instar 1.2.34 → 1.2.35

package/dist/tunnel/CloudflareNamedProvider.d.ts

@@ -0,0 +1,51 @@
+/**
+ * CloudflareNamedProvider — Tier-1 persistent Cloudflare named tunnel.
+ *
+ * Extracted from the original `TunnelManager.startNamedTunnel()` and
+ * `startConfigFileTunnel()` so the manager can drive multiple providers
+ * through `TunnelProvider`. The named path supports two auth modes,
+ * preserved verbatim from the original behavior:
+ *
+ *   - Token auth: `cloudflared` via `Tunnel.withToken(token)`. The URL
+ *     is the configured hostname (passed via `hostname`); cloudflared
+ *     surfaces 'connected' rather than 'url'.
+ *   - Config-file auth: spawn `cloudflared tunnel --config <file> run`
+ *     directly. URL is the configured hostname; we watch stderr for
+ *     "Registered tunnel connection" / "Connection registered" to know
+ *     the tunnel is up.
+ *
+ * `isAvailable()` returns false when neither token NOR configFile is
+ * configured, so the manager skips this provider on quick-only installs.
+ *
+ * Like the quick provider, this module owns ONLY spawn + URL emission
+ * + teardown. Retry, reconnect, fallback, and notification are owned by
+ * the manager per the spec's single-owner mandate.
+ */
+import type { TunnelProvider, TunnelProviderHandle, ProviderName, ProviderTier } from './TunnelProvider.js';
+export interface CloudflareNamedProviderOptions {
+    /** Cloudflare tunnel token (token-auth mode). */
+    token?: string;
+    /** Config file path (config-file-auth mode). */
+    configFile?: string;
+    /** Public hostname for the tunnel (e.g. echo.dawn-tunnel.dev). */
+    hostname?: string;
+    /** Start timeout in milliseconds (default: 30_000 for token; 15_000 for config-file). */
+    startTimeoutMs?: number;
+}
+export declare class CloudflareNamedProvider implements TunnelProvider {
+    readonly name: ProviderName;
+    readonly tier: ProviderTier;
+    private readonly token?;
+    private readonly configFile?;
+    private readonly hostname?;
+    private readonly startTimeoutMs?;
+    constructor(opts: CloudflareNamedProviderOptions);
+    isAvailable(): Promise<boolean>;
+    start(localPort: number): Promise<TunnelProviderHandle>;
+    private startWithToken;
+    private startConfigFile;
+    private stopHandle;
+    private stopChild;
+    private killWithEscalation;
+}
+//# sourceMappingURL=CloudflareNamedProvider.d.ts.map

package/dist/tunnel/CloudflareNamedProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareNamedProvider.d.ts","sourceRoot":"","sources":["../../src/tunnel/CloudflareNamedProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACb,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,8BAA8B;IAC7C,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,uBAAwB,YAAW,cAAc;IAC5D,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAsB;IACjD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAK;IAEhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;gBAE7B,IAAI,EAAE,8BAA8B;IAO1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAMrC,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAczC,cAAc;IAuE5B,OAAO,CAAC,eAAe;YAuET,UAAU;YAQV,SAAS;YAOT,kBAAkB;CAwBjC"}

