linkshell-cli 0.9.0 → 0.10.0

package/dist/gateway/src/relay.js

@@ -0,0 +1,434 @@
+import { createServer } from "node:http";
+import { randomBytes, randomInt, randomUUID } from "node:crypto";
+import WebSocket, { WebSocketServer } from "ws";
+import { clientFrameSchema, gatewayChallengeMessage, idOf, RELAY_PATH, verifySignature, } from "@linkshell/wire";
+import { GatewayStore } from "./store.js";
+class RelayError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+const AUTH_TIMEOUT_MS = 10_000;
+const PAIR_DECISION_MS = 30_000;
+const MAX_CLAIM_ATTEMPTS = 8;
+/**
+ * Gateway v2: authenticates peers by key, routes their end-to-end encrypted
+ * frames to peers they may reach (paired, or same account), and brokers
+ * pairing. It has no way to read what it routes.
+ */
+export class Gateway {
+    options;
+    store;
+    server;
+    peers = new Map();
+    offers = new Map();
+    decisions = new Map();
+    claimTimes = new Map();
+    heartbeat;
+    /** Sockets that answered the last ping. */
+    alive = new WeakSet();
+    stopped = false;
+    log;
+    constructor(options) {
+        this.options = options;
+        this.store = new GatewayStore(options.databasePath);
+        this.log = options.log ?? ((message) => process.stderr.write(`${new Date().toISOString()} [gateway] ${message}\n`));
+    }
+    wss = new WebSocketServer({ noServer: true, perMessageDeflate: false, maxPayload: 48 * 1024 * 1024 });
+    /** Runs on its own port. */
+    async start() {
+        const server = createServer((request, response) => {
+            if (request.url === "/healthz") {
+                response.writeHead(200, { "content-type": "application/json" });
+                response.end(JSON.stringify({ ok: true, peers: this.peers.size }));
+                return;
+            }
+            response.writeHead(404);
+            response.end();
+        });
+        server.on("upgrade", (request, socket, head) => {
+            if (!request.url?.startsWith(RELAY_PATH)) {
+                socket.destroy();
+                return;
+            }
+            this.handleUpgrade(request, socket, head);
+        });
+        this.server = server;
+        await new Promise((resolve) => server.listen(this.options.port, this.options.host ?? "0.0.0.0", resolve));
+        this.attach();
+        const address = server.address();
+        return typeof address === "object" && address ? address.port : this.options.port;
+    }
+    /**
+     * Runs inside another HTTP server, which passes it upgrades for
+     * `RELAY_PATH` through `handleUpgrade`.
+     */
+    attach() {
+        if (this.heartbeat)
+            return;
+        this.heartbeat = setInterval(() => this.sweep(), this.options.heartbeatMs ?? 30_000);
+        this.heartbeat.unref();
+    }
+    handleUpgrade(request, socket, head) {
+        this.wss.handleUpgrade(request, socket, head, (ws) => this.accept(ws));
+    }
+    get connected() {
+        return this.peers.size;
+    }
+    /** Bytes accepted from senders and not yet written to their receivers. */
+    get bufferedBytes() {
+        let total = 0;
+        for (const peer of this.peers.values())
+            total += peer.socket.bufferedAmount;
+        return total;
+    }
+    /** Drops connections that didn't answer the previous ping, pings the rest. */
+    sweep() {
+        for (const peer of this.peers.values()) {
+            // A held peer isn't read, so its pong can't arrive; it is checked again once released.
