@jingyi0605/codingns4dsh 0.2.1-beta.11 → 0.2.1-beta.13

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.js

@@ -0,0 +1,164 @@
+import { randomBytes, X509Certificate } from 'node:crypto';
+import { isAbsolute } from 'node:path';
+import { isIP } from 'node:net';
+import { createServer } from 'node:https';
+import { QUICK_APP_LIMITS } from '../../shared/contracts/quick-apps.js';
+import { endQuickAppResponse as end, quickAppCredentials } from './quick-app-credentials.js';
+const cookieName = '__Host-quickapp';
+const unavailable = () => Object.assign(new Error('Quick Apps HTTPS configuration is unavailable or invalid.'), { code: 'QUICK_APP_ORIGIN_UNAVAILABLE' });
+export function parseQuickAppHttpsConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw unavailable();
+    const config = value;
+    const keys = ['appDomain', 'uiOrigins', 'listenHost', 'listenPort', 'publicPort', 'certFile', 'keyFile'];
+    if (Object.keys(config).some(key => !keys.includes(key)) || typeof config.appDomain !== 'string'
+        || config.appDomain.length > 190 || !/^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/u.test(config.appDomain)
+        || config.appDomain.split('.').some(label => label.length > 63)
+        || config.appDomain === 'localhost' || config.appDomain.endsWith('.localhost') || isIP(config.appDomain)
+        || !isIP(config.listenHost) || ![config.listenPort, config.publicPort].every(port => Number.isInteger(port) && port > 0 && port < 65536)
+        || ![config.certFile, config.keyFile].every(path => typeof path === 'string' && isAbsolute(path))
+        || !Array.isArray(config.uiOrigins) || config.uiOrigins.length < 1 || config.uiOrigins.length > 16)
+        throw unavailable();
+    for (const origin of config.uiOrigins) {
+        let ui;
+        try {
+            ui = new URL(origin);
+        }
+        catch {
+            throw unavailable();
+        }
+        if (ui.origin !== origin || !['http:', 'https:'].includes(ui.protocol) || ui.username || ui.password
+            || ui.hostname === config.appDomain || ui.hostname.endsWith(`.${config.appDomain}`)
+            // Conservatively reject even sibling sites under a multi-label public suffix.
+            // Different final two DNS labels ensure UI Domain cookies cannot reach app pages.
+            || ui.hostname.split('.').slice(-2).join('.') === config.appDomain.split('.').slice(-2).join('.'))
+            throw unavailable();
+    }
+    return structuredClone(config);
+}
+/** No listener is started until an authenticated user opens an HTML app. */
+export async function configuredQuickAppHttpsProvider(configPath = process.env.CODINGNS_QUICK_APPS_HTTPS_CONFIG) {
+    if (!configPath)
+        return undefined;
+    try {
+        if (!isAbsolute(configPath))
+            throw unavailable();
+        const config = parseQuickAppHttpsConfig(JSON.parse(await boundedFile(configPath, 32 * 1024)));
+        const [cert, key] = await Promise.all([boundedFile(config.certFile, 128 * 1024), boundedFile(config.keyFile, 64 * 1024)]);
+        return new QuickAppHttpsProvider(config, { cert, key });
+    }
+    catch {
+        throw unavailable();
+    }
+}
+export async function boundedFile(path, limit) {
+    const { open } = await import('node:fs/promises');
+    const file = await open(path, 'r');
+    try {
+        if (!(await file.stat()).isFile())
+            throw unavailable();
+        const bytes = Buffer.alloc(limit + 1);
+        const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+        if (bytesRead > limit)
+            throw unavailable();
+        return bytes.subarray(0, bytesRead).toString('utf8');
+    }
+    finally {
+        await file.close();
+    }
+}
+/** Dedicated TLS virtual-host listener. It never serves or proxies privileged DSH routes. */
+export class QuickAppHttpsProvider {
+    config;
+    tls;
+    routes = new Map();
+    server;
+    pending = Promise.resolve();
+    stopped = false;
+    constructor(config, tls) {
+        this.config = config;
+        this.tls = tls;
+        parseQuickAppHttpsConfig(config);
+        const certificate = new X509Certificate(tls.cert);
+        if (!certificate.checkHost(`probe.${config.appDomain}`) || Date.parse(certificate.validTo) <= Date.now()
+            || Date.parse(certificate.validFrom) > Date.now())
+            throw unavailable();
+        // Validate the key pair before reporting the configured transport as available.