package/dist/tunnel/CloudflareNamedProvider.js

@@ -0,0 +1,258 @@
+/**
+ * CloudflareNamedProvider — Tier-1 persistent Cloudflare named tunnel.
+ *
+ * Extracted from the original `TunnelManager.startNamedTunnel()` and
+ * `startConfigFileTunnel()` so the manager can drive multiple providers
+ * through `TunnelProvider`. The named path supports two auth modes,
+ * preserved verbatim from the original behavior:
+ *
+ *   - Token auth: `cloudflared` via `Tunnel.withToken(token)`. The URL
+ *     is the configured hostname (passed via `hostname`); cloudflared
+ *     surfaces 'connected' rather than 'url'.
+ *   - Config-file auth: spawn `cloudflared tunnel --config <file> run`
+ *     directly. URL is the configured hostname; we watch stderr for
+ *     "Registered tunnel connection" / "Connection registered" to know
+ *     the tunnel is up.
+ *
+ * `isAvailable()` returns false when neither token NOR configFile is
+ * configured, so the manager skips this provider on quick-only installs.
+ *
+ * Like the quick provider, this module owns ONLY spawn + URL emission
+ * + teardown. Retry, reconnect, fallback, and notification are owned by
+ * the manager per the spec's single-owner mandate.
+ */
+import fs from 'node:fs';
+import { spawn } from 'node:child_process';
+import { bin, install, Tunnel } from 'cloudflared';
+export class CloudflareNamedProvider {
+    name = 'cloudflare-named';
+    tier = 1;
+    token;
+    configFile;
+    hostname;
+    startTimeoutMs;
+    constructor(opts) {
+        this.token = opts.token;
+        this.configFile = opts.configFile;
+        this.hostname = opts.hostname;
+        this.startTimeoutMs = opts.startTimeoutMs;
+    }
+    async isAvailable() {
+        if (!this.token && !this.configFile)
+            return false;
+        if (this.configFile && !fs.existsSync(this.configFile))
+            return false;
+        return typeof bin === 'string' && bin.length > 0;
+    }
+    start(localPort) {
+        // Named tunnel doesn't actually use localPort — the hostname is
+        // pre-configured in Cloudflare to map to the agent's local port.
+        // Accepting the parameter keeps the TunnelProvider signature uniform.
+        void localPort;
+        if (this.configFile) {
+            return this.startConfigFile();
+        }
+        if (this.token) {
+            return this.startWithToken();
+        }
+        return Promise.reject(new Error('binary-missing: named tunnel requires either a token or a configFile'));
+    }
+    async startWithToken() {
+        if (!fs.existsSync(bin)) {
+            try {
+                await install(bin);
+            }
+            catch (err) {
+                throw new Error(`binary-missing: cloudflared install failed: ${err.message}`);
+            }
+        }
+        return new Promise((resolve, reject) => {
+            let tunnel;
+            try {
+                tunnel = Tunnel.withToken(this.token);
+            }
+            catch (err) {
+                reject(new Error(`process-exit: failed to spawn cloudflared (token): ${err.message}`));
+                return;
+            }
+            const hostname = this.hostname;
+            const timeoutMs = this.startTimeoutMs ?? 30_000;
+            let resolved = false;
+            const timeout = setTimeout(() => {
+                if (resolved)
+                    return;
+                resolved = true;
+                try {
+                    tunnel.stop();
+                }
+                catch { /* may already be dead */ }
+                reject(new Error('timeout: cloudflared named tunnel did not connect within the start budget'));
+            }, timeoutMs);
+            const finalize = (url) => {
+                resolved = true;
+                clearTimeout(timeout);
+                resolve({
+                    url,
+                    stop: () => this.stopHandle(tunnel),
+                });
+            };
+            tunnel.once('url', (url) => {
+                if (resolved)
+                    return;
+                finalize(url);
+            });
+            tunnel.once('connected', () => {
+                // For token-auth named tunnels, cloudflared often surfaces
+                // 'connected' before/instead of 'url'; the public URL is the
+                // pre-configured hostname.
+                if (resolved)
+                    return;
+                if (hostname) {
+                    finalize(`https://${hostname}`);
+                }
+            });
+            tunnel.on('error', (err) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timeout);
+                const msg = (err?.message ?? '').toLowerCase();
+                if (msg.includes('429') || msg.includes('1015') || msg.includes('rate limit')) {
+                    reject(new Error(`rate-limited: cloudflared named tunnel rate-limited: ${err.message}`));
+                    return;
+                }
+                reject(err);
+            });
+            tunnel.on('exit', (code) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timeout);
+                reject(new Error(`process-exit code ${code}: named tunnel exited before URL emit`));
+            });
+        });
+    }
+    startConfigFile() {
+        const configFile = this.configFile;
+        const hostname = this.hostname;
+        const timeoutMs = this.startTimeoutMs ?? 15_000;
+        return new Promise((resolve, reject) => {
+            if (!fs.existsSync(configFile)) {
+                reject(new Error(`binary-missing: tunnel config file not found: ${configFile}`));
+                return;
+            }
+            if (!fs.existsSync(bin)) {
+                // Spawn will fail; surface as binary-missing for consistency.
+                reject(new Error(`binary-missing: cloudflared binary not installed: ${bin}`));
+                return;
+            }
+            const child = spawn(bin, ['tunnel', '--config', configFile, 'run'], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            let resolved = false;
+            let stderrBuffer = '';
+            const timeout = setTimeout(() => {
+                if (resolved)
+                    return;
+                resolved = true;
+                // Config-file tunnels sometimes never log a 'connection registered'
+                // line but still come up. If hostname is configured, accept it as
+                // the URL — same behavior as the legacy implementation.
+                if (hostname) {
+                    resolve({
+                        url: `https://${hostname}`,
+                        stop: () => this.stopChild(child),
+                    });
+                }
+                else {
+                    try {
+                        child.kill('SIGTERM');
+                    }
+                    catch { /* already dead */ }
+                    reject(new Error('timeout: named config-file tunnel timed out and no hostname configured'));
+                }
+            }, timeoutMs);
+            child.stderr.on('data', (data) => {
+                const line = data.toString();
+                stderrBuffer = (stderrBuffer + line).slice(-500);
+                if (resolved)
+                    return;
+                if (line.includes('Registered tunnel connection') || line.includes('Connection registered')) {
+                    if (hostname) {
+                        resolved = true;
+                        clearTimeout(timeout);
+                        resolve({
+                            url: `https://${hostname}`,
+                            stop: () => this.stopChild(child),
+                        });
+                    }
+                }
+            });
+            child.on('error', (err) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timeout);
+                reject(new Error(`process-exit: failed to start config-file tunnel: ${err.message}`));
+            });
+            child.on('exit', (code) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timeout);
+                reject(new Error(`process-exit code ${code}: config-file tunnel exited before connection: ${stderrBuffer}`));
+            });
+        });
+    }
+    async stopHandle(tunnel) {
+        const proc = tunnel.process;
+        const pid = proc?.pid;
+        try {
+            tunnel.stop();
+        }
+        catch { /* already dead */ }
+        if (!pid)
+            return;
+        await this.killWithEscalation(pid);
+    }
+    async stopChild(child) {
+        const pid = child.pid;
+        try {
+            child.kill('SIGTERM');
+        }
+        catch { /* already dead */ }
+        if (!pid)
+            return;
+        await this.killWithEscalation(pid);
+    }
+    async killWithEscalation(pid, timeoutMs = 5_000) {
+        const exited = await new Promise((resolve) => {
+            const timer = setTimeout(() => resolve(false), timeoutMs);
+            try {
+                process.kill(pid, 0);
+            }
+            catch {
+                clearTimeout(timer);
+                resolve(true);
+                return;
+            }
+            const poll = setInterval(() => {
+                try {
+                    process.kill(pid, 0);
+                }
+                catch {
+                    clearInterval(poll);
+                    clearTimeout(timer);
+                    resolve(true);
+                }
+            }, 200);
+        });
+        if (!exited) {
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch { /* already dead */ }
+        }
+    }
+}
+//# sourceMappingURL=CloudflareNamedProvider.js.map