+            if (peer.held)
+                continue;
+            if (!this.alive.has(peer.socket)) {
+                peer.socket.terminate();
+                continue;
+            }
+            this.alive.delete(peer.socket);
+            peer.socket.ping();
+        }
+    }
+    async stop() {
+        this.stopped = true;
+        clearInterval(this.heartbeat);
+        for (const peer of this.peers.values())
+            peer.socket.terminate();
+        await new Promise((resolve) => (this.server ? this.server.close(() => resolve()) : resolve()));
+        this.store.close();
+    }
+    // ── connection ────────────────────────────────────────────────────
+    accept(socket) {
+        this.alive.add(socket);
+        socket.on("pong", () => this.alive.add(socket));
+        const nonce = randomBytes(32).toString("base64url");
+        let peer;
+        const send = (frame) => {
+            if (socket.readyState === WebSocket.OPEN)
+                socket.send(JSON.stringify(frame));
+        };
+        const timer = setTimeout(() => {
+            if (!peer)
+                socket.close(4001, "auth timeout");
+        }, AUTH_TIMEOUT_MS);
+        send({ t: "challenge", nonce });
+        socket.on("message", async (data) => {
+            let parsed;
+            try {
+                parsed = clientFrameSchema.safeParse(JSON.parse(data.toString()));
+            }
+            catch {
+                parsed = undefined;
+            }
+            if (!parsed?.success) {
+                send({ t: "error", code: "bad_frame", message: "unreadable frame" });
+                return;
+            }
+            const frame = parsed.data;
+            if (!peer) {
+                if (frame.t !== "auth") {
+                    socket.close(4001, "auth first");
+                    return;
+                }
+                try {
+                    peer = await this.authenticate(frame, nonce, socket);
+                }
+                catch (error) {
+                    const code = error instanceof RelayError ? error.code : "auth_failed";
+                    send({ t: "error", code, message: error instanceof Error ? error.message : String(error) });
+                    socket.close(4001, code);
+                    return;
+                }
+                clearTimeout(timer);
+                send({ t: "ready", userId: peer.record.userId, email: peer.email });
+                this.announce(peer.record, true);
+                return;
+            }
+            switch (frame.t) {
+                case "ping":
+                    send({ t: "pong" });
+                    return;
+                case "to":
+                    this.route(peer, frame.to, frame.d);
+                    return;
+                case "req":
+                    try {
+                        const result = await this.handle(peer, frame.method, (frame.params ?? {}));
+                        send({ t: "res", id: frame.id, result });
+                    }
+                    catch (error) {
+                        const code = error instanceof RelayError ? error.code : "internal";
+                        send({ t: "res", id: frame.id, error: { code, message: error instanceof Error ? error.message : String(error) } });
+                    }
+                    return;
+                case "auth":
+                    return;
+            }
+        });
+        socket.on("close", () => {
+            clearTimeout(timer);
+            if (this.stopped || !peer || this.peers.get(peer.record.id)?.socket !== socket)
+                return;
+            this.peers.delete(peer.record.id);
+            this.store.touch(peer.record.id);
+            this.announce(peer.record, false);
+        });
+    }
+    async authenticate(frame, nonce, socket) {
+        const { identity, role } = frame;
+        if (idOf(identity.signKey) !== identity.id)
+            throw new RelayError("bad_identity", "id doesn't match key");
+        if (!verifySignature(identity.signKey, gatewayChallengeMessage(nonce), frame.signature)) {
+            throw new RelayError("bad_signature", "signature check failed");
+        }
+        const existing = this.store.peer(identity.id);
+        if (existing && existing.role !== role)
+            throw new RelayError("bad_identity", "this key is registered with another role");
+        let userId;
+        let email;
+        if (frame.token) {
+            if (!this.options.verifyToken)
+                throw new RelayError("accounts_disabled", "this gateway doesn't support accounts");
+            const account = await this.options.verifyToken(frame.token);
+            if (!account)
+                throw new RelayError("token_invalid", "account token is invalid or expired");
+            userId = account.userId;
+            email = account.email;
+        }
+        const refusal = await this.options.admit?.({ role: role, userId });
+        if (refusal)
+            throw new RelayError("not_admitted", refusal);
+        const record = {
+            id: identity.id,
+            role: role,
+            signKey: identity.signKey,
+            boxKey: identity.boxKey,
+            name: frame.name,
+            platform: frame.platform,
+            userId,
+            lastSeen: Date.now(),
+        };
+        this.store.upsertPeer(record);
+        const previous = this.peers.get(record.id);
+        const peer = { record, socket, email };
+        this.peers.set(record.id, peer);
+        // One live connection per identity: the newest wins.
