{"version":3,"sources":["../../src/tunnel/aead-node.ts","../../src/tunnel/node-data.ts","../../src/tunnel/server.ts","../../src/tunnel/client.ts","../../src/tunnel/index.ts"],"names":["decodeData","wrapE2E","clientHandshakeOverSink","daemonHandshakeOverSink","connectSinkE2E","acceptSinkE2E"],"mappings":";;;;;;;;;;;;AAQA,IAAM,OAAA,GAAU,EAAA;AAET,IAAM,QAAA,GAAoB;AAAA,EAC/B,aAAA,EAAe,OAAO,GAAA,EAAK,EAAA,EAAI,WAAW,GAAA,KAAQ;AAChD,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACpD,IAAA,IAAI,GAAA,EAAK,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA;AAC1B,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,EAAG,MAAA,CAAO,KAAA,EAAM,EAAG,MAAA,CAAO,UAAA,EAAY,CAAC,CAAA;AAAA,EACtF,CAAA;AAAA,EACA,aAAA,EAAe,OAAO,GAAA,EAAK,EAAA,EAAI,QAAQ,GAAA,KAAQ;AAC7C,IAAA,IAAI,OAAO,MAAA,GAAS,OAAA,EAAS,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAClF,IAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,aAAA,EAAe,GAAA,EAAK,EAAE,CAAA;AACxD,IAAA,IAAI,GAAA,EAAK,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA;AAC5B,IAAA,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,MAAA,GAAS,OAAO,CAAC,CAAA;AAC5D,IAAA,OAAO,OAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,OAAO,QAAA,CAAS,CAAA,EAAG,MAAA,CAAO,MAAA,GAAS,OAAO,CAAC,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAAA,EACvG;AACF;;;ACdO,SAASA,YAAW,IAAA,EAAsB;AAC/C,EAAA,MAAM,KAAA,GAAQ,WAAY,IAAI,CAAA;AAC9B,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,GAAI,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,UAAA,EAAY,KAAA,CAAM,UAAU,CAAA;AACtG;ACkCO,IAAM,0BAAA,GAA6B;AAOnC,IAAM,+BAAA,GAAkC;AA2M/C,IAAM,8BAAA,GAAiC,KAAK,IAAA,GAAO,IAAA;AAEnD,SAAS,WAAA,CAAY,OAA8B,IAAA,EAA2B;AAC5E,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,IAAA,IAAQ,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAC,CAAA;AAC1E,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,CAAI,GAAA,CAAI,GAAG,GAAG,CAAA;AACd,IAAA,GAAA,IAAO,CAAA,CAAE,MAAA;AAAA,EACX;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAA,MAAM,QAAA,uBAAe,GAAA,EAA0B;AAE/C,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAwB;AAI7C,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA+B;AAGtD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAA0B;AAEnD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAA4E;AAEnG,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAsB;AAC5C,EAAA,MAAM,UAAA,GAAa,KAAK,oBAAA,IAAwB,uBAAA;AAChD,EAAA,MAAM,cAAA,GAAiB,KAAK,mBAAA,IAAuB,8BAAA;AACnD,EAAA,IAAI,MAAA,GAAS,KAAA;AAIb,EAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,IACb,CAAA,EAAG,OAAA;AAAA,IACH,OAAA,EAAS,cAAA;AAAA,IACT,YAAA,EAAc;AAAA,MACZ,GAAA,EAAK,KAAK,GAAA,KAAQ,IAAA;AAAA,MAClB,WAAW,IAAA,CAAK,cAAA,KAAmB,MAAA,IAAa,CAAC,CAAC,IAAA,CAAK,YAAA;AAAA,MACvD,iBAAA,EAAmB,IAAA;AAAA,MACnB,GAAI,IAAA,CAAK,cAAA,KAAmB,MAAA,IAAa,CAAC,CAAC,IAAA,CAAK,YAAA,GAAe,EAAE,WAAA,EAAa,IAAA,EAAK,GAAI,EAAC;AAAA,MACxF,GAAI,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAM,GAAI,EAAC;AAAA,MAC/D,GAAI,KAAK,GAAA,KAAQ,IAAA,GAAO,EAAE,GAAA,EAAK,IAAA,KAAS;AAAC,KAC3C;AAAA,IACA,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,YAAA;AAAA,MACN,OAAA,EAAS,aAAA;AAAA,MACT,UAAU,CAAA,EAAG,QAAA,EAAU,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,MACrC,aAAa,OAAA,CAAQ;AAAA;AACvB,GACD,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU;AAC5C,IAAA,WAAA,CAAY,KAAK,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAChC,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,SAAS,IAAA,EAAM,UAAA,EAAY,SAAS,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,MAAM;AACvC,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,KAAA,MAAW,GAAG,KAAK,KAAK,QAAA,EAAU,KAAA,CAAM,KAAK,SAAS,CAAA;AACtD,IAAA,QAAA,CAAS,KAAA,EAAM;AACf,IAAA,KAAA,MAAW,GAAG,GAAG,CAAA,IAAK,QAAA,MAAc,IAAA,EAAK;AACzC,IAAA,QAAA,CAAS,KAAA,EAAM;AACf,IAAA,KAAA,MAAW,GAAG,EAAE,CAAA,IAAK,UAAA,EAAY;AAC/B,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,MAChC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,UAAA,CAAW,KAAA,EAAM;AACjB,IAAA,KAAA,MAAW,GAAG,QAAQ,CAAA,IAAK,YAAA,EAAc;AACvC,MAAA,QAAA,CAAS,MAAM,KAAA,EAAM;AACrB,MAAA,QAAA,CAAS,MAAA,EAAQ,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,UAAA,CAAW,KAAA,EAAM;AACjB,IAAA,SAAA,CAAU,KAAA,EAAM;AAChB,IAAA,YAAA,CAAa,KAAA,EAAM;AACnB,IAAA,QAAA,EAAS;AACT,IAAA,QAAA,EAAS;AAAA,EACX,CAAC,CAAA;AAED,EAAA,eAAe,YAAY,KAAA,EAAmC;AAC5D,IAAA,QAAQ,MAAM,CAAA;AAAG,MACf,KAAK,OAAA;AACH,QAAA,MAAM,YAAY,KAAK,CAAA;AACvB,QAAA;AAAA,MACF,KAAK,OAAA,EAAS;AACZ,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACrC,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,GAAA,CAAI,KAAA,CAAM,OAAO,IAAA,CAAK,KAAA,CAAM,MAAM,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAC5D,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACvC,QAAA,IAAI,CAAC,KAAA,IAAS,CAAC,KAAA,CAAM,KAAA,EAAO;AAC1B,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,OAAA;AAAA,YACH,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,IAAA,EAAM,cAAA;AAAA,YACN,OAAA,EAAS,CAAA,cAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,CAAA;AAAA,WACvC,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,MAAM,KAAA,CAAM,MAAA,CAAO,KAAK,KAAA,CAAM,IAAA,EAAM,QAAQ,CAAC,CAAA;AACnD,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACrC,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,MAAA,IAAU,SAAS,CAAA;AAClC,UAAA;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACvC,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,OAAA;AAAA,YACH,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,IAAA,EAAM,cAAA;AAAA,YACN,OAAA,EAAS,CAAA,cAAA,EAAiB,KAAA,CAAM,MAAM,CAAA,CAAA;AAAA,WACvC,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,KAAA,CAAM,IAAA,CAAM,KAAA,CAAM,MAAA,IAAyC,SAAS,CAAA;AACpE,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,QAAA,CAAS,GAAA,CAAI,MAAM,MAAM,CAAA,EAAG,OAAO,KAAA,CAAM,IAAA,EAAM,MAAM,IAAI,CAAA;AACzD,QAAA;AAAA,MACF;AAAA,MACA,KAAK,cAAA;AACH,QAAA,IAAI,MAAM,WAAA,EAAa;AAErB,UAAA,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,EAAE,KAAA,EAAO,OAAO,EAAC,EAAG,IAAA,EAAM,CAAA,EAAG,CAAA;AACzD,UAAA;AAAA,QACF;AAOA,QAAA,MAAM,kBAAkB,KAAK,CAAA;AAC7B,QAAA;AAAA,MACF,KAAK,oBAAA,EAAsB;AACzB,QAAA,MAAM,OAAA,GAAU,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC1C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,IAAI,MAAM,IAAA,EAAM;AACd,UAAA,MAAM,KAAA,GAAQA,WAAAA,CAAW,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,OAAA,CAAQ,QAAQ,KAAA,CAAM,MAAA;AACtB,UAAA,OAAA,CAAQ,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,QAC1B;AACA,QAAA,IAAI,OAAA,CAAQ,OAAO,cAAA,EAAgB;AACjC,UAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAC7B,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,eAAA;AAAA,YACH,OAAO,KAAA,CAAM,KAAA;AAAA,YACb,MAAA,EAAQ,GAAA;AAAA,YACR,KAAA,EAAO;AAAA,cACL,IAAA,EAAM,wBAAA;AAAA,cACN,OAAA,EAAS,wBAAwB,cAAc,CAAA,OAAA;AAAA;AACjD,WACD,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,IAAI,CAAC,MAAM,GAAA,EAAK;AAChB,QAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAC7B,QAAA,MAAM,iBAAA,CAAkB,QAAQ,KAAA,EAAO,WAAA,CAAY,QAAQ,KAAA,EAAO,OAAA,CAAQ,IAAI,CAAC,CAAA;AAC/E,QAAA;AAAA,MACF;AAAA,MACA,KAAK,aAAA,EAAe;AAClB,QAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAG7B,QAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC7C,QAAA,IAAI,CAAC,QAAA,EAAU;AACf,QAAA,QAAA,CAAS,SAAA,GAAY,IAAA;AACrB,QAAA,QAAA,CAAS,MAAM,KAAA,EAAM;AACrB,QAAA,QAAA,CAAS,MAAA,EAAQ,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AACxC,QAAA;AAAA,MACF;AAAA,MACA,KAAK,SAAA;AACH,QAAA,MAAM,aAAa,KAAK,CAAA;AACxB,QAAA;AAAA,MACF,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACrC,QAAA,IAAI,CAAC,EAAA,EAAI;AAIP,UAAA;AAAA,QACF;AACA,QAAA,IAAI,OAAA,GAAUA,WAAAA,CAAW,KAAA,CAAM,IAAI,CAAA;AACnC,QAAA,IAAI,MAAM,IAAA,EAAM;AAEd,UAAA,MAAM,QAAQ,SAAA,CAAU,GAAA,CAAI,KAAA,CAAM,KAAK,KAAK,EAAC;AAC7C,UAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,UAAA,SAAA,CAAU,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,KAAK,CAAA;AAChC,UAAA;AAAA,QACF;AACA,QAAA,MAAM,IAAA,GAAO,SAAA,CAAU,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACtC,QAAA,IAAI,IAAA,EAAM;AACR,UAAA,SAAA,CAAU,MAAA,CAAO,MAAM,KAAK,CAAA;AAC5B,UAAA,IAAA,CAAK,KAAK,OAAO,CAAA;AACjB,UAAA,OAAA,GAAU,MAAA,CAAO,OAAO,IAAI,CAAA;AAAA,QAC9B;AACA,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAK,OAAA,EAAS,EAAE,QAAQ,KAAA,CAAM,MAAA,KAAW,MAAM,CAAA;AAAA,QACpD,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,UAAA;AAAA,YACH,OAAO,KAAA,CAAM,KAAA;AAAA,YACb,IAAA,EAAM,IAAA;AAAA,YACN,MAAA,EAAQ,gBAAgB,OAAO,CAAA;AAAA,WAChC,CAAA;AACD,UAAA,IAAI;AACF,YAAA,EAAA,CAAG,KAAA,CAAM,MAAM,aAAa,CAAA;AAAA,UAC9B,CAAA,CAAA,MAAQ;AAAA,UAER;AACA,UAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,QAC/B;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,UAAA,EAAY;AACf,QAAA,SAAA,CAAU,MAAA,CAAO,MAAM,KAAK,CAAA;AAC5B,QAAA,MAAM,EAAA,GAAK,UAAA,CAAW,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACrC,QAAA,IAAI,CAAC,EAAA,EAAI;AACT,QAAA,UAAA,CAAW,MAAA,CAAO,MAAM,KAAK,CAAA;AAC7B,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAA,CAAM,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,MAAM,CAAA;AAAA,QACnC,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,QAAQ,KAAA,EAAO,KAAA,CAAM,OAAO,CAAA;AAChD,QAAA;AAAA,MACF,KAAK,gBAAA;AAMH,QAAA,IAAI;AACF,UAAA,IAAA,CAAK,eAAA,GAAkB;AAAA,YACrB,GAAI,MAAM,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,QAAA,EAAU,KAAA,CAAM,QAAA,EAAS,GAAI;AAAC,WACpE,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA;AAAA,MACF,KAAK,MAAA;AAAA,MACL,KAAK,OAAA;AAEH,QAAA;AAAA,MACF;AACE,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,OAAA;AAAA,UACH,IAAA,EAAM,eAAA;AAAA,UACN,OAAA,EAAS,CAAA,uCAAA,EAA2C,KAAA,CAAwB,CAAC,CAAA,CAAA;AAAA,SAC9E,CAAA;AAAA;AACL,EACF;AAEA,EAAA,eAAe,YAAY,GAAA,EAAgC;AACzD,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACrC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,oBAAA;AAAA,QACN;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,oBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AACD,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,CAAS,GAAA,IAAO,IAAA,CAAK,QAAA,EAAU;AACjC,MAAA,IAAI,GAAA;AACJ,MAAA,IAAI;AACF,QAAA,GAAA,GAAM,KAAK,QAAA,CAAS;AAAA,UAClB,SAAS,QAAA,CAAS,OAAA;AAAA,UAClB,IAAA,EAAM,CAAC,GAAG,QAAA,CAAS,IAAI,CAAA;AAAA,UACvB,KAAK,QAAA,CAAS,GAAA;AAAA,UACd,KAAK,QAAA,CAAS,GAAA,GAAM,EAAE,GAAG,QAAA,CAAS,KAAI,GAAI,KAAA,CAAA;AAAA,UAC1C,IAAA,EAAM,SAAS,IAAA,IAAQ,EAAA;AAAA,UACvB,IAAA,EAAM,SAAS,IAAA,IAAQ;AAAA,SACxB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,QAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,OAAA,EAAS,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,CAAA;AAChF,QAAA;AAAA,MACF;AAEA,MAAA,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,GAAG,CAAA;AAC5B,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,CAAA;AAEjE,MAAA,GAAA,CAAI,OAAO,CAAA,IAAA,KAAQ;AACjB,QAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,IAAA,EAAM,UAAA,CAAW,IAAI,CAAA,EAAG,CAAA;AAAA,MAC5E,CAAC,CAAA;AACD,MAAA,GAAA,CAAI,MAAA,CAAO,CAAC,EAAE,QAAA,EAAU,QAAO,KAAM;AACnC,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,MAAA;AAAA,UACH,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,MAAA,EAAQ,MAAA,IAAU,IAAA,GAAO,MAAA,CAAO,MAAM,CAAA,GAAI;AAAA,SAC3C,CAAA;AACD,QAAA,QAAA,CAAS,MAAA,CAAO,IAAI,MAAM,CAAA;AAAA,MAC5B,CAAC,CAAA;AAED,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,IAAI;AAGF,UAAA,IAAA,CAAK,cAAA,CAAe;AAAA,YAClB,QAAQ,GAAA,CAAI,MAAA;AAAA,YACZ,KAAA,EAAO,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAI;AAAA,YACtB,OAAA,EAAS;AAAA,WACV,CAAA;AAAA,QACH,CAAA,CAAA,MAAQ;AAAA,QAAwB;AAAA,MAClC;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,CAAC,GAAG,QAAA,CAAS,IAAI,CAAA,EAAG;AAAA,QAClD,KAAK,QAAA,CAAS,GAAA;AAAA,QACd,GAAA,EAAK,EAAE,GAAG,OAAA,CAAQ,KAAK,GAAI,QAAA,CAAS,GAAA,IAAO,EAAC,EAAG;AAAA,QAC/C,KAAA,EAAO,CAAC,MAAA,EAAQ,MAAA,EAAQ,MAAM;AAAA;AAAA,OAE/B,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,cAAA;AAAA,QACN;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,KAAK,CAAA;AAE9B,IAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,KAAA,CAAM,GAAA,EAAK,CAAA;AAAA,IACrE,CAAA,MAAO;AAIL,MAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,SAAA,EAAW,QAAQ,GAAA,CAAI,MAAA,EAAQ,GAAA,EAAK,EAAA,EAAI,CAAA;AAAA,IAC9D;AAMA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,cAAA,CAAe,EAAE,MAAA,EAAQ,GAAA,CAAI,QAAQ,KAAA,EAAO,OAAA,EAAS,UAAU,CAAA;AAAA,MACtE,SAAS,GAAA,EAAK;AAIZ,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN,CAAA,qDAAA,EAAwD,GAAA,CAAI,MAAM,CAAA,EAAA,EAChE,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,CAAA,GAAiB;AAAA,QACrB,CAAA,EAAG,QAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,WAAW,KAAK;AAAA,OACxB;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,IAClB,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,MAAM,CAAA,GAAiB;AAAA,QACrB,CAAA,EAAG,QAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,WAAW,KAAK;AAAA,OACxB;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,IAClB,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,OAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA,EAAM,aAAA;AAAA,QACN,SAAS,GAAA,CAAI;AAAA,OACd,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,EAAM,MAAA,KAAW;AACjC,MAAA,MAAM,CAAA,GAAe;AAAA,QACnB,CAAA,EAAG,MAAA;AAAA,QACH,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,IAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAA,CAAK,IAAA,CAAK,KAAK,CAAC,CAAA;AAChB,MAAA,QAAA,CAAS,MAAA,CAAO,IAAI,MAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AAAA,EACH;AASA,EAAA,eAAe,aAAa,GAAA,EAAiC;AAC3D,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAM,MAAA,GAAS,CACb,MAAA,EACA,IAAA,EACA,OAAA,KACS;AACT,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,aAAA;AAAA,QACH,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,MAAA;AAAA,QACA,KAAA,EAAO,EAAE,IAAA,EAAM,OAAA;AAAQ,OACxB,CAAA;AAAA,IACH,CAAA;AACA,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,IAAkB,CAAC,KAAK,YAAA,EAAc;AAC9C,MAAA,MAAA;AAAA,QACE,GAAA;AAAA,QACA,4BAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA;AAAA,IACF;AACA,IAAA,IACE,CAAC,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EACtB;AACA,MAAA,MAAA;AAAA,QACE,GAAA;AAAA,QACA,cAAA;AAAA,QACA,CAAA,sDAAA,EAAyD,IAAI,IAAI,CAAA,EAAA;AAAA,OACnE;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,uBAAiB,GAAA,CAAI;AAAA,MACzB,YAAA;AAAA,MACA,SAAA;AAAA,MACA,uBAAA;AAAA,MACA,mBAAA;AAAA,MACA,0BAAA;AAAA,MACA,wBAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,EAAG;AACtD,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,EAAG;AACrC,MAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,IACf;AAKA,IAAA,IAAI,WAAW,IAAA,CAAK,YAAA;AACpB,IAAA,IAAI,IAAI,QAAA,EAAU;AAChB,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,iBAAA,GAAoB,IAAI,QAAQ,CAAA;AAC5D,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAA;AAAA,UACE,GAAA;AAAA,UACA,qBAAA;AAAA,UACA,CAAA,+BAAA,EAAkC,IAAI,QAAQ,CAAA,EAAA;AAAA,SAChD;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,GAAW,QAAA;AAAA,IACb;AAIA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,OAAA,CAAQ,gBAAA,EAAkB,SAAS,CAAA;AACzD,IAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA;AAMjD,IAAA,MAAM,aAAA,GAAgB,KAAK,eAAA,IAAmB,0BAAA;AAC9C,IAAA,MAAM,SAAA,GAAY,IAAI,eAAA,EAAgB;AACtC,IAAA,IAAI,YAAA,GAAe,KAAA;AACnB,IAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,IAAA,MAAM,WAAA,GAAc,KAAK,cAAA,CAAe;AAAA,MACtC,GAAA;AAAA,MACA,GAAI,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,SAAA,CAAU,MAAA,GAAS,CAAA,GACxC,EAAE,SAAA,EAAW,GAAA,CAAI,SAAA,EAAU,GAC3B,EAAC;AAAA,MACL,OAAA;AAAA,MACA,QAAQ,SAAA,CAAU;AAAA,KACnB,CAAA;AACD,IAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAe,CAAC,UAAU,GAAA,KAAQ;AAC3D,MAAA,SAAA,GAAY,WAAW,MAAM;AAC3B,QAAA,YAAA,GAAe,IAAA;AACf,QAAA,SAAA,CAAU,KAAA,CAAM,IAAI,KAAA,CAAM,iBAAiB,CAAC,CAAA;AAC5C,QAAA,GAAA,CAAI,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,aAAa,IAAI,CAAC,CAAA;AAAA,MACtE,GAAG,aAAa,CAAA;AAChB,MAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,SAAA,CAAU,KAAA,EAAM;AAAA,IACrD,CAAC,CAAA;AAED,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAC7D,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,SAAA,eAAwB,SAAS,CAAA;AACrC,MAAA,IAAI,YAAA,EAAc;AAGhB,QAAA,WAAA,CAAY,IAAA;AAAA,UACV,CAAA,IAAA,KAAQ;AACN,YAAA,IAAI;AACF,cAAA,IAAA,CAAK,KAAA,CAAM,MAAM,cAAc,CAAA;AAAA,YACjC,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF,CAAA;AAAA,UACA,MAAM;AAAA,UAAC;AAAA,SACT;AACA,QAAA,MAAA;AAAA,UACE,GAAA;AAAA,UACA,qBAAA;AAAA,UACA,mDAAmD,aAAa,CAAA,GAAA;AAAA,SAClE;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG/D,MAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,mCAAmC,CAAA;AAC3D,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,QAAA,CAAS,EAAE,CAAC,CAAA,EAAI,EAAE,CAAA,GAAI,GAAA;AAChD,MAAA,MAAA,CAAO,MAAA,EAAQ,sBAAsB,OAAO,CAAA;AAC5C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,SAAA,eAAwB,SAAS,CAAA;AAErC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAA,CAAM,MAAM,eAAe,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA;AAAA,IACF;AACA,IAAA,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,QAAQ,CAAA;AAClC,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,MACb,CAAA,EAAG,aAAA;AAAA,MACH,OAAO,GAAA,CAAI,KAAA;AAAA,MACX,MAAA,EAAQ,GAAA;AAAA,MACR,GAAI,SAAS,QAAA,GAAW,EAAE,UAAU,QAAA,CAAS,QAAA,KAAa;AAAC,KAC5D,CAAA;AAED,IAAA,QAAA,CAAS,SAAA,CAAU,CAAC,IAAA,EAAM,QAAA,KAAa;AACrC,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ;AAGvB,MAAA,MAAM,MAAA,GAAS,IAAI,SAAA,KAAc,IAAA,GAAO,aAAa,IAAA,EAAM,UAAU,CAAA,GAAI,CAAC,IAAI,CAAA;AAC9E,MAAA,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,EAAO,CAAA,KAAM;AAC3B,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,YAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,IAAA,EAAM,WAAW,KAAK,CAAA;AAAA,UACtB,MAAA,EAAQ,QAAA;AAAA,UACR,GAAI,IAAI,MAAA,CAAO,MAAA,GAAS,IAAI,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI;AAAC,SAC/C,CAAA;AAAA,MACH,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AACD,IAAA,QAAA,CAAS,OAAA,CAAQ,CAAC,IAAA,EAAM,MAAA,KAAW;AACjC,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AAChC,MAAA,UAAA,CAAW,MAAA,CAAO,IAAI,KAAK,CAAA;AAC3B,MAAA,IAAI,IAAA,CAAK,KAAK,MAAA,EAAQ;AACpB,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,UAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,IAAA;AAAA,UACA,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,SAC5B,CAAA;AAAA,MACH;AAAA,IACF,CAAC,CAAA;AACD,IAAA,QAAA,CAAS,QAAQ,CAAA,GAAA,KAAO;AAGtB,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,EAAG;AAChC,MAAA,UAAA,CAAW,MAAA,CAAO,IAAI,KAAK,CAAA;AAC3B,MAAA,IAAI,IAAA,CAAK,KAAK,MAAA,EAAQ;AACpB,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,UAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,IAAA,EAAM,IAAA;AAAA,UACN,MAAA,EAAQ,CAAA,gBAAA,EAAmB,GAAA,CAAI,OAAO,CAAA;AAAA,SACvC,CAAA;AAAA,MACH;AACA,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAA,CAAM,MAAM,gBAAgB,CAAA;AAAA,MACvC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,iBAAA,CAAkB,KAAuB,WAAA,EAAyC;AAC/F,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAM,OAAA,GAAU,CACd,OAAA,KAGS;AACT,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,eAAA;AAAA,QACH,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,GAAG;AAAA,OACiB,CAAA;AAAA,IACxB,CAAA;AAIA,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,8BAAA;AAAA,UACN,OAAA,EACE;AAAA;AACJ,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAKA,IAAA,IACE,CAAC,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,IACxB,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EACtB;AACA,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EAAS,CAAA,wDAAA,EAA2D,GAAA,CAAI,IAAI,CAAA,EAAA;AAAA;AAC9E,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,UAAA,uBAAiB,GAAA,CAAI;AAAA,MACzB,YAAA;AAAA,MACA,YAAA;AAAA,MACA,mBAAA;AAAA,MACA,SAAA;AAAA,MACA,oBAAA;AAAA,MACA,qBAAA;AAAA,MACA,IAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA;AAAA,MACA;AAAA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,GAAA,CAAI,OAAA,IAAW,EAAE,CAAA,EAAG;AACtD,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,EAAG;AACrC,MAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,IACf;AAIA,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,iBAAiB,CAAA,EAAG;AAC3D,QAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,QAAA,KAAA,MAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,EAAG;AAC3C,UAAA,IAAI,SAAS,WAAA,EAAY,KAAM,KAAA,EAAO,OAAO,QAAQ,QAAQ,CAAA;AAAA,QAC/D;AACA,QAAA,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA;AAAA,MACf;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,YAAA,CAAa,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA;AAC9D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAA,GAAyB,EAAE,KAAA,EAAO,UAAA,EAAY,WAAW,KAAA,EAAM;AACrE,IAAA,YAAA,CAAa,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,QAAQ,CAAA;AACpC,IAAA,MAAM,SAAA,GACJ,GAAA,CAAI,SAAA,IACJ,IAAA,CAAK,oBAAA,IACL,+BAAA;AAOF,IAAA,IAAI,KAAA,GAA8C,UAAA;AAAA,MAChD,MAAM,WAAW,KAAA,EAAM;AAAA,MACvB;AAAA,KACF;AACA,IAAA,MAAM,aAAa,MAAM;AACvB,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,KAAA,GAAQ,IAAA;AAAA,MACV;AAAA,IACF,CAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QACnC,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA;AAAA,QACA,IAAA,EACE,WAAA,KAAgB,KAAA,CAAA,GACZ,WAAA,GACA,GAAA,CAAI,SAAS,KAAA,CAAA,GACX,KAAA,CAAA,GACAA,WAAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AAAA,QAC3B,QAAQ,UAAA,CAAW;AAAA;AAAA;AAAA,OAGpB,CAAA;AACD,MAAA,MAAM,aAAqC,EAAC;AAC5C,MAAA,WAAA,CAAY,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC1C,QAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,EAAG;AACvC,QAAA,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AAAA,MACpB,CAAC,CAAA;AAOD,MAAA,MAAM,WAAA,GAAA,CAAe,UAAA,CAAW,cAAc,CAAA,IAAK,IAAI,WAAA,EAAY;AACnE,MAAA,MAAM,WACJ,WAAA,CAAY,UAAA,CAAW,mBAAmB,CAAA,IAC1C,WAAA,CAAY,SAAS,sBAAsB,CAAA;AAE7C,MAAA,IAAI,QAAA,IAAY,YAAY,IAAA,EAAM;AAIhC,QAAA,UAAA,EAAW;AACX,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,oBAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,QAAQ,WAAA,CAAY,MAAA;AAAA,UACpB,OAAA,EAAS;AAAA,SACV,CAAA;AACD,QAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,SAAA,EAAU;AAC1C,QAAA,QAAA,CAAS,MAAA,GAAS,MAAA;AAKlB,QAAA,MAAM,SAAS,IAAA,CAAK,uBAAA;AACpB,QAAA,MAAM,IAAA,0BAAc,MAAM,CAAA;AAE1B,QAAA,MAAM,YAAY,YAA+C;AAC/D,UAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,MAAA,CAAO,IAAA,EAAK;AAChC,UAAA,IAAI,SAAA,GAAkD,IAAA;AACtD,UAAA,MAAM,IAAA,GAAO,IAAI,OAAA,CAAqB,CAAA,OAAA,KAAW;AAC/C,YAAA,SAAA,GAAY,UAAA,CAAW,MAAM,OAAA,CAAQ,IAAI,GAAG,MAAM,CAAA;AAClD,YAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,SAAA,CAAU,KAAA,EAAM;AAAA,UACrD,CAAC,CAAA;AACD,UAAA,IAAI;AACF,YAAA,OAAO,MAAM,QAAQ,IAAA,CAAK,CAAC,OAAO,IAAA,EAAK,EAAG,IAAI,CAAC,CAAA;AAAA,UACjD,CAAA,SAAE;AACA,YAAA,IAAI,SAAA,eAAwB,SAAS,CAAA;AAAA,UACvC;AAAA,QACF,CAAA;AACA,QAAA,IAAI;AACF,UAAA,OAAO,IAAA,EAAM;AACX,YAAA,MAAM,KAAA,GAAQ,MAAM,SAAA,EAAU;AAC9B,YAAA,IAAI,SAAS,SAAA,EAAW;AACtB,cAAA,MAAM,MAAA,CAAO,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,cAAC,CAAC,CAAA;AACpC,cAAA;AAAA,YACF;AACA,YAAA,IAAI,UAAU,IAAA,EAAM;AAClB,cAAA,IAAI;AACF,gBAAA,MAAM,OAAO,MAAA,EAAO;AAAA,cACtB,CAAA,CAAA,MAAQ;AAAA,cAER;AACA,cAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,gBACb,CAAA,EAAG,qBAAA;AAAA,gBACH,OAAO,GAAA,CAAI,KAAA;AAAA,gBACX,GAAA,EAAK,IAAA;AAAA,gBACL,KAAA,EAAO;AAAA,kBACL,IAAA,EAAM,8BAAA;AAAA,kBACN,OAAA,EAAS,6BAA6B,MAAM,CAAA,GAAA;AAAA;AAC9C,eACD,CAAA;AACD,cAAA;AAAA,YACF;AACA,YAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,KAAA;AACxB,YAAA,IAAI,IAAA,EAAM;AACR,cAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,gBACb,CAAA,EAAG,qBAAA;AAAA,gBACH,OAAO,GAAA,CAAI,KAAA;AAAA,gBACX,GAAA,EAAK;AAAA,eACN,CAAA;AACD,cAAA;AAAA,YACF;AACA,YAAA,IAAI,KAAA,IAAS,KAAA,CAAM,UAAA,GAAa,CAAA,EAAG;AAGjC,cAAA,KAAA,MAAW,KAAA,IAAS,YAAA,CAAa,KAAA,EAAO,UAAU,CAAA,EAAG;AACnD,gBAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,kBACb,CAAA,EAAG,qBAAA;AAAA,kBACH,OAAO,GAAA,CAAI,KAAA;AAAA,kBACX,IAAA,EAAM,WAAW,KAAK;AAAA,iBACvB,CAAA;AAAA,cACH;AAAA,YACF;AAGA,YAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ;AACrB,cAAA,IAAI;AACF,gBAAA,MAAM,OAAO,MAAA,EAAO;AAAA,cACtB,CAAA,CAAA,MAAQ;AAAA,cAER;AACA,cAAA;AAAA,YACF;AAAA,UACF;AAAA,QACF,SAAS,GAAA,EAAK;AACZ,UAAA,IAAI,SAAS,SAAA,EAAW;AACxB,UAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,qBAAA;AAAA,YACH,OAAO,GAAA,CAAI,KAAA;AAAA,YACX,GAAA,EAAK,IAAA;AAAA,YACL,KAAA,EAAO,EAAE,IAAA,EAAM,wBAAA,EAA0B,OAAA;AAAQ,WAClD,CAAA;AAAA,QACH;AACA,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,WAAA,CAAY,aAAa,CAAA;AACvD,MAAA,IAAI,GAAA,CAAI,SAAS,UAAA,EAAY;AAK3B,QAAA,IAAI,SAAS,SAAA,EAAW;AACxB,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,oBAAA;AAAA,UACH,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,QAAQ,WAAA,CAAY,MAAA;AAAA,UACpB,OAAA,EAAS;AAAA,SACV,CAAA;AACD,QAAA,MAAM,MAAA,GAAS,YAAA,CAAa,GAAA,EAAK,UAAU,CAAA;AAC3C,QAAA,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,EAAO,CAAA,KAAM;AAC3B,UAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,YACb,CAAA,EAAG,qBAAA;AAAA,YACH,OAAO,GAAA,CAAI,KAAA;AAAA,YACX,IAAA,EAAM,WAAW,KAAK,CAAA;AAAA,YACtB,GAAI,MAAM,MAAA,CAAO,MAAA,GAAS,IAAI,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI;AAAC,WAChD,CAAA;AAAA,QACH,CAAC,CAAA;AACD,QAAA;AAAA,MACF;AACA,MAAA,OAAA,CAAQ;AAAA,QACN,QAAQ,WAAA,CAAY,MAAA;AAAA,QACpB,OAAA,EAAS,UAAA;AAAA,QACT,MAAM,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,UAAA,CAAW,GAAG,CAAA,GAAI;AAAA,OAC1C,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,SAAS,SAAA,EAAW;AACxB,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA;AACrD,MAAA,OAAA,CAAQ;AAAA,QACN,MAAA,EAAQ,UAAU,GAAA,GAAM,GAAA;AAAA,QACxB,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,UAAU,SAAA,GAAY,uBAAA;AAAA,UAC5B;AAAA;AACF,OACD,CAAA;AAAA,IACH,CAAA,SAAE;AACA,MAAA,UAAA,EAAW;AACX,MAAA,IAAI,YAAA,CAAa,IAAI,GAAA,CAAI,KAAK,MAAM,QAAA,EAAU,YAAA,CAAa,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAAA,IAC7E;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,MAAM,KAAA,GAAQ;AACZ,MAAA,IAAI,MAAA,EAAQ;AACZ,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,MAAW,GAAG,KAAK,KAAK,QAAA,EAAU,KAAA,CAAM,KAAK,SAAS,CAAA;AACtD,MAAA,QAAA,CAAS,KAAA,EAAM;AACf,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,GACF;AACF;AC19BO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAA,MAAM,cAAA,GAAiB,KAAK,cAAA,IAAkB,GAAA;AAC9C,EAAA,IAAI,KAAA,GAA2B,IAAA;AAC/B,EAAA,IAAI,YAAA,GAA2C,IAAA;AAK/C,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAA6B;AACrD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAGvB;AAwCF,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAyB;AAcjD,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAuB;AACjD,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAiC;AAErD,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAsB;AAM9C,EAAA,SAAS,eAAA,CACP,MACA,IAAA,EACM;AACN,IAAA,IACE,IAAA,KAAS,UACT,IAAA,CAAK,MAAA,GAAS,2BACd,KAAA,EAAO,YAAA,CAAa,sBAAsB,IAAA,EAC1C;AACA,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK,EAAE,GAAG,IAAA,EAAM,WAAA,EAAa,MAAM,CAAA;AAC7C,MAAA,MAAM,MAAA,GAAS,aAAa,IAAI,CAAA;AAChC,MAAA,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,EAAO,CAAA,KAAM;AAC3B,QAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,UACb,CAAA,EAAG,oBAAA;AAAA,UACH,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,IAAA,EAAM,WAAW,KAAK,CAAA;AAAA,UACtB,GAAI,MAAM,MAAA,CAAO,MAAA,GAAS,IAAI,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI;AAAC,SAChD,CAAA;AAAA,MACH,CAAC,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK,EAAE,GAAG,IAAA,EAAM,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,EAAM,WAAW,IAAI,CAAA,EAAE,GAAI,IAAK,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,QAAA,GAAW,KAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU,aAAA,CAAc,KAAK,CAAC,CAAA;AAClE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,MAAM;AACvC,IAAA,KAAA,MAAW,GAAG,IAAI,CAAA,IAAK,WAAA,OAAkB,kBAAA,EAAmB;AAC5D,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,YAAA,EAAc;AAChC,MAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAAA,IAC7D;AACA,IAAA,YAAA,CAAa,KAAA,EAAM;AACnB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,WAAA,EAAa;AAC/B,MAAA,YAAA,CAAa,EAAE,KAAK,CAAA;AACpB,MAAA,IAAI,CAAA,CAAE,SAAS,UAAA,EAAY;AACzB,QAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,6CAA6C,CAAC,CAAA;AAAA,MACnE,CAAA,MAAO;AAIL,QAAA,IAAI,CAAC,EAAE,WAAA,EAAa;AAClB,UAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,kDAAkD,CAAC,CAAA;AAAA,QACxE,CAAA,MAAA,IAAW,CAAA,CAAE,UAAA,IAAc,CAAC,EAAE,KAAA,EAAO;AACnC,UAAA,IAAI;AACF,YAAA,CAAA,CAAE,UAAA,CAAW,KAAA,CAAM,IAAI,KAAA,CAAM,2BAA2B,CAAC,CAAA;AAAA,UAC3D,CAAA,CAAA,MAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,GAAG,CAAC,CAAA,IAAK,aAAA,EAAe;AACjC,MAAA,YAAA,CAAa,EAAE,KAAK,CAAA;AACpB,MAAA,CAAA,CAAE,MAAA,CAAO,IAAI,KAAA,CAAM,4CAA4C,CAAC,CAAA;AAAA,IAClE;AACA,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,KAAA,MAAW,GAAG,IAAI,CAAA,IAAK,OAAA,EAAS;AAC9B,MAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,IAC1B;AACA,IAAA,OAAA,CAAQ,KAAA,EAAM;AACd,IAAA,QAAA,EAAS;AACT,IAAA,QAAA,EAAS;AAAA,EACX,CAAC,CAAA;AAED,EAAA,SAAS,cAAc,KAAA,EAA0B;AAC/C,IAAA,QAAQ,MAAM,CAAA;AAAG,MACf,KAAK,OAAA;AACH,QAAA,IAAI,KAAA,CAAM,YAAY,cAAA,EAAgB;AAIpC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,qBAAA,EAAwB,KAAA,CAAM,OAAO,CAAA,qBAAA,EAAwB,cAAc,CAAA,CAAA;AAAA,WAC7E;AAAA,QACF;AACA,QAAA,KAAA,GAAQ,KAAA;AACR,QAAA;AAAA,MACF,KAAK,SAAA,EAAW;AACd,QAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC7C,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,YAAA,CAAa,MAAA,CAAO,MAAM,MAAM,CAAA;AAChC,UAAA,OAAA,CAAQ,QAAQ,KAAK,CAAA;AAAA,QACvB;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,YAAA,CAAaA,WAAAA,CAAY,KAAA,CAAsB,IAAI,CAAC,CAAA;AAC1D,QAAA;AAAA,MACF;AAAA,MACA,KAAK,QAAA,EAAU;AACb,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,YAAA,CAAaA,WAAAA,CAAY,KAAA,CAAsB,IAAI,CAAC,CAAA;AAC1D,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA,EAAQ;AACX,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,QAAA,IAAA,EAAM,aAAa,KAAkB,CAAA;AACrC,QAAA,WAAA,CAAY,MAAA,CAAO,MAAM,MAAM,CAAA;AAC/B,QAAA;AAAA,MACF;AAAA,MACA,KAAK,OAAA,EAAS;AACZ,QAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,UAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAC7C,UAAA,IAAI,OAAA,EAAS;AACX,YAAA,YAAA,CAAa,MAAA,CAAO,MAAM,MAAM,CAAA;AAChC,YAAA,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAC,CAAA;AAC3D,YAAA;AAAA,UACF;AACA,UAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AACzC,UAAA,IAAA,EAAM,WAAA,CAAY,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAC,CAAA;AAC9D,UAAA;AAAA,QACF;AAIA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,eAAA,EAAiB;AAEpB,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,QAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,GAAOA,WAAAA,CAAW,MAAM,IAAI,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjE,QAAA,IAAI,OAAA,CAAQ,SAAS,UAAA,EAAY;AAC/B,UAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,YACd,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,YAC3B,IAAA;AAAA,YACA,GAAI,MAAM,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,KAAA,KAAU;AAAC,WAC7C,CAAA;AAAA,QACH,CAAA,MAAO;AAIL,UAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAA2B;AAAA,YAC5C,MAAM,UAAA,EAAY;AAChB,cAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG,UAAA,CAAW,QAAQ,IAAI,UAAA,CAAW,IAAI,CAAC,CAAA;AAC5D,cAAA,UAAA,CAAW,KAAA,EAAM;AAAA,YACnB;AAAA,WACD,CAAA;AACD,UAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,YAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,YAC3B,IAAA,EAAM;AAAA,WACP,CAAA;AAAA,QACH;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,oBAAA,EAAsB;AACzB,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,IAAW,EAAC;AAClC,QAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAI7B,UAAA,MAAM,MAAA,GAAS,IAAI,cAAA,CAA2B;AAAA,YAC5C,MAAM,UAAA,EAAY;AAChB,cAAA,OAAA,CAAQ,UAAA,GAAa,UAAA;AACrB,cAAA,KAAA,MAAW,KAAA,IAAS,QAAQ,aAAA,EAAe;AACzC,gBAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG,UAAA,CAAW,QAAQ,IAAI,UAAA,CAAW,KAAK,CAAC,CAAA;AAAA,cAChE;AACA,cAAA,OAAA,CAAQ,gBAAgB,EAAC;AAAA,YAC3B,CAAA;AAAA,YACA,QAAQ,MAAM;AAMZ,cAAA,IAAI,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,MAAM,OAAA,EAAS;AAC5C,gBAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,gBAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,cAChC;AAAA,YACF;AAAA,WACD,CAAA;AACD,UAAA,OAAA,CAAQ,WAAA,GAAc,IAAA;AAGtB,UAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,UAAA,OAAA,CAAQ,WAAA,CAAY;AAAA,YAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,OAAA;AAAA,YACA,IAAA,EAAM;AAAA,WACP,CAAA;AAAA,QACH,CAAA,MAAO;AAGL,UAAA,OAAA,CAAQ,UAAA,GAAa,EAAE,MAAA,EAAQ,KAAA,CAAM,QAAQ,OAAA,EAAQ;AAAA,QACvD;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,qBAAA,EAAuB;AAC1B,QAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC3C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,GAAOA,WAAAA,CAAW,MAAM,IAAI,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjE,QAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAC7B,UAAA,IAAI,MAAM,KAAA,EAAO;AAEf,YAAA,IAAI;AACF,cAAA,OAAA,CAAQ,UAAA,EAAY,KAAA;AAAA,gBAClB,IAAI,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA,CAAE;AAAA,eACzD;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AACA,YAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAChB,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA;AAAA,UACF;AACA,UAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,YAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,cAAA,IAAI;AACF,gBAAA,OAAA,CAAQ,UAAA,CAAW,OAAA,CAAQ,IAAI,UAAA,CAAW,IAAI,CAAC,CAAA;AAAA,cACjD,CAAA,CAAA,MAAQ;AAAA,cAER;AAAA,YACF;AACA,YAAA,IAAI,MAAM,GAAA,EAAK;AACb,cAAA,IAAI;AACF,gBAAA,OAAA,CAAQ,WAAW,KAAA,EAAM;AAAA,cAC3B,CAAA,CAAA,MAAQ;AAAA,cAER;AACA,cAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAChB,cAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,cAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,YAChC;AAAA,UACF,CAAA,MAAO;AAEL,YAAA,IAAI,KAAK,MAAA,GAAS,CAAA,EAAG,OAAA,CAAQ,aAAA,CAAc,KAAK,IAAI,CAAA;AACpD,YAAA,IAAI,MAAM,GAAA,EAAK;AAGb,cAAA,OAAA,CAAQ,KAAA,GAAQ,IAAA;AAAA,YAClB;AAAA,UACF;AAAA,QACF,CAAA,MAAO;AAEL,UAAA,IAAI,KAAK,MAAA,GAAS,CAAA,EAAG,OAAA,CAAQ,YAAA,CAAa,KAAK,IAAI,CAAA;AACnD,UAAA,IAAI,MAAM,KAAA,EAAO;AACf,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA,MAAM,YAAA,GAAe,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AACvD,YAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,cACd,MAAA,EAAQ,OAAA,CAAQ,UAAA,EAAY,MAAA,IAAU,GAAA;AAAA,cACtC,OAAA,EAAS,OAAA,CAAQ,UAAA,EAAY,OAAA,IAAW,EAAC;AAAA,cACzC,IAAA,EAAM,YAAA;AAAA,cACN,OAAO,KAAA,CAAM;AAAA,aACd,CAAA;AACD,YAAA;AAAA,UACF;AACA,UAAA,IAAI,MAAM,GAAA,EAAK;AACb,YAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,YAAA,MAAM,YAAA,GAAe,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AACvD,YAAA,OAAA,CAAQ,OAAA,CAAQ;AAAA,cACd,MAAA,EAAQ,OAAA,CAAQ,UAAA,EAAY,MAAA,IAAU,GAAA;AAAA,cACtC,OAAA,EAAS,OAAA,CAAQ,UAAA,EAAY,OAAA,IAAW,EAAC;AAAA,cACzC,IAAA,EAAM;AAAA,aACP,CAAA;AAAA,UACH;AAAA,QACF;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,aAAA,EAAe;AAClB,QAAA,MAAM,OAAA,GAAU,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC7C,QAAA,IAAI,CAAC,OAAA,EAAS;AACd,QAAA,aAAA,CAAc,MAAA,CAAO,MAAM,KAAK,CAAA;AAChC,QAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,QAAA,IAAI,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,MAAA,KAAW,GAAA,EAAK;AACvC,UAAA,MAAM,OAAO,KAAA,CAAM,KAAA,EAAO,IAAA,IAAQ,CAAA,KAAA,EAAQ,MAAM,MAAM,CAAA,CAAA;AACtD,UAAA,MAAM,MACJ,KAAA,CAAM,KAAA,EAAO,OAAA,IACb,CAAA,6BAAA,EAAgC,MAAM,MAAM,CAAA,CAAA;AAC9C,UAAA,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,GAAG,EAAE,CAAC,CAAA;AAC3C,UAAA;AAAA,QACF;AACA,QAAA,MAAM,OAAO,IAAI,mBAAA;AAAA,UACf,KAAA,CAAM,KAAA;AAAA,UACN,MAAM,QAAA,IAAY,IAAA;AAAA,UAClB,IAAA,CAAK,IAAA;AAAA,UACL,MAAM;AACJ,YAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,KAAK,CAAA;AAC1B,YAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAAA,UAChC,CAAA;AAAA,UACA,KAAA,EAAO,aAAa,WAAA,KAAgB;AAAA,SACtC;AACA,QAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAC7B,QAAA,OAAA,CAAQ,QAAQ,IAAI,CAAA;AACpB,QAAA;AAAA,MACF;AAAA,MACA,KAAK,YAAA,EAAc;AACjB,QAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACpC,QAAA,IAAI,CAAC,IAAA,EAAM;AACX,QAAA,MAAM,KAAA,GAAQA,WAAAA,CAAW,KAAA,CAAM,IAAI,CAAA;AACnC,QAAA,IAAI,MAAM,IAAA,EAAM;AACd,UAAA,MAAM,QAAQ,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,KAAK,EAAC;AAC/C,UAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAChB,UAAA,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,KAAK,CAAA;AAClC,UAAA;AAAA,QACF;AACA,QAAA,MAAM,IAAA,GAAO,WAAA,CAAY,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACxC,QAAA,WAAA,CAAY,MAAA,CAAO,MAAM,KAAK,CAAA;AAC9B,QAAA,IAAA,CAAK,eAAA,CAAgB,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,IAAA,EAAM,KAAK,CAAC,CAAA,GAAI,KAAA,EAAO,KAAA,CAAM,WAAW,IAAI,CAAA;AAC1F,QAAA;AAAA,MACF;AAAA,MACA,KAAK,UAAA,EAAY;AAGf,QAAA,MAAM,OAAA,GAAU,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC7C,QAAA,IAAI,OAAA,EAAS;AACX,UAAA,aAAA,CAAc,MAAA,CAAO,MAAM,KAAK,CAAA;AAChC,UAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,UAAA,OAAA,CAAQ,MAAA;AAAA,YACN,IAAI,KAAA;AAAA,cACF,CAAA,+BAAA,EAAkC,KAAA,CAAM,IAAI,CAAA,EAAG,KAAA,CAAM,SAAS,CAAA,EAAA,EAAK,KAAA,CAAM,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA;AACxF,WACF;AACA,UAAA;AAAA,QACF;AACA,QAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AACpC,QAAA,IAAI,IAAA,EAAM;AACR,UAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,KAAK,CAAA;AAC1B,UAAA,IAAA,CAAK,aAAA,CAAc,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,UAAU,EAAE,CAAA;AAAA,QACnD;AACA,QAAA;AAAA,MACF;AAAA,MACA,KAAK,MAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,QAAQ,KAAA,EAAO,KAAA,CAAM,OAAO,CAAA;AAChD,QAAA;AAAA,MACF,KAAK,MAAA;AAAA,MACL,KAAK,OAAA;AAAA,MACL,KAAK,OAAA;AAAA,MACL,KAAK,MAAA;AAAA,MACL,KAAK,QAAA;AAAA,MACL,KAAK,cAAA;AAAA,MACL,KAAK,SAAA;AAEH,QAAA;AAAA;AACJ,EACF;AAEA,EAAA,OAAO;AAAA,IACL,KAAA,GAAQ;AACN,MAAA,IAAI,KAAA,EAAO,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA;AACvC,MAAA,IAAI,cAAc,OAAO,YAAA;AACzB,MAAA,YAAA,GAAe,IAAI,OAAA,CAAoB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC1D,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,2CAA2C,cAAc,CAAA,GAAA;AAAA;AAC3D,WACF;AAAA,QACF,GAAG,cAAc,CAAA;AAEjB,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,CAAC,KAAA,KAAU;AACvC,UAAA,IAAI,KAAA,CAAM,MAAM,OAAA,EAAS;AACzB,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,GAAA,EAAI;AACJ,UAAA,IAAI,KAAA,CAAM,YAAY,cAAA,EAAgB;AACpC,YAAA,MAAA;AAAA,cACE,IAAI,KAAA;AAAA,gBACF,CAAA,qBAAA,EAAwB,KAAA,CAAM,OAAO,CAAA,gBAAA,EAAmB,cAAc,CAAA,CAAA;AAAA;AACxE,aACF;AACA,YAAA;AAAA,UACF;AACA,UAAA,KAAA,GAAQ,KAAA;AACR,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf,CAAC,CAAA;AAAA,MACH,CAAC,CAAA;AACD,MAAA,OAAO,YAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAW;AACpC,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,IAAI,SAAA,EAAW,GAAA,IAAO,KAAA,EAAO,YAAA,CAAa,QAAQ,IAAA,EAAM;AACtD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,eAAA,EAAkB,KAAA,EAAO,KAAA,IAAS,WAAW,CAAA,iCAAA;AAAA,SAC/C;AAAA,MACF;AACA,MAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,MAAA,MAAM,GAAA,GAAkB;AAAA,QACtB,CAAA,EAAG,OAAA;AAAA,QACH,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA;AAAA,QACA,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,KAAK,SAAA,EAAW,GAAA;AAAA,QAChB,GAAI,SAAA,EAAW,GAAA,GAAM,EAAE,IAAA,EAAM,SAAA,CAAU,IAAA,IAAQ,EAAA,EAAI,IAAA,EAAM,SAAA,CAAU,IAAA,IAAQ,EAAA,KAAO;AAAC,OACrF;AACA,MAAA,MAAM,YAAA,GAAe,MAAM,IAAI,OAAA;AAAA,QAC7B,CAAC,SAAS,MAAA,KAAW;AACnB,UAAA,YAAA,CAAa,GAAA,CAAI,MAAA,EAAQ,EAAE,OAAA,EAAS,QAAQ,CAAA;AAC5C,UAAA,IAAA,CAAK,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,QACpB;AAAA,OACF;AACA,MAAA,MAAM,OAAO,IAAI,eAAA,CAAgB,QAAQ,YAAA,CAAa,GAAA,EAAK,KAAK,IAAI,CAAA;AACpE,MAAA,WAAA,CAAY,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC5B,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,YAAY,GAAA,EAAqD;AACrE,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,MAAM,QAAQ,UAAA,EAAW;AACzB,MAAA,MAAM,SAAA,GAAY,IAAI,SAAA,IAAa,GAAA;AACnC,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,KAAS,MAAA,GAAY,SAAY,MAAA,CAAO,IAAA,CAAK,IAAI,IAAI,CAAA;AACtE,MAAA,MAAM,KAAA,GAAwD;AAAA,QAC5D,CAAA,EAAG,cAAA;AAAA,QACH,KAAA;AAAA,QACA,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C;AAAA,OACF;AACA,MAAA,OAAO,IAAI,OAAA,CAA4B,CAAC,OAAA,EAAS,MAAA,KAAW;AAI1D,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,WAAA,CAAY,OAAO,KAAK,CAAA;AACxB,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,CAAA,mBAAA,EAAsB,IAAI,MAAM,CAAA,CAAA,EAAI,IAAI,IAAI,CAAA,kBAAA,EAAqB,YAAY,GAAK,CAAA,GAAA;AAAA;AACpF,WACF;AAAA,QACF,CAAA,EAAG,YAAY,GAAK,CAAA;AACpB,QAAA,WAAA,CAAY,IAAI,KAAA,EAAO;AAAA,UACrB,IAAA,EAAM,UAAA;AAAA,UACN,OAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,UAAA,EAAY,IAAA;AAAA,UACZ,cAAc;AAAC,SAChB,CAAA;AACD,QAAA,eAAA,CAAgB,OAAO,IAAI,CAAA;AAAA,MAC7B,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,kBACJ,GAAA,EACmC;AACnC,MAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAA,CAAK,KAAA,EAAM;AAC7B,MAAA,MAAM,QAAQ,UAAA,EAAW;AAMzB,MAAA,MAAM,aAAA,GAAgB,IAAI,SAAA,IAAa,GAAA;AACvC,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,KAAS,MAAA,GAAY,SAAY,MAAA,CAAO,IAAA,CAAK,IAAI,IAAI,CAAA;AAMtE,MAAA,MAAM,KAAA,GAAwD;AAAA,QAC5D,CAAA,EAAG,cAAA;AAAA,QACH,KAAA;AAAA,QACA,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C,SAAA,EAAW,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAAA;AAAA,OAC5B;AACA,MAAA,OAAO,IAAI,OAAA,CAAkC,CAAC,WAAA,EAAa,MAAA,KAAW;AACpE,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,IAAI,WAAA,CAAY,GAAA,CAAI,KAAK,CAAA,EAAG;AAC1B,YAAA,WAAA,CAAY,OAAO,KAAK,CAAA;AACxB,YAAA,MAAA;AAAA,cACE,IAAI,KAAA;AAAA,gBACF,4BAA4B,GAAA,CAAI,MAAM,IAAI,GAAA,CAAI,IAAI,gCAAgC,aAAa,CAAA,GAAA;AAAA;AACjG,aACF;AAAA,UACF;AAAA,QACF,GAAG,aAAa,CAAA;AAChB,QAAA,WAAA,CAAY,IAAI,KAAA,EAAO;AAAA,UACrB,IAAA,EAAM,QAAA;AAAA,UACN,WAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,UAAA,EAAY,IAAA;AAAA,UACZ,eAAe,EAAC;AAAA,UAChB,WAAA,EAAa,KAAA;AAAA,UACb,KAAA,EAAO;AAAA,SACR,CAAA;AACD,QAAA,eAAA,CAAgB,OAAO,IAAI,CAAA;AAAA,MAC7B,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,iBACJ,GAAA,EAC0B;AAC1B,MAAA,MAAM,CAAA,GAAI,MAAM,IAAA,CAAK,KAAA,EAAM;AAC3B,MAAA,IAAI,CAAA,CAAE,YAAA,CAAa,SAAA,KAAc,IAAA,EAAM;AACrC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,eAAA,EAAkB,CAAA,CAAE,KAAA,IAAS,WAAW,CAAA,4FAAA;AAAA,SAC1C;AAAA,MACF;AACA,MAAA,MAAM,QAAQ,UAAA,EAAW;AACzB,MAAA,MAAM,SAAA,GAAY,IAAI,aAAA,IAAiB,GAAA;AACvC,MAAA,MAAM,KAAA,GAAqB;AAAA,QACzB,CAAA,EAAG,SAAA;AAAA,QACH,KAAA;AAAA,QACA,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,GAAI,IAAI,QAAA,GAAW,EAAE,UAAU,GAAA,CAAI,QAAA,KAAa,EAAC;AAAA,QACjD,GAAI,IAAI,OAAA,GAAU,EAAE,SAAS,GAAA,CAAI,OAAA,KAAY,EAAC;AAAA,QAC9C,GAAI,GAAA,CAAI,SAAA,IAAa,GAAA,CAAI,SAAA,CAAU,MAAA,GAAS,CAAA,GACxC,EAAE,SAAA,EAAW,GAAA,CAAI,SAAA,EAAU,GAC3B,EAAC;AAAA;AAAA,QAEL,SAAA,EAAW;AAAA,OACb;AACA,MAAA,OAAO,IAAI,OAAA,CAAyB,CAAC,OAAA,EAAS,MAAA,KAAW;AACvD,QAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,UAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,KAAK,CAAA,EAAG;AAC/B,UAAA,aAAA,CAAc,OAAO,KAAK,CAAA;AAC1B,UAAA,MAAA;AAAA,YACE,IAAI,KAAA;AAAA,cACF,CAAA,wBAAA,EAA2B,GAAA,CAAI,IAAI,CAAA,qCAAA,EAAwC,SAAS,CAAA,GAAA;AAAA;AACtF,WACF;AAAA,QACF,GAAG,SAAS,CAAA;AACZ,QAAA,aAAA,CAAc,IAAI,KAAA,EAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAO,CAAA;AACnD,QAAA,IAAA,CAAK,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IAEA,MAAM,KAAA,GAAQ;AACZ,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,GACF;AACF;AAOA,IAAM,eAAA,GAAN,cAA8B,YAAA,CAA2C;AAAA,EAC9D,MAAA;AAAA,EACT,GAAA;AAAA,EACS,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACQ,IAAA;AAAA,EACT,MAAA,GAAS,KAAA;AAAA,EAEjB,WAAA,CAAY,MAAA,EAAgB,GAAA,EAAa,IAAA,EAAiB;AACxD,IAAA,KAAA,EAAM;AACN,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA,GAAM,CAAA,GAAI,GAAA,GAAM,IAAA;AAC3B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAIZ,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,QAAA,CAAS,EAAE,IAAA,GAAO;AAAA,IAAC,GAAG,CAAA;AACxC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,QAAA,CAAS,EAAE,IAAA,GAAO;AAAA,IAAC,GAAG,CAAA;AAGxC,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAI,QAAA,CAAS;AAAA,MACxB,KAAA,CAAM,KAAA,EAAwB,IAAA,EAAM,EAAA,EAAI;AACtC,QAAA,IAAA,CAAK,IAAA,CAAK;AAAA,UACR,CAAA,EAAG,OAAA;AAAA,UACH,MAAA;AAAA,UACA,IAAA,EAAM,WAAW,KAAK;AAAA,SACvB,CAAA;AACD,QAAA,EAAA,EAAG;AAAA,MACL,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,MAAM,EAAA,EAAI;AACR,QAAA,IAAA,CAAK,KAAK,EAAE,CAAA,EAAG,SAAS,MAAA,EAAQ,IAAA,EAAM,IAAI,CAAA;AAC1C,QAAA,EAAA,EAAG;AAAA,MACL;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,GAAA,EAAmB;AAC9B,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,EACtB;AAAA,EAEA,aAAa,GAAA,EAAmB;AAC9B,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,EACtB;AAAA,EAEA,YAAY,GAAA,EAAkB;AAC5B,IAAA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,aAAa,KAAA,EAAwB;AACnC,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,IAAA,EAAM,MAAM,MAAM,CAAA;AAAA,EAC5C;AAAA,EAEA,kBAAA,GAA2B;AACzB,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA;AAAA,MACH,MAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,IAAA,CAAK,SAAkC,SAAA,EAAoB;AACzD,IAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,KAAA;AACxB,IAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,MACb,CAAA,EAAG,MAAA;AAAA,MACH,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAM,MAAM,CAAA;AAAA,KAC3D,CAAA;AACD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAA,CAAO,MAAc,IAAA,EAAoB;AACvC,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,EAAE,CAAA,EAAG,QAAA,EAAU,QAAQ,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,EACjE;AACF,CAAA;AAcA,IAAM,sBAAN,MAAqD;AAAA,EAC1C,QAAA;AAAA,EACD,WAAA,GAA6C,MAAA;AAAA,EACpC,KAAA;AAAA,EACA,IAAA;AAAA,EACA,SAAA;AAAA;AAAA,EAEA,QAAA;AAAA,EACA,gBAAA,uBAAuB,GAAA,EAEtC;AAAA,EACe,cAAA,uBAAqB,GAAA,EAEpC;AAAA,EACe,cAAA,uBAAqB,GAAA,EAA0B;AAAA,EAEhE,YACE,KAAA,EACA,QAAA,EACA,IAAA,EACA,SAAA,EACA,WAAW,KAAA,EACX;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,IAAI,UAAA,GAA4C;AAC9C,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA,EAEA,KAAK,IAAA,EAAiC;AACpC,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AACjC,IAAA,MAAM,KAAA,GACJ,OAAO,IAAA,KAAS,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAGzE,IAAA,MAAM,SAAS,IAAA,CAAK,QAAA,GAAW,aAAa,KAAK,CAAA,GAAI,CAAC,KAAK,CAAA;AAC3D,IAAA,MAAA,CAAO,OAAA,CAAQ,CAAC,KAAA,EAAO,CAAA,KAAM;AAC3B,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,YAAA;AAAA,QACH,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,IAAA,EAAM,WAAW,KAAK,CAAA;AAAA,QACtB,MAAA,EAAQ,OAAO,IAAA,KAAS,QAAA;AAAA,QACxB,GAAI,IAAI,MAAA,CAAO,MAAA,GAAS,IAAI,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI;AAAC,OAC/C,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,CAAM,IAAA,GAAe,GAAA,EAAM,MAAA,EAAuB;AAChD,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AAC/B,MAAA,IAAA,CAAK,WAAA,GAAc,SAAA;AACnB,MAAA,IAAA,CAAK,KAAK,IAAA,CAAK;AAAA,QACb,CAAA,EAAG,UAAA;AAAA,QACH,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,IAAA;AAAA,QACA,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,OAC5B,CAAA;AAAA,IACH;AAKA,IAAA,IAAA,CAAK,aAAA,CAAc,IAAA,EAAM,MAAA,IAAU,EAAE,CAAA;AAAA,EACvC;AAAA,EAEA,UACE,QAAA,EACY;AACZ,IAAA,IAAA,CAAK,gBAAA,CAAiB,IAAI,QAAQ,CAAA;AAClC,IAAA,OAAO,MAAM,IAAA,CAAK,gBAAA,CAAiB,MAAA,CAAO,QAAQ,CAAA;AAAA,EACpD;AAAA,EAEA,QAAQ,QAAA,EAA8D;AACpE,IAAA,IAAA,CAAK,cAAA,CAAe,IAAI,QAAQ,CAAA;AAChC,IAAA,OAAO,MAAM,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEA,QAAQ,QAAA,EAA4C;AAClD,IAAA,IAAA,CAAK,cAAA,CAAe,IAAI,QAAQ,CAAA;AAChC,IAAA,OAAO,MAAM,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEA,eAAA,CAAgB,MAAc,QAAA,EAAyB;AACrD,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAQ;AACjC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,gBAAA,EAAkB;AACrC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,MAAM,QAAQ,CAAA;AAAA,MAClB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAA,CAAc,MAAc,MAAA,EAAsB;AAChD,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,IAAA,CAAK,WAAA,GAAc,QAAA;AACnB,IAAA,IAAA,CAAK,SAAA,EAAU;AACf,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,cAAA,EAAgB;AACnC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,MAAM,MAAM,CAAA;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,iBAAiB,KAAA,EAAM;AAC5B,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAC1B,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAAA,EAC5B;AAAA,EAEA,kBAAA,GAA2B;AACzB,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACnC,IAAA,KAAA,MAAW,CAAA,IAAK,KAAK,cAAA,EAAgB;AACnC,MAAA,IAAI;AACF,QAAA,CAAA,CAAE,IAAI,KAAA,CAAM,uBAAuB,CAAC,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,aAAA,CAAc,MAAM,eAAe,CAAA;AAAA,EAC1C;AACF,CAAA;;;AC98BA,IAAM,YAAA,GAAe,CAAC,IAAA,GAA2B,QAA4B,EAAE,IAAA,EAAM,QAAA,EAAU,GAAG,IAAA,EAAK,CAAA;AAGhG,SAASC,QAAAA,CACd,KAAA,EACA,IAAA,EACA,IAAA,GAA2B,EAAC,EACV;AAClB,EAAA,OAAW,OAAA,CAAQ,KAAA,EAAO,IAAA,EAAM,YAAA,CAAa,IAAI,CAAC,CAAA;AACpD;AAGO,SAASC,yBACd,IAAA,EACA,KAAA,EACA,UAAA,EACA,IAAA,GAAqC,EAAC,EACX;AAC3B,EAAA,OAAW,uBAAA,CAAwB,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA,EAAG,CAAA;AACxG;AAGO,SAASC,wBAAAA,CACd,IAAA,EACA,OAAA,EACA,IAAA,GAAqC,EAAC,EACX;AAC3B,EAAA,OAAW,uBAAA,CAAwB,IAAA,EAAM,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA,EAAG,CAAA;AAC9F;AAGO,SAASC,gBACd,IAAA,EACA,KAAA,EACA,UAAA,EACA,IAAA,GAAmC,EAAC,EACF;AAClC,EAAA,OAAiB,cAAA,CAAe,IAAA,EAAM,KAAA,EAAO,UAAA,EAAY,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA,EAAG,CAAA;AACrG;AAGO,SAASC,cAAAA,CACd,IAAA,EACA,OAAA,EACA,IAAA,GAAmC,EAAC,EACI;AACxC,EAAA,OAAiB,aAAA,CAAc,IAAA,EAAM,OAAA,EAAS,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,YAAA,CAAa,IAAA,CAAK,IAAI,CAAA,EAAG,CAAA;AAC1F","file":"index.mjs","sourcesContent":["/**\n * `E2eAead` over `node:crypto` — the default through the `@agentproto/acp/tunnel`\n * Node entry. The exact cipher calls `wrapE2E` made before the AEAD seam.\n */\n\nimport { createCipheriv, createDecipheriv } from \"node:crypto\"\nimport type { E2eAead } from \"./aead.js\"\n\nconst TAG_LEN = 16\n\nexport const nodeAead: E2eAead = {\n  aesGcmEncrypt: async (key, iv, plaintext, aad) => {\n    const cipher = createCipheriv(\"aes-256-gcm\", key, iv)\n    if (aad) cipher.setAAD(aad)\n    return Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()])\n  },\n  aesGcmDecrypt: async (key, iv, sealed, aad) => {\n    if (sealed.length < TAG_LEN) throw new Error(\"ciphertext shorter than the GCM tag\")\n    const decipher = createDecipheriv(\"aes-256-gcm\", key, iv)\n    if (aad) decipher.setAAD(aad)\n    decipher.setAuthTag(sealed.subarray(sealed.length - TAG_LEN))\n    return Buffer.concat([decipher.update(sealed.subarray(0, sealed.length - TAG_LEN)), decipher.final()])\n  },\n}\n","/**\n * Node-side `decodeData`: the frame codec's portable `decodeData` returns a\n * `Uint8Array` (so it runs in a browser); the Node tunnel client/server and the\n * `@agentproto/acp/tunnel` entry keep the `Buffer`-typed signature they always\n * had. Under Node the underlying value already is a `Buffer`, so this is free.\n */\n\nimport { decodeData as decodeBytes } from \"./frames.js\"\n\nexport function decodeData(data: string): Buffer {\n  const bytes = decodeBytes(data)\n  return Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)\n}\n","/**\n * Tunnel server (daemon side).\n *\n * Sits on the local machine that actually owns the binaries (e.g. the\n * user's laptop running `agentproto serve`). Accepts spawn frames from\n * a remote host, spawns the requested child via node:child_process,\n * pipes stdio back as `stdout`/`stderr` frames, and reports lifecycle\n * via `spawned`/`exit`/`error`.\n *\n * Transport-agnostic: the caller passes a `FrameSink`. For WebSocket\n * callers, see `wrapWebSocket()` in ./ws-adapter.ts.