instar 1.2.39 → 1.2.40

package/dist/tunnel/LocaltunnelProvider.d.ts

@@ -0,0 +1,63 @@
+/**
+ * LocaltunnelProvider — Tier-2 consent-gated relay tunnel via *.loca.lt.
+ *
+ * Per spec specs/dev-infrastructure/tunnel-failure-resilience.md Part 1
+ * (provider abstraction, Tier 2) and Part 7 (supply-chain hardening).
+ *
+ * SECURITY POSTURE:
+ *   - localtunnel routes the agent's local server traffic through
+ *     loca.lt servers. The relay operator (and anyone who logs the URL)
+ *     can see dashboard PIN + signed view URLs while the relay is active.
+ *     This is exactly why the spec gates Tier-2 providers behind owner
+ *     consent — see Part 3 (consent flow) and Part 6 (mandatory
+ *     credential rotation on relay-episode end).
+ *   - The agent never spins this up without an explicit per-episode
+ *     consent record bound to the owner principal — that's enforced in
+ *     TunnelManager's state machine, not in this provider.
+ *
+ * Supply-chain hardening (Part 7):
+ *   - The npm package `localtunnel` is pinned at exact version in
+ *     package.json (no caret range).
+ *   - The provider spawns the localtunnel client via its programmatic
+ *     API; a future hardening PR can switch to child-process isolation
+ *     once the spec's checksum-verified install path is added.
+ *   - `isAvailable()` resolves false if the npm package cannot be
+ *     loaded, so a missing dep degrades gracefully (provider skipped)
+ *     instead of crashing.
+ *
+ * The provider does NOT own retry/reconnect/notification — those are
+ * the manager's responsibility per the single-owner mandate (PR 2).
+ */
+import type { TunnelProvider, TunnelProviderHandle, ProviderName, ProviderTier } from './TunnelProvider.js';
+export interface LocaltunnelProviderOptions {
+    /** Local port the relay should point at. */
+    port: number;
+    /** Start timeout in milliseconds (default: 20_000). */
+    startTimeoutMs?: number;
+    /**
+     * Optional subdomain hint passed to localtunnel. When set, the
+     * service will try to allocate the requested name; when unavailable
+     * (already taken or rate-limited), localtunnel falls back to a
+     * random subdomain. NEVER use the agent's identity here — the
+     * subdomain is publicly visible on *.loca.lt.
+     */
+    subdomain?: string;
+}
+export declare class LocaltunnelProvider implements TunnelProvider {
+    readonly name: ProviderName;
+    readonly tier: ProviderTier;
+    private readonly port;
+    private readonly startTimeoutMs;
+    private readonly subdomain;
+    /**
+     * Cached dynamic-import result. The first `isAvailable()` call
+     * detects whether the npm package is present; subsequent calls reuse
+     * the cached resolution.
+     */
+    private _moduleResolved;
+    constructor(opts: LocaltunnelProviderOptions);
+    isAvailable(): Promise<boolean>;
+    start(localPort: number): Promise<TunnelProviderHandle>;
+    private loadModule;
+}
+//# sourceMappingURL=LocaltunnelProvider.d.ts.map

package/dist/tunnel/LocaltunnelProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocaltunnelProvider.d.ts","sourceRoot":"","sources":["../../src/tunnel/LocaltunnelProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACb,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,0BAA0B;IACzC,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAiB;IAC5C,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAK;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAgD;gBAE3D,IAAI,EAAE,0BAA0B;IAMtC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAK/B,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;YA8D/C,UAAU;CAezB"}

package/dist/tunnel/LocaltunnelProvider.js

@@ -0,0 +1,130 @@
+/**
+ * LocaltunnelProvider — Tier-2 consent-gated relay tunnel via *.loca.lt.
+ *
+ * Per spec specs/dev-infrastructure/tunnel-failure-resilience.md Part 1
+ * (provider abstraction, Tier 2) and Part 7 (supply-chain hardening).
+ *
+ * SECURITY POSTURE:
+ *   - localtunnel routes the agent's local server traffic through
+ *     loca.lt servers. The relay operator (and anyone who logs the URL)
+ *     can see dashboard PIN + signed view URLs while the relay is active.
+ *     This is exactly why the spec gates Tier-2 providers behind owner
+ *     consent — see Part 3 (consent flow) and Part 6 (mandatory
+ *     credential rotation on relay-episode end).
+ *   - The agent never spins this up without an explicit per-episode
+ *     consent record bound to the owner principal — that's enforced in
+ *     TunnelManager's state machine, not in this provider.
+ *
+ * Supply-chain hardening (Part 7):
+ *   - The npm package `localtunnel` is pinned at exact version in
+ *     package.json (no caret range).
+ *   - The provider spawns the localtunnel client via its programmatic
+ *     API; a future hardening PR can switch to child-process isolation
+ *     once the spec's checksum-verified install path is added.
+ *   - `isAvailable()` resolves false if the npm package cannot be
+ *     loaded, so a missing dep degrades gracefully (provider skipped)
+ *     instead of crashing.
+ *
+ * The provider does NOT own retry/reconnect/notification — those are
+ * the manager's responsibility per the single-owner mandate (PR 2).
+ */
+export class LocaltunnelProvider {
+    name = 'localtunnel';
+    tier = 2;
+    port;
+    startTimeoutMs;
+    subdomain;
+    /**
+     * Cached dynamic-import result. The first `isAvailable()` call
+     * detects whether the npm package is present; subsequent calls reuse
+     * the cached resolution.
+     */
+    _moduleResolved;
+    constructor(opts) {
+        this.port = opts.port;
+        this.startTimeoutMs = opts.startTimeoutMs ?? 20_000;
+        this.subdomain = opts.subdomain;
+    }
+    async isAvailable() {
+        const mod = await this.loadModule();
+        return mod !== 'unavailable';
+    }
+    async start(localPort) {
+        const mod = await this.loadModule();
+        if (mod === 'unavailable') {
+            throw new Error('binary-missing: localtunnel npm package is not installed');
+        }
+        const lt = mod.default;
+        if (typeof lt !== 'function') {
+            throw new Error('binary-missing: localtunnel module did not expose the expected factory');
+        }
+        const port = localPort || this.port;
+        return new Promise((resolve, reject) => {
+            let resolved = false;
+            const timeout = setTimeout(() => {
+                if (resolved)
+                    return;
+                resolved = true;
+                reject(new Error('timeout: localtunnel did not emit a URL within the start budget'));
+            }, this.startTimeoutMs);
+            lt({ port, subdomain: this.subdomain }).then((client) => {
+                if (resolved) {
+                    try {
+                        client.close();
+                    }
+                    catch { /* best effort */ }
+                    return;
+                }
+                resolved = true;
+                clearTimeout(timeout);
+                if (!client.url) {
+                    reject(new Error('process-exit: localtunnel returned no URL'));
+                    return;
+                }
+                client.on('error', () => { });
+                resolve({
+                    url: client.url,
+                    stop: async () => {
+                        try {
+                            client.close();
+                        }
+                        catch { /* already dead */ }
+                    },
+                });
+            }, (err) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timeout);
+                const msg = (err?.message ?? '').toLowerCase();
+                if (msg.includes('rate') || msg.includes('429')) {
+                    reject(new Error(`rate-limited: localtunnel: ${err.message}`));
+                    return;
+                }
+                if (msg.includes('econnrefused') || msg.includes('dns')) {
+                    reject(new Error(`network: localtunnel: ${err.message}`));
+                    return;
+                }
+                reject(new Error(`process-exit: localtunnel start failed: ${err.message}`));
+            });
+        });
+    }
+    async loadModule() {
+        if (this._moduleResolved !== undefined)
+            return this._moduleResolved;
+        try {
+            // Dynamic specifier so TypeScript doesn't require an installed
+            // `@types/localtunnel`. The npm package itself is an optional
+            // peer-style dep — agents without it installed degrade
+            // gracefully via the catch below.
+            const specifier = 'localtunnel';
+            const mod = (await import(/* @vite-ignore */ specifier));
+            this._moduleResolved = mod;
+        }
+        catch {
+            this._moduleResolved = 'unavailable';
+        }
+        return this._moduleResolved;
+    }
+}
+//# sourceMappingURL=LocaltunnelProvider.js.map

