@antseed/cli 0.1.178 → 0.1.180

package/dist/gateway/console.test.js

@@ -0,0 +1,165 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test, { after, before, describe } from 'node:test';
+import { Wallet } from 'ethers';
+import { FRESH_SIGN_IN_MS } from './auth/db.js';
+import { CONSOLE_LOCATION_SETTING, consoleBaseUrl, gatewayConsole, normalizePublicUrl, readConsoleLocation } from './console.js';
+import { startGatewayRuntime } from './runtime.js';
+describe('normalizePublicUrl', () => {
+    test('keeps the origin and rejects other schemes and paths', () => {
+        assert.equal(normalizePublicUrl(undefined), null);
+        assert.equal(normalizePublicUrl('  '), null);
+        assert.equal(normalizePublicUrl('https://LLM.example.test/'), 'https://llm.example.test');
+        assert.equal(normalizePublicUrl('http://10.0.0.5:8379'), 'http://10.0.0.5:8379');
+        assert.throws(() => normalizePublicUrl('ftp://llm.example.test'), /https:\/\//);
+        assert.throws(() => normalizePublicUrl('https://llm.example.test/gateway'), /without a path/);
+        assert.throws(() => normalizePublicUrl('not a url'), /not a valid URL/);
+    });
+    test('console links fall back to localhost', () => {
+        assert.equal(consoleBaseUrl({ publicUrl: null, port: 8379 }), 'http://localhost:8379');
+        assert.equal(consoleBaseUrl({ publicUrl: 'https://llm.example.test', port: 8379 }), 'https://llm.example.test');
+    });
+});
+describe('gateway console wiring', () => {
+    let dataDir;
+    let runtime;
+    let base;
+    let cookie = '';
+    async function api(method, path, body) {
+        const response = await fetch(`${base}/console/api${path}`, {
+            method,
+            headers: {
+                ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+                ...(method !== 'GET' ? { 'x-antseed-console': '1' } : {}),
+                ...(cookie ? { cookie } : {}),
+            },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+        });
+        const setCookie = response.headers.get('set-cookie');
+        if (setCookie)
+            cookie = setCookie.split(';')[0];
+        const text = await response.text();
+        return { status: response.status, body: text ? JSON.parse(text) : undefined, headers: response.headers };
+    }
+    async function signInWithWallet(wallet, enrollment) {
+        const nonce = await api('POST', '/auth/wallet/nonce', { address: wallet.address });
+        assert.equal(nonce.status, 200);
+        const signature = await wallet.signMessage(nonce.body.message);
+        return api('POST', '/auth/wallet/verify', { message: nonce.body.message, signature, ...(enrollment ? { enrollment } : {}) });
+    }
+    before(async () => {
+        dataDir = mkdtempSync(join(tmpdir(), 'antseed-gateway-console-'));
+        runtime = await startGatewayRuntime({
+            dataDir,
+            configPath: join(dataDir, 'config.json'),
+            listenPort: 0,
+            // Nothing listens here: the spend feed and buyer calls just fail.
+            buyerPort: 1,
+            createConsole: gatewayConsole({ dataDir, configPath: join(dataDir, 'config.json'), publicUrl: null, log: () => undefined, env: {} }),
+        });
+        base = `http://127.0.0.1:${runtime.port}`;
+    });
+    after(async () => {
+        await runtime.stop();
+        rmSync(dataDir, { recursive: true, force: true });
+    });
+    test('starts without keys, saves its location and hands out localhost setup links', async () => {
+        assert.ok(runtime.console);
+        assert.deepEqual(readConsoleLocation(runtime.store), { publicUrl: null, port: runtime.port, host: '127.0.0.1' });
+        assert.ok(runtime.store.getSetting(CONSOLE_LOCATION_SETTING));
+        const config = await api('GET', '/auth/config');
+        assert.equal(config.status, 200);
+        assert.equal(config.body.setupRequired, true);
+        assert.match(runtime.console.setupLink(), new RegExp(`^http://localhost:${runtime.port}/console/setup#`));
+    });
+    test('the owner claims the console, signs in with a wallet and reaches the routes', async () => {
+        const token = runtime.console.setupLink().split('#')[1];
+        const setup = await api('POST', '/auth/setup', { token, label: 'Owner', email: 'owner@example.com' });
+        assert.equal(setup.status, 200);
+        const owner = Wallet.createRandom();
+        const signedIn = await signInWithWallet(owner, setup.body.enrollment);
+        assert.equal(signedIn.status, 200);
+        assert.equal(signedIn.body.kind, 'member');
+        assert.equal(runtime.console.setupLink(), null);
+        const settings = await api('GET', '/settings');
+        assert.equal(settings.status, 200);
+        assert.equal(settings.body.auth.setupRequired, false);
