dsh-zen-remote 2.2.9 → 2.3.2

package/lib/types/wizard/tunnel-orchestrator.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Tunnel orchestration (GW-13b, 路 C's autopilot): one call drives the
+ * whole Cloudflare-side setup the design promises — zone/account lookup
+ * (through the ancestor-chain check), tunnel create-or-adopt, ingress
+ * configuration against the gateway's ACTUAL port, the proxied CNAME,
+ * and the cloudflared child.
+ *
+ * Rules the review and the design pin down:
+ *
+ *   - **已有同名隧道**：the first setup pass answers `tunnel-conflict`
+ *     with the same-name list; the UI lets the user pick one and re-runs
+ *     with `tunnelId`, which adopts the existing tunnel through the token
+ *     endpoint instead of creating anything.
+ *   - **模式切换**：starting the tunnel stops the managed Caddy first
+ *     (`stopCaddy`) — never two ingress processes at once.
+ *   - The connector token travels from the Cloudflare answer into the
+ *     0600 token file and the child's `--token-file`; it never reaches a
+ *     response or a log.
+ *   - Every failure is a VALUE with a stable `reason` the UI maps to
+ *     locale copy; CloudflareError codes map losslessly (`cf-*` → the
+ *     orchestration's own reasons), unknown ones degrade to `api`.
+ */
+import { type CloudflareApi, type CloudflareTunnelSummary } from './cloudflare.js';
+/** The tunnel name the wizard mints and looks for. */
+export declare const TUNNEL_NAME = "dsh-zen-remote";
+export interface TunnelOrchestratorOptions {
+    dshHome: string;
+    /** The stored Cloudflare token (token-store); absent → `no-token`. */
+    readToken: () => string | undefined;
+    /** The gateway's ACTUAL port (the ingress service target); may probe
+     * asynchronously (the wiring re-reads /lan-gate/status per setup). */
+    gatewayPort: () => number | Promise<number>;
+    /** The client factory; injectable so the tests drive the orchestration
+     * against a scripted CloudflareApi without any HTTP. Defaults to
+     * createCloudflareApi over the injected fetch. */
+    apiFactory?: (token: string) => CloudflareApi;
+    cloudflared: {
+        start: (input: {
+            tunnelToken: string;
+        }) => Promise<{
+            ok: true;
+        } | {
+            ok: false;
+            error: string;
+        }>;
+        /** 模式切换：starting the tunnel stops the managed Caddy first. */
+        stopCaddy: () => void;
+    };
+    fetchImpl?: typeof fetch;
+}
+export interface TunnelSetupInput {
+    /** The public domain (bare hostname; may be a subdomain of the zone). */
+    domain: string;
+    /** Adopt this existing tunnel instead of creating one (the conflict path). */
+    tunnelId?: string;
+}
+export type TunnelSetupResult = {
+    ok: true;
+    tunnelId: string;
+    publicUrl: string;
+    tokenFile: string;
+} | {
+    ok: false;
+    reason: 'no-token' | 'bad-domain' | 'zone-not-found' | 'tunnel-conflict' | 'dns-conflict' | 'auth' | 'network' | 'api' | 'spawn-failed';
+    detail?: string;
+    /** The same-name tunnels, for `tunnel-conflict`. */
+    existing?: CloudflareTunnelSummary[];
+    /** The manual-install page, for `spawn-failed`. */
+    installUrl?: string;
+};
+/**
+ * Drive the whole tunnel setup. Throws nothing — every outcome is a value.
+ */
+export declare function setupTunnel(options: TunnelOrchestratorOptions, input: TunnelSetupInput): Promise<TunnelSetupResult>;
+/**
+ * The check-domain probe the migration card's 重新检查 drives: does any
+ * ancestor of the domain name a zone on the token's accounts?