\n *\n * Security: this process MUST refuse spawn requests by default unless\n * the caller installed an `authorize(spawn)` hook. We don't expose a\n * \"trust everything\" mode — every host integration is responsible for\n * deciding what the remote may exec. The hook gets the full SpawnFrame\n * and can mutate it (e.g. force `cwd` into a workspace) or reject.\n */\n\nimport { spawn, type ChildProcess } from \"node:child_process\"\nimport { hostname, platform } from \"node:os\"\nimport { decodeData } from \"./node-data.js\"\nimport {\n  MAX_FRAME_PAYLOAD_BYTES,\n  TUNNEL_VERSION,\n  splitPayload,\n  encodeData,\n  encodeFrame,\n  parseFrame,\n  type ExitFrame,\n  type HttpRequestFrame,\n  type HttpResponseFrame,\n  type SpawnFrame,\n  type StderrFrame,\n  type StdoutFrame,\n  type TunnelFrame,\n  type WsOpenFrame,\n} from \"./frames.js\"\nimport type { FrameSink } from \"./transport.js\"\n\n/**\n * Default ceiling for an upstream WS dial. An upstream that accepts the TCP\n * connection but never completes (or rejects) the WebSocket upgrade would\n * otherwise leave the `ws_open` pending forever — the host never gets an ack or\n * a reject. Bounded so a hung upstream surfaces as a 504 instead.\n */\nexport const DEFAULT_WS_DIAL_TIMEOUT_MS = 10_000\n\n/**\n * Default ceiling for an `http_request` forward when the frame carries no\n * `timeoutMs`. Covers connect + buffered body (or connect + headers for a\n * stream, after which the bound is handed to `httpStreamIdleTimeoutMs`).\n */\nexport const DEFAULT_HTTP_FORWARD_TIMEOUT_MS = 30_000\n\nexport interface TunnelServerOptions {\n  sink: FrameSink\n  /**\n   * Authorization hook. Called for each `spawn` frame BEFORE the\n   * subprocess is created. Return the (possibly mutated) frame to\n   * proceed; throw or return null to reject. Rejection causes an\n   * `error` frame with code \"spawn_unauthorized\".\n   *\n   * No default — callers MUST decide. Pass `(req) => req` to allow\n   * everything (useful for tests; never for production).\n   */\n  authorize: (req: SpawnFrame) => SpawnFrame | null | Promise<SpawnFrame | null>\n  /**\n   * Upstream HTTP base URL for `http_request` frames. The daemon\n   * appends the frame's `path` and forwards. Typically the local\n   * gateway address — `http://127.0.0.1:18790`. When omitted, the\n   * daemon replies to any `http_request` with\n   * `error: { code: \"http_upstream_not_configured\" }`.\n   */\n  httpUpstream?: string\n  /**\n   * Headers merged into EVERY forwarded `http_request` before it hits the\n   * upstream, overriding any same-named header from the frame. Used by the E2E\n   * pairing serve path to inject the daemon's own bearer token so a\n   * peer-authenticated pairing passes the gateway's mutating-route token gate\n   * (`checkSessionsToken` has no loopback bypass) — see DESIGN §5. Omitted for\n   * the trusted `serve --connect` host, which needs no injection. The pairing\n   * layer never learns or transports the user's daemon bearer beyond this hop.\n   */\n  httpInjectHeaders?: Readonly<Record<string, string>>\n  /**\n   * Default ceiling for an `http_request` forward (connect + buffered body, or\n   * connect + headers for a stream) when the frame carries no `timeoutMs`.\n   * Defaults to DEFAULT_HTTP_FORWARD_TIMEOUT_MS. Disarmed once a streaming\n   * response is detected — see `httpStreamIdleTimeoutMs` for the stream phase.\n   */\n  httpForwardTimeoutMs?: number\n  /**\n   * Idle ceiling between chunks of a STREAMING response (SSE / ndjson). A\n   * stalled upstream that sends headers then hangs forever between chunks would\n   * otherwise block indefinitely (the regular timeout is disarmed for streams,\n   * since they're long-lived by design). Counts time since the last byte and\n   * resets on every chunk, so a heartbeating stream is never cut. Omitted ⇒ no\n   * idle bound (current behaviour); set it to guard against silent stalls.\n   */\n  httpStreamIdleTimeoutMs?: number\n  /** User-friendly label sent in the hello frame. */\n  label?: string\n  /**\n   * Capability identifiers advertised in the hello frame — the agent\n   * adapters / tool surfaces this daemon serves (e.g. the gateway's\n   * registered adapter ids). Lets a multi-daemon host enumerate and\n   * route by capability without a round-trip. Omit to advertise none.\n   */\n  tools?: ReadonlyArray<string>\n  /**\n   * Set when the `sink` is an E2E-encrypted channel (a `wrapE2E` box). Purely\n   * informational — surfaced to the host as `hello.capabilities.e2e` so it can\n   * confirm/display that the tunnel is end-to-end encrypted. The encryption\n   * itself is established by the handshake BEFORE this server is constructed\n   * (see ./tunnel-e2e.ts); this flag does not turn anything on. Default false.\n   */\n  e2e?: boolean\n  /**\n   * Whether this daemon advertises PTY support. Set to true only when\n   * `spawnPty` is also provided.\n   */\n  pty?: boolean\n  /**\n   * Factory for PTY-backed processes. When provided (and `pty: true`),\n   * spawn frames with `pty: true` use this instead of node:child_process.\n   * Injected from the CLI layer so the ACP package stays native-free.\n   */\n  spawnPty?: (opts: {\n    command: string\n    args: string[]\n    cwd?: string\n    env?: Record<string, string>\n    cols: number\n    rows: number\n  }) => PtyProcess\n  /**\n   * Optional hook fired once per successful spawn — after authorize\n   * passed and the ChildProcess has emitted its `spawn` event.\n   * Lets the daemon adopt this child into a higher-level registry\n   * (e.g. @agentproto/runtime's sessions registry, AIP-46) so the\n   * spawn shows up in /sessions, the LocalDaemonSessionsCard, and\n   * the CLI TUI alongside spawns originated locally.\n   *\n   * The hook is fire-and-forget — the tunnel doesn't await its\n   * return. Errors from the hook are swallowed so an observer\n   * registry hiccup never breaks the tunnel exchange.\n   */\n  onChildSpawned?: (info: {\n    execId: string\n    child: ChildProcess\n    request: SpawnFrame\n  }) => void\n  /**\n   * Optional hook fired when the host sends a `reconnect_soon` frame —\n   * graceful drain signal during host rollover. The daemon SHOULD\n   * close + reconnect immediately (skipping any backoff) so the new\n   * host replica picks it up. Default: ignore (the host follows up\n   * with `close(1012)` and the daemon's own reconnect supervisor\n   * handles it via normal backoff, ~30 s gap).\n   *\n   * Implementations typically call into their connection supervisor\n   * to mark the next reconnect as \"no-backoff\" then close the sink.\n   * `reasonMs` is the host's hint for how long it will wait before\n   * forcing close — daemons MAY use it to drain in-flight RPCs first.\n   */\n  onReconnectSoon?: (info: { reasonMs?: number }) => void\n  /**\n   * Factory that dials a WS connection to the local upstream. When\n   * provided (and `httpUpstream` is set), the daemon advertises\n   * `wsForward` capability and handles `ws_open` frames by piping the\n   * upstream WS through the tunnel. Injected so `@agentproto/acp`\n   * stays free of a hard `ws` dependency — the CLI provides this\n   * factory using its already-pulled-in `ws` package.\n   */\n  dialUpstreamWs?: (params: {\n    url: string\n    protocols?: readonly string[]\n    headers?: Readonly<Record<string, string>>\n    /**\n     * Aborted when the dial exceeds `wsDialTimeoutMs` (or the tunnel tears down\n     * mid-dial). A cooperating implementation SHOULD abort the in-flight upgrade\n     * and reject so the socket isn't left half-open; even if it doesn't, the\n     * server bounds the wait independently and rejects the `ws_open`.\n     */\n    signal?: AbortSignal\n  }) => Promise<UpstreamWebSocket>\n  /**\n   * Ceiling for `dialUpstreamWs` to resolve before the `ws_open` is rejected\n   * with 504 `upstream_ws_timeout`. Defaults to DEFAULT_WS_DIAL_TIMEOUT_MS.\n   */\n  wsDialTimeoutMs?: number\n  /**\n   * Largest raw payload (bytes) one outgoing frame carries; bigger response\n   * bodies and (negotiated) WS messages are split. Defaults to\n   * `MAX_FRAME_PAYLOAD_BYTES`, sized for the rendezvous' 1 MiB message cap\n   * after E2E wrapping. Also bounds an assembled chunked request body at\n   * `maxRequestBodyBytes`.\n   */\n  maxFramePayloadBytes?: number\n  /**\n   * Ceiling for a chunked (`bodyChunked`) request body the daemon assembles\n   * before forwarding. Default 64 MiB; over it the request is answered 413.\n   */\n  maxRequestBodyBytes?: number\n  /**\n   * Resolve a named upstream (a `ws_open` frame's `upstream` field) to an\n   * HTTP base URL the daemon should dial instead of `httpUpstream`. Lets a\n   * host reach an imported local service by alias (e.g. a browser capability\n   * server) without ever naming a raw origin — the daemon owns the name→URL\n   * mapping. Return undefined for an unknown alias (the open is rejected).\n   * Omitted ⇒ every `ws_open` dials the default `httpUpstream`.\n   */\n  resolveWsUpstream?: (\n    upstream: string\n  ) => string | undefined | Promise<string | undefined>\n}\n\n/**\n * Minimal upstream WS surface — satisfied by the `ws` library's\n * client socket. Daemons supplying `dialUpstreamWs` resolve into\n * one of these as soon as the WS is OPEN. `protocol` is the\n * subprotocol negotiated by the upstream (empty string when none).\n */\nexport interface UpstreamWebSocket {\n  readonly protocol: string\n  /** Send a frame to the upstream. */\n  send(data: Buffer | string, opts: { binary: boolean }): void\n  /** Close the upstream connection. */\n  close(code?: number, reason?: string): void\n  /** Subscribe to inbound frames. */\n  onMessage(handler: (data: Buffer, isBinary: boolean) => void): void\n  /** Subscribe to upstream close. */\n  onClose(handler: (code: number, reason: string) => void): void\n  /** Subscribe to transport errors. */\n  onError(handler: (err: Error) => void): void\n}\n\n/** Minimal PTY process surface — satisfied by node-pty's IPty. */\nexport interface PtyProcess {\n  readonly pid: number\n  write(data: string): void\n  resize(cols: number, rows: number): void\n  kill(signal?: string): void\n  onData(handler: (data: string) => void): void\n  onExit(handler: (event: { exitCode: number; signal?: number }) => void): void\n}\n\nexport interface TunnelServer {\n  /** Currently-live execId → ChildProcess. Read-only diagnostic. */\n  readonly children: ReadonlyMap<string, ChildProcess>\n  /** Kill all live children and close the sink. */\n  close(): Promise<void>\n}\n\n/** Default ceiling for an assembled `bodyChunked` request body. */\nconst DEFAULT_MAX_REQUEST_BODY_BYTES = 64 * 1024 * 1024\n\nfunction concatBytes(parts: readonly Uint8Array[], size?: number): Uint8Array {\n  const out = new Uint8Array(size ?? parts.reduce((n, p) => n + p.length, 0))\n  let off = 0\n  for (const p of parts) {\n    out.set(p, off)\n    off += p.length\n  }\n  return out\n}\n\n/** One in-flight `http_request` forward (see `http_cancel`). */\ninterface HttpInflight {\n  abort: AbortController\n  cancelled: boolean\n  /** The streamed body's reader, once a stream response is being relayed —\n   *  cancelled directly too, since an upstream body need not honour the\n   *  fetch signal. */\n  reader?: ReadableStreamDefaultReader<Uint8Array>\n}\n\nexport function createTunnelServer(opts: TunnelServerOptions): TunnelServer {\n  const children = new Map<string, ChildProcess>()\n  // PTY-backed processes keyed by execId (separate from pipe-based children).\n  const ptyProcs = new Map<string, PtyProcess>()\n  // Per-reqId map of bridged upstream WS connections. Each entry's\n  // lifecycle starts at ws_open (we send open_ack on success) and ends\n  // at ws_close (either direction). On tunnel teardown we close all.\n  const upstreamWs = new Map<string, UpstreamWebSocket>()\n  // In-flight `http_request` forwards by reqId, so an `http_cancel` (or the\n  // tunnel closing) can abort the upstream call and stop a streamed body.\n  const httpInflight = new Map<string, HttpInflight>()\n  // Requests whose body is still arriving as `http_request_chunk` frames.\n  const httpBodies = new Map<string, { frame: HttpRequestFrame; parts: Uint8Array[]; size: number }>()\n  // Host→daemon WS messages still arriving as fragments (`more`), by reqId.\n  const wsInbound = new Map<string, Buffer[]>()\n  const maxPayload = opts.maxFramePayloadBytes ?? MAX_FRAME_PAYLOAD_BYTES\n  const maxRequestBody = opts.maxRequestBodyBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES\n  let closed = false\n\n  // Greet the host immediately so it can fail fast on version\n  // mismatch before issuing spawns.\n  opts.sink.send({\n    t: \"hello\",\n    version: TUNNEL_VERSION,\n    capabilities: {\n      pty: opts.pty === true,\n      wsForward: opts.dialUpstreamWs !== undefined && !!opts.httpUpstream,\n      httpRequestChunks: true,\n      ...(opts.dialUpstreamWs !== undefined && !!opts.httpUpstream ? { wsFragments: true } : {}),\n      ...(opts.tools && opts.tools.length ? { tools: opts.tools } : {}),\n      ...(opts.e2e === true ? { e2e: true } : {}),\n    },\n    label: opts.label,\n    daemon: {\n      name: \"agentproto\",\n      version: \"0.1.0-alpha\",\n      platform: `${platform()}/${hostname()}`,\n      nodeVersion: process.version,\n    },\n  })\n\n  const offFrame = opts.sink.onFrame((frame) => {\n    handleFrame(frame).catch((err) => {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({ t: \"error\", code: \"internal\", message })\n    })\n  })\n\n  const offClose = opts.sink.onClose(() => {\n    closed = true\n    for (const [, child] of children) child.kill(\"SIGTERM\")\n    children.clear()\n    for (const [, pty] of ptyProcs) pty.kill()\n    ptyProcs.clear()\n    for (const [, ws] of upstreamWs) {\n      try {\n        ws.close(1001, \"tunnel_closed\")\n      } catch {\n        /* socket may already be dead */\n      }\n    }\n    upstreamWs.clear()\n    for (const [, inflight] of httpInflight) {\n      inflight.abort.abort()\n      inflight.reader?.cancel().catch(() => {})\n    }\n    httpBodies.clear()\n    wsInbound.clear()\n    httpInflight.clear()\n    offFrame()\n    offClose()\n  })\n\n  async function handleFrame(frame: TunnelFrame): Promise<void> {\n    switch (frame.t) {\n      case \"spawn\":\n        await handleSpawn(frame)\n        return\n      case \"stdin\": {\n        const pty = ptyProcs.get(frame.execId)\n        if (pty) {\n          pty.write(Buffer.from(frame.data, \"base64\").toString(\"utf8\"))\n          return\n        }\n        const child = children.get(frame.execId)\n        if (!child || !child.stdin) {\n          opts.sink.send({\n            t: \"error\",\n            execId: frame.execId,\n            code: \"unknown_exec\",\n            message: `No live exec '${frame.execId}'`,\n          })\n          return\n        }\n        child.stdin.write(Buffer.from(frame.data, \"base64\"))\n        return\n      }\n      case \"kill\": {\n        const pty = ptyProcs.get(frame.execId)\n        if (pty) {\n          pty.kill(frame.signal ?? \"SIGTERM\")\n          return\n        }\n        const child = children.get(frame.execId)\n        if (!child) {\n          opts.sink.send({\n            t: \"error\",\n            execId: frame.execId,\n            code: \"unknown_exec\",\n            message: `No live exec '${frame.execId}'`,\n          })\n          return\n        }\n        child.kill((frame.signal as NodeJS.Signals | undefined) ?? \"SIGTERM\")\n        return\n      }\n      case \"resize\": {\n        ptyProcs.get(frame.execId)?.resize(frame.cols, frame.rows)\n        return\n      }\n      case \"http_request\":\n        if (frame.bodyChunked) {\n          // The body follows as http_request_chunk frames; forward at `end`.\n          httpBodies.set(frame.reqId, { frame, parts: [], size: 0 })\n          return\n        }\n        // Fire-and-forget — the handler emits its own http_response\n        // frame (or error). Errors that escape handleHttpRequest\n        // bubble to the outer .catch and become a generic `error`\n        // frame, but the per-request error path inside the handler\n        // produces an http_response with `error:` set, which is what\n        // the host's forwardHttp expects.\n        await handleHttpRequest(frame)\n        return\n      case \"http_request_chunk\": {\n        const pending = httpBodies.get(frame.reqId)\n        if (!pending) return // cancelled / unknown — drop\n        if (frame.data) {\n          const piece = decodeData(frame.data)\n          pending.size += piece.length\n          pending.parts.push(piece)\n        }\n        if (pending.size > maxRequestBody) {\n          httpBodies.delete(frame.reqId)\n          opts.sink.send({\n            t: \"http_response\",\n            reqId: frame.reqId,\n            status: 413,\n            error: {\n              code: \"request_body_too_large\",\n              message: `Request body exceeds ${maxRequestBody} bytes.