package/dist/tunnel/CloudflareNamedProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareNamedProvider.js","sourceRoot":"","sources":["../../src/tunnel/CloudflareNamedProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAmBnD,MAAM,OAAO,uBAAuB;IACzB,IAAI,GAAiB,kBAAkB,CAAC;IACxC,IAAI,GAAiB,CAAC,CAAC;IAEf,KAAK,CAAU;IACf,UAAU,CAAU;IACpB,QAAQ,CAAU;IAClB,cAAc,CAAU;IAEzC,YAAY,IAAoC;QAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAiB;QACrB,gEAAgE;QAChE,iEAAiE;QACjE,sEAAsE;QACtE,KAAK,SAAS,CAAC;QACf,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,+CAAgD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QAED,OAAO,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAuD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC;YAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC;oBAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC,CAAC;YACjG,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAQ,EAAE;gBACrC,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC;oBACN,GAAG;oBACH,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE;gBACjC,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC5B,2DAA2D;gBAC3D,6DAA6D;gBAC7D,2BAA2B;gBAC3B,IAAI,QAAQ;oBAAE,OAAO;gBACrB,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAChC,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9E,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBACzF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE;gBACxC,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,uCAAuC,CAAC,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,eAAe;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC;QAEhD,OAAO,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,UAAU,EAAE,CAAC,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,8DAA8D;gBAC9D,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC9E,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;gBAClE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,YAAY,GAAG,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,oEAAoE;gBACpE,kEAAkE;gBAClE,wDAAwD;gBACxD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC;wBACN,GAAG,EAAE,WAAW,QAAQ,EAAE;wBAC1B,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;oBAC3D,MAAM,CAAC,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC,CAAC;gBAC9F,CAAC;YACH,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,YAAY,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;gBACjD,IAAI,QAAQ;oBAAE,OAAO;gBACrB,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAC5F,IAAI,QAAQ,EAAE,CAAC;wBACb,QAAQ,GAAG,IAAI,CAAC;wBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;wBACtB,OAAO,CAAC;4BACN,GAAG,EAAE,WAAW,QAAQ,EAAE;4BAC1B,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;yBAClC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAC/B,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACxF,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE;gBACvC,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,kDAAkD,YAAY,EAAE,CAAC,CAAC,CAAC;YAC/G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QACtB,IAAI,CAAC;YAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAA+B;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,SAAS,GAAG,KAAK;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa,CAAC,IAAI,CAAC,CAAC;oBACpB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF"}