+        const probe = createServer({ ...tls, minVersion: 'TLSv1.2' });
+        probe.close();
+    }
+    available(uiOrigin) { return !this.stopped && typeof uiOrigin === 'string' && this.config.uiOrigins.includes(uiOrigin); }
+    open(handler, uiOrigin) {
+        return this.serialize(async () => {
+            if (!this.available(uiOrigin) || this.routes.size >= QUICK_APP_LIMITS.launches)
+                throw unavailable();
+            await this.listen();
+            // Random names are never reused, including across Host/module restarts.
+            const hostname = `${randomBytes(24).toString('hex')}.${this.config.appDomain}`;
+            const origin = `https://${hostname}${this.config.publicPort === 443 ? '' : `:${this.config.publicPort}`}`;
+            const host = new URL(origin).host;
+            const credentials = quickAppCredentials(origin, uiOrigin, cookieName);
+            const route = { host, handle: async (request, response) => {
+                    if (!await credentials.handle(request, response))
+                        handler(request, response);
+                } };
+            this.routes.set(hostname, route);
+            return {
+                origin, uiOrigin: uiOrigin, ownerHostId: 'local', remote: true, cookieName,
+                activate: credentials.activate,
+                dispose: () => this.serialize(async () => {
+                    credentials.dispose();
+                    this.routes.delete(hostname);
+                    if (this.routes.size === 0)
+                        await this.closeListener();
+                }),
+            };
+        });
+    }
+    dispose() {
+        this.stopped = true;
+        return this.serialize(async () => { this.routes.clear(); await this.closeListener(); });
+    }
+    async listen() {
+        if (this.server)
+            return;
+        const server = createServer({ ...this.tls, minVersion: 'TLSv1.2', handshakeTimeout: 10_000, maxHeaderSize: 16 * 1024 }, (request, response) => {
+            response.setHeader('Cache-Control', 'no-store');
+            response.setHeader('Referrer-Policy', 'no-referrer');
+            response.setHeader('X-Content-Type-Options', 'nosniff');
+            const sni = request.socket.servername;
+            const route = typeof sni === 'string' ? this.routes.get(sni) : undefined;
+            // Never trust forwarded Host/Origin headers; TLS terminates at this listener.
+            if (!route || request.headers.host !== route.host || request.rawHeaders.filter((_, i) => i % 2 === 0 && request.rawHeaders[i].toLowerCase() === 'host').length !== 1)
+                return end(response, 421);
+            void route.handle(request, response).catch(() => end(response, 400));
+        });
+        server.requestTimeout = 15_000;
+        server.headersTimeout = 10_000;
+        server.timeout = 30_000;
+        server.keepAliveTimeout = 5_000;
+        server.maxRequestsPerSocket = 100;
+        server.maxConnections = 256;
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(this.config.listenPort, this.config.listenHost, () => { server.removeListener('error', reject); resolve(); });
+        }).catch(() => { server.close(); throw unavailable(); });
+        // Listener failures must not take down unrelated Host modules.