+ */
+export type TunnelCheckResult = {
+    ok: true;
+    onCloudflare: boolean;
+    zoneId: string | null;
+    accountId: string | null;
+} | {
+    ok: false;
+    reason: 'no-token' | 'bad-domain' | 'auth' | 'network' | 'api';
+    detail?: string;
+};
+export declare function checkDomainOnCloudflare(options: Pick<TunnelOrchestratorOptions, 'readToken' | 'fetchImpl' | 'apiFactory'>, domain: string): Promise<TunnelCheckResult>;
+//# sourceMappingURL=tunnel-orchestrator.d.ts.map

package/lib/types/wizard/tunnel-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-orchestrator.d.ts","sourceRoot":"","sources":["../../../src/wizard/tunnel-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAuB,KAAK,aAAa,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAGvG,sDAAsD;AACtD,eAAO,MAAM,WAAW,mBAAmB,CAAA;AAE3C,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;IACnC;0EACsE;IACtE,WAAW,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C;;sDAEkD;IAClD,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,aAAa,CAAA;IAC7C,WAAW,EAAE;QACX,KAAK,EAAE,CAAC,KAAK,EAAE;YAAE,WAAW,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC;YAAE,EAAE,EAAE,IAAI,CAAA;SAAE,GAAG;YAAE,EAAE,EAAE,KAAK,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC/F,8DAA8D;QAC9D,SAAS,EAAE,MAAM,IAAI,CAAA;KACtB,CAAA;IACD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACpE;IACA,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,cAAc,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,cAAc,CAAA;IACvI,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,CAAC,EAAE,uBAAuB,EAAE,CAAA;IACpC,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAcH;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwFzH;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAElG,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAe5K"}

package/lib/types/wizard/verify.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Final-verification orchestration (GW-9): the wizard's last mile, where
+ * 「完成」 means a real phone really paired through the real public URL —
+ * never a green light from internal checks alone (设计: 不做已联通的假绿灯).
+ *
+ * The flow, spread over two entry points the UI drives:
+ *
+ *   start({ publicUrl }): runtime ready? → walk the public URL
+ *   (GW-8's probe; BOTH the pairing page and the admin-403 shape must be
+ *   right) → snapshot the gateway's device ids (the baseline) → mint a WEB
+ *   pairing code → remember the session IN MEMORY and answer with the
+ *   code, the URL and the expiry. The code never touches the row config,
+ *   and minting it restarts nothing — trustedProxies changes are what
+ *   restart the gateway, and any such change invalidates the session
+ *   instead (the config fingerprint below).
+ *
+ *   check(): re-read the gateway status. A device id the baseline did not
+ *   have is a freshly paired phone; the gateway's lastWebClaim record must
+ *   name THAT device with secure === true (the proxy passed
+ *   X-Forwarded-Proto: https through, so the issued cookie carries the
+ *   Secure flag). All green → pass. The claim recorded an insecure cookie →
+ *   cookie-insecure. Past the code's expiry → code-expired. Anything else →
+ *   pending, keep polling.
+ *
+ * The session binds to a CONFIG FINGERPRINT (ingressMode, domain,
+ * httpsPort, publicUrl, the gateway's ACTUAL port, host, trustedProxies):
+ * any of those moving between start and check answers stale and discards
+ * the session, because the verification proved a URL that no longer exists.
+ * The session is deliberately memory-only — a row reload (which a
+ * trustedProxies change causes) builds a fresh manager and the session is
+ * gone, exactly the same verdict the fingerprint would have produced.