package/dist/tunnel/LocaltunnelProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocaltunnelProvider.js","sourceRoot":"","sources":["../../src/tunnel/LocaltunnelProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAwCH,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAiB,aAAa,CAAC;IACnC,IAAI,GAAiB,CAAC,CAAC;IAEf,IAAI,CAAS;IACb,cAAc,CAAS;IACvB,SAAS,CAAqB;IAC/C;;;;OAIG;IACK,eAAe,CAAgD;IAEvE,YAAY,IAAgC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,OAAO,GAAG,KAAK,aAAa,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;QACvB,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC;QAEpC,OAAO,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC,CAAC;YACvF,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAExB,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAC1C,CAAC,MAAM,EAAE,EAAE;gBACT,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBAEtB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBAED,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAA+C,CAAC,CAAC,CAAC;gBAE1E,OAAO,CAAC;oBACN,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,IAAI,EAAE,KAAK,IAAI,EAAE;wBACf,IAAI,CAAC;4BAAC,MAAM,CAAC,KAAK,EAAE,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;oBACtD,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,EACD,CAAC,GAAU,EAAE,EAAE;gBACb,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChD,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxD,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,KAAK,CAAC,2CAA2C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QACpE,IAAI,CAAC;YACH,+DAA+D;YAC/D,8DAA8D;YAC9D,uDAAuD;YACvD,kCAAkC;YAClC,MAAM,SAAS,GAAG,aAAa,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAsB,CAAC;YAC9E,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF"}

package/dist/tunnel/TunnelManager.d.ts

@@ -40,7 +40,7 @@
  */
 import { EventEmitter } from 'node:events';
 import { type PersistedTunnelState } from './TunnelLifecycle.js';
-import type { TunnelProvider, ProviderFailureReason } from './TunnelProvider.js';
+import type { TunnelProvider, ProviderName, ProviderFailureReason } from './TunnelProvider.js';
 import type { NotifierSink } from './TunnelNotifier.js';
 export interface TunnelConfig {
     /** Whether tunnel is enabled. */
@@ -110,6 +110,13 @@ export declare class TunnelManager extends EventEmitter {
     private _backoffAttempt;
     private _backoffTimer;
     private _postExhaustedTimer;
+    /**
+     * Pending consent record — populated when the manager enters
+     * `awaiting-consent` and cleared on grant / decline / timeout / stop.
+     * The nonce is the CSPRNG token sent to the owner; matching it on
+     * `grantConsent()` is the security-load-bearing check.
+     */
+    private _pendingConsent;
     constructor(config: TunnelConfig, injections?: TunnelManagerInjections);
     get url(): string | null;
     get isRunning(): boolean;
@@ -154,6 +161,42 @@ export declare class TunnelManager extends EventEmitter {
     private doStart;
     private driveTier1;
     private exhaustedOrBackoff;
+    /** First Tier-2 provider that reports available, or null. */
+    private findAvailableTier2;
+    /**
+     * Internal — called after the lifecycle transitions to
+     * `awaiting-consent`. Generates the one-time nonce, stores the
+     * pending consent record, and arms the timeout.
+     */
+    private requestConsent;
+    private clearPendingConsent;
+    /**
+     * Public — called by the consent UX layer (Telegram callback handler
+     * in PR 6) after the owner approves. Validates the nonce matches the
+     * pending consent record, starts the Tier-2 provider, and transitions
+     * to `relay-active`. Returns true on success, false if the nonce
+     * didn't match (replay, race, stale click) or the state moved beyond
+     * awaiting-consent.
+     */
+    grantConsent(nonce: string): Promise<boolean>;
+    /**
+     * Public — called by the consent UX layer when the owner declines.
+     * Validates the nonce, applies the cross-episode cooldown, and
+     * transitions to `exhausted` + background retry.
+     */
+    declineConsent(nonce: string): boolean;
+    private recordConsentDecline;
+    /**
+     * Public — the active pending-consent record (or null). Used by the
+     * consent UX layer (PR 6) to know what nonce to embed in the inline
+     * button.
+     */
+    get pendingConsent(): {
+        episodeId: string;
+        provider: ProviderName;
+        nonce: string;
+        issuedAt: number;
+    } | null;
     /**
      * Background retry — runs the bounded exponential ladder off the
      * start() promise so initial start() resolves/rejects fast. After

package/dist/tunnel/TunnelManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TunnelManager.d.ts","sourceRoot":"","sources":["../../src/tunnel/TunnelManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,cAAc,EAGd,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKxD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,4FAA4F;IAC5F,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,SAAS,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACxE,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAAC;IAC1C,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAAC;CAC1C;AAsBD,qBAAa,aAAc,SAAQ,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAwB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IAEvC,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,mBAAmB,CAA6B;IACxD,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,mBAAmB,CAA8C;gBAE7D,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,uBAAuB;IA4BtE,IAAI,GAAG,IAAI,MAAM,GAAG,IAAI,CAAkC;IAE1D,IAAI,SAAS,IAAI,OAAO,CAA0D;IAElF,IAAI,KAAK,IAAI,WAAW,CAAqC;IAE7D,kDAAkD;IAClD,IAAI,cAAc,IAAI,oBAAoB,CAIzC;IAED;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAQxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB3B,4EAA4E;IACtE,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,mBAAmB,IAAI,IAAI;IAE3B,oBAAoB,IAAI,IAAI;IAK5B,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOhD;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI;IAoB7F,OAAO,CAAC,gBAAgB;YAaV,OAAO;YAiBP,UAAU;YA8DV,kBAAkB;IA8BhC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAiC/B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,uBAAuB;IAO/B;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAuBlC,6EAA6E;YAC/D,iBAAiB;IAgB/B,OAAO,CAAC,OAAO;IAYf,OAAO,CAAC,gBAAgB;CAYzB;AAED,YAAY,EAAE,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"TunnelManager.d.ts","sourceRoot":"","sources":["../../src/tunnel/TunnelManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAIL,KAAK,oBAAoB,EAE1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,cAAc,EAEd,YAAY,EACZ,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKxD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,4FAA4F;IAC5F,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,SAAS,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACxE,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAAC;IAC1C,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAAC;CAC1C;AAwBD,qBAAa,aAAc,SAAQ,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAwB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IAEvC,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,mBAAmB,CAA6B;IACxD,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,mBAAmB,CAA8C;IACzE;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAMP;gBAEJ,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,uBAAuB;IA4BtE,IAAI,GAAG,IAAI,MAAM,GAAG,IAAI,CAAkC;IAE1D,IAAI,SAAS,IAAI,OAAO,CAA0D;IAElF,IAAI,KAAK,IAAI,WAAW,CAAqC;IAE7D,kDAAkD;IAClD,IAAI,cAAc,IAAI,oBAAoB,CAIzC;IAED;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAQxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B3B,4EAA4E;IACtE,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,mBAAmB,IAAI,IAAI;IAE3B,oBAAoB,IAAI,IAAI;IAK5B,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOhD;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI;IAoB7F,OAAO,CAAC,gBAAgB;YAsBV,OAAO;YAiBP,UAAU;YA8DV,kBAAkB;IA0ChC,6DAA6D;YAC/C,kBAAkB;IAShC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;OAOG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8DnD;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAItC,OAAO,CAAC,oBAAoB;IAgB5B;;;;OAIG;IACH,IAAI,cAAc,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAQ1G;IAED;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAiC/B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,uBAAuB;IAO/B;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAuBlC,6EAA6E;YAC/D,iBAAiB;IAgB/B,OAAO,CAAC,OAAO;IAYf,OAAO,CAAC,gBAAgB;CAYzB;AAED,YAAY,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/tunnel/TunnelManager.js