+        server.on('error', () => { void this.dispose(); });
+        this.server = server;
+    }
+    async closeListener() {
+        const server = this.server;
+        this.server = undefined;
+        if (!server)
+            return;
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+    serialize(operation) {
+        const result = this.pending.catch(() => undefined).then(operation);
+        this.pending = result.then(() => undefined, () => undefined);
+        return result;
+    }
+}
+//# sourceMappingURL=quick-app-https-provider.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-https-provider.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-https-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAItD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,IAAI,GAAG,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAa5F,MAAM,UAAU,GAAG,iBAAiB,CAAA;AACpC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAA;AAEzJ,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,EAAE,CAAA;IACpF,MAAM,MAAM,GAAG,KAA4B,CAAA;IAC3C,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;IACxG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;WAC3F,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;WAC7G,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;WAC5D,MAAM,CAAC,SAAS,KAAK,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;WACrG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC;WACrI,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;WAC9F,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,WAAW,EAAE,CAAA;IACzH,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,EAAO,CAAA;QACX,IAAI,CAAC;YAAC,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,WAAW,EAAE,CAAA;QAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ;eAC/F,EAAE,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnF,8EAA8E;YAC9E,kFAAkF;eAC/E,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,WAAW,EAAE,CAAA;IAC1H,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC;IAC7G,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,WAAW,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7F,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACzH,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,WAAW,EAAE,CAAA;IAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,WAAW,EAAE,CAAA;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAChE,IAAI,SAAS,GAAG,KAAK;YAAE,MAAM,WAAW,EAAE,CAAA;QAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAClC,CAAC;AAID,6FAA6F;AAC7F,MAAM,OAAO,qBAAqB;IAKH;IAA8C;IAJ1D,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAA;IAC1C,MAAM,CAAoB;IAC1B,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1C,OAAO,GAAG,KAAK,CAAA;IACvB,YAA6B,MAA2B,EAAmB,GAAkC;QAAhF,WAAM,GAAN,MAAM,CAAqB;QAAmB,QAAG,GAAH,GAAG,CAA+B;QAC3G,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;eACnG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,WAAW,EAAE,CAAA;QACxE,gFAAgF;QAChF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,KAAK,EAAE,CAAA;IACf,CAAC;IACD,SAAS,CAAC,QAAiB,IAAa,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAC;IAC1I,IAAI,CAAC,OAAqE,EAAE,QAAiB;QAC3F,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ;gBAAE,MAAM,WAAW,EAAE,CAAA;YACnG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;YACnB,wEAAwE;YACxE,MAAM,QAAQ,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9E,MAAM,MAAM,GAAG,WAAW,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAA;YACzG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;YACjC,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAS,EAAE,UAAU,CAAC,CAAA;YACtE,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;oBAC/D,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;wBAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;gBAC9E,CAAC,EAAE,CAAA;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAChC,OAAO;gBACL,MAAM,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;gBAC3E,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;oBACvC,WAAW,CAAC,OAAO,EAAE,CAAA;oBACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;oBAC5B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;wBAAE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;gBACxD,CAAC,CAAC;aACH,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC;IACO,KAAK,CAAC,MAAM;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAM;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAC5I,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;YAC/C,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAA;YACpD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;YACvD,MAAM,GAAG,GAAI,OAAO,CAAC,MAAoB,CAAC,UAAU,CAAA;YACpD,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACxE,8EAA8E;YAC9E,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YAChM,