package/dist/tunnel/CloudflareQuickProvider.d.ts

@@ -0,0 +1,48 @@
+/**
+ * CloudflareQuickProvider — Tier-1 zero-config Cloudflare quick tunnel.
+ *
+ * Extracted from the original `TunnelManager.startQuickTunnel()` so the
+ * manager can drive multiple providers through the common
+ * `TunnelProvider` interface. Behavior preserved verbatim where it
+ * doesn't conflict with the spec's single-owner mandate:
+ *
+ *   - Owns: spawning `cloudflared` with --config-isolation; resolving
+ *     when the quick-tunnel URL emits; tearing down on stop().
+ *   - Does NOT own: retry/backoff, reconnect-on-disconnect, failure
+ *     notification, episode/consent state. Those are the manager's
+ *     responsibility now (per
+ *     specs/dev-infrastructure/tunnel-failure-resilience.md Part 1's
+ *     "single-owner mandate" that retires the old in-provider reconnect
+ *     loop).
+ *
+ * Failure-mode classification is surfaced via the rejection Error's
+ * `message`; the manager parses to `ProviderFailureReason`. This module
+ * uses fixed substrings the manager recognizes:
+ *   - "rate-limited" (Cloudflare 429 / 1015 detected from cloudflared stderr)
+ *   - "binary-missing" (the bundled cloudflared binary path doesn't exist)
+ *   - "timeout" (URL didn't emit within the start budget)
+ *   - "process-exit code N" (child exited before URL emit)
+ */
+import type { TunnelProvider, TunnelProviderHandle, ProviderName, ProviderTier } from './TunnelProvider.js';
+export interface CloudflareQuickProviderOptions {
+    /** Local port to expose. */
+    port: number;
+    /** State directory for the quick-tunnel isolation config file. */
+    stateDir: string;
+    /** Start timeout in milliseconds (default: 30_000). */
+    startTimeoutMs?: number;
+}
+export declare class CloudflareQuickProvider implements TunnelProvider {
+    readonly name: ProviderName;
+    readonly tier: ProviderTier;
+    private readonly port;
+    private readonly stateDir;
+    private readonly startTimeoutMs;
+    constructor(opts: CloudflareQuickProviderOptions);
+    isAvailable(): Promise<boolean>;
+    start(localPort: number): Promise<TunnelProviderHandle>;
+    private startInner;
+    private classifyError;
+    private stopHandle;
+}
+//# sourceMappingURL=CloudflareQuickProvider.d.ts.map

package/dist/tunnel/CloudflareQuickProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareQuickProvider.d.ts","sourceRoot":"","sources":["../../src/tunnel/CloudflareQuickProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACb,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,8BAA8B;IAC7C,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,uBAAwB,YAAW,cAAc;IAC5D,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAsB;IACjD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAK;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,IAAI,EAAE,8BAA8B;IAM1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQrC,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;YASzC,UAAU;IA6FxB,OAAO,CAAC,aAAa;YAiBP,UAAU;CAmCzB"}