+        previous?.socket.close(4000, "replaced by a newer connection");
+        this.log(`${role} ${record.id.slice(0, 8)} "${record.name}" online${userId ? " (account)" : ""}`);
+        return peer;
+    }
+    // ── routing ───────────────────────────────────────────────────────
+    route(from, to, data) {
+        const via = this.store.route(from.record.id, to);
+        const target = this.peers.get(to);
+        const undeliverable = (reason) => from.socket.send(JSON.stringify({ t: "undeliverable", to, reason }));
+        if (!via)
+            return undeliverable("not_allowed");
+        if (!target)
+            return undeliverable("offline");
+        const frame = JSON.stringify({
+            t: "from",
+            from: { id: from.record.id, signKey: from.record.signKey, boxKey: from.record.boxKey },
+            via,
+            d: data,
+        });
+        this.options.onRouted?.(frame);
+        target.socket.send(frame);
+        this.holdWhileBehind(from, target);
+    }
+    /**
+     * Backpressure. What a peer can't take yet would otherwise pile up here, in
+     * memory every user of this gateway shares: stop reading the sender instead,
+     * so the data waits on its side until the receiver catches up.
+     */
+    holdWhileBehind(from, target) {
+        const limit = this.options.maxBufferedBytes ?? 4 * 1024 * 1024;
+        if (from.held || target.socket.bufferedAmount <= limit)
+            return;
+        from.held = true;
+        from.socket.pause();
+        const since = Date.now();
+        const timer = setInterval(() => {
+            const open = target.socket.readyState === WebSocket.OPEN;
+            if (open && target.socket.bufferedAmount > limit / 4) {
+                if (Date.now() - since < (this.options.stalledPeerMs ?? 60_000))
+                    return;
+                this.log(`${target.record.role} ${target.record.id.slice(0, 8)} can't keep up; dropping it`);
+                target.socket.terminate();
+            }
+            clearInterval(timer);
+            from.held = false;
+            this.alive.add(from.socket);
+            if (from.socket.readyState === WebSocket.OPEN)
+                from.socket.resume();
+        }, 20);
+        timer.unref();
+    }
+    event(peerId, name, data) {
+        const peer = this.peers.get(peerId);
+        if (peer?.socket.readyState === WebSocket.OPEN)
+            peer.socket.send(JSON.stringify({ t: "event", name, data }));
+    }
+    /** Tells everyone who can reach `record` that it came or went. */
+    announce(record, online) {
+        for (const { peer } of this.store.reachable(record.id))
+            this.event(peer.id, "presence", { id: record.id, online });
+    }
+    machineEntry(peer, via) {
+        return {
+            id: peer.id,
+            signKey: peer.signKey,
+            boxKey: peer.boxKey,
+            name: peer.name,
+            platform: peer.platform,
+            online: this.peers.has(peer.id),
+            via,
+        };
+    }
+    deviceEntry(peer, pairedAt) {
+        return { id: peer.id, signKey: peer.signKey, boxKey: peer.boxKey, name: peer.name, online: this.peers.has(peer.id), pairedAt };
+    }
+    // ── control methods ───────────────────────────────────────────────
+    async handle(peer, method, params) {
+        const role = peer.record.role;
+        const need = (wanted) => {
+            if (role !== wanted)
+                throw new RelayError("forbidden", `${method} is for ${wanted}s`);
+        };
+        switch (method) {
+            case "pair.offer": {
+                need("machine");
+                for (const [code, offer] of this.offers)
+                    if (offer.machineId === peer.record.id)
+                        this.offers.delete(code);
+                let code;
+                do
+                    code = String(randomInt(0, 1_000_000)).padStart(6, "0");
+                while (this.offers.has(code));
+                const expiresAt = Date.now() + (this.options.pairingTtlMs ?? 10 * 60_000);
+                this.offers.set(code, { code, machineId: peer.record.id, expiresAt, attempts: 0 });
+                return { code, expiresAt };
+            }
+            case "pair.decide": {
+                need("machine");
+                const pending = this.decisions.get(String(params.requestId));
+                if (!pending || pending.machineId !== peer.record.id)
+                    throw new RelayError("not_found", "no such pairing request");
+                pending.resolve(params.accept === true);
+                return {};
+            }
+            case "pair.claim":
+                need("device");
+                return this.claim(peer, params);
+            case "machines.list":
+                need("device");
+                return {
+                    machines: this.store
+                        .reachable(peer.record.id)
+                        .map(({ peer: machine, via }) => this.machineEntry(machine, via))
+                        .sort((a, b) => Number(b.online) - Number(a.online) || a.name.localeCompare(b.name)),
+                };
+            case "machines.forget": {
+                need("device");
+                const machineId = String(params.machineId ?? "");
+                const unpaired = this.store.unlink(machineId, peer.record.id);
+                if (unpaired)
+                    this.event(machineId, "presence", { id: peer.record.id, online: false });
+                // A computer that is listed because it signed in to this account, and is gone (reinstalled,
+                // given away): taken off the account, so the list stops showing it. One that is connected
+                // stays: it is signed in right now, and would only be back at once.
