waterplane 0.0.1 → 0.1.6

package/packages/host/dist/pair.js

@@ -0,0 +1,505 @@
+/**
+ * Pairing a new phone by QR: the code store, the three routes and the
+ * host-rendered landing page.
+ *
+ *   POST /api/pair/mint              behind the gate (loopback, an ungated
+ *                                    Tailscale peer, or a valid token)
+ *   POST /api/pair/redeem {code, deviceName}
+ *                                    PRE-auth — the code IS the credential —
+ *                                    rate-limited per remote IP
+ *   GET  /pair/<code>                the landing page the QR opens
+ *   GET  /pair/<code>/apk            the Android build, same origin
+ *
+ * **Codes live in memory only, as their sha256** (`PairStore`): a restart
+ * forgets every outstanding code, which costs a person one "show a new QR" and
+ * means no file ever holds a live credential. A lookup hashes the presented
+ * code and compares it against EVERY entry with `timingSafeEqual`, no early
+ * exit. A code lives `PAIR_TTL_MS`, is spent by its first successful REDEEM —
+ * viewing the landing page and downloading the APK do NOT spend it, because
+ * the new phone does both before it has an app that can redeem — and at most
+ * `PAIR_MAX_OUTSTANDING` are live at once (the oldest is dropped by a new mint).
+ * A spent or expired code is remembered a little longer only so the phone can
+ * be told WHICH it was; it never passes again.
+ *
+ * **The landing page reveals nothing without a live code.** It is reachable by
+ * a brand-new device with no token (static paths are outside the token gate,
+ * and over LAN that is the point: the code is the capability), so the code is
+ * checked BEFORE anything about this desktop is rendered, and every invalid
+ * case — malformed, unknown, expired, spent, rate-limited — is the same plain
+ * page. `/pair/*` is NOT in `OPAQUE_READ_ROUTES` and passes no origin check:
+ * it is a top-level navigation, not an `/api/` call.
+ *
+ * Redeem mints a device token (a ledger row, `auth.issueToken`) only when a
+ * password is set — deny-until-set. With none set a loopback/Tailscale peer
+ * needs no token and is told so; a LAN peer is refused BEFORE the code is spent.
+ * The LAN identity secret goes only to a loopback/Tailscale redeemer, as
+ * `GET /api/lan/identity` does.
+ */
+import { createHash, timingSafeEqual } from "node:crypto";
+import { createReadStream, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { PAIR_TTL_MS, formatPairCode, newPairCode, normalizeDeviceName, normalizePairCode, pairDeepLink, pairLandingUrl, pairPathCode, pairRedeemErrorText, BRAND, releaseApkName, } from "@waterplane/shared";
+import { tokenFromRequest } from "./auth.js";
+import { lanIdentity } from "./lanid.js";
+import { hostName, lanIps, serveHttpsUrl, tailscaleIp } from "./net.js";
+import { RateLimiter, rateKey } from "./ratelimit.js";
+import { corsHeaders } from "./origin.js";
+import { env } from "./env.js";
+/** Live (unspent, unexpired) codes at once; a mint past it drops the oldest. */
+export const PAIR_MAX_OUTSTANDING = 5;
+/** A spent/expired code is remembered this long past its expiry, only so the
+ *  phone can say "used" or "expired" instead of "unknown". */
+const PAIR_FORGET_AFTER_MS = PAIR_TTL_MS;
+/** Hard bound on remembered entries (live + spent + expired). */
+const PAIR_MAX_ENTRIES = 50;
+/** `WATERPLANE_PAIR_TTL_MS` shortens the lifetime for e2e (floored at 1 s, never
+ *  longer than the shared 10 minutes the phone's sentences promise). */
+function pairTtlFromEnv() {
+    const n = Number(env("PAIR_TTL_MS"));
+    return Number.isFinite(n) && n > 0 ? Math.min(PAIR_TTL_MS, Math.max(1000, n)) : PAIR_TTL_MS;
+}
+function hashCode(code) {
+    return createHash("sha256").update(code, "utf8").digest();
+}
+export class PairStore {
+    entries = [];
+    now;
+    ttlMs;
+    maxOutstanding;
+    compare;
+    constructor(opts = {}) {
+        this.now = opts.now ?? Date.now;
+        this.ttlMs = opts.ttlMs ?? pairTtlFromEnv();
+        this.maxOutstanding = opts.maxOutstanding ?? PAIR_MAX_OUTSTANDING;
+        this.compare = opts.compare ?? timingSafeEqual;
+    }
+    /** A new code; the plaintext exists only in the return value. */
+    mint(mintedBy, passive = false) {
+        const now = this.now();
+        this.prune(now);
+        let code = newPairCode();
+        while (this.find(code) !== null)
+            code = newPairCode(); // 32^8: never in practice
+        const live = this.entries.filter((e) => e.usedAt === null && e.expiresAt > now);
+        for (let i = 0; i <= live.length - this.maxOutstanding; i++)
+            this.entries.splice(this.entries.indexOf(live[i]), 1);
+        const expiresAt = now + this.ttlMs;
+        this.entries.push({ hash: hashCode(code), createdAt: now, expiresAt, mintedBy, usedAt: null, passive });
+        while (this.entries.length > PAIR_MAX_ENTRIES)
+            this.entries.shift();
+        return { code, expiresAt };
+    }
+    /** Constant-time over every entry: no early exit on a match. */
+    find(code) {