+ */
+import type { ZenRemoteConfig } from '../config.js';
+import { type HostPathOutcome } from './probe.js';
+export interface VerificationManagerOptions {
+    /** Loopback base of the gateway child, `http://127.0.0.1:<port>`. */
+    gatewayBase: string;
+    /** Fresh resolved config values per call (volatile discipline). */
+    getValues: () => ZenRemoteConfig;
+    /** The hostPath probe; injectable for tests (defaults to GW-8's real one). */
+    probe?: (publicUrl: string) => Promise<HostPathOutcome>;
+    /** Whether the ingress processes are alive (Caddy / cloudflared). The
+     * wiring supplies this once the process managers are mounted; absent
+     * means "checked elsewhere" and only the gateway is probed. */
+    runtimeReady?: () => boolean | Promise<boolean>;
+    fetchImpl?: typeof fetch;
+    /** Per-gateway-call ceiling. Default 5000 ms. */
+    timeoutMs?: number;
+    /** Clock (tests drive expiry). */
+    now?: () => number;
+}
+export type VerificationStartResult = {
+    ok: true;
+    pairingCode: string;
+    publicUrl: string;
+    expiresAt: number;
+} | {
+    ok: false;
+    reason: 'no-public-url' | 'bad-public-url' | 'runtime-not-ready' | 'gateway-unreachable' | 'probe-failed' | 'pair-refused';
+    /** The probe's classifications for `probe-failed`; the gateway's status
+     * code for `pair-refused`; the normalize failure reason for
+     * `bad-public-url`. */
+    detail?: unknown;
+};
+export type VerificationCheckResult = {
+    result: 'not-started';
+} | {
+    result: 'stale';
+} | {
+    result: 'code-expired';
+} | {
+    result: 'pending';
+} | {
+    result: 'cookie-insecure';
+    deviceId: string;
+} | {
+    result: 'pass';
+    deviceId: string;
+    at: number;
+};
+/**
+ * The config fingerprint a session binds to: any drift between start and
+ * check means the verified URL is no longer the deployed URL.
+ */
+export declare function verificationFingerprint(values: ZenRemoteConfig, gatewayPort: number | null): string;
+export interface VerificationManager {
+    start(input: {
+        publicUrl: unknown;
+        probeOnly?: boolean;
+    }): Promise<VerificationStartResult>;
+    check(): Promise<VerificationCheckResult>;
+    /** Whether a verification session is open (the route surfaces it for the
+     * UI's 「待外部验证」 state). */
+    hasSession(): boolean;
+}
+export declare function createVerificationManager(options: VerificationManagerOptions): VerificationManager;
+//# sourceMappingURL=verify.d.ts.map

package/lib/types/wizard/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/wizard/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAA;AAEhE,MAAM,WAAW,0BAA0B;IACzC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,SAAS,EAAE,MAAM,eAAe,CAAA;IAChC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IACvD;;mEAE+D;IAC/D,YAAY,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACvE;IACA,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,qBAAqB,GAAG,cAAc,GAAG,cAAc,CAAA;IAC1H;;2BAEuB;IACvB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAEH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,GAC1B;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AASpD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAUnG;AAWD,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC3F,KAAK,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACzC;8BAC0B;IAC1B,UAAU,IAAI,OAAO,CAAA;CACtB;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,mBAAmB,CAyHlG"}

package/lib/wizard/binary-io.js

@@ -0,0 +1,386 @@
+/**
+ * Ingress binary I/O (GW-2, revised by GW-fix-1/H1): download, unpack,
+ * install and cache-probe for the two wizard-managed binaries. The
+ * arithmetic lives in binary.ts; this file is the only one allowed to touch
+ * the filesystem or the network for it.
+ *
+ * House rules the tasks pin down:
+ *
+ *   - No shell, no `child_process` at all. Downloads ride `fetch`, the
+ *     body streams straight to a `.part` file, and the install is a POSIX
+ *     rename — a crash mid-download can never leave a half binary at the
+ *     install path.
+ *   - The archive wrapper comes from binary.ts's METADATA (`options.archive`,
+ *     what binaryUrls() models per platform), never from sniffing the URL:
+ *     the Caddy build API's URL is a query string whose ending says nothing
+ *     about the tar.gz / zip payload it answers with (GW-fix-1/H1).
+ *   - Windows' Caddy asset is a zip and there is no zip reader here yet:
+ *     refused up front with the typed `windows-zip-unsupported` code, the
+ *     manual-install link stays the fallback (GW-fix-1/H1 item 3).
+ *   - After unpacking (or for a bare download), a unix image must carry an
+ *     ELF or Mach-O magic; anything else is refused as `bad-binary-image`
+ *     and leaves nothing on disk (GW-fix-1/H1 item 4). Windows keeps no
+ *     magic check — PE inspection is not this module's job.