+        assert.equal(settings.body.auth.wallet, true);
+        const members = await api('GET', '/members');
+        assert.equal(members.status, 200);
+        assert.equal(members.body[0].credentials.length, 1);
+        assert.equal(members.body[0].credentials[0].kind, 'wallet');
+    });
+    test('removes sign-in methods, but never a member\'s last one', async () => {
+        const me = await api('GET', '/auth/me');
+        const memberId = me.body.me.member.id;
+        const [only] = me.body.me.member.credentials;
+        const refused = await api('DELETE', `/members/${memberId}/credentials/${only.id}`);
+        assert.equal(refused.status, 409);
+        assert.equal(refused.body.error.code, 'last_credential');
+        // A second wallet, linked while signed in.
+        const second = Wallet.createRandom();
+        const linked = await signInWithWallet(second);
+        assert.equal(linked.status, 200);
+        assert.equal(linked.body.me.member.credentials.length, 2);
+        // Removing one of your own needs a recent sign-in.
+        runtime.store.database.prepare('UPDATE auth_sessions SET authenticated_at = ? WHERE member_id = ?').run(Date.now() - FRESH_SIGN_IN_MS - 1000, memberId);
+        const stale = await api('DELETE', `/members/${memberId}/credentials/${only.id}`);
+        assert.equal(stale.status, 403);
+        assert.equal(stale.body.error.code, 'reauth_required');
+        const nonce = await api('POST', '/auth/reauth/wallet/nonce', { address: second.address });
+        assert.equal((await api('POST', '/auth/reauth/wallet/verify', { message: nonce.body.message, signature: await second.signMessage(nonce.body.message) })).status, 200);
+        const removed = await api('DELETE', `/members/${memberId}/credentials/${only.id}`);
+        assert.equal(removed.status, 204);
+        const missing = await api('DELETE', `/members/${memberId}/credentials/${only.id}`);
+        assert.equal(missing.status, 404);
+        assert.equal((await api('GET', '/auth/me')).body.me.member.credentials.length, 1);
+    });
+    test('a disabled member\'s sessions end', async () => {
+        const invite = await api('POST', '/invites', { label: 'Pat', workspaces: [] });
+        assert.equal(invite.status, 201);
+        const ownerCookie = cookie;
+        cookie = '';
+        const accepted = await api('POST', '/auth/invite', { token: invite.body.url.split('#')[1] });
+        assert.equal(accepted.status, 200);
+        const pat = Wallet.createRandom();
+        assert.equal((await signInWithWallet(pat, accepted.body.enrollment)).status, 200);
+        const patCookie = cookie;
+        const patId = (await api('GET', '/auth/me')).body.me.member.id;
+        cookie = ownerCookie;
+        assert.equal((await api('POST', `/members/${patId}/disable`)).status, 200);
+        cookie = patCookie;
+        assert.equal((await api('GET', '/auth/me')).status, 401);
+        cookie = ownerCookie;
+    });
+    test('only an org owner removes another member\'s last sign-in method, which ends their sessions', async () => {
+        const ownerCookie = cookie;
+        async function join(label, orgRole) {
+            cookie = ownerCookie;
+            const invite = await api('POST', '/invites', { label, orgRole, workspaces: [] });
+            assert.equal(invite.status, 201, JSON.stringify(invite.body));
+            cookie = '';
+            const accepted = await api('POST', '/auth/invite', { token: invite.body.url.split('#')[1] });
+            assert.equal((await signInWithWallet(Wallet.createRandom(), accepted.body.enrollment)).status, 200);
+            return { id: (await api('GET', '/auth/me')).body.me.member.id, cookie };
+        }
+        const robin = await join('Robin', 'member');
+        const ari = await join('Ari', 'admin');
+        cookie = robin.cookie;
+        const robinCredential = (await api('GET', '/auth/me')).body.me.member.credentials[0].id;
+        cookie = ari.cookie;
+        const byAdmin = await api('DELETE', `/members/${robin.id}/credentials/${robinCredential}`);
+        assert.equal(byAdmin.status, 409);
+        assert.equal(byAdmin.body.error.code, 'last_credential');
+        cookie = ownerCookie;
+        assert.equal((await api('DELETE', `/members/${robin.id}/credentials/${robinCredential}`)).status, 204);
+        const audited = runtime.store.listAudit({ action: 'member.credential_remove' }).entries;
+        assert.ok(audited.some((entry) => entry.target?.id === robin.id && entry.details?.['last'] === true));
+        cookie = robin.cookie;
+        assert.equal((await api('GET', '/auth/me')).status, 401, 'their sessions ended');
+        cookie = ownerCookie;
+    });
+});
+//# sourceMappingURL=console.test.js.map