+        const h = hashCode(code);
+        let hit = null;
+        for (const e of this.entries)
+            if (this.compare(e.hash, h) && hit === null)
+                hit = e;
+        return hit;
+    }
+    stateOf(e, now) {
+        if (!e)
+            return "unknown";
+        if (e.usedAt !== null)
+            return "used";
+        return now >= e.expiresAt ? "expired" : "ok";
+    }
+    /** What a code is, spending nothing (the landing page, the APK). */
+    peek(code) {
+        const now = this.now();
+        this.prune(now);
+        return this.stateOf(this.find(code), now);
+    }
+    /** Does this code pair a passive device? Spends nothing. */
+    isPassive(code) {
+        return this.find(code)?.passive === true;
+    }
+    /** Spend a live code. Anything but "ok" spends nothing. */
+    redeem(code) {
+        const now = this.now();
+        this.prune(now);
+        const e = this.find(code);
+        const state = this.stateOf(e, now);
+        if (state === "ok" && e)
+            e.usedAt = now;
+        return { state, mintedBy: e?.mintedBy ?? null, passive: e?.passive === true };
+    }
+    /** Live codes right now. */
+    outstanding() {
+        const now = this.now();
+        return this.entries.filter((e) => e.usedAt === null && e.expiresAt > now).length;
+    }
+    /** Every remembered entry, spent and expired included (tests). */
+    get size() { return this.entries.length; }
+    /** The stored hashes, hex (tests: nothing at rest is the code). */
+    storedHashes() { return this.entries.map((e) => e.hash.toString("hex")); }
+    prune(now) {
+        this.entries = this.entries.filter((e) => now < e.expiresAt + PAIR_FORGET_AFTER_MS);
+    }
+}
+let netCache = null;
+const NET_CACHE_MS = 60_000;
+/**
+ * Re-derived here rather than handed down from `main()`: the same three facts
+ * `main()` binds with (tailscale IP, serve URL, bound LAN IPs), asked of the
+ * same functions, cached a minute — a mint is a person tapping "show QR", not
+ * a hot path. An explicit `WATERPLANE_HOST` is the address actually bound, so it
+ * wins over the Tailscale IP.
+ */
+export async function pairNet(port) {
+    const now = Date.now();
+    if (netCache && netCache.port === port && now - netCache.at < NET_CACHE_MS)
+        return netCache.net;
+    const httpsUrl = await serveHttpsUrl(port);
+    const ts = await tailscaleIp();
+    const hostEnv = env("HOST");
+    const explicit = hostEnv && !/^(0\.0\.0\.0|::)$/.test(hostEnv) ? hostEnv : null;
+    const addr = explicit ?? ts ?? "127.0.0.1";
+    const hostPart = addr.includes(":") ? `[${addr}]` : addr;
+    const lan = env("ALLOW_PUBLIC") === "1" && !explicit ? lanIps()[0] : undefined;
+    const net = {
+        name: hostName(),
+        base: httpsUrl ?? `http://${hostPart}:${port}`,
+        httpsUrl,
+        ...(lan ? { lanBase: `http://${lan}:${port}` } : {}),
+    };
+    netCache = { at: now, port, net };
+    return net;
+}
+// ── The Android build ───────────────────────────────────────────────────
+/** Gradle's output for `npm run apk` — the `dev` flavor's debug build, the
+ *  owner's sideloadable one (the `play` flavor ships through Google Play and is
+ *  never handed out here) — relative to this checkout (`src/` under tsx and
+ *  `dist/` built are both one level under `packages/host`). */
+export const DEFAULT_APK = resolve(import.meta.dirname, "../../app/android/app/build/outputs/apk/dev/debug/app-dev-debug.apk");
+function apkAt(p) {
+    try {
+        const st = statSync(p);
+        if (st.isFile())
+            return /\.apk$/i.test(p) && st.size > 0 ? { path: p, size: st.size, mtimeMs: st.mtimeMs } : null;
+        if (!st.isDirectory())
+            return null;
+        let best = null;
+        for (const name of readdirSync(p)) {
+            if (!/\.apk$/i.test(name))
+                continue;
+            const f = apkAt(join(p, name));
+            if (f && (!best || f.mtimeMs > best.mtimeMs))
+                best = f;
+        }
+        return best;
+    }
+    catch {
+        return null;
+    }
+}
+/** The newest of `WATERPLANE_APK_PATH` (a file, or a directory of .apk files) and
+ *  the default gradle output; null when neither holds one. */
+export function latestApk(envPath = env("APK_PATH"), fallback = DEFAULT_APK) {
+    const cands = [envPath ? apkAt(envPath) : null, apkAt(fallback)].filter((x) => !!x);
+    cands.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    return cands[0] ?? null;
+}
+/** The install root's `release.json`: `dist/` → `host/` → `packages/` → the root. */
+const RELEASE_JSON = resolve(import.meta.dirname, "../../../release.json");
+/**
+ * Where a release install's phone can get the APK, or null. Never a guess: a URL
+ * is built only from what the release says it published (`apk`, the asset's file
+ * name, which `scripts/release/build.mjs --apk` records), or an explicit
+ * `WATERPLANE_APK_URL` (https only). A release without an APK asset answers null,
+ * and the page then says the web route — a link that 404s is worse than none.