+ *   - The darwin cloudflared asset is a `.tgz`; it is unpacked with
+ *     `zlib.gunzipSync` plus a minimal ustar reader (the archive carries a
+ *     single entry — no PAX/GNU long-name handling needed, but those
+ *     header types are skipped correctly if an upstream rebuild adds one).
+ *   - Installed images get 0755; `ensureBinary` is idempotent (an existing
+ *     executable short-circuits before any network traffic).
+ *
+ * `fetch` is injectable so the tests drive real downloads against a local
+ * mock server without touching the network.
+ */
+import { accessSync, chmodSync, closeSync, constants as fsConstants, createWriteStream, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { gunzipSync } from 'node:zlib';
+import { MANUAL_INSTALL_LINKS, binaryDownloadCandidates, binaryInstallPath, binDir, binaryUrls, currentPlatform, } from './binary.js';
+/** Generous ceiling on one download; a mirror gone wrong must not be able
+ * to fill the disk. Both real binaries sit far below 200 MB. */
+const MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;
+/** Connection / response-headers timeout before a mirror is skipped. */
+const CONNECT_TIMEOUT_MS = 10_000;
+/** Maximum idle gap between body chunks before a stalled mirror is aborted. */
+const STALL_TIMEOUT_MS = 15_000;
+/** ELF: `\x7fELF`. */
+const ELF_MAGIC = Buffer.from([0x7f, 0x45, 0x4c, 0x46]);
+/** Mach-O 32 big-endian, Mach-O 64 big-endian, Mach-O 64 little-endian —
+ * the three shapes Apple toolchains emit for this codebase's targets. */
+const MACH_O_MAGICS = [
+    Buffer.from([0xfe, 0xed, 0xfa, 0xce]),
+    Buffer.from([0xfe, 0xed, 0xfa, 0xcf]),
+    Buffer.from([0xcf, 0xfa, 0xed, 0xfe]),
+];
+/** Whether the first bytes of an image look like an executable this module
+ * is willing to install on a unix host (GW-fix-1/H1 item 4). */
+function looksLikeUnixImage(head) {
+    return ELF_MAGIC.equals(head) || MACH_O_MAGICS.some((magic) => magic.equals(head));
+}
+/** The first four bytes of a file (fewer when the file is shorter). */
+function headBytes(path) {
+    const head = Buffer.alloc(4);
+    const fd = openSync(path, 'r');
+    try {
+        return head.subarray(0, readSync(fd, head, 0, 4, 0));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * One failed or refused download/install. `code` is the wire-stable marker
+ * the UI classifies on — `'download-failed'` for transport/shaping
+ * failures, `'windows-zip-unsupported'` for the zip refusal, and
+ * `'bad-binary-image'` when the payload did not carry an executable
+ * image's magic. `installUrl` is the official manual-install page the
+ * failure card links to. Fields are assigned in the constructor body rather
+ * than declared as parameter properties (the check scripts import modules
+ * through Node's strip-only type stripping, which rejects that syntax).
+ */
+export class BinaryDownloadError extends Error {
+    code;
+    tool;
+    url;
+    status;
+    installUrl;
+    constructor(tool, url, status, message, options) {
+        super(message, options);
+        this.name = 'BinaryDownloadError';
+        this.code = options?.code ?? 'download-failed';
+        this.tool = tool;
+        this.url = url;
+        this.status = status;
+        this.installUrl = MANUAL_INSTALL_LINKS[tool];
+    }
+}
+/** Whether `path` exists and is executable (the "already installed" test). */
+function isExecutableFile(path) {
+    try {
+        if (!statSync(path).isFile())
+            return false;
+        accessSync(path, fsConstants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The installed binary's absolute path, or undefined when it is not (yet)
+ * on disk in executable shape — the read-only probe; see binary.ts's
+ * `binaryInstallPath` for the pure arithmetic.