package/dist/gateway/console.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.test.js","sourceRoot":"","sources":["../../src/gateway/console.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAChI,OAAO,EAAE,mBAAmB,EAAuB,MAAM,cAAc,CAAA;AAEvE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QACjD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,EAAE,0BAA0B,CAAC,CAAA;QACzF,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC,CAAA;QAChF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,YAAY,CAAC,CAAA;QAC/E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QAC7F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAA;QACtF,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,0BAA0B,CAAC,CAAA;IACjH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,OAAe,CAAA;IACnB,IAAI,OAAuB,CAAA;IAC3B,IAAI,IAAY,CAAA;IAChB,IAAI,MAAM,GAAG,EAAE,CAAA;IAEf,KAAK,UAAU,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,IAAc;QAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,eAAe,IAAI,EAAE,EAAE;YACzD,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACpD,IAAI,SAAS;YAAE,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;IAC1G,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,MAA0E,EAAE,UAAmB;QAC7H,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAClF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9D,OAAO,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC9H,CAAC;IAED,MAAM,CAAC,KAAK,IAAI,EAAE;QAChB,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAA;QACjE,OAAO,GAAG,MAAM,mBAAmB,CAAC;YAClC,OAAO;YACP,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC;YACxC,UAAU,EAAE,CAAC;YACb,kEAAkE;YAClE,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;SACrI,CAAC,CAAA;QACF,IAAI,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QACpB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC1B,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;QAChH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAC7D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;QAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAU,EAAG,EAAE,IAAI,MAAM,CAAC,qBAAqB,OAAO,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAA;IAC7G,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,OAAQ,CAAC,SAAU,EAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAC3D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;QACrG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACrE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAQ,CAAC,SAAU,EAAE,EAAE,IAAI,CAAC,CAAA;QAEjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAE7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QACnD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAY,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAoC,CAAA;QACrE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,QAAQ,gBAAgB,IAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QAExD,2CAA2C;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAEzD,mDAAmD;QACnD,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,mEAAmE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAA;QACvJ,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,QAAQ,gBAAgB,IAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QACjF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QACzF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAErK,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,QAAQ,gBAAgB,IAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,QAAQ,gBAAgB,IAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,WAAW,GAAG,MAAM,CAAA;QAC1B,MAAM,GAAG,EAAE,CAAA;QACX,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,MAAM,CAAA;QACxB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAY,CAAA;QAExE,MAAM,GAAG,WAAW,CAAA;QACpB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC1E,MAAM,GAAG,SAAS,CAAA;QAClB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACxD,MAAM,GAAG,WAAW,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,WAAW,GAAG,MAAM,CAAA;QAC1B,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,OAA2B;YAC5D,MAAM,GAAG,WAAW,CAAA;YACpB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;YAChF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;YAC7D,MAAM,GAAG,EAAE,CAAA;YACX,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAC5F,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACnG,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAY,EAAE,MAAM,EAAE,CAAA;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACtC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QACrB,MAAM,eAAe,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAY,CAAA;QAEjG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;QACnB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,KAAK,CAAC,EAAE,gBAAgB,eAAe,EAAE,CAAC,CAAA;QAC1F,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QAExD,MAAM,GAAG,WAAW,CAAA;QACpB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,KAAK,CAAC,EAAE,gBAAgB,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACtG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAA;QACvF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;QACrG,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QACrB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;QAChF,MAAM,GAAG,WAAW,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/gateway/errors.d.ts

