuntime?.()) ?? {};
+                }
+                catch {
+                    // A broken runtime probe is "no information", never a failed read.
+                    runtime = {};
+                }
+                responseJson(res, 200, projectWizardStatus(options.getConfig().values, runtime));
+                return;
+            }
+            if (route === WIZARD_TRUST_PROXY_ROUTE && method === 'POST') {
+                if (!sameOriginPost(req)) {
+                    responseJson(res, 403, {
+                        ok: false,
+                        error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                    });
+                    return;
+                }
+                const trust = options.trustProxy;
+                // A wiring that predates GW-5 has no persister: same answer as the
+                // other unwired verbs.
+                if (trust === undefined) {
+                    responseJson(res, 501, { ok: false, error: { code: 'not-implemented', message: 'This wizard step is not wired up yet' } });
+                    return;
+                }
+                const body = await readJsonObject(req);
+                if (body === null) {
+                    responseJson(res, 400, { ok: false, error: { code: 'bad-request', message: 'request body must be a JSON object' } });
+                    return;
+                }
+                const ip = normalizeTrustedIp(body.ip);
+                if (ip === undefined) {
+                    responseJson(res, 400, { ok: false, error: { code: 'bad-ip', message: 'ip must be an IPv4 or IPv6 literal' } });
+                    return;
+                }
+                let resolved;
+                try {
+                    resolved = trust.resolved();
+                }
+                catch {
+                    resolved = { value: '', source: 'default' };
+                }
+                // env / row values SHADOW the file layer the persister writes: a
+                // write there would silently do nothing. Refuse honestly instead.
+                if (resolved.source === 'env' || resolved.source === 'row') {
+                    responseJson(res, 409, {
+                        ok: false,
+                        error: {
+                            code: 'proxy-list-shadowed',
+                            message: `trustedProxies 目前由${resolved.source === 'env' ? '环境变量' : '插件行配置'}提供，请先清掉那边的值再自动信任`,
+                        },
+                    });
+                    return;
+                }
+                if (parseProxyList(resolved.value).includes(ip)) {
+                    responseJson(res, 200, { ok: true, added: false });
+                    return;
+                }
+                const merged = mergeProxyList(resolved.value, ip);
+                // GW-fix-2/L2: the persister re-reads the persisted surface and
+                // refuses when it moved since `resolved()` — two 信任 clicks in
+                // quick succession must not lose either IP.
+                const landed = await trust.write(resolved.value, merged);
+                if (landed === false) {
+                    responseJson(res, 409, {
+                        ok: false,
+                        error: { code: 'trust-list-changed', message: '信任列表刚被其他操作修改，请刷新后重试' },
+                    });
+                    return;
+                }
+                responseJson(res, 200, { ok: true, added: true });
+                return;
+            }
+            if (route === WIZARD_CF_TOKEN_ROUTE && (method === 'POST' || method === 'DELETE')) {
+                if (!sameOriginPost(req)) {
+                    responseJson(res, 403, {
+                        ok: false,
+                        error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                    });
+                    return;
+                }
+                const store = options.tokenStore;
+                if (store === undefined) {
+                    responseJson(res, 501, { ok: false, error: { code: 'not-implemented', message: 'This wizard step is not wired up yet' } });
+                    return;
+                }
+                if (method === 'DELETE') {
+                    store.deleteCfToken();
+                    responseJson(res, 200, { ok: true, configured: false });
+                    return;
+                }
+                const body = await readJsonObject(req);
+                const token = typeof body?.token === 'string' ? body.token.trim() : '';
+                if (token === '') {
+                    responseJson(res, 400, { ok: false, error: { code: 'bad-token', message: 'token must be a non-empty string' } });
+                    return;
+                }
+                store.writeCfToken(token);
+                responseJson(res, 200, { ok: true, configured: true });
+                return;
+            }
+            if (route === WIZARD_TUNNEL_TOKEN_ROUTE && method === 'POST') {
+                if (!sameOriginPost(req)) {
+                    responseJson(res, 403, {
+                        ok: false,
+                        error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                    });
+                    return;
+                }
+                const store = options.tokenStore;
+                if (store === undefined) {
+                    responseJson(res, 501, { ok: false, error: { code: 'not-implemented', message: 'This wizard step is not wired up yet' } });
+                    return;
+                }
+                const body = await readJsonObject(req);
+                const token = typeof body?.token === 'string' ? body.token.trim() : '';
+                if (token === '') {
+                    responseJson(res, 400, { ok: false, error: { code: 'bad-token', message: 'token must be a non-empty string' } });
+                    return;
+                }
+                store.writeTunnelToken(token);
+                responseJson(res, 200, { ok: true, configured: true });
+                return;
+            }
+            if (route.startsWith(`${WIZARD_ROUTE_PREFIX}/caddy/`)) {
+                // Walls first, then the method shape, then (and only then) the
+                // wiring check — a 501 must never answer before the walls, and a
+                // wrong method on a wired route must still read 405.