+ */
+export function releaseApkUrl(releaseJson = readJsonQuiet(RELEASE_JSON), envUrl = env("APK_URL"), org = BRAND.githubOrg, slug = BRAND.slug) {
+    if (envUrl && /^https:\/\/[^\s"'<>]+$/.test(envUrl))
+        return envUrl;
+    const r = releaseJson;
+    if (!r || typeof r.version !== "string" || typeof r.apk !== "string")
+        return null;
+    if (!/^[\w.-]+\.apk$/i.test(r.apk) || !/^[\w.+-]+$/.test(r.version))
+        return null;
+    if (r.apk !== releaseApkName(slug, r.version))
+        return null; // the one shared naming rule (shared/brand.ts)
+    if (r.apk !== releaseApkName(slug, r.version))
+        return null; // the one shared naming rule (shared/brand.ts)
+    return `https://github.com/${org}/${slug}/releases/download/v${r.version}/${r.apk}`;
+}
+function readJsonQuiet(p) {
+    try {
+        return JSON.parse(readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** The one decision: a build on this computer wins (it matches this host); else the release's; else none. */
+export function apkSource(local, releaseUrl) {
+    if (local)
+        return { kind: "local", apk: local };
+    if (releaseUrl)
+        return { kind: "release", url: releaseUrl };
+    return { kind: "none" };
+}
+/** The name a download carries: the build's own time, so two are told apart. */
+export function apkFileName(a) {
+    const d = new Date(a.mtimeMs);
+    const p = (n) => String(n).padStart(2, "0");
+    return `${BRAND.slug}-${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}.apk`;
+}
+/** 5 attempts in a burst, then one every 10 s, per remote IP: 32^8 codes do
+ *  not fall to that, and a person mistyping twice is never blocked. */
+export const redeemLimit = new RateLimiter({ burst: 5, perSec: 0.1 });
+/** The landing + APK: a phone loads the page, maybe twice, and the APK once. */
+export const landingLimit = new RateLimiter({ burst: 12, perSec: 0.2 });
+const NO_PASSWORD_LAN = "This desktop has no password set, so it refuses every device on the Wi-Fi. Pair over Tailscale, or set a password on the paired phone first.";
+const NO_PASSWORD_PASSIVE = "This desktop has no password set, and a passive device needs a token of its own. Set a password on the desktop first, then show a new code.";
+const NO_PASSWORD_NOTE = "This desktop has no password set, so this phone needs no token over Tailscale. It cannot use the Wi-Fi route until a password is set.";
+function reply(req, res, status, body, extra = {}) {
+    res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store", ...corsHeaders(req.headers), ...extra });
+    res.end(JSON.stringify(body));
+}
+async function readJson(req, max = 4096) {
+    const chunks = [];
+    let n = 0;
+    for await (const c of req) {
+        n += c.length;
+        if (n > max) {
+            req.destroy();
+            return {};
+        }
+        chunks.push(c);
+    }
+    try {
+        const j = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+        return j && typeof j === "object" ? j : {};
+    }
+    catch {
+        return {};
+    }
+}
+const refuse = (error, message = error === "no-password" ? NO_PASSWORD_LAN : pairRedeemErrorText(error)) => ({ ok: false, error, message });
+/** The redeem decision, over a store and an auth manager — no sockets, so the
+ *  test suite asks it directly. Never spends the code on a refusal.