+                const machine = this.store.peer(machineId);
+                const ours = machine?.role === "machine" && peer.record.userId !== undefined && machine.userId === peer.record.userId;
+                if (ours && !this.peers.has(machineId))
+                    this.store.disown(machineId);
+                return {};
+            }
+            case "devices.list":
+                need("machine");
+                return {
+                    devices: this.store.reachable(peer.record.id).map(({ peer: device, pairedAt }) => this.deviceEntry(device, pairedAt)),
+                };
+            case "devices.revoke": {
+                need("machine");
+                const deviceId = String(params.deviceId ?? "");
+                if (this.store.unlink(peer.record.id, deviceId)) {
+                    this.event(deviceId, "machines.changed", {});
+                    this.peers.get(deviceId)?.socket.close(4003, "unpaired");
+                }
+                return {};
+            }
+            default:
+                throw new RelayError("unknown_method", `unknown method ${method}`);
+        }
+    }
+    async claim(device, params) {
+        // Throttle guessing: a handful of claims per device per minute.
+        const now = Date.now();
+        const recent = (this.claimTimes.get(device.record.id) ?? []).filter((t) => now - t < 60_000);
+        if (recent.length >= 6)
+            throw new RelayError("rate_limited", "too many pairing attempts, wait a minute");
+        this.claimTimes.set(device.record.id, [...recent, now]);
+        const code = typeof params.code === "string" ? params.code.replace(/\D/g, "") : undefined;
+        const machineId = typeof params.machineId === "string" ? params.machineId : undefined;
+        const offer = code
+            ? this.offers.get(code)
+            : [...this.offers.values()].find((candidate) => candidate.machineId === machineId);
+        if (!offer || offer.expiresAt < now) {
+            if (offer)
+                this.offers.delete(offer.code);
+            throw new RelayError("pairing_expired", "this pairing code is wrong or has expired");
+        }
+        if (++offer.attempts > MAX_CLAIM_ATTEMPTS) {
+            this.offers.delete(offer.code);
+            throw new RelayError("pairing_expired", "too many attempts on this code; start pairing again");
+        }
+        const machine = this.peers.get(offer.machineId);
+        if (!machine)
+            throw new RelayError("machine_offline", "the computer is offline");
+        // The machine checks the proof (it holds the QR secret) and decides.
+        const requestId = randomUUID();
+        const accepted = await new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                this.decisions.delete(requestId);
+                resolve(false);
+            }, PAIR_DECISION_MS);
+            this.decisions.set(requestId, {
+                machineId: machine.record.id,
+                resolve: (accept) => {
+                    clearTimeout(timer);
+                    this.decisions.delete(requestId);
+                    resolve(accept);
+                },
+            });
+            this.event(machine.record.id, "pair.request", {
+                requestId,
+                device: { id: device.record.id, signKey: device.record.signKey, boxKey: device.record.boxKey, name: device.record.name },
+                proof: String(params.proof ?? ""),
+                code: offer.code,
+            });
+        });
+        if (!accepted) {
+            this.event(machine.record.id, "pair.done", { requestId, accepted: false });
+            throw new RelayError("pairing_refused", "the computer refused this pairing");
+        }
+        this.offers.delete(offer.code);
+        this.store.link(machine.record.id, device.record.id);
+        this.event(machine.record.id, "pair.done", {
+            requestId,
+            accepted: true,
+            device: this.deviceEntry(device.record, Date.now()),
+        });
+        this.log(`paired device ${device.record.id.slice(0, 8)} with machine ${machine.record.id.slice(0, 8)}`);
+        return { machine: this.machineEntry(machine.record, "paired") };
+    }
+}
+//# sourceMappingURL=relay.js.map

package/dist/gateway/src/relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../../../gateway/src/relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqC,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,SAAS,EAAE,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,IAAI,EACJ,UAAU,EACV,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AA2C3D,MAAM,UAAW,SAAQ,KAAK;IAEjB;IADX,YACW,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAQ;IAIvB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;;;GAIG;AACH,MAAM,OAAO,OAAO;IAaW;IAZpB,KAAK,CAAe;IACrB,MAAM,CAAU;IACP,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IAChC,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAClC,SAAS,GAAG,IAAI,GAAG,EAAqE,CAAC;IACzF,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,SAAS,CAAkC;IACnD,2CAA2C;IAC1B,KAAK,GAAG,IAAI,OAAO,EAAa,CAAC;IAC1C,OAAO,GAAG,KAAK,CAAC;IACP,GAAG,CAA4B;IAEhD,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,OAAO,IAAI,CAAC,CAAC,CAAC;IACtH,CAAC;IAEgB,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAEvH,4BAA4B;IAC5B,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC/B,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAChE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACxB,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAChH,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IACnF,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY;QAClE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,0EAA0E;IAC1E,IAAI,aAAa;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8EAA8E;IACtE,KAAK;QACX,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,uFAAuF;YACvF,IAAI,IAAI,CAAC,IAAI;gBAAE,SAAS;YACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,qEAAqE;IAE7D,MAAM,CAAC,MAAiB;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,IAAsB,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,KAAkB,EAAE,EAAE;YAClC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,IAAI;gBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAChD,CAAC,EAAE,eAAe,CAAC,CAAC;QACpB,IAAI,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAClC,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrB,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;oBACvB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;oBACjC,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACvD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;oBACtE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC5F,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YACD,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChB,KAAK,MAAM;oBACT,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBACpB,OAAO;gBACT,KAAK,IAAI;oBACP,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;oBACpC,OAAO;gBACT,KAAK,KAAK;oBACR,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC,CAAC;wBACtG,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;wBACnE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrH,CAAC;oBACD,OAAO;gBACT,KAAK,MAAM;oBACT,OAAO;YACX,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,MAAM;gBAAE,OAAO;YACvF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAoE,EAAE,KAAa,EAAE,MAAiB;QAC/H,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;QACzG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,0CAA0C,CAAC,CAAC;QACzH,IAAI,MAA0B,CAAC;QAC/B,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;gBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;YAClH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;YAC3F,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACxB,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,IAAI,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,IAAI,EAAE,IAAgB;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAChC,qDAAqD;QACrD,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IAE7D,KAAK,CAAC,IAAU,EAAE,EAAU,EAAE,IAAY;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,EAAE,CACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAwB,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,CAAC,EAAE,MAAM;YACT,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YACtF,GAAG;YACH,CAAC,EAAE,IAAI;SACc,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,IAAU,EAAE,MAAY;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;QAC/D,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK;YAAE,OAAO;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,CAAC;YACzD,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;gBACrD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;oBAAE,OAAO;gBACxE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,6BAA6B,CAAC,CAAC;gBAC7F,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5B,CAAC;YACD,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACtE,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAEO,KAAK,CAA8B,MAAc,EAAE,IAAO,EAAE,IAAoB;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAwB,CAAC,CAAC,CAAC;IACrI,CAAC;IAED,kEAAkE;IAC1D,QAAQ,CAAC,MAAkB,EAAE,MAAe;QAClD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrH,CAAC;IAEO,YAAY,CAAC,IAAgB,EAAE,GAAyB;QAC9D,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,GAAG;SACJ,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,IAAgB,EAAE,QAAiB;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;IACjI,CAAC;IAED,qEAAqE;IAE7D,KAAK,CAAC,MAAM,CAAC,IAAU,EAAE,MAAc,EAAE,MAA+B;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAgB,EAAE,EAAE;YAChC,IAAI,IAAI,KAAK,MAAM;gBAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,GAAG,MAAM,WAAW,MAAM,GAAG,CAAC,CAAC;QACxF,CAAC,CAAC;QACF,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;oBAAE,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE;wBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1G,IAAI,IAAY,CAAC;gBACjB;oBAAG,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;uBACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;gBAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;gBAC1E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE;oBAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