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAA;QACvF,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAAC,MAAM,CAAC,oBAAoB,GAAG,GAAG,CAAC;QAAC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAA;QAC/F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5H,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,WAAW,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACvD,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IACO,KAAK,CAAC,aAAa;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;QACnD,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,CAAC,mBAAmB,EAAE,CAAA;QAC5B,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACnE,CAAC;IACO,SAAS,CAAI,SAA2B;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.d.ts

@@ -0,0 +1,44 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type QuickAppRuntimeReason } from '../../shared/contracts/quick-apps.js';
+import type { QuickAppLanTransport, QuickAppOriginLease, QuickAppOriginProvider } from './quick-app-origin-adapter.js';
+export interface QuickAppLanPortsConfig {
+    readonly transport: 'lan-ports';
+    readonly publicHost: string;
+    readonly uiOrigins: readonly string[];
+    readonly ports: readonly [number, number];
+    readonly stateDirectory: string;
+    readonly certFile: string;
+    readonly keyFile: string;
+}
+export declare function parseQuickAppLanPortsConfig(value: unknown): QuickAppLanPortsConfig;
+/** Browsers cannot forge these headers; they are an origin fence, never authentication. */
+export declare function sameBrowserOrigin(headers: Record<string, string | string[] | undefined>, origin: string): boolean;
+/** Dedicated app HTTPS ports on the existing LAN bind address; no DSH forwarding. */
+export declare class QuickAppLanPortsProvider implements QuickAppOriginProvider, QuickAppLanTransport {
+    private readonly tls;
+    readonly isolation: "lan-port";
+    private listenHost;
+    private stopped;
+    private pending;
+    private readonly active;
+    private readonly reserved;
+    private allocationFailure;
+    private generation;
+    private readonly config;
+    constructor(config: QuickAppLanPortsConfig, tls: {
+        cert: string;
+        key: string;
+    });
+    /** Read persistent reservations before availability is advertised. Never delete this history. */
+    initialize(): Promise<void>;
+    started(listenHost: string): void;
+    stopping(): Promise<void>;
+    dispose(): Promise<void>;
+    available(uiOrigin?: string): boolean;
+    protects(uiOrigin?: string): boolean;
+    diagnostic(uiOrigin?: string): QuickAppRuntimeReason | undefined;
+    permits(headers: Record<string, string>, method: string, path: string): boolean;
+    open(handler: (request: IncomingMessage, response: ServerResponse) => void, uiOrigin?: string): Promise<QuickAppOriginLease>;
+    private allocate;
+}
+//# sourceMappingURL=quick-app-lan-ports.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-lan-ports.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-lan-ports.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAgD,KAAK,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAC/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAGtH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAiBlF;AAUD,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOjH;AAMD,qFAAqF;AACrF,qBAAa,wBAAyB,YAAW,sBAAsB,EAAE,oBAAoB;IAW/C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVhE,QAAQ,CAAC,SAAS,EAAG,UAAU,CAAS;IACxC,OAAO,CAAC,UAAU,CAAoB;IACtC,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,iBAAiB,CAAmC;IAC5D,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEnC,MAAM,EAAE,sBAAsB,EAAmB,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAS/F,iGAAiG;IAC3F,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAC3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAKzB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAC9B,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACpC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAQhE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAe/E,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAM9G,QAAQ;CA2DvB"}

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.js

@@ -0,0 +1,240 @@
+import { randomBytes, X509Certificate } from 'node:crypto';
+import { mkdir, readdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:https';
+import { isIP } from 'node:net';
+import { isAbsolute, join } from 'node:path';
+import { QUICK_APP_LIMITS, quickAppTransportErrorCode } from '../../shared/contracts/quick-apps.js';
+import { endQuickAppResponse, quickAppCredentials } from './quick-app-credentials.js';
+export function parseQuickAppLanPortsConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw unavailable('config-invalid');
+    const c = value;