+ *
+ *  `presented`: a token the caller sent with the redeem (the phone re-pairing a
+ *  desktop it already holds a token for). A valid one names the caller's OWN
+ *  old ledger row, which the new token replaces — otherwise every re-pair left
+ *  a ghost row in Paired devices. Only the holder of a token can retire it,
+ *  and only after the code checked out and a new row was minted. */
+export async function redeemPair(body, kind, deps, presented = null) {
+    const code = normalizePairCode(body.code);
+    if (!code)
+        return { status: 400, body: refuse("bad-request") };
+    const trustedPath = kind === "loopback" || kind === "tailscale";
+    const state = deps.store.peek(code);
+    if (state !== "ok")
+        return { status: state === "unknown" ? 404 : 410, body: refuse(state) };
+    if (!deps.auth.isEnabled() && !trustedPath)
+        return { status: 403, body: refuse("no-password") };
+    // A passive device without a token would be a full one on Tailscale: refused, code unspent.
+    if (!deps.auth.isEnabled() && deps.store.isPassive(code))
+        return { status: 403, body: refuse("no-password", NO_PASSWORD_PASSIVE) };
+    const spent = deps.store.redeem(code);
+    if (spent.state !== "ok")
+        return { status: 410, body: refuse("used") };
+    const net = await deps.net();
+    const host = { name: net.name, base: net.base, httpsUrl: net.httpsUrl, ...(net.lanBase ? { lanBase: net.lanBase } : {}) };
+    const out = { ok: true, host };
+    if (deps.auth.isEnabled()) {
+        const gateBefore = deps.auth.gateTailscale();
+        const { token, deviceId } = deps.auth.issueToken(normalizeDeviceName(body.deviceName) ?? "paired phone", kind, spent.passive ? "passive" : undefined);
+        out.token = token;
+        out.deviceId = deviceId;
+        if (spent.passive)
+            out.scope = "passive";
+        if (presented && deps.auth.deviceFor(presented))
+            deps.auth.revoke(presented);
+        // A passive row switches the gate on for good: every tokenless Tailscale socket open right
+        // now is no longer authorized, and must be told and closed rather than left to have its
+        // frames dropped in silence.
+        if (deps.auth.gateTailscale() !== gateBefore)
+            deps.onGateChange?.();
+    }
+    else {
+        out.note = NO_PASSWORD_NOTE;
+    }
+    if (trustedPath) {
+        const id = lanIdentity(deps.root);
+        out.lanIdentity = { hostId: id.hostId, secret: id.secret };
+    }
+    return { status: 200, body: out };
+}
+/** `POST /api/pair/redeem`, before the auth gate. True when it answered. */
+export async function handlePairPreAuth(req, res, kind, deps) {
+    const path = (req.url ?? "/").split("?")[0];
+    if (path !== "/api/pair/redeem")
+        return false;
+    if (req.method !== "POST") {
+        reply(req, res, 405, { error: "POST only" });
+        return true;
+    }
+    const key = rateKey(req);
+    if (!redeemLimit.take(key)) {
+        reply(req, res, 429, refuse("rate-limited"), { "retry-after": String(Math.ceil(redeemLimit.retryAfterMs(key) / 1000) || 1) });
+        return true;
+    }
+    const r = await redeemPair(await readJson(req), kind, deps, tokenFromRequest(req.headers));
+    reply(req, res, r.status, r.body);
+    return true;
+}
+/** `POST /api/pair/mint`, behind the auth gate. True when it answered. */
+export async function handlePairAuthed(req, res, tok, deps, kind) {
+    const path = (req.url ?? "/").split("?")[0];
+    if (path !== "/api/pair/mint")
+        return false;
+    if (req.method !== "POST") {
+        reply(req, res, 405, { error: "POST only" });
+        return true;
+    }
+    // Pairing hands out a full token: only the trusted path (loopback / Tailscale) mints, never a LAN token.
+    if (!deps.auth.canManage(kind)) {
+        reply(req, res, 403, { error: "Pairing codes are made from the desktop or from a phone over Tailscale — not over the Wi-Fi route." });
+        return true;
+    }
+    const passive = (await readJson(req)).passive === true;
+    if (passive && !deps.auth.isEnabled()) {
+        reply(req, res, 409, { error: NO_PASSWORD_PASSIVE });
+        return true;
+    }
+    const { code, expiresAt } = deps.store.mint(deps.auth.deviceFor(tok)?.id ?? null, passive);
+    const net = await deps.net();
+    const out = {
+        code, expiresAt, base: net.base, ...(passive ? { passive } : {}),
+        landingUrl: pairLandingUrl(net.base, code),
+        deepLink: pairDeepLink(net.base, code),
+        ...(net.lanBase ? { lanBase: net.lanBase } : {}),
+    };
+    reply(req, res, 200, out);
+    return true;
+}
+// ── The landing page ────────────────────────────────────────────────────
+const PAGE_HEADERS = {
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+    "x-frame-options": "DENY",
+    "x-content-type-options": "nosniff",
+    // The code is in the URL: never hand it to another site as a Referer.