+                if (method === 'POST' && !sameOriginPost(req)) {
+                    responseJson(res, 403, {
+                        ok: false,
+                        error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                    });
+                    return;
+                }
+                if (method !== 'GET' && method !== 'POST') {
+                    res.setHeader('Allow', 'GET, POST');
+                    responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use GET or POST' } });
+                    return;
+                }
+                const caddy = options.caddy;
+                if (caddy === undefined) {
+                    responseJson(res, 501, { ok: false, error: { code: 'not-implemented', message: 'This wizard step is not wired up yet' } });
+                    return;
+                }
+                if (route === WIZARD_CADDY_STATUS_ROUTE && method === 'GET') {
+                    responseJson(res, 200, { ok: true, state: caddy.status() });
+                    return;
+                }
+                if (route === WIZARD_CADDY_STOP_ROUTE && method !== 'POST') {
+                    // GW-fix-4/H2: a GET must never stop a process, even by accident.
+                    res.setHeader('Allow', 'GET, POST');
+                    responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use POST to stop' } });
+                    return;
+                }
+                if (route === WIZARD_CADDY_STOP_ROUTE) {
+                    caddy.stop();
+                    responseJson(res, 200, { ok: true, state: caddy.status() });
+                    return;
+                }
+                if (route === WIZARD_CADDY_START_ROUTE && method === 'POST') {
+                    const body = await readJsonObject(req);
+                    const values = options.getConfig().values;
+                    const rawDomain = typeof body?.domain === 'string' && body.domain.trim() !== ''
+                        ? body.domain.trim()
+                        : values.ingressDomain;
+                    const domain = hostOf(rawDomain);
+                    if (domain === undefined) {
+                        responseJson(res, 400, { ok: false, error: { code: 'no-domain', message: '保存一个有效的公开域名后再启动' } });
+                        return;
+                    }
+                    const rawPort = typeof body?.httpsPort === 'number' && Number.isSafeInteger(body.httpsPort) && body.httpsPort >= 1 && body.httpsPort <= 65535
+                        ? body.httpsPort
+                        : values.ingressHttpsPort;
+                    let runtime = {};
+                    try {
+                        runtime = (await options.getRuntime?.()) ?? {};
+                    }
+                    catch {
+                        runtime = {};
+                    }
+                    const gatewayPort = typeof runtime.gatewayActualPort === 'number' ? runtime.gatewayActualPort : values.port;
+                    const result = await caddy.start({ domain, httpsPort: rawPort, gatewayPort });
+                    // The start result may carry a failure detail — never the token.
+                    responseJson(res, 200, { ok: result.ok, ...(result.ok ? { caddyfile: result.caddyfile } : { error: result.error, detail: result.detail, installUrl: result.installUrl }) });
+                    return;
+                }
+                responseJson(res, 404, { ok: false, error: { code: 'not-found', message: 'Unknown wizard route' } });
+                return;
+            }
+            if (route.startsWith(`${WIZARD_ROUTE_PREFIX}/tunnel/`)) {
+                // Same discipline as the caddy block: walls, then method shape,
+                // then the wiring check.