@@ -0,0 +1,3 @@
+/** The message of a thrown value, for logs and error answers. */
+export declare function errorMessage(error: unknown): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/gateway/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/gateway/errors.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD"}

package/dist/gateway/errors.js

@@ -0,0 +1,5 @@
+/** The message of a thrown value, for logs and error answers. */
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=errors.js.map

package/dist/gateway/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/gateway/errors.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC"}

package/dist/gateway/exposure.d.ts

@@ -0,0 +1,33 @@
+import type { GatewayExposure } from './console-api/types.js';
+/** What the host looks like; read once at start-up, injectable for tests. */
+export interface HostFacts {
+    platform: NodeJS.Platform;
+    /** systemd is the init system (a typical Linux server). */
+    systemd: boolean;
+    /** Inside a container (Docker, Podman, Kubernetes). */
+    container: boolean;
+}
+export declare function detectHostFacts(env?: NodeJS.ProcessEnv, exists?: (path: string) => boolean): HostFacts;
+export type AddressScope = 'loopback' | 'any' | 'private' | 'public' | 'name';
+/** How far an address or hostname reaches: this machine, every interface, a private network, or the internet. */
+export declare function addressScope(host: string | null | undefined): AddressScope;
+/** macOS or Windows, or a Linux box without systemd outside a container: probably someone's own computer. */
+export declare function isPersonalComputer(host: HostFacts): boolean;
+/**
+ * Who can reach this gateway, judged only from its own configuration (no
+ * outbound probes): `public` when it has a public URL (a domain or a
+ * tunnel), `lan` when it listens beyond loopback without one, `local` when
+ * only this machine can reach it.
+ */
+export declare function detectExposure(input: {
+    publicUrl: string | null;
+    listenHost: string | null;
+    host: HostFacts;
+}): GatewayExposure;
+/**
+ * One line for start-up when wallet keys sit in the data dir unencrypted;
+ * null when every stored key is encrypted. `passphraseSet` says whether
+ * ANTSEED_PASSPHRASE (or its file) is configured, which changes the advice.
+ */
+export declare function unencryptedWalletWarning(dataDir: string, passphraseSet: boolean): Promise<string | null>;
+//# sourceMappingURL=exposure.d.ts.map

package/dist/gateway/exposure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposure.d.ts","sourceRoot":"","sources":["../../src/gateway/exposure.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IACzB,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAChB,uDAAuD;IACvD,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAAG,SAAS,CAM/H;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;AAY7E,iHAAiH;AACjH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAgB1E;AAED,6GAA6G;AAC7G,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAG3D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,eAAe,CA4D/H;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAU9G"}