@@ -41,9 +41,10 @@
 import { EventEmitter } from 'node:events';
 import fs from 'node:fs';
 import path from 'node:path';
-import { TunnelLifecycle, classifyFailure, } from './TunnelLifecycle.js';
+import { TunnelLifecycle, classifyFailure, generateNonce, } from './TunnelLifecycle.js';
 import { CloudflareQuickProvider } from './CloudflareQuickProvider.js';
 import { CloudflareNamedProvider } from './CloudflareNamedProvider.js';
+import { LocaltunnelProvider } from './LocaltunnelProvider.js';
 import { TunnelNotifier } from './TunnelNotifier.js';
 // ── Constants ───────────────────────────────────────────────────────
 const BASE_BACKOFF_MS = 5_000;
@@ -61,6 +62,8 @@ const REACHABILITY_TIMEOUT_MS = 8_000;
  * the regression we explicitly need to avoid in the PR chain.
  */
 const POST_EXHAUSTED_RETRY_INTERVAL_MS = 15 * 60_000;
+/** Per-episode consent prompt timeout — matches spec Part 4 default (15 min). */
+const CONSENT_TIMEOUT_MS = 15 * 60_000;
 // ── Manager ────────────────────────────────────────────────────────
 export class TunnelManager extends EventEmitter {
     config;
@@ -78,6 +81,13 @@ export class TunnelManager extends EventEmitter {
     _backoffAttempt = 0;
     _backoffTimer = null;
     _postExhaustedTimer = null;
+    /**
+     * Pending consent record — populated when the manager enters
+     * `awaiting-consent` and cleared on grant / decline / timeout / stop.
+     * The nonce is the CSPRNG token sent to the owner; matching it on
+     * `grantConsent()` is the security-load-bearing check.
+     */
+    _pendingConsent = null;
     constructor(config, injections) {
         super();
         this.config = config;
@@ -132,6 +142,7 @@ export class TunnelManager extends EventEmitter {
         this._stopped = true;
         this.clearBackoffTimer();
         this.clearPostExhaustedTimer();
+        this.clearPendingConsent();
         this._startPromise = null;
         if (this.currentHandle) {
             try {
@@ -208,6 +219,8 @@ export class TunnelManager extends EventEmitter {
     // ── Internals ──────────────────────────────────────────────────
     buildDefaultPool(config) {
         const pool = [];
+        // Tier-1 (automatic, secure). Cloudflare named first when configured,
+        // then quick as the zero-config default.
         if (config.token || config.configFile) {
             pool.push(new CloudflareNamedProvider({
                 token: config.token,
@@ -216,6 +229,13 @@ export class TunnelManager extends EventEmitter {
             }));
         }
         pool.push(new CloudflareQuickProvider({ port: config.port, stateDir: config.stateDir }));
+        // Tier-2 (consent-gated relays). Listed AFTER Tier-1 — the driver
+        // only reaches these after exhausting Tier-1, and only after the
+        // owner explicitly grants consent. LocaltunnelProvider's
+        // isAvailable() returns false when the `localtunnel` npm package
+        // isn't installed, so agents without the dep see this slot
+        // silently skipped — the spec's "opt-in capability" posture.
+        pool.push(new LocaltunnelProvider({ port: config.port }));
         return pool;
     }
     async doStart() {
@@ -293,31 +313,195 @@ export class TunnelManager extends EventEmitter {
         return this.exhaustedOrBackoff(lastErr);
     }
     async exhaustedOrBackoff(lastErr) {
-        // Matches the legacy semantics: start() rejects after the FIRST
-        // round of provider attempts fails. The backoff retry runs in the
-        // background — the manager keeps trying without blocking the
-        // caller, and emits 'url' when a later attempt succeeds. This
-        // prevents start() from blocking server.ts boot for the full
-        // 25-minute worst-case exponential window. The original failing
-        // E2E (tests/e2e/tunnel-private-view.test.ts) timed out at the
-        // beforeAll 60s budget because the old draft kept retrying inside
-        // start().
+        // start() rejects after the FIRST round of provider attempts
+        // fails (matches the legacy semantics). The backoff retry runs in
+        // the background — the manager keeps trying without blocking the
+        // caller, and emits 'url' when a later attempt succeeds.
+        //
+        // PR 5 addition: BEFORE transitioning to exhausted, check if any
+        // Tier-2 providers are available and the cross-episode consent
+        // cooldown isn't active. If so, transition to `awaiting-consent`
+        // and request consent from the owner. The relay-active path
+        // activates on `grantConsent()`.
+        const candidateTier2 = await this.findAvailableTier2();
+        const cooldownActive = this.lifecycle.isConsentSuppressed();
+        if (candidateTier2 && !cooldownActive) {
+            const from = this.lifecycle.state;
+            if (from === 'retrying' || from === 'starting') {
+                if (this.lifecycle.transition(from, 'awaiting-consent', {
+                    activeProvider: null,
+                    lastFailureReason: classifyFailure(lastErr),
+                })) {
+                    this.requestConsent(candidateTier2);
+                }
+            }
+            const err = lastErr ?? new Error('Tier-1 exhausted; awaiting owner consent for backup relay');
+            this.emit('error', err);
+            throw err;
+        }
         const from = this.lifecycle.state;
         if (from === 'retrying' || from === 'starting') {
             this.lifecycle.transition(from, 'exhausted', { activeProvider: null });
         }
         const err = lastErr ?? new Error('all Tier-1 providers failed');
-        // Schedule background retry (bounded exponential ladder, then the
-        // indefinite post-exhausted placeholder once the ladder runs out).
-        // Fire-and-forget; if a later attempt succeeds, the 'url' event
-        // fires and downstream subscribers (notifier, dashboard
-        // broadcaster, log line) catch up.
         if (this._autoReconnect && !this._stopped) {
             this.scheduleBackgroundRetry();
         }
         this.emit('error', err);
         throw err;
     }
+    /** First Tier-2 provider that reports available, or null. */
+    async findAvailableTier2() {
+        for (const p of this.providers) {
+            if (p.tier !== 2)
+                continue;
+            const avail = await p.isAvailable().catch(() => false);
+            if (avail)
+                return p;
+        }
+        return null;
+    }
+    /**
+     * Internal — called after the lifecycle transitions to
+     * `awaiting-consent`. Generates the one-time nonce, stores the
+     * pending consent record, and arms the timeout.
+     */
+    requestConsent(provider) {
+        this.clearPendingConsent();
+        const episode = this.lifecycle.episode;
+        if (!episode)
+            return;
+        const nonce = generateNonce();
+        const timer = setTimeout(() => {
+            this.recordConsentDecline(nonce, 'timeout');
+        }, CONSENT_TIMEOUT_MS);
+        this._pendingConsent = {
+            episodeId: episode.episodeId,
+            provider,
+            nonce,
+            issuedAt: Date.now(),
+            timer,
+        };
+    }
+    clearPendingConsent() {
+        if (this._pendingConsent) {
+            clearTimeout(this._pendingConsent.timer);
+            this._pendingConsent = null;
+        }
+    }
+    /**
+     * Public — called by the consent UX layer (Telegram callback handler
+     * in PR 6) after the owner approves. Validates the nonce matches the
+     * pending consent record, starts the Tier-2 provider, and transitions
+     * to `relay-active`. Returns true on success, false if the nonce
+     * didn't match (replay, race, stale click) or the state moved beyond
+     * awaiting-consent.
+     */
+    async grantConsent(nonce) {
+        if (!this._pendingConsent)
+            return false;
+        if (this._pendingConsent.nonce !== nonce)
+            return false;
+        if (this.lifecycle.state !== 'awaiting-consent') {
+            this.clearPendingConsent();
+            return false;
+        }
+        const { provider, episodeId } = this._pendingConsent;
+        if (this.lifecycle.episode?.episodeId !== episodeId) {
+            this.clearPendingConsent();
+            return false;
+        }
+        // Single-use: clear BEFORE starting so a replay loses cleanly.
+        this.clearPendingConsent();
+        try {
+            const handle = await provider.start(this.config.port);
+            const reachable = await this.probeReachability(handle.url).catch(() => false);
+            if (!reachable) {
+                try {
+                    await handle.stop();
+                }
+                catch { /* best effort */ }
+                this.lifecycle.recordAttempt(provider.name, 'reachability-failed');
+                this.lifecycle.recordConsentRefusal();
+                const from = this.lifecycle.state;
+                if (from === 'awaiting-consent') {
+                    this.lifecycle.transition('awaiting-consent', 'exhausted', { activeProvider: null });
+                }
+                if (this._autoReconnect && !this._stopped) {
+                    this.scheduleBackgroundRetry();
+                }
+                return false;
+            }
+            this.currentHandle = handle;
+            this.currentProviderName = provider.name;
+            this._legacyState.url = handle.url;
+            this._legacyState.startedAt = new Date().toISOString();
+            // Set rotation-pending — entering relay-active is the persisted
+            // marker that says "credentials must rotate when this episode
+            // ends" (per spec Part 6 / verification finding V1).
+            this.lifecycle.setRotationPending(true);
+            this.lifecycle.transition('awaiting-consent', 'relay-active', {
+                activeProvider: provider.name,
+                lastFailureReason: null,
+                rotationPending: true,
+            });
+            this.persist();
+            this.emit('url', handle.url);
+            return true;
+        }
+        catch (err) {
+            this.lifecycle.recordAttempt(provider.name, classifyFailure(err));
+            this.lifecycle.recordConsentRefusal();
+            const from = this.lifecycle.state;
+            if (from === 'awaiting-consent') {
+                this.lifecycle.transition('awaiting-consent', 'exhausted', { activeProvider: null });
+            }
+            if (this._autoReconnect && !this._stopped) {
+                this.scheduleBackgroundRetry();
+            }
+            return false;
+        }
+    }
+    /**
+     * Public — called by the consent UX layer when the owner declines.
+     * Validates the nonce, applies the cross-episode cooldown, and
+     * transitions to `exhausted` + background retry.
+     */
+    declineConsent(nonce) {
+        return this.recordConsentDecline(nonce, 'decline');
+    }
+    recordConsentDecline(nonce, _reason) {
+        if (!this._pendingConsent)
+            return false;
+        if (this._pendingConsent.nonce !== nonce)
+            return false;
+        if (this.lifecycle.state !== 'awaiting-consent') {
+            this.clearPendingConsent();
+            return false;
+        }
+        this.clearPendingConsent();
+        this.lifecycle.recordConsentRefusal();
+        this.lifecycle.transition('awaiting-consent', 'exhausted', { activeProvider: null });
+        if (this._autoReconnect && !this._stopped) {
+            this.scheduleBackgroundRetry();
+        }
+        return true;
+    }
+    /**
+     * Public — the active pending-consent record (or null). Used by the
+     * consent UX layer (PR 6) to know what nonce to embed in the inline
+     * button.
+     */
+    get pendingConsent() {
+        if (!this._pendingConsent)
+            return null;
+        return {
+            episodeId: this._pendingConsent.episodeId,
+            provider: this._pendingConsent.provider.name,
+            nonce: this._pendingConsent.nonce,
+            issuedAt: this._pendingConsent.issuedAt,
+        };
+    }
     /**
      * Background retry — runs the bounded exponential ladder off the
      * start() promise so initial start() resolves/rejects fast. After