package/dist/tunnel/CloudflareQuickProvider.js

@@ -0,0 +1,201 @@
+/**
+ * CloudflareQuickProvider — Tier-1 zero-config Cloudflare quick tunnel.
+ *
+ * Extracted from the original `TunnelManager.startQuickTunnel()` so the
+ * manager can drive multiple providers through the common
+ * `TunnelProvider` interface. Behavior preserved verbatim where it
+ * doesn't conflict with the spec's single-owner mandate:
+ *
+ *   - Owns: spawning `cloudflared` with --config-isolation; resolving
+ *     when the quick-tunnel URL emits; tearing down on stop().
+ *   - Does NOT own: retry/backoff, reconnect-on-disconnect, failure
+ *     notification, episode/consent state. Those are the manager's
+ *     responsibility now (per
+ *     specs/dev-infrastructure/tunnel-failure-resilience.md Part 1's
+ *     "single-owner mandate" that retires the old in-provider reconnect
+ *     loop).
+ *
+ * Failure-mode classification is surfaced via the rejection Error's
+ * `message`; the manager parses to `ProviderFailureReason`. This module
+ * uses fixed substrings the manager recognizes:
+ *   - "rate-limited" (Cloudflare 429 / 1015 detected from cloudflared stderr)
+ *   - "binary-missing" (the bundled cloudflared binary path doesn't exist)
+ *   - "timeout" (URL didn't emit within the start budget)
+ *   - "process-exit code N" (child exited before URL emit)
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { bin, install, Tunnel } from 'cloudflared';
+export class CloudflareQuickProvider {
+    name = 'cloudflare-quick';
+    tier = 1;
+    port;
+    stateDir;
+    startTimeoutMs;
+    constructor(opts) {
+        this.port = opts.port;
+        this.stateDir = opts.stateDir;
+        this.startTimeoutMs = opts.startTimeoutMs ?? 30_000;
+    }
+    async isAvailable() {
+        // The cloudflared npm package installs the binary on-demand via
+        // install(bin). availability == we can install or already have it.
+        // We don't actually do the install here; we just confirm the path
+        // is resolvable. Install happens during start().
+        return typeof bin === 'string' && bin.length > 0;
+    }
+    start(localPort) {
+        // localPort overrides constructor-time port for flexibility, but we
+        // default to the constructor value.
+        const port = localPort || this.port;
+        return new Promise((resolve, reject) => {
+            void this.startInner(port, resolve, reject);
+        });
+    }
+    async startInner(port, resolve, reject) {
+        try {
+            if (!fs.existsSync(bin)) {
+                try {
+                    await install(bin);
+                }
+                catch (installErr) {
+                    reject(new Error(`binary-missing: cloudflared install failed: ${installErr.message}`));
+                    return;
+                }
+            }
+        }
+        catch {
+            reject(new Error('binary-missing: cloudflared binary path unresolvable'));
+            return;
+        }
+        const localUrl = `http://127.0.0.1:${port}`;
+        let tunnel;
+        try {
+            // Empty config to prevent cloudflared from reading
+            // ~/.cloudflared/config.yml, whose named-tunnel ingress rules
+            // would override the quick-tunnel's --url proxy. Preserved from
+            // the original implementation.
+            const emptyConfig = path.join(this.stateDir, 'cloudflared-quick.yml');
+            const dir = path.dirname(emptyConfig);
+            if (!fs.existsSync(dir)) {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+            fs.writeFileSync(emptyConfig, '# Quick tunnel — no ingress rules\n');
+            tunnel = Tunnel.quick(localUrl, { '--config': emptyConfig });
+        }
+        catch (err) {
+            reject(new Error(`process-exit: failed to spawn cloudflared: ${err.message}`));
+            return;
+        }
+        let resolved = false;
+        let urlEmitted = null;
+        let stderrTail = '';
+        const timeout = setTimeout(() => {
+            if (!resolved) {
+                resolved = true;
+                try {
+                    tunnel.stop();
+                }
+                catch { /* may already be dead */ }
+                reject(new Error('timeout: cloudflared quick tunnel did not emit a URL within the start budget'));
+            }
+        }, this.startTimeoutMs);
+        tunnel.once('url', (url) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timeout);
+            urlEmitted = url;
+            resolve({
+                url,
+                stop: () => this.stopHandle(tunnel),
+            });
+        });
+        tunnel.on('error', (err) => {
+            // Capture stderr-ish context. The cloudflared npm wrapper emits
+            // 'error' for child exit failures; we use the message as is.
+            stderrTail = (stderrTail + ' ' + (err?.message ?? '')).slice(-500);
+            if (!resolved) {
+                resolved = true;
+                clearTimeout(timeout);
+                reject(this.classifyError(err?.message ?? '', stderrTail));
+            }
+            // After resolution, we do NOT auto-reconnect. The manager owns
+            // disconnect handling per the single-owner mandate.
+        });
+        tunnel.on('exit', (code) => {
+            if (!resolved) {
+                resolved = true;
+                clearTimeout(timeout);
+                const msg = code === 0
+                    ? 'process-exit: cloudflared exited cleanly before URL emission'
+                    : `process-exit code ${code}: ${stderrTail || 'no stderr captured'}`;
+                reject(this.classifyError(msg, stderrTail));
+            }
+            // Post-resolution exits are surfaced to the manager via the
+            // handle's lifecycle. (The handle itself doesn't reconnect.)
+        });
+        // urlEmitted is referenced only inside the closure above; this
+        // suppresses an unused-variable lint while documenting intent.
+        void urlEmitted;
+    }
+    classifyError(msg, stderr) {
+        const haystack = `${msg} ${stderr}`.toLowerCase();
+        // Cloudflare's quick-tunnel rate-limit surfaces as 429 / error 1015.
+        // Both substrings appear in cloudflared's stderr on rate-limit.
+        if (haystack.includes('429') || haystack.includes('1015') || haystack.includes('rate limit') || haystack.includes('too many requests')) {
+            return new Error(`rate-limited: cloudflared quick-tunnel rate-limited (${msg})`);
+        }
+        if (haystack.includes('enoent') || haystack.includes('not found') || haystack.includes('binary-missing')) {
+            return new Error(`binary-missing: ${msg}`);
+        }
+        if (haystack.includes('dns') || haystack.includes('eai_again') || haystack.includes('econnrefused') || haystack.includes('network')) {
+            return new Error(`network: ${msg}`);
+        }
+        // Preserve as-is so the manager's classifier sees the original prefix.
+        return new Error(msg);
+    }
+    async stopHandle(tunnel) {
+        // Force-stop with PID escalation, mirroring TunnelManager.forceStop's
+        // SIGINT → SIGKILL pattern. This is security-load-bearing per spec
+        // Part 5 (relay teardown must guarantee the child process dies).
+        const proc = tunnel.process;
+        const pid = proc?.pid;
+        try {
+            tunnel.stop();
+        }
+        catch { /* may already be dead */ }
+        if (!pid)
+            return;
+        // Poll for exit; escalate to SIGKILL after 5s.
+        const timeoutMs = 5_000;
+        const exited = await new Promise((resolve) => {
+            const timer = setTimeout(() => resolve(false), timeoutMs);
+            try {
+                process.kill(pid, 0);
+            }
+            catch {
+                clearTimeout(timer);
+                resolve(true);
+                return;
+            }
+            const poll = setInterval(() => {
+                try {
+                    process.kill(pid, 0);
+                }
+                catch {
+                    clearInterval(poll);
+                    clearTimeout(timer);
+                    resolve(true);
+                }
+            }, 200);
+        });
+        if (!exited) {
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch { /* already dead */ }
+        }
+    }
+}
+//# sourceMappingURL=CloudflareQuickProvider.js.map