+ */
+export function binaryPath(dshHome, tool, platform = currentPlatform()) {
+    const path = binaryInstallPath(dshHome, tool, platform);
+    return isExecutableFile(path) ? path : undefined;
+}
+/** Write one fetched response body to `partPath` under the size cap and
+ * per-chunk stall timeout so a throttled or hung mirror fails over quickly. */
+async function streamToFile(tool, url, body, partPath, onProgress) {
+    let received = 0;
+    let stallTimer;
+    const counter = new Transform({
+        transform(chunk, _encoding, done) {
+            received += chunk.length;
+            if (received > MAX_DOWNLOAD_BYTES) {
+                done(new BinaryDownloadError(tool, url, null, `the download of ${tool} exceeds the ${MAX_DOWNLOAD_BYTES}-byte cap`));
+                return;
+            }
+            if (stallTimer !== undefined)
+                clearTimeout(stallTimer);
+            stallTimer = setTimeout(() => {
+                counter.destroy(new BinaryDownloadError(tool, url, null, `the download of ${tool} stalled after ${received} bytes`));
+            }, STALL_TIMEOUT_MS);
+            if (typeof stallTimer.unref === 'function')
+                stallTimer.unref();
+            onProgress?.(received, null);
+            done(null, chunk);
+        },
+    });
+    stallTimer = setTimeout(() => {
+        counter.destroy(new BinaryDownloadError(tool, url, null, `the download of ${tool} stalled before first byte`));
+    }, STALL_TIMEOUT_MS);
+    if (typeof stallTimer.unref === 'function')
+        stallTimer.unref();
+    try {
+        await pipeline(Readable.fromWeb(body), counter, createWriteStream(partPath, { mode: 0o644 }));
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        throw error;
+    }
+    finally {
+        if (stallTimer !== undefined)
+            clearTimeout(stallTimer);
+    }
+}
+/** Size bytes of a ustar header's octal size field, 0 when unparsable. */
+function tarEntrySize(header) {
+    const raw = header.subarray(124, 136).toString('ascii').replace(/[\0 ]+$/g, '').trim();
+    const size = parseInt(raw === '' ? '0' : raw, 8);
+    return Number.isFinite(size) && size > 0 ? size : 0;
+}
+/**
+ * The first regular-file payload of a ustar archive as one buffer slice.
+ * The cloudflared `.tgz` carries exactly one (`cloudflared`); anything else
+ * (PAX/GNU metadata, directories) is skipped by advancing over its data
+ * blocks, so a future archive layout change degrades to "not found" instead
+ * of corrupt bytes.
+ */
+function firstTarFileEntry(archive) {
+    let offset = 0;
+    while (offset + 512 <= archive.length) {
+        const header = archive.subarray(offset, offset + 512);
+        if (header.every((byte) => byte === 0))
+            return undefined;
+        const size = tarEntrySize(header);
+        const typeflag = String.fromCharCode(header[156] ?? 0x20);
+        const dataStart = offset + 512;
+        if ((typeflag === '0' || typeflag === '\0') && size > 0 && dataStart + size <= archive.length) {
+            return archive.subarray(dataStart, dataStart + size);
+        }
+        offset = dataStart + Math.ceil(size / 512) * 512;
+    }
+    return undefined;
+}
+function chmodExec(path) {
+    try {
+        chmodSync(path, 0o755);
+    }
+    catch {
+        // Windows: no executable bit — the extension does that job.
+    }
+}
+/** Install `bytes` at `installPath`: `.part` sibling, chmod, atomic rename. */
+function installBytes(bytes, installPath) {
+    const partPath = `${installPath}.part`;
+    try {
+        writeFileSync(partPath, bytes, { mode: 0o644 });
+        chmodExec(partPath);
+        renameSync(partPath, installPath);
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        throw error;
+    }
+}
+/** The unix image-magic gate (GW-fix-1/H1 item 4): a payload that does not
+ * open with an ELF or Mach-O magic is refused, nothing lands on disk. */
+function assertUnixImageMagic(tool, url, status, head) {
+    if (looksLikeUnixImage(head))
+        return;
+    throw new BinaryDownloadError(tool, url, status, `the downloaded ${tool} does not carry an ELF or Mach-O image magic`, { code: 'bad-binary-image' });
+}
+/**
+ * Download one binary from an explicit URL and install it. The archive
+ * wrapper is the CALLER'S metadata (`options.archive`) — `ensureBinary`
+ * feeds it from binaryUrls(); tests pin it per fixture. `platform` only
+ * matters for the install name and the magic-check gate; it defaults to
+ * this process's.