package/dist/tunnel/TunnelManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"TunnelManager.js","sourceRoot":"","sources":["../../src/tunnel/TunnelManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAyDrD,uEAAuE;AAEvE,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAAG,EAAE,GAAG,MAAM,CAAC;AAErD,sEAAsE;AAEtE,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC5B,MAAM,CAAe;IACrB,SAAS,CAAS;IAElB,SAAS,CAAkB;IAC3B,SAAS,CAAmB;IACrC,QAAQ,CAAwB;IACvB,OAAO,CAAe;IAE/B,aAAa,GAAgC,IAAI,CAAC;IAClD,mBAAmB,GAAwB,IAAI,CAAC;IAChD,YAAY,CAAc;IAC1B,cAAc,GAAG,IAAI,CAAC,CAAC,iCAAiC;IACxD,QAAQ,GAAG,KAAK,CAAC;IACjB,aAAa,GAA2B,IAAI,CAAC;IAC7C,eAAe,GAAG,CAAC,CAAC;IACpB,aAAa,GAAyC,IAAI,CAAC;IAC3D,mBAAmB,GAAyC,IAAI,CAAC;IAEzE,YAAY,MAAoB,EAAE,UAAoC;QACpE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,UAAU,EAAE,YAAY;YACtC,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,CAAC,OAAO,GAAG,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEtE,IAAI,CAAC,YAAY,GAAG;YAClB,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,oDAAoD;QACpD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAkB,EAAE,EAAE;YACrD,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,mEAAmE;IAEnE,IAAI,GAAG,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,IAAI,SAAS,KAAc,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElF,IAAI,KAAK,KAAkB,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAE7D,kDAAkD;IAClD,IAAI,cAAc;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC;QACnC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAEhC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAClC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC;gBAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAC1E,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,SAAS,CAAC,UAAmB;QACjC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,mBAAmB,KAAW,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB;QAClB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;QAClE,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,OAA+B,EAAE,YAAsC;QACpF,MAAM,IAAI,GAAiB;YACzB,SAAS,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;gBAChC,MAAM,OAAO,GAAG,OAAO,CAAC,mBAAmB,EAAE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC9E,IAAI,OAAO,OAAO,KAAK,QAAQ;oBAAE,OAAO,CAAC,uBAAuB;gBAChE,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,WAAW,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;gBAClC,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;SACF,CAAC;QACF,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,CAAC;YAChC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;YAC1B,GAAG,EAAE,YAAY,EAAE;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,kEAAkE;IAE1D,gBAAgB,CAAC,MAAoB;QAC3C,MAAM,IAAI,GAAqB,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC;gBACpC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACzE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7E,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAC1D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,OAAO,GAAiB,IAAI,CAAC;QAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;gBAAE,SAAS,CAAC,0BAA0B;YAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAEtD,8CAA8C;gBAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,IAAI,CAAC;wBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;oBACxD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;oBACnE,OAAO,GAAG,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,IAAI,iCAAiC,CAAC,CAAC;oBAC5F,SAAS;gBACX,CAAC;gBAED,WAAW;gBACX,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;gBAC5B,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACzC,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAClC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC/C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE;wBACxC,cAAc,EAAE,QAAQ,CAAC,IAAI;wBAC7B,iBAAiB,EAAE,IAAI;qBACxB,CAAC,CAAC;gBACL,CAAC;gBAED,kEAAkE;gBAClE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAEf,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;gBACzB,OAAO,MAAM,CAAC,GAAG,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACpD,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE9D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACxC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE;wBAChD,cAAc,EAAE,IAAI;wBACpB,iBAAiB,EAAE,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,OAAqB;QACpD,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,8DAA8D;QAC9D,6DAA6D;QAC7D,gEAAgE;QAChE,+DAA+D;QAC/D,kEAAkE;QAClE,WAAW;QACX,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAClC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,IAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAEhE,kEAAkE;QAClE,mEAAmE;QACnE,gEAAgE;QAChE,wDAAwD;QACxD,mCAAmC;QACnC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB;QAC7B,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QAClD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,CAAC,oBAAoB;QAEpD,IAAI,IAAI,CAAC,eAAe,IAAI,oBAAoB,EAAE,CAAC;YACjD,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,CAAC;QAC5F,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAE1B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;oBACzB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBACrD,CAAC;qBAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC3B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC/B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,yBAAyB;gBACnC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,2BAA2B;YACrC,CAAC;YACD,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAiD,CAAC,CAAC,CAAC;QACxF,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;IAC3B,CAAC;IAEO,uBAAuB;QAC7B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACvC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,0BAA0B;QAChC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QAClD,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,CAAC,oBAAoB;QAC1D,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YAC/C,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAChC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO;YAClD,sCAAsC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAClC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,IAAI,CAAC;oBAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAC3D,MAAM,CAAC,CAAC,+BAA+B;oBAAC,OAAO;gBAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClD,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CACpB,GAAG,EAAE,GAA6C,CAAC,EACnD,GAAG,EAAE,GAAmE,CAAC,CAC1E,CAAC;QACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACvC,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,EAAE;gBACjE,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,oEAAoE;IAE5D,OAAO;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YACrC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO;YAC3C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;YACrD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"TunnelManager.js","sourceRoot":"","sources":["../../src/tunnel/TunnelManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,eAAe,EACf,aAAa,GAGd,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAyDrD,uEAAuE;AAEvE,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAAG,EAAE,GAAG,MAAM,CAAC;AACrD,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvC,sEAAsE;AAEtE,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC5B,MAAM,CAAe;IACrB,SAAS,CAAS;IAElB,SAAS,CAAkB;IAC3B,SAAS,CAAmB;IACrC,QAAQ,CAAwB;IACvB,OAAO,CAAe;IAE/B,aAAa,GAAgC,IAAI,CAAC;IAClD,mBAAmB,GAAwB,IAAI,CAAC;IAChD,YAAY,CAAc;IAC1B,cAAc,GAAG,IAAI,CAAC,CAAC,iCAAiC;IACxD,QAAQ,GAAG,KAAK,CAAC;IACjB,aAAa,GAA2B,IAAI,CAAC;IAC7C,eAAe,GAAG,CAAC,CAAC;IACpB,aAAa,GAAyC,IAAI,CAAC;IAC3D,mBAAmB,GAAyC,IAAI,CAAC;IACzE;;;;;OAKG;IACK,eAAe,GAMZ,IAAI,CAAC;IAEhB,YAAY,MAAoB,EAAE,UAAoC;QACpE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,UAAU,EAAE,YAAY;YACtC,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,CAAC,OAAO,GAAG,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEtE,IAAI,CAAC,YAAY,GAAG;YAClB,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,oDAAoD;QACpD,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAkB,EAAE,EAAE;YACrD,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,mEAAmE;IAEnE,IAAI,GAAG,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,IAAI,SAAS,KAAc,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElF,IAAI,