package/dist/tunnel/CloudflareQuickProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareQuickProvider.js","sourceRoot":"","sources":["../../src/tunnel/CloudflareQuickProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiBnD,MAAM,OAAO,uBAAuB;IACzB,IAAI,GAAiB,kBAAkB,CAAC;IACxC,IAAI,GAAiB,CAAC,CAAC;IAEf,IAAI,CAAS;IACb,QAAQ,CAAS;IACjB,cAAc,CAAS;IAExC,YAAY,IAAoC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,iDAAiD;QACjD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAiB;QACrB,oEAAoE;QACpE,oCAAoC;QACpC,MAAM,IAAI,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC;QACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,KAAK,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,OAA0C,EAC1C,MAA4B;QAE5B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,+CAAgD,UAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAClG,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAc,CAAC;QAEnB,IAAI,CAAC;YACH,mDAAmD;YACnD,8DAA8D;YAC9D,gEAAgE;YAChE,+BAA+B;YAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;YACrE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA+C,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,UAAU,GAAG,EAAE,CAAC;QAEpB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC;oBAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC,CAAC;YACpG,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE;YACjC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,UAAU,GAAG,GAAG,CAAC;YACjB,OAAO,CAAC;gBACN,GAAG;gBACH,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAChC,gEAAgE;YAChE,6DAA6D;YAC7D,UAAU,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,+DAA+D;YAC/D,oDAAoD;QACtD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAmB,EAAE,EAAE;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC;oBACpB,CAAC,CAAC,8DAA8D;oBAChE,CAAC,CAAC,qBAAqB,IAAI,KAAK,UAAU,IAAI,oBAAoB,EAAE,CAAC;gBACvE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,4DAA4D;YAC5D,6DAA6D;QAC/D,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,+DAA+D;QAC/D,KAAK,UAAU,CAAC;IAClB,CAAC;IAEO,aAAa,CAAC,GAAW,EAAE,MAAc;QAC/C,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,qEAAqE;QACrE,gEAAgE;QAChE,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvI,OAAO,IAAI,KAAK,CAAC,wDAAwD,GAAG,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzG,OAAO,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpI,OAAO,IAAI,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,uEAAuE;QACvE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc;QACrC,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QACtB,IAAI,CAAC;YAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,+CAA+C;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa,CAAC,IAAI,CAAC,CAAC;oBACpB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF"}