package/dist/gateway/exposure.js

@@ -0,0 +1,146 @@
+import { existsSync } from 'node:fs';
+import { isIP } from 'node:net';
+import { PASSPHRASE_ENV } from '@antseed/node';
+import { storedWalletKeys } from '../buyer-identities/store.js';
+export function detectHostFacts(env = process.env, exists = existsSync) {
+    return {
+        platform: process.platform,
+        systemd: exists('/run/systemd/system') || Boolean(env['INVOCATION_ID']),
+        container: exists('/.dockerenv') || exists('/run/.containerenv') || Boolean(env['KUBERNETES_SERVICE_HOST']),
+    };
+}
+function ipv4Scope(ip) {
+    const [a = 0, b = 0] = ip.split('.').map(Number);
+    if (a === 127)
+        return 'loopback';
+    if (a === 0)
+        return 'any';
+    if (a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254))
+        return 'private';
+    // 100.64.0.0/10: carrier-grade NAT, and the range Tailscale hands out.
+    if (a === 100 && b >= 64 && b <= 127)
+        return 'private';
+    return 'public';
+}
+/** How far an address or hostname reaches: this machine, every interface, a private network, or the internet. */
+export function addressScope(host) {
+    const value = (host ?? '').trim().toLowerCase().replace(/^\[|\]$/g, '');
+    if (value === '' || value === '::' || value === '0.0.0.0' || value === '*')
+        return 'any';
+    if (value === 'localhost' || value.endsWith('.localhost'))
+        return 'loopback';
+    const family = isIP(value);
+    if (family === 4)
+        return ipv4Scope(value);
+    if (family === 6) {
+        if (value === '::1')
+            return 'loopback';
+        const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(value);
+        if (mapped)
+            return ipv4Scope(mapped[1]);
+        if (/^f[cd]/.test(value) || /^fe[89ab]/.test(value))
+            return 'private';
+        return 'public';
+    }
+    // Single-label and local-only names never resolve on the internet.
+    if (!value.includes('.') || /\.(local|lan|internal|home\.arpa|localdomain)$/.test(value))
+        return 'private';
+    return 'name';
+}
+/** macOS or Windows, or a Linux box without systemd outside a container: probably someone's own computer. */
+export function isPersonalComputer(host) {
+    if (host.platform === 'darwin' || host.platform === 'win32')
+        return true;
+    return !host.systemd && !host.container;
+}
+/**
+ * Who can reach this gateway, judged only from its own configuration (no
+ * outbound probes): `public` when it has a public URL (a domain or a
+ * tunnel), `lan` when it listens beyond loopback without one, `local` when
+ * only this machine can reach it.
+ */
+export function detectExposure(input) {
+    const { listenHost, host } = input;
+    const reasons = [];
+    const personalComputer = isPersonalComputer(host);
+    let publicUrl = input.publicUrl;
+    let mode;
+    let reachableFromInternet;
+    let urlScope = null;
+    if (publicUrl) {
+        try {
+            urlScope = addressScope(new URL(publicUrl).hostname);
+        }
+        catch {
+            urlScope = null;
+        }
+    }
+    if (publicUrl && urlScope === 'loopback') {
+        reasons.push(`The public URL ${publicUrl} points at this computer.`);
+        publicUrl = null;
+    }
+    if (publicUrl && urlScope === 'private') {
+        mode = 'lan';
+        reachableFromInternet = false;
+        reasons.push(`The console is served at ${publicUrl}, a private-network address.`);
+    }
+    else if (publicUrl) {
+        mode = 'public';
+        reachableFromInternet = true;
+        reasons.push(`The console is served at ${publicUrl}.`);
+        if (publicUrl.startsWith('http://'))
+            reasons.push('The public URL is plain HTTP: API keys cross the network unencrypted.');
+    }
+    else {
+        const scope = addressScope(listenHost);
+        if (scope === 'loopback') {
+            mode = 'local';
+            reachableFromInternet = false;
+            reasons.push(`The gateway listens on ${listenHost ?? '127.0.0.1'}, so only this computer can reach it.`);
+        }
+        else {
+            mode = 'lan';
+            if (scope === 'any') {
+                reachableFromInternet = null;
+                reasons.push('The gateway listens on every network interface: other machines on your network can reach it over plain HTTP.');
+            }
+            else if (scope === 'public') {
+                reachableFromInternet = true;
+                reasons.push(`The gateway listens on the public address ${listenHost} over plain HTTP: API keys cross the internet unencrypted.`);
+            }
+            else if (scope === 'private') {
+                reachableFromInternet = false;
+                reasons.push(`The gateway listens on the private address ${listenHost}: only your network can reach it.`);
+            }
+            else {
+                reachableFromInternet = null;
+                reasons.push(`The gateway listens on ${listenHost} over plain HTTP.`);
+            }
+            reasons.push('No public URL is set (--public-url, a domain or a tunnel).');
+        }
+    }
+    if (personalComputer) {
+        const where = host.platform === 'darwin' ? 'macOS' : host.platform === 'win32' ? 'Windows' : 'a machine without a service manager';
+        reasons.push(`It runs on ${where}: keys work only while this computer is on, awake and online.`);
+    }
+    return { mode, publicUrl, listenHost: listenHost ?? null, reachableFromInternet, personalComputer, reasons };
+}
+/**
+ * One line for start-up when wallet keys sit in the data dir unencrypted;
+ * null when every stored key is encrypted. `passphraseSet` says whether
+ * ANTSEED_PASSPHRASE (or its file) is configured, which changes the advice.
+ */
+export async function unencryptedWalletWarning(dataDir, passphraseSet) {
+    const plaintext = [];
+    for (const key of await storedWalletKeys(dataDir)) {
+        if (await key.store.format().catch(() => null) === 'plaintext')
+            plaintext.push(key.name);
+    }
+    if (plaintext.length === 0)
+        return null;
+    const fix = passphraseSet
+        ? 'run `antseed buyer identity protect --all`'
+        : `set ${PASSPHRASE_ENV} and run \`antseed buyer identity protect --all\``;
+    return `Wallet keys are stored unencrypted (${plaintext.join(', ')}); to encrypt them at rest, ${fix}.`;
+}
+//# sourceMappingURL=exposure.js.map