+                if (method === 'POST' && !sameOriginPost(req)) {
+                    responseJson(res, 403, {
+                        ok: false,
+                        error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                    });
+                    return;
+                }
+                if (method !== 'GET' && method !== 'POST') {
+                    res.setHeader('Allow', 'GET, POST');
+                    responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use GET or POST' } });
+                    return;
+                }
+                const tunnel = options.tunnel;
+                if (tunnel === undefined) {
+                    responseJson(res, 501, { ok: false, error: { code: 'not-implemented', message: 'This wizard step is not wired up yet' } });
+                    return;
+                }
+                if (route === WIZARD_TUNNEL_STATUS_ROUTE && method === 'GET') {
+                    responseJson(res, 200, { ok: true, state: tunnel.status() });
+                    return;
+                }
+                if (method !== 'POST') {
+                    res.setHeader('Allow', 'GET, POST');
+                    responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use GET or POST' } });
+                    return;
+                }
+                const body = await readJsonObject(req);
+                const domain = typeof body?.domain === 'string' ? body.domain : '';
+                if (route === WIZARD_TUNNEL_CHECK_ROUTE) {
+                    const result = await tunnel.checkDomain(domain);
+                    responseJson(res, 200, { ok: result.ok, ...(result.ok ? { onCloudflare: result.onCloudflare, zoneId: result.zoneId } : { reason: result.reason, detail: result.detail }) });
+                    return;
+                }
+                if (route === WIZARD_TUNNEL_STOP_ROUTE && method !== 'POST') {
+                    res.setHeader('Allow', 'GET, POST');
+                    responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use POST to stop' } });
+                    return;
+                }
+                if (route === WIZARD_TUNNEL_STOP_ROUTE) {
+                    tunnel.stop();
+                    responseJson(res, 200, { ok: true, state: tunnel.status() });
+                    return;
+                }
+                if (route === WIZARD_TUNNEL_SETUP_ROUTE) {
+                    const tunnelId = typeof body?.tunnelId === 'string' && body.tunnelId !== '' ? body.tunnelId : undefined;
+                    const result = await tunnel.setup({ domain, tunnelId });
+                    // The setup answer never carries the connector token — only its
+                    // file path (a server-local fact) and the conflict list.
+                    if (result.ok) {
+                        responseJson(res, 200, { ok: true, tunnelId: result.tunnelId, publicUrl: result.publicUrl });
+                    }
+                    else {
+                        responseJson(res, 200, {
+                            ok: false,
+                            reason: result.reason,
+                            ...(result.detail !== undefined ? { detail: result.detail } : {}),
+                            ...(result.existing !== undefined ? { existing: result.existing } : {}),
+                            ...(result.installUrl !== undefined ? { installUrl: result.installUrl } : {}),
+                        });
+                    }
+                    return;
+                }
+                responseJson(res, 404, { ok: false, error: { code: 'not-found', message: 'Unknown wizard route' } });
+                return;
+            }
+            if (route === WIZARD_VERIFY_ROUTE && (method === 'POST' || method === 'GET')) {
+                // Wall 3 applies to the POST; the GET is read-only polling. Both
+                // answers are 200 with the orchestration's own verdict in the
+                // body — the UI branches on `ok` / `result`, not on status codes.
+                if (method === 'POST' && !sameOriginPost(req)) {
+                    responseJson(res, 403, {
+                        ok: false,
+                        error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                    });
+                    return;
+                }
+                const verify = options.verify;
+                if (verify === undefined) {
+                    responseJson(res, 501, { ok: false, error: { code: 'not-implemented', message: 'This wizard step is not wired up yet' } });
+                    return;
+                }
+                if (method === 'GET') {
+                    responseJson(res, 200, await verify.check());
+                    return;
+                }
+                const body = await readJsonObject(req);
+                if (body === null) {
+                    responseJson(res, 400, { ok: false, error: { code: 'bad-request', message: 'request body must be a JSON object' } });
+                    return;
+                }
+                responseJson(res, 200, await verify.start({
+                    publicUrl: body.publicUrl,
+                    ...(body.probeOnly === true ? { probeOnly: true } : {}),
+                }));
+                return;
+            }
+            if (route.startsWith(`${WIZARD_ROUTE_PREFIX}/`)) {
+                if (method === 'POST') {
+                    if (!sameOriginPost(req)) {
+                        responseJson(res, 403, {
+                            ok: false,
+                            error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                        });
+                        return;
+                    }
+                    // Skeleton placeholder: later tasks mount the real verbs here.