KAAK,KAAkB,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAE7D,kDAAkD;IAClD,IAAI,cAAc;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC;QACnC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAEhC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAClC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC;gBAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAC1E,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,SAAS,CAAC,UAAmB;QACjC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,mBAAmB,KAAW,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB;QAClB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;QAClE,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,OAA+B,EAAE,YAAsC;QACpF,MAAM,IAAI,GAAiB;YACzB,SAAS,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;gBAChC,MAAM,OAAO,GAAG,OAAO,CAAC,mBAAmB,EAAE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC9E,IAAI,OAAO,OAAO,KAAK,QAAQ;oBAAE,OAAO,CAAC,uBAAuB;gBAChE,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,WAAW,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;gBAClC,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;SACF,CAAC;QACF,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,CAAC;YAChC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;YAC1B,GAAG,EAAE,YAAY,EAAE;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,kEAAkE;IAE1D,gBAAgB,CAAC,MAAoB;QAC3C,MAAM,IAAI,GAAqB,EAAE,CAAC;QAClC,sEAAsE;QACtE,yCAAyC;QACzC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC;gBACpC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzF,kEAAkE;QAClE,iEAAiE;QACjE,yDAAyD;QACzD,iEAAiE;QACjE,2DAA2D;QAC3D,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACzE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7E,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAC1D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,OAAO,GAAiB,IAAI,CAAC;QAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;gBAAE,SAAS,CAAC,0BAA0B;YAE7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAEtD,8CAA8C;gBAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,IAAI,CAAC;wBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;oBACxD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;oBACnE,OAAO,GAAG,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,IAAI,iCAAiC,CAAC,CAAC;oBAC5F,SAAS;gBACX,CAAC;gBAED,WAAW;gBACX,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;gBAC5B,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACzC,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAClC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC/C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE;wBACxC,cAAc,EAAE,QAAQ,CAAC,IAAI;wBAC7B,iBAAiB,EAAE,IAAI;qBACxB,CAAC,CAAC;gBACL,CAAC;gBAED,kEAAkE;gBAClE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAEf,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;gBACzB,OAAO,MAAM,CAAC,GAAG,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACpD,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE9D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACxC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE;wBAChD,cAAc,EAAE,IAAI;wBACpB,iBAAiB,EAAE,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,OAAqB;QACpD,6DAA6D;QAC7D,kEAAkE;QAClE,iEAAiE;QACjE,yDAAyD;QACzD,EAAE;QACF,iEAAiE;QACjE,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,iCAAiC;QACjC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC;QAE5D,IAAI,cAAc,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAClC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/C,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE;oBACtD,cAAc,EAAE,IAAI;oBACpB,iBAAiB,EAAE,eAAe,CAAC,OAAO,CAAC;iBAC5C,CAAC,EAAE,CAAC;oBACH,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,IAAI,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC9F,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAClC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,IAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,6DAA6D;IACrD,KAAK,CAAC,kBAAkB;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,SAAS;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,KAAK;gBAAE,OAAO,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,QAAwB;QAC7C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,IAAI,CAAC,eAAe,GAAG;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ;YACR,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,KAAK;SACN,CAAC;IACJ,CAAC;IAEO,mBAAmB;QACzB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YAChD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QACrD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACpD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,+DAA+D;QAC/D,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBACxD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;gBACnE,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAClC,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC1C,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACjC,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;YAC5B,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC;YACzC,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACvD,gEAAgE;YAChE,8DAA8D;YAC9D,qDAAqD;YACrD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,EAAE,cAAc,EAAE;gBAC5D,cAAc,EAAE,QAAQ,CAAC,IAAI;gBAC7B,iBAAiB,EAAE,IAAI;gBACvB,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAClC,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAEO,oBAAoB,CAAC,KAAa,EAAE,OAA8B;QACxE,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YAChD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,IAAI,cAAc;QAChB,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS;YACzC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI;YAC5C,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK;YACjC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ;SACxC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB;QAC7B,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QAClD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,CAAC,oBAAoB;QAEpD,IAAI,IAAI,CAAC,eAAe,IAAI,oBAAoB,EAAE,CAAC;YACjD,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,CAAC;QAC5F,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAE1B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;oBACzB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBACrD,CAAC;qBAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC3B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC/B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,yBAAyB;gBACnC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,2BAA2B;YACrC,CAAC;YACD,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAiD,CAAC,CAAC,CAAC;QACxF,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;IAC3B,CAAC;IAEO,uBAAuB;QAC7B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACvC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,0BAA0B;QAChC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QAClD,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,CAAC,oBAAoB;QAC1D,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YAC/C,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAChC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO;YAClD,sCAAsC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAClC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,IAAI,CAAC;oBAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAC3D,MAAM,CAAC,CAAC,+BAA+B;oBAAC,OAAO;gBAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClD,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CACpB,GAAG,EAAE,GAA6C,CAAC,EACnD,GAAG,EAAE,GAAmE,CAAC,CAC1E,CAAC;QACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACvC,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,EAAE;gBACjE,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,oEAAoE;IAE5D,OAAO;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YACrC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO;YAC3C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;YACrD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.2.39",
+  "version": "1.2.40",
   "description": "Persistent autonomy infrastructure for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-23T02:07:34.437Z",
-  "instarVersion": "1.2.39",
+  "generatedAt": "2026-05-23T02:31:36.933Z",
+  "instarVersion": "1.2.40",
   "entryCount": 191,
   "entries": {
     "hook:session-start": {