`,\n            },\n          })\n          return\n        }\n        if (!frame.end) return\n        httpBodies.delete(frame.reqId)\n        await handleHttpRequest(pending.frame, concatBytes(pending.parts, pending.size))\n        return\n      }\n      case \"http_cancel\": {\n        httpBodies.delete(frame.reqId)\n        // The host gave up on this request — stop the upstream call. Nothing\n        // more is sent for the reqId (the host has already dropped it).\n        const inflight = httpInflight.get(frame.reqId)\n        if (!inflight) return\n        inflight.cancelled = true\n        inflight.abort.abort()\n        inflight.reader?.cancel().catch(() => {})\n        return\n      }\n      case \"ws_open\":\n        await handleWsOpen(frame)\n        return\n      case \"ws_message\": {\n        const ws = upstreamWs.get(frame.reqId)\n        if (!ws) {\n          // Stale frame for a closed bridge — silently drop. Sending\n          // an error frame would race with our own ws_close on the\n          // teardown path.\n          return\n        }\n        let payload = decodeData(frame.data)\n        if (frame.more) {\n          // A fragment: hold it until the message's last piece arrives.\n          const parts = wsInbound.get(frame.reqId) ?? []\n          parts.push(payload)\n          wsInbound.set(frame.reqId, parts)\n          return\n        }\n        const held = wsInbound.get(frame.reqId)\n        if (held) {\n          wsInbound.delete(frame.reqId)\n          held.push(payload)\n          payload = Buffer.concat(held)\n        }\n        try {\n          ws.send(payload, { binary: frame.binary === true })\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err)\n          opts.sink.send({\n            t: \"ws_close\",\n            reqId: frame.reqId,\n            code: 1011,\n            reason: `send_failed: ${message}`,\n          })\n          try {\n            ws.close(1011, \"send_failed\")\n          } catch {\n            /* defensive */\n          }\n          upstreamWs.delete(frame.reqId)\n        }\n        return\n      }\n      case \"ws_close\": {\n        wsInbound.delete(frame.reqId)\n        const ws = upstreamWs.get(frame.reqId)\n        if (!ws) return\n        upstreamWs.delete(frame.reqId)\n        try {\n          ws.close(frame.code, frame.reason)\n        } catch {\n          /* socket may already be dead */\n        }\n        return\n      }\n      case \"ping\":\n        opts.sink.send({ t: \"pong\", nonce: frame.nonce })\n        return\n      case \"reconnect_soon\":\n        // Host is shutting down this replica (e.g. k8s preStop). Fire\n        // the supervisor hook so the daemon CLI can drop the WS +\n        // reconnect without exponential backoff. We do NOT close the\n        // sink here — that's the supervisor's call (it may want to\n        // drain in-flight RPCs first using the `reasonMs` hint).\n        try {\n          opts.onReconnectSoon?.({\n            ...(frame.reasonMs !== undefined ? { reasonMs: frame.reasonMs } : {}),\n          })\n        } catch {\n          /* defensive — supervisor hook must never break the tunnel */\n        }\n        return\n      case \"pong\":\n      case \"error\":\n        // Daemon doesn't act on these; host-side concern.\n        return\n      default:\n        opts.sink.send({\n          t: \"error\",\n          code: \"unknown_frame\",\n          message: `Daemon received unexpected frame type '${(frame as { t: string }).t}'`,\n        })\n    }\n  }\n\n  async function handleSpawn(req: SpawnFrame): Promise<void> {\n    if (closed) return\n    let approved: SpawnFrame | null\n    try {\n      approved = await opts.authorize(req)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_unauthorized\",\n        message,\n      })\n      return\n    }\n    if (!approved) {\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_unauthorized\",\n        message: \"Authorize hook rejected the spawn request.\",\n      })\n      return\n    }\n\n    // PTY path — use injected spawnPty factory when pty:true is requested.\n    if (approved.pty && opts.spawnPty) {\n      let pty: PtyProcess\n      try {\n        pty = opts.spawnPty({\n          command: approved.command,\n          args: [...approved.args],\n          cwd: approved.cwd,\n          env: approved.env ? { ...approved.env } : undefined,\n          cols: approved.cols ?? 80,\n          rows: approved.rows ?? 24,\n        })\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err)\n        opts.sink.send({ t: \"error\", execId: req.execId, code: \"spawn_failed\", message })\n        return\n      }\n\n      ptyProcs.set(req.execId, pty)\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: pty.pid })\n\n      pty.onData(data => {\n        opts.sink.send({ t: \"stdout\", execId: req.execId, data: encodeData(data) })\n      })\n      pty.onExit(({ exitCode, signal }) => {\n        opts.sink.send({\n          t: \"exit\",\n          execId: req.execId,\n          code: exitCode,\n          signal: signal != null ? String(signal) : null,\n        })\n        ptyProcs.delete(req.execId)\n      })\n\n      if (opts.onChildSpawned) {\n        try {\n          // PTY processes can't be adopted as ChildProcess — pass a no-op shim\n          // so the hook fires (for session visibility) without crashing.\n          opts.onChildSpawned({\n            execId: req.execId,\n            child: { pid: pty.pid } as unknown as ChildProcess,\n            request: approved,\n          })\n        } catch { /* fire-and-forget */ }\n      }\n      return\n    }\n\n    let child: ChildProcess\n    try {\n      child = spawn(approved.command, [...approved.args], {\n        cwd: approved.cwd,\n        env: { ...process.env, ...(approved.env ?? {}) },\n        stdio: [\"pipe\", \"pipe\", \"pipe\"],\n        // detached:false so SIGINT/SIGTERM on the daemon kills children too.\n      })\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err)\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"spawn_failed\",\n        message,\n      })\n      return\n    }\n\n    children.set(req.execId, child)\n\n    if (typeof child.pid === \"number\") {\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: child.pid })\n    } else {\n      // Pid is null when spawn synchronously failed. The 'error'\n      // event below will fire with the real cause; we still report\n      // a placeholder spawned to keep the lifecycle predictable.\n      opts.sink.send({ t: \"spawned\", execId: req.execId, pid: -1 })\n    }\n\n    // Notify the higher-level registry (when wired) — this is what\n    // makes tunnel-driven spawns visible in the daemon's\n    // /sessions list alongside spawns originated locally. Errors\n    // from the observer never break the tunnel.\n    if (opts.onChildSpawned) {\n      try {\n        opts.onChildSpawned({ execId: req.execId, child, request: approved })\n      } catch (err) {\n        // Hook is fire-and-forget — log + continue.\n        // Use console.warn directly because tunnel server has no\n        // logger context.\n        console.warn(\n          `[tunnel-server] onChildSpawned hook threw for execId=${req.execId}: ${\n            err instanceof Error ? err.message : String(err)\n          }`\n        )\n      }\n    }\n\n    child.stdout?.on(\"data\", (chunk: Buffer) => {\n      const f: StdoutFrame = {\n        t: \"stdout\",\n        execId: req.execId,\n        data: encodeData(chunk),\n      }\n      opts.sink.send(f)\n    })\n    child.stderr?.on(\"data\", (chunk: Buffer) => {\n      const f: StderrFrame = {\n        t: \"stderr\",\n        execId: req.execId,\n        data: encodeData(chunk),\n      }\n      opts.sink.send(f)\n    })\n\n    child.on(\"error\", (err) => {\n      opts.sink.send({\n        t: \"error\",\n        execId: req.execId,\n        code: \"child_error\",\n        message: err.message,\n      })\n    })\n\n    child.on(\"exit\", (code, signal) => {\n      const f: ExitFrame = {\n        t: \"exit\",\n        execId: req.execId,\n        code,\n        signal,\n      }\n      opts.sink.send(f)\n      children.delete(req.execId)\n    })\n  }\n\n  /**\n   * Open a bridged WS connection to the local upstream. Same path-\n   * safety rules as `handleHttpRequest` (no absolute URLs, no `..`),\n   * same hop-by-hop header stripping. The `dialUpstreamWs` factory\n   * resolves to an `UpstreamWebSocket` once the upgrade is OPEN — we\n   * then emit `ws_open_ack` to the host and start piping frames.\n   */\n  async function handleWsOpen(req: WsOpenFrame): Promise<void> {\n    if (closed) return\n    const reject = (\n      status: number,\n      code: string,\n      message: string\n    ): void => {\n      opts.sink.send({\n        t: \"ws_open_ack\",\n        reqId: req.reqId,\n        status,\n        error: { code, message },\n      })\n    }\n    if (!opts.dialUpstreamWs || !opts.httpUpstream) {\n      reject(\n        502,\n        \"ws_upstream_not_configured\",\n        \"Daemon does not support WS forwarding — start with `--upstream ws://…` (or upgrade).\"\n      )\n      return\n    }\n    if (\n      !req.path.startsWith(\"/\") ||\n      req.path.startsWith(\"//\") ||\n      req.path.includes(\"..\")\n    ) {\n      reject(\n        400,\n        \"invalid_path\",\n        `Daemon WS forward requires a safe relative path; got '${req.path}'.`\n      )\n      return\n    }\n    const HOP_BY_HOP = new Set([\n      \"connection\",\n      \"upgrade\",\n      \"sec-websocket-version\",\n      \"sec-websocket-key\",\n      \"sec-websocket-extensions\",\n      \"sec-websocket-protocol\",\n      \"host\",\n      \"content-length\",\n    ])\n    const headers: Record<string, string> = {}\n    for (const [k, v] of Object.entries(req.headers ?? {})) {\n      if (HOP_BY_HOP.has(k.toLowerCase())) continue\n      headers[k] = v\n    }\n    // Pick the HTTP base: a named upstream (resolved by the daemon to an\n    // imported service's origin) when the frame carries one, else the\n    // default gateway. The host names an alias, never a URL, so it can't\n    // steer the daemon at an arbitrary origin.\n    let httpBase = opts.httpUpstream\n    if (req.upstream) {\n      const resolved = await opts.resolveWsUpstream?.(req.upstream)\n      if (!resolved) {\n        reject(\n          502,\n          \"unknown_ws_upstream\",\n          `No WS upstream registered for '${req.upstream}'.`\n        )\n        return\n      }\n      httpBase = resolved\n    }\n    // Map the http upstream base to a ws scheme. The daemon's upstream\n    // is conventionally http://127.0.0.1:<port>; the same host accepts\n    // WS upgrades on the same port, so ws://… works.\n    const base = httpBase.replace(/^http(s?):\\/\\//, \"ws$1://\")\n    const url = `${base.replace(/\\/$/, \"\")}${req.path}`\n\n    // Bound the dial: a hung upstream that never finishes the upgrade must not\n    // strand the ws_open. Abort the dial (cooperating impls cancel the real\n    // socket) AND race the timeout independently, so even an impl that ignores\n    // the signal still yields a 504.\n    const dialTimeoutMs = opts.wsDialTimeoutMs ?? DEFAULT_WS_DIAL_TIMEOUT_MS\n    const dialAbort = new AbortController()\n    let dialTimedOut = false\n    let dialTimer: ReturnType<typeof setTimeout> | null = null\n    const dialPromise = opts.dialUpstreamWs({\n      url,\n      ...(req.protocols && req.protocols.length > 0\n        ? { protocols: req.protocols }\n        : {}),\n      headers,\n      signal: dialAbort.signal,\n    })\n    const timeoutPromise = new Promise<never>((_resolve, rej) => {\n      dialTimer = setTimeout(() => {\n        dialTimedOut = true\n        dialAbort.abort(new Error(\"ws_dial_timeout\"))\n        rej(new Error(`upstream WS dial timed out after ${dialTimeoutMs}ms`))\n      }, dialTimeoutMs)\n      if (typeof dialTimer !== \"number\") dialTimer.unref()\n    })\n\n    let upstream: UpstreamWebSocket\n    try {\n      upstream = await Promise.race([dialPromise, timeoutPromise])\n    } catch (err) {\n      if (dialTimer) clearTimeout(dialTimer)\n      if (dialTimedOut) {\n        // The timeout won the race. If the abandoned dial ever resolves, close\n        // the orphaned socket so it doesn't leak.\n        dialPromise.then(\n          sock => {\n            try {\n              sock.close(1001, \"dial_timeout\")\n            } catch {\n              /* defensive */\n            }\n          },\n          () => {},\n        )\n        reject(\n          504,\n          \"upstream_ws_timeout\",\n          `Upstream did not complete the WS upgrade within ${dialTimeoutMs}ms.`,\n        )\n        return\n      }\n      const message = err instanceof Error ? err.message : String(err)\n      // Try to extract an HTTP status from a `ws` error like\n      // `Unexpected server response: 404`.\n      const m = message.match(/Unexpected server response: (\\d+)/)\n      const status = m ? Number.parseInt(m[1]!, 10) : 502\n      reject(status, \"upstream_ws_failed\", message)\n      return\n    }\n    if (dialTimer) clearTimeout(dialTimer)\n    // Race: caller already abandoned us (tunnel closed mid-upgrade).\n    if (closed) {\n      try {\n        upstream.close(1001, \"tunnel_closed\")\n      } catch {\n        /* defensive */\n      }\n      return\n    }\n    upstreamWs.set(req.reqId, upstream)\n    opts.sink.send({\n      t: \"ws_open_ack\",\n      reqId: req.reqId,\n      status: 101,\n      ...(upstream.protocol ? { protocol: upstream.protocol } : {}),\n    })\n\n    upstream.onMessage((data, isBinary) => {\n      if (!opts.sink.isOpen) return\n      // Split a large message only for a host that said it reassembles;\n      // older hosts get it whole (as before).\n      const pieces = req.fragments === true ? splitPayload(data, maxPayload) : [data]\n      pieces.forEach((piece, i) => {\n        opts.sink.send({\n          t: \"ws_message\",\n          reqId: req.reqId,\n          data: encodeData(piece),\n          binary: isBinary,\n          ...(i < pieces.length - 1 ? { more: true } : {}),\n        })\n      })\n    })\n    upstream.onClose((code, reason) => {\n      if (!upstreamWs.has(req.reqId)) return\n      upstreamWs.delete(req.reqId)\n      if (opts.sink.isOpen) {\n        opts.sink.send({\n          t: \"ws_close\",\n          reqId: req.reqId,\n          code,\n          ...(reason ? { reason } : {}),\n        })\n      }\n    })\n    upstream.onError(err => {\n      // Errors typically precede a close; emit a stable error code in\n      // the close frame so the host can distinguish from clean close.\n      if (!upstreamWs.has(req.reqId)) return\n      upstreamWs.delete(req.reqId)\n      if (opts.sink.isOpen) {\n        opts.sink.send({\n          t: \"ws_close\",\n          reqId: req.reqId,\n          code: 1011,\n          reason: `upstream_error: ${err.message}`,\n        })\n      }\n      try {\n        upstream.close(1011, \"upstream_error\")\n      } catch {\n        /* defensive */\n      }\n    })\n  }\n\n  async function handleHttpRequest(req: HttpRequestFrame, chunkedBody?: Uint8Array): Promise<void> {\n    if (closed) return\n    const respond = (\n      partial:\n        | { status: number; headers?: HttpResponseFrame[\"headers\"]; body?: string }\n        | { error: HttpResponseFrame[\"error\"]; status: number }\n    ): void => {\n      opts.sink.send({\n        t: \"http_response\",\n        reqId: req.reqId,\n        ...partial,\n      } as HttpResponseFrame)\n    }\n\n    // Reject if no upstream is configured. Better explicit error\n    // than a confusing 502 from a missing fetch target.\n    if (!opts.httpUpstream) {\n      respond({\n        status: 502,\n        error: {\n          code: \"http_upstream_not_configured\",\n          message:\n            \"Daemon was not started with an http upstream — cannot forward HTTP frames.\",\n        },\n      })\n      return\n    }\n\n    // Path-only is required to keep the daemon from being a generic\n    // SSRF amplifier. Absolute URLs (including protocol-relative `//`)\n    // and parent-traversal are rejected. Querystrings are fine.\n    if (\n      !req.path.startsWith(\"/\") ||\n      req.path.startsWith(\"//\") ||\n      req.path.includes(\"..\")\n    ) {\n      respond({\n        status: 400,\n        error: {\n          code: \"invalid_path\",\n          message: `Daemon http forward requires a safe relative path; got '${req.path}'.`,\n        },\n      })\n      return\n    }\n\n    // Strip hop-by-hop headers defensively before forwarding —\n    // they're meaningful only to the previous transport hop.\n    const HOP_BY_HOP = new Set([\n      \"connection\",\n      \"keep-alive\",\n      \"transfer-encoding\",\n      \"upgrade\",\n      \"proxy-authenticate\",\n      \"proxy-authorization\",\n      \"te\",\n      \"trailer\",\n      \"host\", // upstream sets its own based on the URL\n      \"content-length\", // fetch recomputes\n    ])\n    const headers: Record<string, string> = {}\n    for (const [k, v] of Object.entries(req.headers ?? {})) {\n      if (HOP_BY_HOP.has(k.toLowerCase())) continue\n      headers[k] = v\n    }\n    // Daemon-injected headers (e.g. an internal bearer so a peer-authenticated\n    // pairing passes the gateway's mutating-route token gate — DESIGN §5). These\n    // win over any forwarded header of the same (case-insensitive) name.