+                    responseJson(res, 501, {
+                        ok: false,
+                        error: { code: 'not-implemented', message: 'This wizard step is not wired up yet' },
+                    });
+                    return;
+                }
+                if (method === 'GET') {
+                    // Unknown GET under the wizard prefix: 404, after the walls.
+                    responseJson(res, 404, { ok: false, error: { code: 'not-found', message: 'Unknown wizard route' } });
+                    return;
+                }
+                res.setHeader('Allow', 'GET, POST');
+                responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use GET or POST' } });
+                return;
+            }
+            responseJson(res, 404, { ok: false, error: { code: 'not-found', message: 'Unknown wizard route' } });
+        }
+        catch {
+            if (!res.headersSent) {
+                responseJson(res, 500, { ok: false, error: { code: 'internal', message: 'The wizard route failed' } });
+            }
+            else {
+                res.destroy();
+            }
+        }
+    };
+}
+//# sourceMappingURL=routes.js.map

package/lib/wizard/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/wizard/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGvF,OAAO,EAAE,mBAAmB,EAA2B,MAAM,aAAa,CAAA;AAG1E;;uCAEuC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAElE,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,mBAAmB,SAAS,CAAA;AAElE;4BAC4B;AAC5B,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,mBAAmB,cAAc,CAAA;AAE5E;wCACwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,mBAAmB,SAAS,CAAA;AAElE;wDACwD;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,mBAAmB,WAAW,CAAA;AAEtE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,mBAAmB,eAAe,CAAA;AAE9E;0DAC0D;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,mBAAmB,cAAc,CAAA;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,mBAAmB,aAAa,CAAA;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,mBAAmB,eAAe,CAAA;AAE9E;;mDAEmD;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,mBAAmB,sBAAsB,CAAA;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,mBAAmB,eAAe,CAAA;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,mBAAmB,cAAc,CAAA;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,mBAAmB,gBAAgB,CAAA;AAMhF,oEAAoE;AACpE,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAA;AAmEhC;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,GAAoB;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,cAAc;QAAE,OAAO,IAAI,CAAA;IACtG,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAA;QAC/E,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;QACpB,IAAI,IAAI,GAAG,cAAc;YAAE,OAAO,IAAI,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QACvF,OAAO,MAAiC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,CAAC;YACH,qCAAqC;YACrC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;gBAC7B,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,EAAE;oBACrC,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE;iBAC5E,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,qBAAqB,CAAC,CAAA;YAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAA;YAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;YAClC,6DAA6D;YAC7D,qEAAqE;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,+DAA+D;YAC/D,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;oBACrB,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE;iBAC1D,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YACD,IAAI,KAAK,KAAK,mBAAmB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACtD,IAAI,OAAO,GAAuB,EAAE,CAAA;gBACpC,IAAI,CAAC;oBACH,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,OAAO,GAAG,EAAE,CAAA;gBACd,CAAC;gBACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;gBAChF,OAAM;YACR,CAAC;YACD,IAAI,KAAK,KAAK,wBAAwB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;qBACxG,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAA;gBAChC,mEAAmE;gBACnE,uBAAuB;gBACvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAA;oBAC1H,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;gBACtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAA;oBACpH,OAAM;gBACR,CAAC;gBACD,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACtC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;oBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAA;oBAC/G,OAAM;gBACR,CAAC;gBACD,IAAI,QAAiD,CAAA;gBACrD,IAAI,CAAC;oBACH,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;gBAC7C,CAAC;gBACD,iEAAiE;gBACjE,kEAAkE;gBAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC3D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,qBAAqB;4BAC3B,OAAO,EAAE,qBAAqB,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,kBAAkB;yBAC7F;qBACF,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;oBAChD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;oBAClD,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;gBACjD,gEAAgE;gBAChE,8DAA8D;gBAC9D,4CAA4C;gBAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;gBACxD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,EAAE;qBACtE,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjD,OAAM;YACR,CAAC;YACD,IAAI,KAAK,KAAK,qBAAqB,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAClF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;qBACxG,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAA;gBAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAA;oBAC1H,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACxB,KAAK,CAAC,aAAa,EAAE,CAAA;oBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;oBACvD,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;gBACtC,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBACtE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;oBACjB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;oBAChH,OAAM;gBACR,CAAC;gBACD,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YACD,IAAI,KAAK,KAAK,yBAAyB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;qBACxG,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAA;gBAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAA;oBAC1H,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;gBACtC,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBACtE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;oBACjB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;oBAChH,OAAM;gBACR,CAAC;gBACD,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;gBAC7B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,mBAAmB,SAAS,CAAC,EAAE,CAAC;gBACtD,+DAA+D;gBAC/D,iEAAiE;gBACjE,qDAAqD;gBACrD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;qBACxG,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1C,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;oBACnC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;oBACxG,OAAM;gBACR,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;gBAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAA;oBAC1H,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,yBAAyB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC5D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;oBAC3D,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,uBAAuB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC3D,kEAAkE;oBAClE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;oBACnC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;oBACzG,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;oBACtC,KAAK,CAAC,IAAI,EAAE,CAAA;oBACZ,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;oBAC3D,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,wBAAwB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC5D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;oBACtC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,CAAA;oBACzC,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;wBAC7E,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;wBACpB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAA;oBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;oBAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;wBAC/F,OAAM;oBACR,CAAC;oBACD,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,KAAK;wBAC3I,CAAC,CAAC,IAAI,CAAC,SAAS;wBAChB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAA;oBAC3B,IAAI,OAAO,GAAuB,EAAE,CAAA;oBACpC,IAAI,CAAC;wBACH,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;oBAChD,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,GAAG,EAAE,CAAA;oBACd,CAAC;oBACD,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;oBAC3G,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;oBAC7E,iEAAiE;oBACjE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;oBAC3K,OAAM;gBACR,CAAC;gBACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;gBACpG,OAAM;YACR,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,mBAAmB,UAAU,CAAC,EAAE,CAAC;gBACvD,gEAAgE;gBAChE,yBAAyB;gBACzB,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;qBACxG,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1C,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;oBACnC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;oBACxG,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;gBAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAA;oBAC1H,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,0BAA0B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC7D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;oBAC5D,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;oBACnC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;oBACxG,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;gBACtC,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;gBAClE,IAAI,KAAK,KAAK,yBAAyB,EAAE,CAAC;oBACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;oBAC/C,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;oBAC3K,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,wBAAwB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC5D,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;oBACnC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;oBACzG,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,wBAAwB,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,EAAE,CAAA;oBACb,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;oBAC5D,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,yBAAyB,EAAE,CAAC;oBACxC,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;oBACvG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;oBACvD,gEAAgE;oBAChE,yDAAyD;oBACzD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;wBACd,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;oBAC9F,CAAC;yBAAM,CAAC;wBACN,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;4BACrB,EAAE,EAAE,KAAK;4BACT,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACjE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACvE,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC9E,CAAC,CAAA;oBACJ,CAAC;oBACD,OAAM;gBACR,CAAC;gBACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;gBACpG,OAAM;YACR,CAAC;YACD,IAAI,KAAK,KAAK,mBAAmB,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC7E,iEAAiE;gBACjE,8DAA8D;gBAC9D,kEAAkE;gBAClE,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;qBACxG,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;gBAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAA;oBAC1H,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;oBAC5C,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;gBACtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAA;oBACpH,OAAM;gBACR,CAAC;gBACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,KAAK,CAAC;oBACxC,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,CAAC,CAAC,CAAA;gBACH,OAAM;YACR,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,mBAAmB,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;wBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;4BACrB,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;yBACxG,CAAC,CAAA;wBACF,OAAM;oBACR,CAAC;oBACD,+DAA+D;oBAC/D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE;qBACpF,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,6DAA6D;oBAC7D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;oBACpG,OAAM;gBACR,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;gBACnC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;gBACxG,OAAM;YACR,CAAC;YACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAA;YACxG,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}