;gBACnH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;gBACxC,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,KAAK,YAAY;gBACf,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClC,KAAK,eAAe;gBAClB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,OAAO;oBACL,QAAQ,EAAE,IAAI,CAAC,KAAK;yBACjB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;yBACzB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;yBAChE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBACvF,CAAC;YACJ,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC9D,IAAI,QAAQ;oBAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvF,4FAA4F;gBAC5F,0FAA0F;gBAC1F,oEAAoE;gBACpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtH,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrE,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,KAAK,cAAc;gBACjB,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;iBACtH,CAAC;YACJ,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC/C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAC3D,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD;gBACE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kBAAkB,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,MAAY,EAAE,MAA+B;QAC/D,gEAAgE;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,0CAA0C,CAAC,CAAC;QACzG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YACvB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACpC,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,EAAE,KAAK,CAAC,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,qDAAqD,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QAEjF,qEAAqE;QACrE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACtD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACrB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC5B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC5B,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;oBAClB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBACjC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE;gBAC5C,SAAS;gBACT,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBACxH,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACxG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;IAClE,CAAC;CACF"}

package/dist/gateway/src/serve.d.ts

@@ -0,0 +1,34 @@
+import type { VerifyToken } from "./accounts.js";
+import { Gateway, type GatewayOptions } from "./relay.js";
+export interface StartGatewayOptions {
+    port: number;
+    /** The interface to listen on; all of them when omitted. */
+    host?: string;
+    /** SQLite file holding pairings and peers' public keys. Losing it unpairs every phone. */
+    databasePath: string;
+    /** What `/healthz` reports; this package's version when omitted. */
+    version?: string;
+    log?: (message: string) => void;
+    /** Validates account tokens; without it, accounts are off and only pairing works. */
+    verifyToken?: VerifyToken;
+    admit?: GatewayOptions["admit"];
+    /** Addresses of the reverse proxies in front, whose X-Forwarded-For is believed. */
+    trustedProxies?: readonly string[];
+    /** Connections one address may open per window (default 20 a minute). */
+    wsConnectLimit?: {
+        max: number;
+        windowMs: number;
+    };
+}
+export interface RunningGateway {
+    port: number;
+    relay: Gateway;
+    close(): Promise<void>;
+}
+/**
+ * The gateway as it is deployed: one HTTP server with the relay on
+ * `RELAY_PATH` and a health check on `/healthz`. Nothing else is served.
+ */
+export declare function startGateway(options: StartGatewayOptions): Promise<RunningGateway>;
+/** This package's version, so `/healthz` says which build is deployed. */
+export declare function packageVersion(): string;

package/dist/gateway/src/serve.js

@@ -0,0 +1,102 @@
+import { mkdirSync } from "node:fs";
+import { createServer } from "node:http";
+import { createRequire } from "node:module";
+import { dirname } from "node:path";
+import { RELAY_PATH } from "@linkshell/wire";
+import { clientIp, isLoopback, RateLimiter, trustedProxySet } from "./rate-limit.js";
+import { Gateway } from "./relay.js";
+/**
+ * The gateway as it is deployed: one HTTP server with the relay on
+ * `RELAY_PATH` and a health check on `/healthz`. Nothing else is served.
+ */
+export async function startGateway(options) {
+    mkdirSync(dirname(options.databasePath), { recursive: true });
+    const relay = new Gateway({
+        port: 0,
+        databasePath: options.databasePath,
+        verifyToken: options.verifyToken,
+        admit: options.admit,
+        log: options.log,
+    });
+    const version = options.version ?? packageVersion();
+    const trustedProxies = trustedProxySet(options.trustedProxies ?? []);
+    const limit = options.wsConnectLimit ?? { max: 20, windowMs: 60_000 };
+    const connectLimiter = new RateLimiter(limit.max, limit.windowMs);
+    const server = createServer((request, response) => {
+        if (request.method === "GET" && pathOf(request) === "/healthz") {
+            // memoryMb: what the process holds, to watch against the container's limit.