+ * @returns the absolute install path.
+ */
+export async function downloadBinary(dshHome, tool, url, options = {}) {
+    const platform = options.platform ?? currentPlatform();
+    const archive = options.archive ?? 'none';
+    const installPath = binaryInstallPath(dshHome, tool, platform);
+    if (archive === 'zip') {
+        // Refused BEFORE any network traffic: there is no zip reader in this
+        // codebase yet (GW-fix-1/H1 item 3), and half-supporting the format
+        // would only install a zip's bytes as an image.
+        throw new BinaryDownloadError(tool, url, null, `the ${tool} asset for Windows ships as a zip, which cannot be unpacked here yet`, { code: 'windows-zip-unsupported' });
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            redirect: 'follow',
+            signal: AbortSignal.timeout(CONNECT_TIMEOUT_MS),
+        });
+    }
+    catch (cause) {
+        throw new BinaryDownloadError(tool, url, null, `the download of ${tool} failed before an answer arrived`, { cause });
+    }
+    if (!response.ok || response.body === null) {
+        throw new BinaryDownloadError(tool, url, response.status, `the download of ${tool} answered ${response.status}`);
+    }
+    mkdirSync(binDir(dshHome), { recursive: true });
+    const declared = Number(response.headers.get('content-length'));
+    const total = Number.isFinite(declared) && declared > 0 ? declared : null;
+    const onProgress = options.onProgress
+        ? (received) => options.onProgress?.(received, total)
+        : undefined;
+    if (archive === 'tgz') {
+        // Archive (or auto-detected bare binary if an upstream endpoint serves a
+        // raw ELF/Mach-O image despite tgz metadata): land the bytes in a sibling,
+        // then either install directly when the payload already starts with a
+        // unix image magic or gunzip + extract the tar entry.
+        const tgzPath = `${installPath}.download.tgz`;
+        try {
+            await streamToFile(tool, url, response.body, tgzPath, onProgress);
+            const rawBytes = readFileSync(tgzPath);
+            const gzipMagic = rawBytes.length >= 2 && rawBytes[0] === 0x1f && rawBytes[1] === 0x8b;
+            const entry = (!gzipMagic && platform.os !== 'windows' && looksLikeUnixImage(rawBytes.subarray(0, 4)))
+                ? rawBytes
+                : firstTarFileEntry(gunzipSync(rawBytes));
+            if (entry === undefined) {
+                throw new BinaryDownloadError(tool, url, response.status, `the ${tool} archive carried no binary entry`);
+            }
+            if (platform.os !== 'windows')
+                assertUnixImageMagic(tool, url, response.status, entry.subarray(0, 4));
+            installBytes(entry, installPath);
+        }
+        catch (error) {
+            if (error instanceof BinaryDownloadError)
+                throw error;
+            throw new BinaryDownloadError(tool, url, response.status, `the ${tool} archive could not be unpacked`, { cause: error });
+        }
+        finally {
+            rmSync(tgzPath, { force: true });
+        }
+        return installPath;
+    }
+    // Bare executable: stream to the .part, gate the magic, then rename.
+    const partPath = `${installPath}.part`;
+    try {
+        await streamToFile(tool, url, response.body, partPath, onProgress);
+        if (platform.os !== 'windows')
+            assertUnixImageMagic(tool, url, response.status, headBytes(partPath));
+        chmodExec(partPath);
+        renameSync(partPath, installPath);
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        if (error instanceof BinaryDownloadError)
+            throw error;
+        throw new BinaryDownloadError(tool, url, response.status, `the download of ${tool} could not be written to disk`, { cause: error });
+    }
+    return installPath;
+}
+/** Cached mainland-China network detection so repeated downloads do not
+ * re-probe within the same process. */
+let cachedCnNetwork;
+/**
+ * Detect whether the current host is in mainland China:
+ * 1. Fast local check: system timezone is `Asia/Shanghai`, `Asia/Chongqing`,
+ *    `Asia/Harbin`, or `Asia/Urumqi`, or `LANG`/`LC_ALL` carries `zh_CN`.