package/upgrades/1.2.40.md

@@ -0,0 +1,119 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+<!-- patch = consent state machine + grantConsent/declineConsent API; no Telegram wire-up yet -->
+
+## What Changed
+
+**feat(tunnel): consent state machine — Tier-1 exhaustion → awaiting-consent → relay-active.**
+
+PR 5 of the tunnel-failure-resilience chain. Lands the consent state
+machine inside `TunnelManager` so an exhausted Tier-1 path can offer
+the Tier-2 relay (LocaltunnelProvider from PR 4) behind an
+owner-approval gate.
+
+What's new:
+
+- `TunnelManager.buildDefaultPool` now appends a `LocaltunnelProvider`
+  as the Tier-2 slot. `isAvailable()` returns false when the
+  `localtunnel` npm package isn't installed (per the spec's opt-in
+  posture), so the slot is silently skipped on agents without the
+  dep — behavior is unchanged for them.
+- `TunnelManager.exhaustedOrBackoff` now checks for an available
+  Tier-2 provider AND that the cross-episode consent cooldown isn't
+  active before deciding between `exhausted` and `awaiting-consent`.
+  When both conditions hold, the manager transitions to
+  `awaiting-consent` and generates a one-time CSPRNG nonce stored in
+  a new `_pendingConsent` record.
+- `TunnelManager.grantConsent(nonce)` — public API. Validates the
+  nonce matches the pending record AND the state is still
+  `awaiting-consent` (replay-safe single-use), starts the Tier-2
+  provider, runs the post-start reachability probe, and transitions
+  to `relay-active` with `rotationPending=true` (the persisted
+  marker for the upcoming mandatory PIN+authToken rotation in PR 6).
+  Returns true on success; false on any validation failure or
+  start/probe failure.
+- `TunnelManager.declineConsent(nonce)` — public API. Validates the
+  nonce, advances the cross-episode cooldown counter, and
+  transitions to `exhausted` + background retry.
+- Consent timeout (15 min, per spec Part 4 default) — fires
+  automatically; same effect as decline.
+- `stop()` clears the pending consent + its timer so a torn-down
+  manager can't have a stale timeout fire.
+- `TunnelManager.pendingConsent` accessor — returns a defensive
+  snapshot (episodeId, provider name, nonce, issuedAt) for the
+  upcoming Telegram callback handler (PR 6) to embed the nonce in
+  the inline-button payload.
+
+What's NOT new yet (deliberate, future PRs in the chain):
+
+- Telegram `callback_query` handler that invokes `grantConsent` /
+  `declineConsent` on owner button clicks (PR 6).
+- Inline-button payload in the consent prompt (PR 6).
+- `authToken` / PIN rotation lifecycle on relay-episode end (PR 6+).
+- Full N-consecutive-success self-heal stability gate (PR 7).
+- The auth-gated `/tunnel` route + `ConfigDefaults` migration +
+  CLAUDE.md template (PR 8).
+- The `localtunnel` npm dep itself (PR 6, alongside the consent
+  wire-up — keeps the capability opt-in until the gate is fully
+  live).
+
+Behavior change for users today: **none** at runtime. Agents without
+the `localtunnel` dep installed continue exactly as before (Tier-2
+slot is unavailable, manager falls through to exhausted). The
+plumbing is in place; PR 6 makes it user-facing.
+
+## Evidence
+
+11 new unit tests in `tests/unit/tunnel-consent-state-machine.test.ts`:
+
+- Tier-1 exhausts + Tier-2 available + cooldown inactive →
+  `awaiting-consent` + pendingConsent populated with 128-bit hex nonce.
+- Tier-1 exhausts + NO Tier-2 available → `exhausted` (baseline path).
+- Tier-1 exhausts + consent cooldown active → `exhausted` (cooldown
+  wins).
+- `grantConsent` with matching nonce → `relay-active` + URL emitted +
+  rotationPending=true + pendingConsent cleared (single-use).
+- `grantConsent` with wrong nonce → returns false, state unchanged,
+  provider.start NOT called.
+- `grantConsent` replay of a used nonce → returns false, state
+  unchanged.
+- `grantConsent` + reachability probe fails → `exhausted` + cooldown
+  advanced.
+- `grantConsent` + provider.start throws → `exhausted` + cooldown
+  advanced.
+- `declineConsent` with matching nonce → `exhausted` + cooldown
+  advanced + pendingConsent cleared.
+- `declineConsent` with wrong nonce → returns false, state unchanged,
+  no cooldown change.
+- `stop()` clears pendingConsent + the timeout timer.
+
+All 92 tunnel-related unit tests pass (11 new + 81 from PRs 1–4).
+`tsc --noEmit` clean. `npm run lint` clean.
+
+## What to Tell Your User
+
+This release puts the security gate for backup tunnels into place.
+Nothing visible to you yet — the gate needs a button to click, and
+that's the next release. Once that lands, when Cloudflare goes fully
+down, you'll get a private message from your agent asking permission
+to use a backup. Until you approve, the agent stays link-less and
+keeps retrying Cloudflare. If you decline or don't reply, the agent
+won't ask again for a while (the wait window grows the more you
+decline, so the agent stops bothering you about something you've
+already decided).
+
+If you want the backup capability to actually work when the next
+release lands, install the localtunnel npm package alongside your
+agent. Without it the backup option is silently skipped and the
+agent continues with Cloudflare only — which is fine if that's your
+preference.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Consent state machine (Tier-1 → awaiting-consent → relay-active) | Internal — exposed via grantConsent / declineConsent APIs that the upcoming Telegram callback handler will call |
+| Single-use CSPRNG nonce binding | Automatic — pendingConsent.nonce embeds in the inline button in the next release |
+| Cross-episode consent cooldown | Automatic — exponential back-off on decline/timeout (1h → 4h → 24h) |
+| Mandatory rotation marker on relay-active entry | Automatic — rotationPending=true is the crash-safe flag the upcoming rotation lifecycle reads |