\n    if (opts.httpInjectHeaders) {\n      for (const [k, v] of Object.entries(opts.httpInjectHeaders)) {\n        const lower = k.toLowerCase()\n        for (const existing of Object.keys(headers)) {\n          if (existing.toLowerCase() === lower) delete headers[existing]\n        }\n        headers[k] = v\n      }\n    }\n\n    const url = `${opts.httpUpstream.replace(/\\/$/, \"\")}${req.path}`\n    const controller = new AbortController()\n    const inflight: HttpInflight = { abort: controller, cancelled: false }\n    httpInflight.set(req.reqId, inflight)\n    const timeoutMs =\n      req.timeoutMs ??\n      opts.httpForwardTimeoutMs ??\n      DEFAULT_HTTP_FORWARD_TIMEOUT_MS\n    // For streaming responses (SSE / long-poll), the daemon-side\n    // request must NOT abort on the regular timeout — the stream is\n    // *meant* to be long-lived. We arm the timer initially, then\n    // disarm it as soon as we detect a streaming response so the\n    // stream can run indefinitely (the host enforces its own teardown\n    // via tunnel close / explicit cancel).\n    let timer: ReturnType<typeof setTimeout> | null = setTimeout(\n      () => controller.abort(),\n      timeoutMs\n    )\n    const clearTimer = () => {\n      if (timer) {\n        clearTimeout(timer)\n        timer = null\n      }\n    }\n    try {\n      const upstreamRes = await fetch(url, {\n        method: req.method,\n        headers,\n        body:\n          chunkedBody !== undefined\n            ? chunkedBody\n            : req.body === undefined\n              ? undefined\n              : decodeData(req.body),\n        signal: controller.signal,\n        // node fetch follows redirects by default — fine for MCP, the\n        // upstream gateway doesn't redirect anyway.\n      })\n      const outHeaders: Record<string, string> = {}\n      upstreamRes.headers.forEach((value, key) => {\n        if (HOP_BY_HOP.has(key.toLowerCase())) return\n        outHeaders[key] = value\n      })\n\n      // Streaming detection — SSE responses MUST go through the\n      // chunked-frame protocol so the host can pipe bytes to the\n      // browser in real time. Anything else stays on the buffered\n      // path for now (small JSON responses are simpler that way; we\n      // can widen streaming to all responses later once it's proven).\n      const contentType = (outHeaders[\"content-type\"] ?? \"\").toLowerCase()\n      const isStream =\n        contentType.startsWith(\"text/event-stream\") ||\n        contentType.includes(\"application/x-ndjson\")\n\n      if (isStream && upstreamRes.body) {\n        // Disarm the request-level timeout — SSE streams are\n        // long-lived by design. The host closing the tunnel (or the\n        // upstream closing its end) is what terminates us now.\n        clearTimer()\n        opts.sink.send({\n          t: \"http_response_head\",\n          reqId: req.reqId,\n          status: upstreamRes.status,\n          headers: outHeaders,\n        })\n        const reader = upstreamRes.body.getReader()\n        inflight.reader = reader\n        // Inter-chunk idle bound: the request timeout is disarmed for streams,\n        // so without this a stalled upstream (headers sent, then silence) hangs\n        // forever. The timer resets per chunk, so a heartbeating stream is never\n        // cut. `IDLE` is the sentinel for \"no byte arrived within the window\".\n        const idleMs = opts.httpStreamIdleTimeoutMs\n        const IDLE = Symbol(\"idle\")\n        type ReadResult = Awaited<ReturnType<typeof reader.read>>\n        const readChunk = async (): Promise<ReadResult | typeof IDLE> => {\n          if (!idleMs) return reader.read()\n          let idleTimer: ReturnType<typeof setTimeout> | null = null\n          const idle = new Promise<typeof IDLE>(resolve => {\n            idleTimer = setTimeout(() => resolve(IDLE), idleMs)\n            if (typeof idleTimer !== \"number\") idleTimer.unref()\n          })\n          try {\n            return await Promise.race([reader.read(), idle])\n          } finally {\n            if (idleTimer) clearTimeout(idleTimer)\n          }\n        }\n        try {\n          while (true) {\n            const chunk = await readChunk()\n            if (inflight.cancelled) {\n              await reader.cancel().catch(() => {})\n              return\n            }\n            if (chunk === IDLE) {\n              try {\n                await reader.cancel()\n              } catch {\n                /* ignore */\n              }\n              opts.sink.send({\n                t: \"http_response_chunk\",\n                reqId: req.reqId,\n                end: true,\n                error: {\n                  code: \"upstream_stream_idle_timeout\",\n                  message: `No data from upstream for ${idleMs}ms.`,\n                },\n              })\n              return\n            }\n            const { value, done } = chunk\n            if (done) {\n              opts.sink.send({\n                t: \"http_response_chunk\",\n                reqId: req.reqId,\n                end: true,\n              })\n              return\n            }\n            if (value && value.byteLength > 0) {\n              // An upstream read can be arbitrarily large; keep every frame\n              // under the transport's message cap.\n              for (const piece of splitPayload(value, maxPayload)) {\n                opts.sink.send({\n                  t: \"http_response_chunk\",\n                  reqId: req.reqId,\n                  data: encodeData(piece),\n                })\n              }\n            }\n            // Stop streaming if the tunnel sink closed under us — no\n            // point feeding chunks into the void.\n            if (!opts.sink.isOpen) {\n              try {\n                await reader.cancel()\n              } catch {\n                /* ignore */\n              }\n              return\n            }\n          }\n        } catch (err) {\n          if (inflight.cancelled) return\n          const message = err instanceof Error ? err.message : String(err)\n          opts.sink.send({\n            t: \"http_response_chunk\",\n            reqId: req.reqId,\n            end: true,\n            error: { code: \"upstream_stream_failed\", message },\n          })\n        }\n        return\n      }\n\n      // Buffered path: small responses + non-SSE traffic.\n      const buf = Buffer.from(await upstreamRes.arrayBuffer())\n      if (buf.length > maxPayload) {\n        // Too big for one frame: a single frame this size would exceed the\n        // rendezvous' message cap once E2E-wrapped and kill the channel. Send\n        // it as head + bounded chunks — both tunnel clients reassemble that\n        // (buffered mode concatenates; a stream consumer reads it).\n        if (inflight.cancelled) return\n        opts.sink.send({\n          t: \"http_response_head\",\n          reqId: req.reqId,\n          status: upstreamRes.status,\n          headers: outHeaders,\n        })\n        const pieces = splitPayload(buf, maxPayload)\n        pieces.forEach((piece, i) => {\n          opts.sink.send({\n            t: \"http_response_chunk\",\n            reqId: req.reqId,\n            data: encodeData(piece),\n            ...(i === pieces.length - 1 ? { end: true } : {}),\n          })\n        })\n        return\n      }\n      respond({\n        status: upstreamRes.status,\n        headers: outHeaders,\n        body: buf.length > 0 ? encodeData(buf) : \"\",\n      })\n    } catch (err) {\n      if (inflight.cancelled) return\n      const message = err instanceof Error ? err.message : String(err)\n      const aborted = err instanceof Error && err.name === \"AbortError\"\n      respond({\n        status: aborted ? 504 : 502,\n        error: {\n          code: aborted ? \"timeout\" : \"upstream_fetch_failed\",\n          message,\n        },\n      })\n    } finally {\n      clearTimer()\n      if (httpInflight.get(req.reqId) === inflight) httpInflight.delete(req.reqId)\n    }\n  }\n\n  return {\n    children,\n    async close() {\n      if (closed) return\n      closed = true\n      for (const [, child] of children) child.kill(\"SIGTERM\")\n      children.clear()\n      opts.sink.close(\"server.close\")\n    },\n  }\n}\n\n// Re-exports for convenience — server-only callers don't need to\n// reach into ./frames for these.\nexport { encodeFrame, parseFrame }\n","/**\n * Tunnel client (host side).\n *\n * Sits on the orchestrator (e.g. Guilde API). Speaks to a remote daemon\n * over a `FrameSink`. Exposes `spawn(command, args, opts)` that returns\n * an object shaped like Node's `ChildProcess` — same `.stdin` /\n * `.stdout` / `.stderr` / `.on('exit')` / `.kill()` surface. This lets\n * the existing ACP protocol arm drive remote subprocesses with zero\n * code changes; the arm thinks it's talking to a local child.\n *\n * The duck is intentionally minimal — only the methods the ACP arm\n * actually calls. If you need the full ChildProcess interface, wrap\n * this with a node:stream.Readable shim.\n */\n\nimport { EventEmitter } from \"node:events\"\nimport { Readable, Writable } from \"node:stream\"\nimport { randomUUID } from \"node:crypto\"\nimport { decodeData } from \"./node-data.js\"\nimport {\n  MAX_FRAME_PAYLOAD_BYTES,\n  TUNNEL_VERSION,\n  encodeData,\n  splitPayload,\n  type ExitFrame,\n  type HelloFrame,\n  type HttpRequestFrame,\n  type HttpResponseFrame,\n  type SpawnFrame,\n  type SpawnedFrame,\n  type StderrFrame,\n  type StdoutFrame,\n  type TunnelFrame,\n  type WsOpenFrame,\n} from \"./frames.js\"\nimport type { FrameSink } from \"./transport.js\"\n\n/** Resolved response from `forwardHttp`. Mirrors `HttpResponseFrame`\n *  but with the body decoded back to a Buffer for the caller. */\nexport interface TunnelHttpResponse {\n  status: number\n  headers: Readonly<Record<string, string>>\n  body: Buffer\n  /** Set when the daemon failed to complete the upstream call. */\n  error?: Readonly<{\n    code: string\n    message: string\n  }>\n}\n\n/** Resolved response from `forwardHttpStream`. Body is a Web\n *  `ReadableStream<Uint8Array>` — consume it to receive chunks as\n *  they arrive from the daemon's upstream (SSE, long-poll, NDJSON).\n *  The stream closes when the daemon's upstream closes OR an upstream\n *  error occurs (surfaced as a stream error on the reader). */\nexport interface TunnelHttpStreamResponse {\n  status: number\n  headers: Readonly<Record<string, string>>\n  body: ReadableStream<Uint8Array>\n}\n\nexport interface TunnelHttpRequest {\n  method: string\n  path: string\n  headers?: Readonly<Record<string, string>>\n  body?: Buffer | Uint8Array | string\n  /** Per-request timeout in ms. Default 30_000. */\n  timeoutMs?: number\n}\n\nexport interface TunnelWebSocketOpenRequest {\n  /** Path + querystring on the daemon-local upstream. Daemon prepends\n   *  its `ws://<upstream>` base; absolute URLs are rejected. */\n  path: string\n  /** Optional registered upstream to dial instead of the daemon's default\n   *  gateway — a NAME the daemon resolves to a base URL (e.g. an imported\n   *  service alias). The host never names a raw origin. */\n  upstream?: string\n  /** Headers forwarded to the upstream upgrade. Hop-by-hop / Sec-* are\n   *  stripped by the daemon. Cookies are NOT forwarded unless the\n   *  daemon was started with `--upstream-cookies`. */\n  headers?: Readonly<Record<string, string>>\n  /** Subprotocols requested. Echoed in `protocol` on success. */\n  protocols?: readonly string[]\n  /** How long to wait for the upstream upgrade before erroring. The\n   *  message stream itself has no timeout (WS lives as long as either\n   *  end keeps it open). Default 30_000. */\n  openTimeoutMs?: number\n}\n\n/**\n * Bridged WS connection. Mirrors the surface of a browser WebSocket\n * minus URL/protocol bookkeeping — the host already chose those when\n * calling `forwardWebSocket`. Messages are typed as text (UTF-8 string)\n * or binary (Uint8Array); the bridge preserves the upstream's framing.\n */\nexport interface TunnelWebSocket {\n  /** True until `close` runs in either direction. */\n  readonly readyState: \"open\" | \"closing\" | \"closed\"\n  /** Selected subprotocol from the upstream's upgrade response, if any. */\n  readonly protocol: string | null\n  /** Send a frame to the daemon's upstream. No-op when not open. */\n  send(data: string | Uint8Array): void\n  /** Initiate a clean close. Idempotent. */\n  close(code?: number, reason?: string): void\n  /** Subscribe to inbound frames. Returns an unsubscribe fn. */\n  onMessage(\n    listener: (data: Buffer, isBinary: boolean) => void\n  ): () => void\n  /** Subscribe to close. Fires exactly once (after either side closes\n   *  OR the tunnel itself drops). Returns an unsubscribe fn. */\n  onClose(listener: (code: number, reason: string) => void): () => void\n  /** Subscribe to transport-level errors. Closes follow shortly. */\n  onError(listener: (err: Error) => void): () => void\n}\n\nexport interface TunnelClientOptions {\n  sink: FrameSink\n  /**\n   * Reject the `spawn` call if the daemon hasn't sent its `hello`\n   * within this window. Defaults to 10s — generous for high-latency\n   * tunnels but fast enough that misconfigured daemons fail loudly.\n   */\n  helloTimeoutMs?: number\n}\n\nexport interface TunnelSpawnOptions {\n  cwd?: string\n  env?: Readonly<Record<string, string>>\n  /** Allocate a PTY on the daemon. Requires `hello.capabilities.pty`. */\n  pty?: boolean\n  /** Initial PTY column width (ignored when `pty` is false). Default 80. */\n  cols?: number\n  /** Initial PTY row height (ignored when `pty` is false). Default 24. */\n  rows?: number\n}\n\n/**\n * Minimal ChildProcess-shaped duck. Covers the surface our ACP arm\n * calls; expand only when a real consumer needs more.\n */\nexport interface TunnelChildProcess {\n  readonly execId: string\n  readonly pid: number | null\n  readonly stdin: Writable\n  readonly stdout: Readable\n  readonly stderr: Readable\n  /** \"exit\" → (code, signal). \"error\" → (Error). */\n  on(event: \"exit\", listener: (code: number | null, signal: string | null) => void): this\n  on(event: \"error\", listener: (err: Error) => void): this\n  kill(signal?: NodeJS.Signals | number): boolean\n  /** Send a terminal resize to the daemon. No-op if the exec isn't PTY-backed. */\n  resize(cols: number, rows: number): void\n}\n\nexport interface TunnelClient {\n  /**\n   * Resolves once the daemon has sent its `hello` frame, OR rejects\n   * with a tunnel-level error. Subsequent calls return the cached\n   * promise.\n   */\n  ready(): Promise<HelloFrame>\n  spawn(\n    command: string,\n    args: readonly string[],\n    opts?: TunnelSpawnOptions\n  ): Promise<TunnelChildProcess>\n  /**\n   * Forward an HTTP request through the tunnel to the daemon's\n   * configured upstream (typically `http://127.0.0.1:<port>`). The\n   * daemon completes the upstream call and replies with the response,\n   * which this promise resolves to. Rejects on tunnel-transport\n   * failure; the daemon-reported HTTP status (incl. 5xx) is returned\n   * in the resolved value.\n   *\n   * Streaming responses (text/event-stream, NDJSON) are buffered into\n   * the returned Buffer. For real streaming, use `forwardHttpStream`.\n   */\n  forwardHttp(req: TunnelHttpRequest): Promise<TunnelHttpResponse>\n  /**\n   * Stream an HTTP response through the tunnel. The promise resolves\n   * as soon as the response head (status + headers) arrives — the\n   * body chunks then flow through `body` (a ReadableStream) until the\n   * daemon's upstream closes. Required for SSE / NDJSON / long-poll\n   * upstreams where buffering until the end would defeat the point.\n   * For one-shot HTTP, prefer `forwardHttp`.\n   */\n  forwardHttpStream(req: TunnelHttpRequest): Promise<TunnelHttpStreamResponse>\n  /**\n   * Open a bridged WebSocket through the tunnel. The promise resolves\n   * once the daemon has completed the upstream upgrade; from that\n   * point messages flow via the returned `TunnelWebSocket`.\n   *\n   * Rejects on:\n   *   - missing `hello.capabilities.wsForward` — older daemon, no bridge\n   *   - upstream upgrade failure (4xx/5xx) — `cause` carries the status\n   *   - timeout waiting for `ws_open_ack`\n   */\n  forwardWebSocket(req: TunnelWebSocketOpenRequest): Promise<TunnelWebSocket>\n  close(): Promise<void>\n}\n\nexport function createTunnelClient(opts: TunnelClientOptions): TunnelClient {\n  const helloTimeoutMs = opts.helloTimeoutMs ?? 10_000\n  let hello: HelloFrame | null = null\n  let helloPromise: Promise<HelloFrame> | null = null\n\n  // Per-execId routing tables. We dispatch incoming frames to the\n  // right child duck by execId; spawn awaits its own `spawned` /\n  // `error` reply via these one-shot resolvers.