+ * 2. Quick 1.5s probe to Cloudflare's `/cdn-cgi/trace` (`loc=CN`), or if
+ *    direct `github.com` HEAD fails/times out within 2s.
+ */
+export async function detectCnNetwork(fetchImpl = fetch) {
+    if (cachedCnNetwork !== undefined)
+        return cachedCnNetwork;
+    try {
+        const tz = Intl.DateTimeFormat().resolvedOptions().timeZone ?? '';
+        if (/^Asia\/(Shanghai|Chongqing|Harbin|Urumqi)$/i.test(tz)) {
+            cachedCnNetwork = true;
+            return true;
+        }
+    }
+    catch { /* ignore */ }
+    const envLang = `${process.env.LANG ?? ''} ${process.env.LC_ALL ?? ''}`;
+    if (/zh_CN/i.test(envLang)) {
+        cachedCnNetwork = true;
+        return true;
+    }
+    try {
+        const trace = await fetchImpl('https://www.cloudflare.com/cdn-cgi/trace', {
+            signal: AbortSignal.timeout(1500),
+        });
+        if (trace.ok) {
+            const text = await trace.text();
+            if (/\bloc=CN\b/i.test(text)) {
+                cachedCnNetwork = true;
+                return true;
+            }
+            cachedCnNetwork = false;
+            return false;
+        }
+    }
+    catch {
+        // ignore trace timeout
+    }
+    cachedCnNetwork = false;
+    return false;
+}
+/**
+ * The idempotent front door: an already-installed executable short-circuits
+ * (no network), anything else downloads from the official distribution
+ * point for the tool, archive shape included.
+ *
+ * When using the default `fetch` transport, automatically detects mainland
+ * China network environments and tries prebuilt GitHub Release mirrors
+ * (`gh-proxy.com` / `ghfast.top`) + direct GitHub Release before falling back
+ * to `caddyserver.com/api/download`. When a custom `fetchImpl` is injected
+ * (unit tests), calls the canonical `binaryUrls(platform)` endpoint directly.
+ * @returns the absolute install path and whether THIS call downloaded.
+ */
+export async function ensureBinary(dshHome, tool, options = {}) {
+    const platform = options.platform ?? currentPlatform();
+    const existing = binaryPath(dshHome, tool, platform);
+    if (existing !== undefined)
+        return { path: existing, downloaded: false };
+    if (options.fetchImpl !== undefined) {
+        const urls = binaryUrls(platform);
+        const [url, archive] = tool === 'caddy' ? [urls.caddy, urls.caddyArchive] : [urls.cloudflared, urls.cloudflaredArchive];
+        const path = await downloadBinary(dshHome, tool, url, { ...options, archive });
+        return { path, downloaded: true };
+    }
+    const preferCnMirror = await detectCnNetwork();
+    const candidates = binaryDownloadCandidates(tool, platform, preferCnMirror);
+    let lastError;
+    for (const candidate of candidates) {
+        try {
+            const path = await downloadBinary(dshHome, tool, candidate.url, {
+                ...options,
+                archive: candidate.archive,
+            });
+            return { path, downloaded: true };
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError;
+}
+//# sourceMappingURL=binary-io.js.map

package/lib/wizard/binary-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-io.js","sourceRoot":"","sources":["../../src/wizard/binary-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,MAAM,EACN,UAAU,EACV,eAAe,GAIhB,MAAM,aAAa,CAAA;AAEpB;gEACgE;AAChE,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;AAC5C,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B,sBAAsB;AACtB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AACvD;yEACyE;AACzE,MAAM,aAAa,GAAG;IACpB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;CACtC,CAAA;AAED;gEACgE;AAChE,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AACpF,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAAQ;IACZ,IAAI,CAAe;IACnB,GAAG,CAAQ;IACX,MAAM,CAAe;IACrB,UAAU,CAAQ;IAE3B,YAAY,IAAmB,EAAE,GAAW,EAAE,MAAqB,EAAE,OAAe,EAAE,OAA4C;QAChI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,iBAAiB,CAAA;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,KAAK,CAAA;QAC1C,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAA;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAmB,EAAE,WAA2B,eAAe,EAAE;IAC3G,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAgBD;+EAC+E;AAC/E,KAAK,UAAU,YAAY,CACzB,IAAmB,EACnB,GAAW,EACX,IAAuC,EACvC,QAAgB,EAChB,UAAwC;IAExC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,UAAqD,CAAA;IACzD,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC;QAC5B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,IAAI;YACtC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAA;YACxB,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,IAAI,gBAAgB,kBAAkB,WAAW,CAAC,CAAC,CAAA;gBACpH,OAAM;YACR,CAAC;YACD,IAAI,UAAU,KAAK,SAAS;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAA;YACtD,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,IAAI,kBAAkB,QAAQ,QAAQ,CAAC,CAAC,CAAA;YACtH,CAAC,EAAE,gBAAgB,CAAC,CAAA;YACpB,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAA;YAC