package/upgrades/side-effects/consent-state-machine.md

@@ -0,0 +1,135 @@
+# Side-effects review — consent state machine (PR 5 of tunnel-failure-resilience chain)
+
+**Scope (PR 5 of the chain):** Land the consent state machine inside
+`TunnelManager` and append `LocaltunnelProvider` (from PR 4) to the
+default Tier-2 slot. Adds public `grantConsent` / `declineConsent`
+methods so the upcoming Telegram callback handler (PR 6) can drive the
+owner-approval gate. Spec
+`specs/dev-infrastructure/tunnel-failure-resilience.md` is converged
++ approved on main.
+
+**Files touched:**
+- `src/tunnel/TunnelManager.ts` — adds Tier-2 to `buildDefaultPool`;
+  modifies `exhaustedOrBackoff` to branch on Tier-2 availability +
+  consent cooldown; adds `findAvailableTier2`, `requestConsent`,
+  `clearPendingConsent`, `grantConsent`, `declineConsent`,
+  `recordConsentDecline`, and the `pendingConsent` accessor; updates
+  `stop()` to clear the pending consent.
+- `tests/unit/tunnel-consent-state-machine.test.ts` — 11 tests covering
+  the awaiting-consent transition (and its negative cases — no Tier-2
+  available, cooldown active), grantConsent happy path, nonce
+  rejection (wrong nonce, replay), grant-failure paths (unreachable
+  relay, provider.start throws), declineConsent happy path + wrong
+  nonce, stop() clearing pendingConsent.
+
+**Under-block**: None at user-visible runtime. Agents without the
+`localtunnel` npm dep installed continue to fall through to
+`exhausted` exactly as before (the Tier-2 slot's `isAvailable()`
+returns false; `findAvailableTier2` returns null; the branch picks
+the existing `exhausted` path). This is the spec's opt-in posture —
+PR 4's side-effects review documented it explicitly.
+
+**Over-block**: Minimal. Agents that DO have `localtunnel` installed
+WILL see the new `awaiting-consent` transition fire instead of going
+straight to `exhausted` — but the manager has no UX layer to surface
+the prompt yet (PR 6 lands the Telegram callback handler that
+actually calls `grantConsent` / `declineConsent`). For now the
+manager sits in `awaiting-consent` for the 15-minute timeout, then
+auto-declines and falls through to exhausted with the cooldown
+advanced. From the user's perspective this looks identical to
+"exhausted" today — there's just a 15-min delay before the cooldown
+counter ticks the first time.
+
+To explicitly avoid this UX gap during the interim window between
+PR 5 and PR 6, operators who don't want the awaiting-consent state
+can simply not install `localtunnel`. The default ships without it.
+
+**Level-of-abstraction fit**:
+- The state machine lives in `TunnelLifecycle` (PR 1); the manager
+  drives state through the existing CAS-guarded transitions.
+- `_pendingConsent` is private state on the manager (binds nonce +
+  episode + provider). Exposed read-only via the `pendingConsent`
+  accessor that returns a snapshot — callers cannot mutate the
+  manager's state from outside.
+- `grantConsent` / `declineConsent` are the AUTHORITY surface for
+  consent decisions. The Telegram callback handler (PR 6) will be
+  the SIGNAL layer — it validates the click came from the owner and
+  the message id matches, then calls these methods.
+
+**Signal vs authority**: Compliant. The manager is the authority for
+state transitions and the consent record's lifecycle; external
+callers can only ask for grant/decline by presenting the nonce, and
+the manager validates+decides. The Telegram callback handler in PR 6
+will be a thin signal layer above this; it cannot bypass the nonce
+check.
+
+**Interactions**:
+- `_pendingConsent` is single-flight per manager instance — only one
+  consent record can be active at a time (the lifecycle's `episode`
+  invariant: one episode = one consent prompt = one nonce).
+- `clearPendingConsent` is called on every terminal path (grant
+  success, decline, timeout, stop, episode change). The timer is
+  cleared atomically with the record so no stale callback can fire.
+- The consent timeout uses the lifecycle's `recordConsentRefusal`
+  to advance the cross-episode cooldown — same path as a manual
+  decline. The cooldown progression is exponential (1h → 4h → 24h)
+  per PR 1's lifecycle implementation.
+- `rotationPending=true` is set on entering `relay-active` (the
+  crash-safe persisted marker for the upcoming rotation lifecycle
+  in PR 6). The actual rotation work is NOT in this PR — only the
+  marker.
+- Reachability probe on the granted Tier-2 provider follows the
+  same `/health` semantics as Tier-1 — a relay that emits a URL
+  but doesn't actually serve traffic falls through to exhausted +
+  cooldown (so the owner isn't asked again immediately).
+
+**External surfaces**:
+- New public methods: `grantConsent(nonce)`, `declineConsent(nonce)`,
+  `pendingConsent` getter on `TunnelManager`. All require the
+  caller to have the current pending nonce, which is itself only
+  accessible via `pendingConsent.nonce` — there's no broader
+  exposure.
+- No new API endpoint, no new CLI command, no new config field.
+- The default tunnel pool now includes a `LocaltunnelProvider`
+  slot, but the manager only activates it after Tier-1 exhausts +
+  consent is granted, so users who never hit a Tier-1 exhaustion
+  never see Tier-2 attempted.
+
+**Migration parity**: N/A. Server-side code only.
+
+**Rollback cost**: Trivial. Revert `TunnelManager.ts` + the test file.
+The new methods become unused (they're not called from anywhere
+outside the manager + tests yet). LocaltunnelProvider stays in tree
+from PR 4 but is no longer in the default pool.
+
+**Tests**:
+- 11/11 new tests in `tests/unit/tunnel-consent-state-machine.test.ts`.
+- 19/19 tests in `tests/unit/tunnel-manager-rewrite.test.ts` (from
+  PR 2 + 3) still pass.
+- 32/32 lifecycle, 13/13 notifier, 10/10 providers, 7/7 localtunnel-
+  provider — all still pass.
+- `tsc --noEmit` clean. `npm run lint` clean. No existing tests
+  modified.
+
+**Decision-point inventory**:
+1. `_pendingConsent` stores the provider directly (vs. a provider-name
+   key into the pool) — keeps the grant path independent of the pool
+   ordering, and ensures a provider that becomes "unavailable"
+   between request and grant is still the one we attempt (failure
+   surfaces cleanly).
+2. Nonce is 128-bit CSPRNG via `generateNonce` from PR 1 — meets the
+   GPT external review's spec for entropy + atomic compare-and-delete.
+3. Single-use enforced by `clearPendingConsent` BEFORE the provider
+   starts — a replay of the same nonce loses cleanly even if the
+   start is in flight.
+4. Timeout = 15 min (spec Part 4 default, staggered off the 10-min
+   reconnect window per verification finding V1).
+5. Reachability failure on a granted relay → cooldown advanced.
+   Reason: the relay started but doesn't serve; bothering the owner
+   again immediately wouldn't help. The cooldown gates the next ask.
+6. State machine transitions `awaiting-consent → exhausted` directly
+   on decline/timeout/start-failure — same transition the cooldown
+   path uses, so background retry semantics are uniform.
+7. `pendingConsent` accessor returns a defensive snapshot — mutating
+   it does NOT affect the manager. External callers cannot inject
+   their own nonce or change the bound provider.