\n  const childByExec = new Map<string, TunnelChildDuck>()\n  const spawnPending = new Map<\n    string,\n    { resolve: (frame: SpawnedFrame) => void; reject: (err: Error) => void }\n  >()\n\n  // Inflight HTTP forwards keyed by reqId. Each entry's mode depends\n  // on which API the caller used:\n  //   - \"buffered\": forwardHttp(). Resolves once the full body has\n  //     arrived (either as a single `http_response` frame, OR as\n  //     `http_response_head` + chunks that get concatenated here).\n  //   - \"stream\": forwardHttpStream(). Resolves on `http_response_head`\n  //     with a ReadableStream that's fed by subsequent chunk frames.\n  //     For backward-compat with daemons that emit a single\n  //     `http_response`, we synthesize a one-chunk stream + end.\n  // Either mode handles either server response shape — the daemon's\n  // streaming decision is purely server-side (Content-Type based), and\n  // the client adapts.\n  type HttpPending =\n    | {\n        mode: \"buffered\"\n        resolve: (resp: TunnelHttpResponse) => void\n        reject: (err: Error) => void\n        timer: ReturnType<typeof setTimeout>\n        // Set when daemon starts a chunked response.\n        streamHead: {\n          status: number\n          headers: Record<string, string>\n        } | null\n        streamChunks: Buffer[]\n      }\n    | {\n        mode: \"stream\"\n        resolveHead: (resp: TunnelHttpStreamResponse) => void\n        reject: (err: Error) => void\n        timer: ReturnType<typeof setTimeout>\n        // Set once the head arrives — drains pendingChunks into it.\n        controller: ReadableStreamDefaultController<Uint8Array> | null\n        pendingChunks: Buffer[]\n        headEmitted: boolean\n        // Goes true after `end: true` so a late close-of-tunnel doesn't\n        // try to error a closed controller.\n        ended: boolean\n      }\n  const httpPending = new Map<string, HttpPending>()\n\n  // Per-reqId routing for bridged WS connections. Lifecycle:\n  //   1. forwardWebSocket() inserts a `wsOpenPending` entry + sends ws_open\n  //   2. Daemon emits ws_open_ack → we resolve the open promise into a\n  //      TunnelWebSocketDuck, move it to `wsByReq`, drop the pending entry\n  //   3. Bidirectional ws_message frames route to the duck\n  //   4. ws_close in either direction tears the duck down + drops from the map\n  //   5. Tunnel close errors all open WSes with code 1006\n  type WsPending = {\n    resolve: (ws: TunnelWebSocket) => void\n    reject: (err: Error) => void\n    timer: ReturnType<typeof setTimeout>\n  }\n  const wsOpenPending = new Map<string, WsPending>()\n  const wsByReq = new Map<string, TunnelWebSocketDuck>()\n  // Daemon→host WS messages still arriving as fragments (`more`), by reqId.\n  const wsFragments = new Map<string, Buffer[]>()\n\n  /** Send an `http_request`. A body above MAX_FRAME_PAYLOAD_BYTES goes out as\n   *  `http_request_chunk` frames when the daemon accepts them — one frame that\n   *  size would exceed a rendezvous' message cap once E2E-wrapped. Older\n   *  daemons get it inline, as before. */\n  function sendHttpRequest(\n    base: Omit<HttpRequestFrame, \"body\" | \"bodyChunked\">,\n    body: Buffer | undefined,\n  ): void {\n    if (\n      body !== undefined &&\n      body.length > MAX_FRAME_PAYLOAD_BYTES &&\n      hello?.capabilities.httpRequestChunks === true\n    ) {\n      opts.sink.send({ ...base, bodyChunked: true })\n      const pieces = splitPayload(body)\n      pieces.forEach((piece, i) => {\n        opts.sink.send({\n          t: \"http_request_chunk\",\n          reqId: base.reqId,\n          data: encodeData(piece),\n          ...(i === pieces.length - 1 ? { end: true } : {}),\n        })\n      })\n      return\n    }\n    opts.sink.send({ ...base, ...(body !== undefined ? { body: encodeData(body) } : {}) })\n  }\n\n  const offFrame = opts.sink.onFrame((frame) => routeIncoming(frame))\n  const offClose = opts.sink.onClose(() => {\n    for (const [, duck] of childByExec) duck.__handleSinkClosed()\n    childByExec.clear()\n    for (const [, p] of spawnPending) {\n      p.reject(new Error(\"Tunnel closed before spawn completed.\"))\n    }\n    spawnPending.clear()\n    for (const [, p] of httpPending) {\n      clearTimeout(p.timer)\n      if (p.mode === \"buffered\") {\n        p.reject(new Error(\"Tunnel closed before HTTP response arrived.\"))\n      } else {\n        // For an active stream, error the controller so the consumer's\n        // reader.read() rejects instead of hanging forever. If the head\n        // hasn't been emitted yet, reject the head promise too.\n        if (!p.headEmitted) {\n          p.reject(new Error(\"Tunnel closed before HTTP response head arrived.\"))\n        } else if (p.controller && !p.ended) {\n          try {\n            p.controller.error(new Error(\"Tunnel closed mid-stream.\"))\n          } catch {\n            /* already closed */\n          }\n        }\n      }\n    }\n    httpPending.clear()\n    for (const [, p] of wsOpenPending) {\n      clearTimeout(p.timer)\n      p.reject(new Error(\"Tunnel closed before WS upgrade completed.\"))\n    }\n    wsOpenPending.clear()\n    for (const [, duck] of wsByReq) {\n      duck.__handleSinkClosed()\n    }\n    wsByReq.clear()\n    offFrame()\n    offClose()\n  })\n\n  function routeIncoming(frame: TunnelFrame): void {\n    switch (frame.t) {\n      case \"hello\":\n        if (frame.version !== TUNNEL_VERSION) {\n          // Mismatch — surface via the ready() rejection. We don't\n          // tear down the sink because the caller may want to\n          // negotiate a fallback.\n          throw new Error(\n            `Tunnel daemon speaks ${frame.version}; this client speaks ${TUNNEL_VERSION}.`\n          )\n        }\n        hello = frame\n        return\n      case \"spawned\": {\n        const pending = spawnPending.get(frame.execId)\n        if (pending) {\n          spawnPending.delete(frame.execId)\n          pending.resolve(frame)\n        }\n        return\n      }\n      case \"stdout\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__pushStdout(decodeData((frame as StdoutFrame).data))\n        return\n      }\n      case \"stderr\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__pushStderr(decodeData((frame as StderrFrame).data))\n        return\n      }\n      case \"exit\": {\n        const duck = childByExec.get(frame.execId)\n        duck?.__handleExit(frame as ExitFrame)\n        childByExec.delete(frame.execId)\n        return\n      }\n      case \"error\": {\n        if (frame.execId) {\n          const pending = spawnPending.get(frame.execId)\n          if (pending) {\n            spawnPending.delete(frame.execId)\n            pending.reject(new Error(`${frame.code}: ${frame.message}`))\n            return\n          }\n          const duck = childByExec.get(frame.execId)\n          duck?.__pushError(new Error(`${frame.code}: ${frame.message}`))\n          return\n        }\n        // Tunnel-level error: nowhere to surface it cleanly here.\n        // Callers that care should wrap the FrameSink and observe\n        // tunnel-error frames themselves.\n        return\n      }\n      case \"http_response\": {\n        // Buffered response from the daemon — single-frame body.\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        httpPending.delete(frame.reqId)\n        clearTimeout(pending.timer)\n        const body = frame.body ? decodeData(frame.body) : Buffer.alloc(0)\n        if (pending.mode === \"buffered\") {\n          pending.resolve({\n            status: frame.status,\n            headers: frame.headers ?? {},\n            body,\n            ...(frame.error ? { error: frame.error } : {}),\n          })\n        } else {\n          // Caller asked for a stream but the daemon decided to send\n          // a single buffered response. Synthesize a one-chunk stream\n          // so the same consumer code path works.\n          const stream = new ReadableStream<Uint8Array>({\n            start(controller) {\n              if (body.length > 0) controller.enqueue(new Uint8Array(body))\n              controller.close()\n            },\n          })\n          pending.resolveHead({\n            status: frame.status,\n            headers: frame.headers ?? {},\n            body: stream,\n          })\n        }\n        return\n      }\n      case \"http_response_head\": {\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        const headers = frame.headers ?? {}\n        if (pending.mode === \"stream\") {\n          // Wire a ReadableStream whose controller drains any chunks\n          // we've buffered while waiting for the head frame (rare —\n          // chunks shouldn't precede the head — but harmless).\n          const stream = new ReadableStream<Uint8Array>({\n            start(controller) {\n              pending.controller = controller\n              for (const chunk of pending.pendingChunks) {\n                if (chunk.length > 0) controller.enqueue(new Uint8Array(chunk))\n              }\n              pending.pendingChunks = []\n            },\n            cancel: () => {\n              // Consumer abandoned the stream — clean up the pending\n              // entry. We don't send a cancel frame to the daemon\n              // (the protocol doesn't define one), so the daemon will\n              // keep streaming until its upstream closes; we simply\n              // drop frames we still receive.\n              if (httpPending.get(frame.reqId) === pending) {\n                clearTimeout(pending.timer)\n                httpPending.delete(frame.reqId)\n              }\n            },\n          })\n          pending.headEmitted = true\n          // Stream is long-lived — disarm the buffered-mode timeout\n          // (it was a safety net for a stuck buffered response).\n          clearTimeout(pending.timer)\n          pending.resolveHead({\n            status: frame.status,\n            headers,\n            body: stream,\n          })\n        } else {\n          // Buffered caller, streaming server — start accumulating\n          // chunks; we'll resolve once `end: true` arrives.\n          pending.streamHead = { status: frame.status, headers }\n        }\n        return\n      }\n      case \"http_response_chunk\": {\n        const pending = httpPending.get(frame.reqId)\n        if (!pending) return\n        const data = frame.data ? decodeData(frame.data) : Buffer.alloc(0)\n        if (pending.mode === \"stream\") {\n          if (frame.error) {\n            // Upstream error mid-stream — surface it on the reader.\n            try {\n              pending.controller?.error(\n                new Error(`${frame.error.code}: ${frame.error.message}`)\n              )\n            } catch {\n              /* already closed */\n            }\n            pending.ended = true\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            return\n          }\n          if (pending.controller) {\n            if (data.length > 0) {\n              try {\n                pending.controller.enqueue(new Uint8Array(data))\n              } catch {\n                /* reader detached — drop */\n              }\n            }\n            if (frame.end) {\n              try {\n                pending.controller.close()\n              } catch {\n                /* already closed */\n              }\n              pending.ended = true\n              clearTimeout(pending.timer)\n              httpPending.delete(frame.reqId)\n            }\n          } else {\n            // Head hasn't been processed yet — buffer until it is.\n            if (data.length > 0) pending.pendingChunks.push(data)\n            if (frame.end) {\n              // Race: chunk-end before head. Defer closing until head\n              // creates the controller.\n              pending.ended = true\n            }\n          }\n        } else {\n          // Buffered mode — accumulate chunks; resolve on end.\n          if (data.length > 0) pending.streamChunks.push(data)\n          if (frame.error) {\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            const concatenated = Buffer.concat(pending.streamChunks)\n            pending.resolve({\n              status: pending.streamHead?.status ?? 502,\n              headers: pending.streamHead?.headers ?? {},\n              body: concatenated,\n              error: frame.error,\n            })\n            return\n          }\n          if (frame.end) {\n            clearTimeout(pending.timer)\n            httpPending.delete(frame.reqId)\n            const concatenated = Buffer.concat(pending.streamChunks)\n            pending.resolve({\n              status: pending.streamHead?.status ?? 200,\n              headers: pending.streamHead?.headers ?? {},\n              body: concatenated,\n            })\n          }\n        }\n        return\n      }\n      case \"ws_open_ack\": {\n        const pending = wsOpenPending.get(frame.reqId)\n        if (!pending) return\n        wsOpenPending.delete(frame.reqId)\n        clearTimeout(pending.timer)\n        if (frame.error || frame.status !== 101) {\n          const code = frame.error?.code ?? `http_${frame.status}`\n          const msg =\n            frame.error?.message ??\n            `Upstream WS upgrade returned ${frame.status}`\n          pending.reject(new Error(`${code}: ${msg}`))\n          return\n        }\n        const duck = new TunnelWebSocketDuck(\n          frame.reqId,\n          frame.protocol ?? null,\n          opts.sink,\n          () => {\n            wsByReq.delete(frame.reqId)\n            wsFragments.delete(frame.reqId)\n          },\n          hello?.capabilities.wsFragments === true\n        )\n        wsByReq.set(frame.reqId, duck)\n        pending.resolve(duck)\n        return\n      }\n      case \"ws_message\": {\n        const duck = wsByReq.get(frame.reqId)\n        if (!duck) return // stale frame after close — drop\n        const piece = decodeData(frame.data)\n        if (frame.more) {\n          const parts = wsFragments.get(frame.reqId) ?? []\n          parts.push(piece)\n          wsFragments.set(frame.reqId, parts)\n          return\n        }\n        const held = wsFragments.get(frame.reqId)\n        wsFragments.delete(frame.reqId)\n        duck.__handleMessage(held ? Buffer.concat([...held, piece]) : piece, frame.binary === true)\n        return\n      }\n      case \"ws_close\": {\n        // Resolve a pending open if the daemon closes before acking\n        // (e.g. upstream refused mid-upgrade and emitted close).\n        const pending = wsOpenPending.get(frame.reqId)\n        if (pending) {\n          wsOpenPending.delete(frame.reqId)\n          clearTimeout(pending.timer)\n          pending.reject(\n            new Error(\n              `WS closed before upgrade (code ${frame.code}${frame.reason ? `: ${frame.reason}` : \"\"})`\n            )\n          )\n          return\n        }\n        const duck = wsByReq.get(frame.reqId)\n        if (duck) {\n          wsByReq.delete(frame.reqId)\n          duck.__handleClose(frame.code, frame.reason ?? \"\")\n        }\n        return\n      }\n      case \"ping\":\n        opts.sink.send({ t: \"pong\", nonce: frame.nonce })\n        return\n      case \"pong\":\n      case \"spawn\":\n      case \"stdin\":\n      case \"kill\":\n      case \"resize\":\n      case \"http_request\":\n      case \"ws_open\":\n        // Not expected on the host side; ignore.\n        return\n    }\n  }\n\n  return {\n    ready() {\n      if (hello) return Promise.resolve(hello)\n      if (helloPromise) return helloPromise\n      helloPromise = new Promise<HelloFrame>((resolve, reject) => {\n        const timer = setTimeout(() => {\n          reject(\n            new Error(\n              `Tunnel daemon did not send hello within ${helloTimeoutMs}ms.`\n            )\n          )\n        }, helloTimeoutMs)\n        // Rebind sink listener so we resolve on the next hello.\n        const off = opts.sink.onFrame((frame) => {\n          if (frame.t !== \"hello\") return\n          clearTimeout(timer)\n          off()\n          if (frame.version !== TUNNEL_VERSION) {\n            reject(\n              new Error(\n                `Tunnel daemon speaks ${frame.version}; client speaks ${TUNNEL_VERSION}.`\n              )\n            )\n            return\n          }\n          hello = frame\n          resolve(frame)\n        })\n      })\n      return helloPromise\n    },\n\n    async spawn(command, args, spawnOpts) {\n      if (!hello) await this.ready()\n      if (spawnOpts?.pty && hello?.capabilities.pty !== true) {\n        throw new Error(\n          `Tunnel daemon '${hello?.label ?? \"(unnamed)\"}' does not advertise PTY support.`\n        )\n      }\n      const execId = randomUUID()\n      const req: SpawnFrame = {\n        t: \"spawn\",\n        execId,\n        command,\n        args,\n        cwd: spawnOpts?.cwd,\n        env: spawnOpts?.env,\n        pty: spawnOpts?.pty,\n        ...