package/dist/gateway/exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposure.js","sourceRoot":"","sources":["../../src/gateway/exposure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAY/D,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,SAAoC,UAAU;IAClH,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,MAAM,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACvE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;KAC5G,CAAA;AACH,CAAC;AAID,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChD,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,UAAU,CAAA;IAChC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACzB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3H,uEAAuE;IACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,SAAS,CAAA;IACtD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACvE,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACxF,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,UAAU,CAAA;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;IACzC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,UAAU,CAAA;QACtC,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,MAAM;YAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;QACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QACrE,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,mEAAmE;IACnE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1G,OAAO,MAAM,CAAA;AACf,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACxE,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAA;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAA+E;IAC5G,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IAClC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IAC/B,IAAI,IAA6B,CAAA;IACjC,IAAI,qBAAqC,CAAA;IAEzC,IAAI,QAAQ,GAAwB,IAAI,CAAA;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAA;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,kBAAkB,SAAS,2BAA2B,CAAC,CAAA;QACpE,SAAS,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,IAAI,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,CAAA;QACZ,qBAAqB,GAAG,KAAK,CAAA;QAC7B,OAAO,CAAC,IAAI,CAAC,4BAA4B,SAAS,8BAA8B,CAAC,CAAA;IACnF,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,IAAI,GAAG,QAAQ,CAAA;QACf,qBAAqB,GAAG,IAAI,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,4BAA4B,SAAS,GAAG,CAAC,CAAA;QACtD,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAA;IAC5H,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QACtC,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,IAAI,GAAG,OAAO,CAAA;YACd,qBAAqB,GAAG,KAAK,CAAA;YAC7B,OAAO,CAAC,IAAI,CAAC,0BAA0B,UAAU,IAAI,WAAW,uCAAuC,CAAC,CAAA;QAC1G,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,KAAK,CAAA;YACZ,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,qBAAqB,GAAG,IAAI,CAAA;gBAC5B,OAAO,CAAC,IAAI,CAAC,8GAA8G,CAAC,CAAA;YAC9H,CAAC;iBAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,qBAAqB,GAAG,IAAI,CAAA;gBAC5B,OAAO,CAAC,IAAI,CAAC,6CAA6C,UAAU,4DAA4D,CAAC,CAAA;YACnI,CAAC;iBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,qBAAqB,GAAG,KAAK,CAAA;gBAC7B,OAAO,CAAC,IAAI,CAAC,8CAA8C,UAAU,mCAAmC,CAAC,CAAA;YAC3G,CAAC;iBAAM,CAAC;gBACN,qBAAqB,GAAG,IAAI,CAAA;gBAC5B,OAAO,CAAC,IAAI,CAAC,0BAA0B,UAAU,mBAAmB,CAAC,CAAA;YACvE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAA;QAClI,OAAO,CAAC,IAAI,CAAC,cAAc,KAAK,+DAA+D,CAAC,CAAA;IAClG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,IAAI,IAAI,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAA;AAC9G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAe,EAAE,aAAsB;IACpF,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,GAAG,GAAG,aAAa;QACvB,CAAC,CAAC,4CAA4C;QAC9C,CAAC,CAAC,OAAO,cAAc,mDAAmD,CAAA;IAC5E,OAAO,uCAAuC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,GAAG,GAAG,CAAA;AACzG,CAAC"}

package/dist/gateway/exposure.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=exposure.test.d.ts.map

package/dist/gateway/exposure.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposure.test.d.ts","sourceRoot":"","sources":["../../src/gateway/exposure.test.ts"],"names":[],"mappings":""}