+    "referrer-policy": "no-referrer",
+    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+};
+function esc(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+}
+// lucide-style strokes, inline: no icon font, no external request.
+const svg = (d) => `<svg viewBox="0 0 24 24" width="22" height="22" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">${d}</svg>`;
+const ICON_GLOBE = svg('<circle cx="12" cy="12" r="10"/><path d="M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20"/><path d="M2 12h20"/>');
+const ICON_DOWNLOAD = svg('<path d="M12 15V3"/><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><path d="m7 10 5 5 5-5"/>');
+const ICON_PHONE = svg('<rect width="14" height="20" x="5" y="2" rx="2" ry="2"/><path d="M12 18h.01"/>');
+const STYLE = `
+:root{--bg:#f7f7f5;--fg:#1b1b1a;--muted:#5d5d58;--card:#fff;--line:#deded8;--accent:#2f5bd3;--accentfg:#fff}
+@media (prefers-color-scheme:dark){:root{--bg:#141413;--fg:#ecece8;--muted:#a3a39c;--card:#1f1f1d;--line:#34342f;--accent:#7d9bff;--accentfg:#0d0d0c}}
+*{box-sizing:border-box}html{-webkit-text-size-adjust:100%}
+body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}
+main{max-width:30rem;margin:0 auto;padding:24px 16px 40px}
+h1{font-size:1.4rem;line-height:1.25;margin:0 0 4px}
+p{margin:8px 0}.muted{color:var(--muted);font-size:.93rem}
+.choice{display:flex;align-items:center;gap:12px;width:100%;min-height:56px;margin:14px 0 4px;padding:14px 16px;border-radius:12px;background:var(--accent);color:var(--accentfg);text-decoration:none;font-weight:600;font-size:1.05rem}
+.choice.alt{background:var(--card);color:var(--fg);border:1px solid var(--line)}
+.box{margin-top:24px;padding:14px 16px;border:1px solid var(--line);border-radius:12px;background:var(--card)}
+code{font:600 1.05rem/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;overflow-wrap:anywhere}
+a{color:var(--accent)}
+`;
+function page(title, body) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><meta name="robots" content="noindex"><title>${esc(title)}</title><style>${STYLE}</style></head><body><main>${body}</main></body></html>`;
+}
+/** Every invalid case renders THIS — nothing about the desktop in it. */
+export function invalidPage() {
+    return page("Pairing code not valid", `<h1>This pairing code is not valid</h1><p>It may have expired (codes last 10 minutes), already been used, or been mistyped.</p><p>Ask for a new code on your other phone: in ${BRAND.name}, open the host list and choose "show QR".</p>`);
+}
+/** The page for a live code. Pure: tests render it without a server. */
+export function landingPage(code, net, apk, releaseUrl = null) {
+    const addr = net.base;
+    // The PWA route is the URL itself, in words, not only a button: a phone that will never take the
+    // APK (an iPhone, a locked-down Android) needs the address to open, bookmark or type.
+    const webUrl = `${net.httpsUrl ?? addr}/`;
+    const route = `<p class="muted">Or open <code>${esc(webUrl)}</code> in this phone's browser — that is the whole app, no install needed${net.httpsUrl ? "; add it to the home screen to keep it" : ""}.</p>`;
+    const web = net.httpsUrl
+        ? `<a class="choice" href="${esc(webUrl)}">${ICON_GLOBE}<span>Use web version</span></a>
+       ${route}`
+        : `<a class="choice" href="${esc(webUrl)}">${ICON_GLOBE}<span>Use web version</span></a>
+       ${route}
+       <p class="muted">This address is plain http, so the browser will not install the app or show notifications. On the desktop, run <code>tailscale serve --bg --https=443 http://127.0.0.1:${esc(new URL(addr).port || "8770")}</code> to give it an https address.</p>`;
+    const mb = apk ? Math.max(1, Math.round(apk.size / 1048576)) : 0;
+    const src = apkSource(apk, releaseUrl);
+    const app = src.kind === "release"
+        ? `<a class="choice alt" href="${esc(src.url)}" rel="noreferrer">${ICON_DOWNLOAD}<span>Download the Android app</span></a>
+       <p class="muted">From the ${esc(BRAND.name)} release page. Android will ask to allow installs from your browser.</p>`
+        : apk
+            ? `<a class="choice alt" href="/pair/${esc(code)}/apk" download="${esc(apkFileName(apk))}">${ICON_DOWNLOAD}<span>Download the Android app</span></a>
+       <p class="muted">${mb} MB, built ${esc(new Date(apk.mtimeMs).toISOString().slice(0, 10))}. Android will ask to allow installs from your browser.</p>`
+            : `<p class="box">No Android app is offered from this computer. Use the web version${net.httpsUrl ? " — it installs to the home screen" : ""}.</p>`;
+    const deep = pairDeepLink(addr, code);
+    return page(`Pair with ${net.name}`, `
+<h1>Connect to ${esc(net.name)}</h1>
+<p class="muted">This phone must be on the same tailnet, with Tailscale connected.</p>
+${web}
+${app}
+<div class="box">
+  <p>${ICON_PHONE} <strong>After installing</strong></p>