package/upgrades/side-effects/localtunnel-provider.md

@@ -0,0 +1,95 @@
+# Side-effects review — LocaltunnelProvider (PR 4 of tunnel-failure-resilience chain)
+
+**Scope (PR 4 of the chain):** Add the `LocaltunnelProvider`
+implementation of the `TunnelProvider` interface from PR 1. The class
+is added in isolation — NOT wired into the manager's active pool —
+so PR 5 can ship the consent state machine + inline-button UX +
+relay-active activation path with the provider already in place
+under separate review. Spec
+`specs/dev-infrastructure/tunnel-failure-resilience.md` is converged
++ approved on main.
+
+**Files touched:**
+- `src/tunnel/LocaltunnelProvider.ts` — NEW. Implements
+  `TunnelProvider` with `name: 'localtunnel'`, `tier: 2`. Dynamic
+  import of the `localtunnel` npm package; graceful "unavailable"
+  return path when the dep isn't installed. Failure classification
+  preserves the `ProviderFailureReason` enum surface from PR 1
+  (rate-limited / network / process-exit / binary-missing).
+- `tests/unit/localtunnel-provider.test.ts` — NEW. 7 tests covering
+  the provider's surface (name + tier), graceful degradation when
+  the npm package is absent (isAvailable=false; start() rejects
+  binary-missing; verdict cached across calls), and constructor
+  option acceptance.
+
+**Under-block**: None — the provider is added but NOT wired into the
+manager's active pool. The manager's existing `buildDefaultPool`
+returns Cloudflare-named + Cloudflare-quick only, and the driver
+filters Tier-2 providers (`if (provider.tier !== 1) continue;`).
+User-facing behavior is unchanged.
+
+**Over-block**: None. The provider class is purely additive; no
+existing behavior changes.
+
+**Level-of-abstraction fit**: The provider implements the same
+interface as the Cloudflare providers, so PR 5's state-machine
+changes can use it through the existing pool abstraction without
+needing provider-specific code paths. Tier-2 trust classification
+lives on the provider (`tier: 2` field), which is correctly the
+manager's structural signal for "consent required."
+
+**Signal vs authority**: Compliant. The provider raises errors with
+classified reason strings (the SIGNAL); the manager classifies them
+into `ProviderFailureReason` (the AUTHORITY). The consent gate (PR 5)
+will be a separate AUTHORITY layer above the manager's driver — the
+provider never makes consent decisions on its own.
+
+**Interactions**:
+- Dynamic import: the provider does `await import('localtunnel')` at
+  first `isAvailable()` call. On environments without the dep, the
+  import throws and the provider caches the "unavailable" verdict.
+  This is deliberately a runtime check, not a build-time one — instar
+  ships without the `localtunnel` dep in `package.json` (per the
+  spec's supply-chain hardening — Tier-2 backup capability is opt-in,
+  installed explicitly by operators who want it).
+- The `subdomain` constructor option is operator-controlled. The
+  comment documents the privacy posture: never use the agent's
+  identity as a subdomain hint — it would be publicly visible on
+  `*.loca.lt`.
+
+**External surfaces**:
+- New exported class `LocaltunnelProvider` from `src/tunnel/`.
+- No new npm dependency — `localtunnel` is NOT added to
+  `package.json` in this PR. The provider degrades gracefully when
+  the dep is absent. Operators add the dep explicitly to enable the
+  capability. This matches the spec's supply-chain posture (Part 7).
+- No new API endpoint, no new CLI command, no new config field
+  (Part 4 fields land with PR 5 alongside the consent flow).
+
+**Migration parity**: N/A. The provider is server-side code only;
+no agent-installed file change.
+
+**Rollback cost**: Trivial. Delete two files (`src/tunnel/Local-
+tunnelProvider.ts` and the test). The provider is isolated; nothing
+else references it.
+
+**Tests**:
+- 7/7 tests in `tests/unit/localtunnel-provider.test.ts`.
+- 70/70 tunnel-related tests from PRs 1–3 unaffected.
+- `tsc --noEmit` clean. `npm run lint` clean.
+
+**Decision-point inventory**:
+1. Dynamic import (vs. static `import localtunnel from 'localtunnel'`)
+   — keeps `localtunnel` out of the build-time type-check graph so
+   instar can ship without the dep. Operators add it explicitly per
+   the spec's supply-chain stance.
+2. `localtunnel` NOT added to `package.json` in this PR — landing the
+   dep before the consent gate ships would expose users to an
+   unchecked Tier-2 capability. The dep lands in PR 5 alongside the
+   consent flow that gates its use. This is intentional and
+   per-spec — Part 7 frames the capability as opt-in regardless.
+3. `subdomain` is operator-controlled and documented as
+   non-identifying. The provider does not auto-generate one.
+4. Failure classification matches PR 1's enum — no new failure
+   reasons needed; the manager's existing logic handles localtunnel
+   failures the same way as cloudflared failures.