package/dist/gateway/exposure.test.js

@@ -0,0 +1,93 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import { FileIdentityStore } from '@antseed/node';
+import { addressScope, detectExposure, detectHostFacts, isPersonalComputer, unencryptedWalletWarning } from './exposure.js';
+const SERVER = { platform: 'linux', systemd: true, container: false };
+const MAC = { platform: 'darwin', systemd: false, container: false };
+test('addressScope classifies loopback, wildcard, private and public addresses', () => {
+    for (const host of ['127.0.0.1', '127.1.2.3', 'localhost', 'app.localhost', '::1', '[::1]', '::ffff:127.0.0.1'])
+        assert.equal(addressScope(host), 'loopback', host);
+    for (const host of ['0.0.0.0', '::', '', null, undefined])
+        assert.equal(addressScope(host), 'any', String(host));
+    for (const host of ['10.0.0.5', '172.16.1.1', '172.31.255.1', '192.168.1.20', '169.254.1.1', '100.100.1.1', 'fd12::1', 'fe80::1', 'nas', 'box.local', 'gw.lan', 'gw.home.arpa']) {
+        assert.equal(addressScope(host), 'private', host);
+    }
+    for (const host of ['203.0.113.7', '172.32.0.1', '100.128.0.1', '2001:db8::1'])
+        assert.equal(addressScope(host), 'public', host);
+    assert.equal(addressScope('llm.example.com'), 'name');
+});
+test('a laptop gateway on loopback without a public URL is local', () => {
+    const exposure = detectExposure({ publicUrl: null, listenHost: '127.0.0.1', host: MAC });
+    assert.equal(exposure.mode, 'local');
+    assert.equal(exposure.reachableFromInternet, false);
+    assert.equal(exposure.personalComputer, true);
+    assert.equal(exposure.listenHost, '127.0.0.1');
+    assert.ok(exposure.reasons.some((reason) => reason.includes('only this computer')));
+    assert.ok(exposure.reasons.some((reason) => reason.includes('macOS')));
+});
+test('listening beyond loopback without a public URL is lan', () => {
+    const any = detectExposure({ publicUrl: null, listenHost: '0.0.0.0', host: SERVER });
+    assert.equal(any.mode, 'lan');
+    assert.equal(any.reachableFromInternet, null);
+    assert.equal(any.personalComputer, false);
+    const privateIp = detectExposure({ publicUrl: null, listenHost: '192.168.1.20', host: SERVER });
+    assert.equal(privateIp.mode, 'lan');
+    assert.equal(privateIp.reachableFromInternet, false);
+    const publicIp = detectExposure({ publicUrl: null, listenHost: '203.0.113.7', host: SERVER });
+    assert.equal(publicIp.mode, 'lan');
+    assert.equal(publicIp.reachableFromInternet, true);
+    assert.ok(publicIp.reasons.some((reason) => reason.includes('unencrypted')));
+});
+test('a public URL makes it public, unless it points at this machine or a private network', () => {
+    const server = detectExposure({ publicUrl: 'https://llm.example.com', listenHost: '127.0.0.1', host: SERVER });
+    assert.equal(server.mode, 'public');
+    assert.equal(server.reachableFromInternet, true);
+    assert.equal(server.publicUrl, 'https://llm.example.com');
+    assert.equal(server.personalComputer, false);
+    const tunnelOnLaptop = detectExposure({ publicUrl: 'https://quick.trycloudflare.com', listenHost: '127.0.0.1', host: MAC });
+    assert.equal(tunnelOnLaptop.mode, 'public');
+    assert.equal(tunnelOnLaptop.personalComputer, true, 'still flagged as a personal computer');
+    const plain = detectExposure({ publicUrl: 'http://llm.example.com', listenHost: '127.0.0.1', host: SERVER });
+    assert.ok(plain.reasons.some((reason) => reason.includes('plain HTTP')));
+    const localhostUrl = detectExposure({ publicUrl: 'http://localhost:8379', listenHost: '127.0.0.1', host: MAC });
+    assert.equal(localhostUrl.mode, 'local');
+    assert.equal(localhostUrl.publicUrl, null);
+    const lanUrl = detectExposure({ publicUrl: 'http://192.168.1.20:8379', listenHost: '0.0.0.0', host: SERVER });
+    assert.equal(lanUrl.mode, 'lan');
+    assert.equal(lanUrl.reachableFromInternet, false);
+});
+test('personal computer hint: macOS and Windows always, Linux without systemd outside containers', () => {
+    assert.equal(isPersonalComputer({ platform: 'win32', systemd: false, container: false }), true);
+    assert.equal(isPersonalComputer({ platform: 'darwin', systemd: false, container: true }), true);
+    assert.equal(isPersonalComputer({ platform: 'linux', systemd: false, container: false }), true);
+    assert.equal(isPersonalComputer({ platform: 'linux', systemd: false, container: true }), false);
+    assert.equal(isPersonalComputer(SERVER), false);
+});
+test('detectHostFacts reads systemd and container markers without network calls', () => {
+    const files = new Set(['/run/systemd/system']);
+    assert.deepEqual({ ...detectHostFacts({}, (path) => files.has(path)), platform: 'x' }, { platform: 'x', systemd: true, container: false });
+    assert.equal(detectHostFacts({ INVOCATION_ID: 'abc' }, () => false).systemd, true);
+    assert.equal(detectHostFacts({}, (path) => path === '/.dockerenv').container, true);
+    assert.equal(detectHostFacts({ KUBERNETES_SERVICE_HOST: '10.0.0.1' }, () => false).container, true);
+});
+test('start-up warns about wallet keys stored unencrypted, and stops once they are encrypted', async () => {
+    const dataDir = mkdtempSync(join(tmpdir(), 'antseed-wallet-warning-'));
+    try {
+        assert.equal(await unencryptedWalletWarning(dataDir, false), null, 'no keys, nothing to warn about');
+        writeFileSync(join(dataDir, 'identity.key'), '12'.repeat(32), { mode: 0o600 });
+        await new FileIdentityStore(join(dataDir, 'buyer-identities', 'team-a'), { passphrase: null }).save('34'.repeat(32));
+        const warning = await unencryptedWalletWarning(dataDir, false);
+        assert.match(warning ?? '', /stored unencrypted \(default, team-a\).*set ANTSEED_PASSPHRASE/);
+        assert.doesNotMatch(await unencryptedWalletWarning(dataDir, true) ?? '', /set ANTSEED_PASSPHRASE/);
+        for (const dir of [dataDir, join(dataDir, 'buyer-identities', 'team-a')])
+            await new FileIdentityStore(dir, { passphrase: 'correct horse' }).protect();
+        assert.equal(await unencryptedWalletWarning(dataDir, false), null);
+    }
+    finally {
+        rmSync(dataDir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=exposure.test.js.map