+  <p>Open the app, choose "Pair with code", enter</p>
+  <p><code>${esc(addr)}</code></p>
+  <p>and code <code>${esc(formatPairCode(code))}</code></p>
+  <p><a href="${esc(deep)}">Open in app</a></p>
+  <p class="muted">The code works once and expires 10 minutes after it was shown.</p>
+</div>`);
+}
+/** `GET /pair/<code>` and `/pair/<code>/apk`. Every other `/pair…` path is
+ *  the invalid page, never the SPA shell. */
+export async function handlePairPage(req, res, deps) {
+    const method = req.method ?? "GET";
+    if (method !== "GET" && method !== "HEAD") {
+        res.writeHead(405, { ...PAGE_HEADERS, allow: "GET, HEAD" });
+        res.end();
+        return;
+    }
+    const path = (req.url ?? "/").split("?")[0];
+    const invalid = (status) => { res.writeHead(status, PAGE_HEADERS); res.end(method === "HEAD" ? undefined : invalidPage()); };
+    if (!landingLimit.take(rateKey(req))) {
+        invalid(429);
+        return;
+    }
+    const p = pairPathCode(path);
+    // The code is checked BEFORE anything about this desktop is looked up.
+    if (!p || deps.store.peek(p.code) !== "ok") {
+        invalid(404);
+        return;
+    }
+    const apk = deps.apk();
+    if (p.apk) {
+        if (!apk) {
+            res.writeHead(404, PAGE_HEADERS);
+            res.end(method === "HEAD" ? undefined : page("No Android build", `<h1>No Android build on this computer yet</h1><p>Use the web version instead.</p>`));
+            return;
+        }
+        res.writeHead(200, {
+            "content-type": "application/vnd.android.package-archive",
+            "content-length": String(apk.size),
+            "content-disposition": `attachment; filename="${apkFileName(apk)}"`,
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff",
+            "referrer-policy": "no-referrer",
+        });
+        if (method === "HEAD") {
+            res.end();
+            return;
+        }
+        const s = createReadStream(apk.path);
+        s.on("error", () => res.destroy());
+        s.pipe(res);
+        return;
+    }
+    const html = landingPage(p.code, await deps.net(), apk, releaseApkUrl());
+    res.writeHead(200, PAGE_HEADERS);
+    res.end(method === "HEAD" ? undefined : html);
+}
+//# sourceMappingURL=pair.js.map

package/packages/host/dist/pair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair.js","sourceRoot":"","sources":["../src/pair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEhF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAC9G,YAAY,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,GAEzD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAoB,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC;8DAC8D;AAC9D,MAAM,oBAAoB,GAAG,WAAW,CAAC;AACzC,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAM5B;wEACwE;AACxE,SAAS,cAAc;IACrB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAMD,MAAM,OAAO,SAAS;IACZ,OAAO,GAAY,EAAE,CAAC;IACb,GAAG,CAAe;IAClB,KAAK,CAAS;IACd,cAAc,CAAS;IACvB,OAAO,CAAoC;IAE5D,YAAY,OAAsB,EAAE;QAClC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,EAAE,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,oBAAoB,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IACjD,CAAC;IAED,iEAAiE;IACjE,IAAI,CAAC,QAAuB,EAAE,OAAO,GAAG,KAAK;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,GAAG,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,IAAI,GAAG,WAAW,EAAE,CAAC,CAAC,0BAA0B;QACjF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACpH,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,gBAAgB;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,gEAAgE;IACxD,IAAI,CAAC,IAAY;QACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,GAAiB,IAAI,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,IAAI;gBAAE,GAAG,GAAG,CAAC,CAAC;QACnF,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,CAAe,EAAE,GAAW;QAC1C,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACrC,OAAO,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,IAAY;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,4DAA4D;IAC5D,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,IAAY;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC;YAAE,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;IAChF,CAAC;IAED,4BAA4B;IAC5B,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACnF,CAAC;IAED,kEAAkE;IAClE,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAElD,mEAAmE;IACnE,YAAY,KAAe,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,KAAK,CAAC,GAAW;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,GAAG,oBAAoB,CAAC,CAAC;IACtF,CAAC;CACF;AAaD,IAAI,QAAQ,GAAsD,IAAI,CAAC;AACvE,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,GAAG,QAAQ,CAAC,EAAE,GAAG,YAAY;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC;IAChG,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,IAAI,WAAW,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