+            json(response, 200, { ok: true, version, relay: relay.connected, memoryMb: Math.round(process.memoryUsage.rss() / 1048576) });
+            return;
+        }
+        json(response, 404, { error: "not_found" });
+    });
+    server.on("upgrade", (request, socket, head) => {
+        if (pathOf(request) !== RELAY_PATH) {
+            socket.destroy();
+            return;
+        }
+        const ip = clientIp(request, trustedProxies);
+        if (!isLoopback(ip) && !connectLimiter.allow(ip)) {
+            socket.write("HTTP/1.1 429 Too Many Requests\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        relay.handleUpgrade(request, socket, head);
+    });
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(options.port, options.host, () => {
+                server.off("error", reject);
+                resolve();
+            });
+        });
+    }
+    catch (error) {
+        connectLimiter.destroy();
+        await relay.stop();
+        throw error;
+    }
+    relay.attach();
+    const address = server.address();
+    return {
+        port: typeof address === "object" && address ? address.port : options.port,
+        relay,
+        close: async () => {
+            connectLimiter.destroy();
+            // The relay drops its peers first: the server only finishes closing once their sockets are gone.
+            await relay.stop();
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+/** The request's path; undefined for a target that doesn't parse, which then matches nothing. */
+function pathOf(request) {
+    try {
+        return new URL(request.url ?? "/", "http://gateway").pathname;
+    }
+    catch {
+        return undefined;
+    }
+}
+function json(response, status, body) {
+    response.writeHead(status, { "content-type": "application/json" });
+    response.end(JSON.stringify(body));
+}
+/** This package's version, so `/healthz` says which build is deployed. */
+export function packageVersion() {
+    const require = createRequire(import.meta.url);
+    // package.json is one level up from src/ and three up from dist/gateway/src/.
+    for (const path of ["../package.json", "../../../package.json"]) {
+        try {
+            const manifest = require(path);
+            if (manifest.name === "@linkshell/gateway" && manifest.version)
+                return manifest.version;
+        }
+        catch {
+            // Not at this depth.
+        }
+    }
+    return "unknown";
+}
+//# sourceMappingURL=serve.js.map

package/dist/gateway/src/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../../gateway/src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAuB,MAAM,YAAY,CAAC;AA0B1D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC;QACxB,IAAI,EAAE,CAAC;QACP,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACpD,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACtE,MAAM,cAAc,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;YAC/D,4EAA4E;YAC5E,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9H,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC7C,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACvD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,KAAK,CAAC,MAAM,EAAE,CAAC;IAEf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;QAC1E,KAAK;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,cAAc,CAAC,OAAO,EAAE,CAAC;YACzB,iGAAiG;YACjG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,MAAM,CAAC,OAAwB;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACnE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc;IAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,8EAA8E;IAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAwC,CAAC;YACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,oBAAoB,IAAI,QAAQ,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/gateway/src/store.d.ts

@@ -0,0 +1,35 @@
+import type { PeerRole } from "@linkshell/wire";
+export interface PeerRecord {
+    id: string;
+    role: PeerRole;
+    signKey: string;
+    boxKey: string;
+    name: string;
+    platform?: string;
+    userId?: string;
+    lastSeen: number;
+}
+export declare class GatewayStore {
+    private readonly db;
+    constructor(path: string);
+    close(): void;
+    peer(id: string): PeerRecord | undefined;
+    upsertPeer(peer: PeerRecord): void;
+    touch(id: string, at?: number): void;
+    link(machineId: string, deviceId: string, at?: number): void;
+    unlink(machineId: string, deviceId: string): boolean;
+    /**
+     * Takes a peer off its account: the account's other peers no longer reach it, or list it. Its
+     * keys and pairings stay, and signing in again puts it back.
+     */
+    disown(id: string): boolean;
+    linkedAt(machineId: string, deviceId: string): number | undefined;
+    /** Peers of the other role that `id` may reach: linked, or owned by the same account. */
+    reachable(id: string): {
+        peer: PeerRecord;
+        via: "paired" | "account";
+        pairedAt?: number;
+    }[];
+    /** How `from` may reach `to`, or undefined when it may not. */
+    route(from: string, to: string): "paired" | "account" | undefined;
+}