package/dist/gateway/exposure.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposure.test.js","sourceRoot":"","sources":["../../src/gateway/exposure.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,wBAAwB,EAAkB,MAAM,eAAe,CAAA;AAE3I,MAAM,MAAM,GAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AAChF,MAAM,GAAG,GAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AAE/E,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IACnK,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAChH,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;QAChL,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IAChI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAA;AACvD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IACxF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACpC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;IACnD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC9C,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAA;IACnF,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACxE,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACpF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;IAEzC,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/F,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACnC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;IAEpD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAClC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;IAClD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;AAC9E,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACnC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;IAChD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;IAE5C,MAAM,cAAc,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,iCAAiC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3H,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,EAAE,IAAI,EAAE,sCAAsC,CAAC,CAAA;IAE3F,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5G,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAExE,MAAM,YAAY,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/G,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACxC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAE1C,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;AACnD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,4FAA4F,EAAE,GAAG,EAAE;IACtG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IAC/F,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAA;AACjD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAC9C,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1I,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAClF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACnF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,uBAAuB,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;AACrG,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;IACxG,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAA;QACpG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QACpH,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,gEAAgE,CAAC,CAAA;QAC7F,MAAM,CAAC,YAAY,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAElG,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;QACrJ,MAAM,CAAC,KAAK,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;IACpE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC;AACH,CAAC,CAAC,CAAA"}

package/dist/gateway/gateway-policy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gateway-policy.test.d.ts.map

package/dist/gateway/gateway-policy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-policy.test.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway-policy.test.ts"],"names":[],"mappings":""}