,GAAG,GAAY;QACnB,IAAI,EAAE,QAAQ,EAAE;QAChB,IAAI,EAAE,QAAQ,IAAI,UAAU,QAAQ,IAAI,IAAI,EAAE;QAC9C,QAAQ;QACR,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IACF,QAAQ,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAE3E;;;+DAG+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,qEAAqE,CAAC,CAAC;AAI/H,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClH,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,GAAmB,IAAI,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBAAE,IAAI,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,SAAS,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,WAAW;IACzE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,qFAAqF;AACrF,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,cAAuB,aAAa,CAAC,YAAY,CAAC,EAClD,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,EACvB,GAAG,GAAG,KAAK,CAAC,SAAS,EACrB,IAAI,GAAG,KAAK,CAAC,IAAI;IAEjB,IAAI,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,MAAM,CAAC,GAAG,WAA0D,CAAC;IACrE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,+CAA+C;IAC3G,IAAI,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,+CAA+C;IAC3G,OAAO,sBAAsB,GAAG,IAAI,IAAI,uBAAuB,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC5E,CAAC;AAOD,6GAA6G;AAC7G,MAAM,UAAU,SAAS,CAAC,KAAqB,EAAE,UAAyB;IACxE,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAChD,IAAI,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC;AAC9H,CAAC;AAeD;uEACuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACtE,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAUxE,MAAM,eAAe,GAAG,8IAA8I,CAAC;AACvK,MAAM,mBAAmB,GAAG,6IAA6I,CAAC;AAC1K,MAAM,gBAAgB,GAAG,uIAAuI,CAAC;AAEjK,SAAS,KAAK,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAE,QAAgC,EAAE;IACzH,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAClI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,GAAG,GAAG,IAAI;IACtD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QAC1B,CAAC,IAAK,CAAY,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAwB,EAAE,OAAO,GAAG,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAmB,EAAE,CAC7I,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAElC;;;;;;;oEAOoE;AACpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAA6B,EAAE,IAAc,EAAE,IAAwE,EAAE,YAA2B,IAAI;IAExJ,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,WAAW,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAChG,4FAA4F;IAC5F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,EAAE,CAAC;IACnI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1I,MAAM,GAAG,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtJ,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;QAClB,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO;YAAE,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;QACzC,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7E,2FAA2F;QAC3F,wFAAwF;QACxF,6BAA6B;QAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,UAAU;YAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC9B,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,WAAW,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAc,EAAE,IAAc;IAC/G,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACzF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAkB,EAAE,IAAc,EAAE,IAAc;IAClI,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACzF,yGAAyG;IACzG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oGAAoG,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACvL,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;IACvD,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC7G,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,GAAG,GAA4C;QACnD,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1C,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAE3E,MAAM,YAAY,GAAG;IACnB,cAAc,EAAE,0BAA0B;IAC1C,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,MAAM;IACzB,wBAAwB,EAAE,SAAS;IACnC,sEAAsE;IACtE,iBAAiB,EAAE,aAAa;IAChC,yBAAyB,EAAE,2HAA2H;CAC7H,CAAC;AAE5B,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AACrH,CAAC;AAED,mEAAmE;AACnE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,wKAAwK,CAAC,QAAQ,CAAC;AAC7M,MAAM,UAAU,GAAG,GAAG,CAAC,iHAAiH,CAAC,CAAC;AAC1I,MAAM,aAAa,GAAG,GAAG,CAAC,oGAAoG,CAAC,CAAC;AAChI,MAAM,UAAU,GAAG,GAAG,CAAC,gFAAgF,CAAC,CAAC;AAEzG,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,SAAS,IAAI,CAAC,KAAa,EAAE,IAAY;IACvC,OAAO,0NAA0N,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,8BAA8B,IAAI,uBAAuB,CAAC;AAC9T,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,wBAAwB,EAAE,gLAAgL,KAAK,CAAC,IAAI,gDAAgD,CAAC,CAAC;AACpR,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAY,EAAE,GAAmB,EAAE,aAA4B,IAAI;IAC3G,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,iGAAiG;IACjG,sFAAsF;IACtF,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC;IAC1C,MAAM,KAAK,GAAG,kCAAkC,GAAG,CAAC,MAAM,CAAC,6EAA6E,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IAC5M,