(spawnOpts?.pty ? { cols: spawnOpts.cols ?? 80, rows: spawnOpts.rows ?? 24 } : {}),\n      }\n      const spawnedFrame = await new Promise<SpawnedFrame>(\n        (resolve, reject) => {\n          spawnPending.set(execId, { resolve, reject })\n          opts.sink.send(req)\n        }\n      )\n      const duck = new TunnelChildDuck(execId, spawnedFrame.pid, opts.sink)\n      childByExec.set(execId, duck)\n      return duck\n    },\n\n    async forwardHttp(req: TunnelHttpRequest): Promise<TunnelHttpResponse> {\n      if (!hello) await this.ready()\n      const reqId = randomUUID()\n      const timeoutMs = req.timeoutMs ?? 30_000\n      const body = req.body === undefined ? undefined : Buffer.from(req.body)\n      const frame: Omit<HttpRequestFrame, \"body\" | \"bodyChunked\"> = {\n        t: \"http_request\",\n        reqId,\n        method: req.method,\n        path: req.path,\n        ...(req.headers ? { headers: req.headers } : {}),\n        timeoutMs,\n      }\n      return new Promise<TunnelHttpResponse>((resolve, reject) => {\n        // Belt-and-suspenders timeout: in addition to the daemon-side\n        // enforcement, we time out client-side at timeoutMs + 5s so a\n        // misbehaving daemon can't stall this promise forever.\n        const timer = setTimeout(() => {\n          httpPending.delete(reqId)\n          reject(\n            new Error(\n              `Tunnel forwardHttp(${req.method} ${req.path}) timed out after ${timeoutMs + 5_000}ms.`\n            )\n          )\n        }, timeoutMs + 5_000)\n        httpPending.set(reqId, {\n          mode: \"buffered\",\n          resolve,\n          reject,\n          timer,\n          streamHead: null,\n          streamChunks: [],\n        })\n        sendHttpRequest(frame, body)\n      })\n    },\n\n    async forwardHttpStream(\n      req: TunnelHttpRequest\n    ): Promise<TunnelHttpStreamResponse> {\n      if (!hello) await this.ready()\n      const reqId = randomUUID()\n      // Streaming requests don't enforce a body-completion timeout —\n      // SSE / long-poll streams are *meant* to stay open. We do gate\n      // the HEAD on a generous-but-finite window so a daemon that\n      // silently drops the request still surfaces an error rather\n      // than hanging forever; once head arrives, the timer is cleared.\n      const headTimeoutMs = req.timeoutMs ?? 30_000\n      const body = req.body === undefined ? undefined : Buffer.from(req.body)\n      // Daemon-side request timeout: pass a very large number so the\n      // daemon doesn't kill its own fetch before the stream completes.\n      // Daemon detects SSE content-type and disarms its timer anyway,\n      // but for non-SSE callers using forwardHttpStream this keeps\n      // things safe.\n      const frame: Omit<HttpRequestFrame, \"body\" | \"bodyChunked\"> = {\n        t: \"http_request\",\n        reqId,\n        method: req.method,\n        path: req.path,\n        ...(req.headers ? { headers: req.headers } : {}),\n        timeoutMs: 24 * 60 * 60 * 1000, // 24h — effectively \"forever\"\n      }\n      return new Promise<TunnelHttpStreamResponse>((resolveHead, reject) => {\n        const timer = setTimeout(() => {\n          if (httpPending.has(reqId)) {\n            httpPending.delete(reqId)\n            reject(\n              new Error(\n                `Tunnel forwardHttpStream(${req.method} ${req.path}) head did not arrive within ${headTimeoutMs}ms.`\n              )\n            )\n          }\n        }, headTimeoutMs)\n        httpPending.set(reqId, {\n          mode: \"stream\",\n          resolveHead,\n          reject,\n          timer,\n          controller: null,\n          pendingChunks: [],\n          headEmitted: false,\n          ended: false,\n        })\n        sendHttpRequest(frame, body)\n      })\n    },\n\n    async forwardWebSocket(\n      req: TunnelWebSocketOpenRequest\n    ): Promise<TunnelWebSocket> {\n      const h = await this.ready()\n      if (h.capabilities.wsForward !== true) {\n        throw new Error(\n          `Tunnel daemon '${h.label ?? \"(unnamed)\"}' does not advertise wsForward capability. Update the daemon to forward browser WS upgrades.`\n        )\n      }\n      const reqId = randomUUID()\n      const timeoutMs = req.openTimeoutMs ?? 30_000\n      const frame: WsOpenFrame = {\n        t: \"ws_open\",\n        reqId,\n        path: req.path,\n        ...(req.upstream ? { upstream: req.upstream } : {}),\n        ...(req.headers ? { headers: req.headers } : {}),\n        ...(req.protocols && req.protocols.length > 0\n          ? { protocols: req.protocols }\n          : {}),\n        // We reassemble `more` fragments, so the daemon may split big messages.\n        fragments: true,\n      }\n      return new Promise<TunnelWebSocket>((resolve, reject) => {\n        const timer = setTimeout(() => {\n          if (!wsOpenPending.has(reqId)) return\n          wsOpenPending.delete(reqId)\n          reject(\n            new Error(\n              `Tunnel forwardWebSocket(${req.path}) did not receive ws_open_ack within ${timeoutMs}ms.`\n            )\n          )\n        }, timeoutMs)\n        wsOpenPending.set(reqId, { resolve, reject, timer })\n        opts.sink.send(frame)\n      })\n    },\n\n    async close() {\n      opts.sink.close(\"client.close\")\n    },\n  }\n}\n\n/**\n * Internal ChildProcess duck. Public methods mirror the subset of\n * Node's ChildProcess that our ACP arm calls; double-underscored\n * methods are control hooks for the client.\n */\nclass TunnelChildDuck extends EventEmitter implements TunnelChildProcess {\n  readonly execId: string\n  pid: number | null\n  readonly stdin: Writable\n  readonly stdout: Readable\n  readonly stderr: Readable\n  private readonly sink: FrameSink\n  private exited = false\n\n  constructor(execId: string, pid: number, sink: FrameSink) {\n    super()\n    this.execId = execId\n    this.pid = pid > 0 ? pid : null\n    this.sink = sink\n\n    // stdout / stderr are passive Readables — consumers attach\n    // listeners and we push() data as it arrives.\n    this.stdout = new Readable({ read() {} })\n    this.stderr = new Readable({ read() {} })\n\n    // stdin is a Writable that converts each chunk to a `stdin` frame.\n    this.stdin = new Writable({\n      write(chunk: Buffer | string, _enc, cb) {\n        sink.send({\n          t: \"stdin\",\n          execId,\n          data: encodeData(chunk),\n        })\n        cb()\n      },\n      // Sending an empty stdin frame on `final` mirrors the local\n      // semantics of closing a child's stdin (signal EOF). Daemons\n      // ignore empty payloads, so this is safe even if the child\n      // doesn't care about EOF.\n      final(cb) {\n        sink.send({ t: \"stdin\", execId, data: \"\" })\n        cb()\n      },\n    })\n  }\n\n  __pushStdout(buf: Buffer): void {\n    this.stdout.push(buf)\n  }\n\n  __pushStderr(buf: Buffer): void {\n    this.stderr.push(buf)\n  }\n\n  __pushError(err: Error): void {\n    this.emit(\"error\", err)\n  }\n\n  __handleExit(frame: ExitFrame): void {\n    if (this.exited) return\n    this.exited = true\n    this.stdout.push(null)\n    this.stderr.push(null)\n    this.emit(\"exit\", frame.code, frame.signal)\n  }\n\n  __handleSinkClosed(): void {\n    if (this.exited) return\n    this.exited = true\n    this.stdout.push(null)\n    this.stderr.push(null)\n    this.emit(\n      \"exit\",\n      null,\n      \"SIGHUP\" // surrogate signal — the tunnel went away\n    )\n  }\n\n  kill(signal: NodeJS.Signals | number = \"SIGTERM\"): boolean {\n    if (this.exited) return false\n    this.sink.send({\n      t: \"kill\",\n      execId: this.execId,\n      signal: typeof signal === \"string\" ? signal : `SIG${signal}`,\n    })\n    return true\n  }\n\n  resize(cols: number, rows: number): void {\n    if (this.exited) return\n    this.sink.send({ t: \"resize\", execId: this.execId, cols, rows })\n  }\n}\n\n/**\n * Internal duck for a bridged WS. Mirrors the `TunnelWebSocket`\n * interface; double-underscored methods are control hooks called by\n * the client's frame router.\n *\n * Listener semantics:\n *   - `onMessage` fires for every `ws_message` frame routed here\n *   - `onClose` fires exactly once, either when the daemon emits\n *     `ws_close`, when the caller calls `.close()`, or when the\n *     underlying tunnel disappears (with code 1006 in that case)\n *   - `onError` fires for transport-level errors; close follows\n */\nclass TunnelWebSocketDuck implements TunnelWebSocket {\n  readonly protocol: string | null\n  private _readyState: \"open\" | \"closing\" | \"closed\" = \"open\"\n  private readonly reqId: string\n  private readonly sink: FrameSink\n  private readonly onCleanup: () => void\n  /** The daemon reassembles `more` fragments (hello `wsFragments`). */\n  private readonly fragment: boolean\n  private readonly messageListeners = new Set<\n    (data: Buffer, isBinary: boolean) => void\n  >()\n  private readonly closeListeners = new Set<\n    (code: number, reason: string) => void\n  >()\n  private readonly errorListeners = new Set<(err: Error) => void>()\n\n  constructor(\n    reqId: string,\n    protocol: string | null,\n    sink: FrameSink,\n    onCleanup: () => void,\n    fragment = false\n  ) {\n    this.reqId = reqId\n    this.protocol = protocol\n    this.sink = sink\n    this.onCleanup = onCleanup\n    this.fragment = fragment\n  }\n\n  get readyState(): \"open\" | \"closing\" | \"closed\" {\n    return this._readyState\n  }\n\n  send(data: string | Uint8Array): void {\n    if (this._readyState !== \"open\") return\n    const bytes =\n      typeof data === \"string\" ? Buffer.from(data, \"utf8\") : Buffer.from(data)\n    // Split a large message only for a daemon that reassembles; older\n    // daemons get it whole (as before).\n    const pieces = this.fragment ? splitPayload(bytes) : [bytes]\n    pieces.forEach((piece, i) => {\n      this.sink.send({\n        t: \"ws_message\",\n        reqId: this.reqId,\n        data: encodeData(piece),\n        binary: typeof data !== \"string\",\n        ...(i < pieces.length - 1 ? { more: true } : {}),\n      })\n    })\n  }\n\n  close(code: number = 1000, reason?: string): void {\n    if (this._readyState === \"closed\") return\n    if (this._readyState === \"open\") {\n      this._readyState = \"closing\"\n      this.sink.send({\n        t: \"ws_close\",\n        reqId: this.reqId,\n        code,\n        ...(reason ? { reason } : {}),\n      })\n    }\n    // Fire local close immediately so the caller's onClose handler\n    // runs without waiting for the daemon's echo. The daemon's later\n    // ws_close (if any) is dropped because routeIncoming has already\n    // removed us from wsByReq via __handleClose.\n    this.__handleClose(code, reason ?? \"\")\n  }\n\n  onMessage(\n    listener: (data: Buffer, isBinary: boolean) => void\n  ): () => void {\n    this.messageListeners.add(listener)\n    return () => this.messageListeners.delete(listener)\n  }\n\n  onClose(listener: (code: number, reason: string) => void): () => void {\n    this.closeListeners.add(listener)\n    return () => this.closeListeners.delete(listener)\n  }\n\n  onError(listener: (err: Error) => void): () => void {\n    this.errorListeners.add(listener)\n    return () => this.errorListeners.delete(listener)\n  }\n\n  __handleMessage(data: Buffer, isBinary: boolean): void {\n    if (this._readyState !== \"open\") return\n    for (const l of this.messageListeners) {\n      try {\n        l(data, isBinary)\n      } catch {\n        /* listener threw — don't let it tear down siblings */\n      }\n    }\n  }\n\n  __handleClose(code: number, reason: string): void {\n    if (this._readyState === \"closed\") return\n    this._readyState = \"closed\"\n    this.onCleanup()\n    for (const l of this.closeListeners) {\n      try {\n        l(code, reason)\n      } catch {\n        /* swallow */\n      }\n    }\n    this.messageListeners.clear()\n    this.closeListeners.clear()\n    this.errorListeners.clear()\n  }\n\n  __handleSinkClosed(): void {\n    if (this._readyState === \"closed\") return\n    for (const l of this.errorListeners) {\n      try {\n        l(new Error(\"Tunnel closed mid-WS.\"))\n      } catch {\n        /* swallow */\n      }\n    }\n    this.__handleClose(1006, \"tunnel_closed\")\n  }\n}\n","/**\n * @agentproto/acp/tunnel — frame protocol + client/server for relaying\n * subprocess I/O across a duplex transport (typically WebSocket). Node entry.\n *\n * Wire spec: agentproto/tunnel/v1, defined in ./frames.ts.\n *\n * The frame codec, `wrapE2E` and the handshake-over-sink helpers are shared\n * with the browser-safe entry (`@agentproto/acp/tunnel/browser`, ./browser.ts).\n * The only difference here: the E2E helpers default their AES-GCM to\n * `node:crypto` (`nodeAead`) instead of WebCrypto — same bytes either way —\n * and `decodeData` keeps its `Buffer` return type.\n */\n\nimport { nodeAead } from \"./aead-node.js\"\nimport * as e2e from \"./e2e.js\"\nimport type { FrameSink } from \"./transport.js\"\nimport * as tunnelE2e from \"./tunnel-e2e.js\"\n\nexport { decodeData } from \"./node-data.js\"\n\nexport {\n  TUNNEL_VERSION,\n  MAX_FRAME_PAYLOAD_BYTES,\n  splitPayload,\n  encodeFrame,\n  parseFrame,\n  encodeData,\n  type SpawnFrame,\n  type StdinFrame,\n  type KillFrame,\n  type ResizeFrame,\n  type HelloFrame,\n  type SpawnedFrame,\n  type StdoutFrame,\n  type StderrFrame,\n  type ExitFrame,\n  type ErrorFrame,\n  type PingFrame,\n  type PongFrame,\n  type WsOpenFrame,\n  type WsOpenAckFrame,\n  type WsMessageFrame,\n  type WsCloseFrame,\n  type ReconnectSoonFrame,\n  type E2eFrame,\n  type E2eHandshakeFrame,\n  type TunnelFrame,\n  type HostToDaemonFrame,\n  type DaemonToHostFrame,\n} from \"./frames.js\"\n\nexport type { FrameSink } from \"./transport.js\"\n\nexport {\n  E2eError,\n  DEFAULT_E2E_MAX_FRAMES,\n  holdFrames,\n  type E2eKeys,\n  type E2eErrorCode,\n  type E2eFrameSink,\n  type WrapE2EOptions,\n  type HandshakeOverSinkOptions,\n} from \"./e2e.js\"\n\nexport {\n  DEFAULT_TUNNEL_E2E_TIMEOUT_MS,\n  type TunnelE2EOptions,\n  type AcceptSinkE2EResult,\n} from \"./tunnel-e2e.js\"\n\nexport { nodeAead } from \"./aead-node.js\"\nexport { webCryptoAead, createWebCryptoAead, type E2eAead } from \"./aead.js\"\n\nconst withNodeAead = (wrap: e2e.WrapE2EOptions = {}): e2e.WrapE2EOptions => ({ aead: nodeAead, ...wrap })\n\n/** `wrapE2E` (see ./e2e.ts), AES-GCM defaulting to `node:crypto`. */\nexport function wrapE2E(\n  inner: FrameSink,\n  keys: e2e.E2eKeys,\n  opts: e2e.WrapE2EOptions = {},\n): e2e.E2eFrameSink {\n  return e2e.wrapE2E(inner, keys, withNodeAead(opts))\n}\n\n/** `clientHandshakeOverSink` (see ./e2e.ts), AES-GCM defaulting to `node:crypto`. */\nexport function clientHandshakeOverSink(\n  sink: FrameSink,\n  hello: Uint8Array,\n  deriveKeys: (reply: Uint8Array) => e2e.E2eKeys | Promise<e2e.E2eKeys>,\n  opts: e2e.HandshakeOverSinkOptions = {},\n): Promise<e2e.E2eFrameSink> {\n  return e2e.clientHandshakeOverSink(sink, hello, deriveKeys, { ...opts, wrap: withNodeAead(opts.wrap) })\n}\n\n/** `daemonHandshakeOverSink` (see ./e2e.ts), AES-GCM defaulting to `node:crypto`. */\nexport function daemonHandshakeOverSink(\n  sink: FrameSink,\n  respond: Parameters<typeof e2e.daemonHandshakeOverSink>[1],\n  opts: e2e.HandshakeOverSinkOptions = {},\n): Promise<e2e.E2eFrameSink> {\n  return e2e.daemonHandshakeOverSink(sink, respond, { ...opts, wrap: withNodeAead(opts.wrap) })\n}\n\n/** `connectSinkE2E` (see ./tunnel-e2e.ts), AES-GCM defaulting to `node:crypto`. */\nexport function connectSinkE2E(\n  sink: FrameSink,\n  offer: Uint8Array,\n  deriveKeys: (reply: Uint8Array) => e2e.E2eKeys | Promise<e2e.E2eKeys>,\n  opts: tunnelE2e.TunnelE2EOptions = {},\n): Promise<e2e.E2eFrameSink | null> {\n  return tunnelE2e.connectSinkE2E(sink, offer, deriveKeys, { ...opts, wrap: withNodeAead(opts.wrap) })\n}\n\n/** `acceptSinkE2E` (see ./tunnel-e2e.ts), AES-GCM defaulting to `node:crypto`. */\nexport function acceptSinkE2E(\n  sink: FrameSink,\n  respond: Parameters<typeof tunnelE2e.acceptSinkE2E>[1],\n  opts: tunnelE2e.TunnelE2EOptions = {},\n): Promise<tunnelE2e.AcceptSinkE2EResult> {\n  return tunnelE2e.acceptSinkE2E(sink, respond, { ...opts, wrap: withNodeAead(opts.wrap) })\n}\n\nexport {\n  createTunnelServer,\n  DEFAULT_WS_DIAL_TIMEOUT_MS,\n  DEFAULT_HTTP_FORWARD_TIMEOUT_MS,\n  type TunnelServer,\n  type TunnelServerOptions,\n  type PtyProcess,\n  type UpstreamWebSocket,\n} from \"./server.js\"\n\nexport {\n  createTunnelClient,\n  type TunnelClient,\n  type TunnelClientOptions,\n  type TunnelChildProcess,\n  type TunnelSpawnOptions,\n  type TunnelHttpRequest,\n  type TunnelHttpResponse,\n  type TunnelHttpStreamResponse,\n  type TunnelWebSocket,\n  type TunnelWebSocketOpenRequest,\n} from \"./client.js\"\n\nexport { wrapWebSocket, type WebSocketLike } from \"./ws-adapter.js\"\n"]}