9D,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACnB,CAAC;KACF,CAAC,CAAA;IACF,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;QAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,IAAI,4BAA4B,CAAC,CAAC,CAAA;IAChH,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACpB,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;QAAE,UAAU,CAAC,KAAK,EAAE,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,YAAY,CAAC,UAAU,CAAC,CAAA;IACxD,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,OAAO,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAA;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAA;QACzD,MAAM,SAAS,GAAG,MAAM,GAAG,GAAG,CAAA;QAC9B,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC9F,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAA;IAClD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,KAAiB,EAAE,WAAmB;IAC1D,MAAM,QAAQ,GAAG,GAAG,WAAW,OAAO,CAAA;IACtC,IAAI,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/C,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnB,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,SAAS,oBAAoB,CAAC,IAAmB,EAAE,GAAW,EAAE,MAAqB,EAAE,IAAY;IACjG,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAM;IACpC,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,GAAG,EACH,MAAM,EACN,kBAAkB,IAAI,8CAA8C,EACpE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,IAAmB,EACnB,GAAW,EACX,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAA;IACtD,MAAM,OAAO,GAAkB,OAAO,CAAC,OAAO,IAAI,MAAM,CAAA;IACxD,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC9D,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,qEAAqE;QACrE,oEAAoE;QACpE,gDAAgD;QAChD,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,GAAG,EACH,IAAI,EACJ,OAAO,IAAI,sEAAsE,EACjF,EAAE,IAAI,EAAE,yBAAyB,EAAE,CACpC,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC9B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,IAAI,kCAAkC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACtH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClH,CAAC;IACD,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,MAAM,UAAU,GAAiC,OAAO,CAAC,UAAU;QACjE,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;QACrD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,OAAO,GAAG,GAAG,WAAW,eAAe,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAoD,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YACjH,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;YACtF,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpG,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,IAAI,kCAAkC,CAAC,CAAA;YAC1G,CAAC;YACD,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;gBAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACrG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,KAAK,CAAA;YACrD,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,IAAI,gCAAgC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1H,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,WAAW,OAAO,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAoD,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;QAClH,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;YAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;QACpG,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnB,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAA;QACrD,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,IAAI,+BAA+B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACrI,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAOD;uCACuC;AACvC,IAAI,eAAoC,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,YAA0B,KAAK;IACnE,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,eAAe,CAAA;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAA;QACjE,IAAI,6CAA6C,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3D,eAAe,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAA;IACvE,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,eAAe,GAAG,IAAI,CAAA;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,0CAA0C,EAAE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YAC/B,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,eAAe,GAAG,IAAI,CAAA;gBACtB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,eAAe,GAAG,KAAK,CAAA;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IACD,eAAe,GAAG,KAAK,CAAA;IACvB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,IAAmB,EACnB,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAA;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACpD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IACxE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACvH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,eAAe,EAAE,CAAA;IAC9C,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;IAC3E,IAAI,SAAkB,CAAA;IACtB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE;gBAC9D,GAAG,OAAO;gBACV,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC,CAAA;YACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAA;QACnB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAA;AACjB,CAAC"}