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ;QACtB,CAAC,CAAC,2BAA2B,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;SAClD,KAAK,EAAE;QACZ,CAAC,CAAC,2BAA2B,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;SAClD,KAAK;iMACmL,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,0CAA0C,CAAC;IAC3Q,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS;QAChC,CAAC,CAAC,+BAA+B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,sBAAsB,aAAa;mCACjD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0EAA0E;QACxH,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,qCAAqC,GAAG,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa;0BACpF,EAAE,cAAc,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,6DAA6D;YACxJ,CAAC,CAAC,mFAAmF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACtJ,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,EAAE,EAAE;iBACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;;EAE5B,GAAG;EACH,GAAG;;OAEE,UAAU;;aAEJ,GAAG,CAAC,IAAI,CAAC;sBACA,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC/B,GAAG,CAAC,IAAI,CAAC;;OAElB,CAAC,CAAC;AACT,CAAC;AAED;6CAC6C;AAC7C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAc;IAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,uEAAuE;IACvE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACV,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,mFAAmF,CAAC,CAAC,CAAC;YACvJ,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,yCAAyC;YACzD,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAClC,qBAAqB,EAAE,yBAAyB,WAAW,CAAC,GAAG,CAAC,GAAG;YACnE,eAAe,EAAE,UAAU;YAC3B,wBAAwB,EAAE,SAAS;YACnC,iBAAiB,EAAE,aAAa;SACjC,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/packages/host/dist/passive.d.ts

@@ -0,0 +1,58 @@
+import { type DeviceRow, type PassiveUnlockResponse, type PullItem } from "@waterplane/shared";
+/** `WATERPLANE_PASSIVE_UNLOCK_MS` shortens the unlock for e2e (floored at 1 s,
+ *  never longer than the 30 minutes the phone's sentence promises). */
+export declare function unlockMsFromEnv(): number;
+/**
+ * May a passive (locked) token make this `/api/` request? `queuedApk` answers
+ * "is (repoId, worktree-relative path) an APK in the auto-pull queue". Pure:
+ * `packages/host/test/passive.test.mjs` asks it directly.
+ */
+export declare function passiveAllows(method: string, path: string, query: URLSearchParams, queuedApk: (repoId: string, relPath: string) => boolean): boolean;
+/**
+ * Auth MATERIAL is out of a passive row's reach even while it is unlocked: a
+ * pairing code (it mints a full token), a revoke, a peer pairing, the LAN
+ * identity secret. The unlock lifts the device to full scope for 30 minutes;
+ * each of these would outlive it as a credential or an auth change in its own
+ * right. `/api/auth/token` and `/api/auth/pin` refuse a passive row the same
+ * way in `server/http.ts`, and the WebSocket `auth.*` ops in `routes/system.ts`.
+ * Pure: `passive.test.mjs` asks it.
+ */
+export declare function passiveNeverAllows(method: string, path: string): boolean;
+/** The auto-pull queue as a passive device may see it: APKs only. */
+export declare function passiveItems(items: readonly PullItem[]): PullItem[];
+/** `passiveAllows`'s question over a queue. */
+export declare function queuedApkIn(items: readonly PullItem[]): (repoId: string, relPath: string) => boolean;
+export interface PassiveGateOpts {
+    now?: () => number;
+    unlockMs?: number;
+    /** A device's unlock ended (expiry or "Lock now"): close its sockets. */
+    onRelock?: (deviceId: string) => void;
+}
+export type UnlockResult = PassiveUnlockResponse & {
+    retryAfterMs?: number;
+};
+export declare class PassiveGate {
+    readonly file: string;
+    private pin;
+    private readonly unlocked;
+    private readonly now;
+    readonly unlockMs: number;
+    /** Set by `main.ts` once the socket registry exists (`closeDevice`). */
+    onRelock: (id: string) => void;
+    /** 5 tries in a burst, then one a minute, per device: a 4-digit PIN takes
+     *  days to walk, a child mistyping twice is never locked out. */
+    private readonly limit;
+    constructor(root: string, opts?: PassiveGateOpts);
+    pinSet(): boolean;
+    /** Set (a valid PIN) or clear (`null`) the unlock PIN. Every live unlock ends. */
+    setPin(raw: string | null): void;
+    private pinMatches;
+    /** A passive device asks to be lifted to full scope. */
+    unlock(row: DeviceRow | null, raw: unknown): UnlockResult;
+    /** End a device's unlock ("Lock now", expiry, a PIN change). */
+    lock(id: string, notify?: boolean): boolean;
+    /** Until when this device is unlocked, or null. The clock decides, not the timer. */
+    unlockedUntil(id: string | null | undefined): number | null;
+    /** Is this row a passive token that is NOT unlocked right now? */
+    restricted(row: DeviceRow | null | undefined): boolean;
+}