+    if (Object.keys(c).some(key => !['transport', 'publicHost', 'uiOrigins', 'ports', 'stateDirectory', 'certFile', 'keyFile'].includes(key))
+        || c.transport !== 'lan-ports' || typeof c.publicHost !== 'string' || c.publicHost.length > 253
+        || !validHost(c.publicHost) || !Array.isArray(c.ports) || c.ports.length !== 2
+        || !c.ports.every(port => Number.isInteger(port) && port >= 1024 && port <= 65535)
+        || c.ports[0] > c.ports[1] || c.ports[1] - c.ports[0] >= 16384
+        || ![c.stateDirectory, c.certFile, c.keyFile].every(path => typeof path === 'string' && isAbsolute(path))
+        || !Array.isArray(c.uiOrigins) || c.uiOrigins.length < 1 || c.uiOrigins.length > 16)
+        throw unavailable('config-invalid');
+    for (const origin of c.uiOrigins) {
+        let url;
+        try {
+            url = new URL(origin);
+        }
+        catch {
+            throw unavailable('config-invalid');
+        }
+        if (url.origin !== origin || url.protocol !== 'https:' || url.username || url.password || !validHost(url.hostname)
+            || url.hostname === c.publicHost && Number(url.port || 443) >= c.ports[0] && Number(url.port || 443) <= c.ports[1])
+            throw unavailable('config-invalid');
+    }
+    return structuredClone(c);
+}
+function validHost(host) {
+    try {
+        if (new URL(`https://${host}`).hostname !== host)
+            return false;
+    }
+    catch {
+        return false;
+    }
+    const ip = host.replace(/^\[|\]$/gu, '');
+    if (isIP(ip))
+        return ip !== '0.0.0.0' && ip !== '::' && ip !== '::1' && !/^127\./u.test(ip) && !ip.startsWith('::ffff:');
+    return /^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/u.test(host)
+        && host.split('.').every(label => label.length <= 63) && !host.endsWith('.localhost');
+}
+/** Browsers cannot forge these headers; they are an origin fence, never authentication. */
+export function sameBrowserOrigin(headers, origin) {
+    if (headers.origin !== undefined && headers.origin !== origin)
+        return false;
+    const site = headers['sec-fetch-site'];
+    if (site !== undefined && site !== 'same-origin')
+        return false;
+    if (headers.origin === origin || site === 'same-origin')
+        return true;
+    // A fallback for clients that omit Fetch Metadata. No-referrer clients fail closed.
+    try {
+        return typeof headers.referer === 'string' && new URL(headers.referer).origin === origin;
+    }
+    catch {
+        return false;
+    }
+}
+function unavailable(reason) {
+    return Object.assign(new Error(`Quick Apps transport unavailable: ${reason}.`), { code: quickAppTransportErrorCode(reason), reason });
+}
+/** Dedicated app HTTPS ports on the existing LAN bind address; no DSH forwarding. */
+export class QuickAppLanPortsProvider {
+    tls;
+    isolation = 'lan-port';
+    listenHost;
+    stopped = false;
+    pending = Promise.resolve();
+    active = new Set();
+    reserved = new Set();
+    allocationFailure;
+    generation = 0;
+    config;
+    constructor(config, tls) {
+        this.tls = tls;
+        this.config = parseQuickAppLanPortsConfig(config);
+        const cert = new X509Certificate(tls.cert);
+        const ip = config.publicHost.replace(/^\[|\]$/gu, '');
+        if (!(isIP(ip) ? cert.checkIP(ip) : cert.checkHost(config.publicHost))
+            || Date.parse(cert.validFrom) > Date.now() || Date.parse(cert.validTo) <= Date.now())
+            throw unavailable('config-invalid');
+        const probe = createServer({ ...tls, minVersion: 'TLSv1.2' });
+        probe.close();
+    }
+    /** Read persistent reservations before availability is advertised. Never delete this history. */
+    async initialize() {
+        await mkdir(this.config.stateDirectory, { recursive: true, mode: 0o700 });
+        for (const entry of await readdir(this.config.stateDirectory)) {
+            if (/^\d+\.json$/u.test(entry))
+                this.reserved.add(Number(entry.slice(0, -5)));
+        }
+    }
+    started(listenHost) { this.listenHost = listenHost; this.generation++; this.allocationFailure = undefined; }
+    async stopping() {
+        this.listenHost = undefined;
+        this.generation++;
+        await this.pending.catch(() => undefined);
+        await Promise.all([...this.active].map(dispose => dispose()));
+    }
+    async dispose() { this.stopped = true; await this.stopping(); }
+    available(uiOrigin) { return this.diagnostic(uiOrigin) === undefined; }
+    protects(uiOrigin) { return !this.stopped && Boolean(this.listenHost) && Boolean(uiOrigin && this.config.uiOrigins.includes(uiOrigin)); }
+    diagnostic(uiOrigin) {
+        if (this.stopped || !this.listenHost)
+            return 'lan-stopped';
+        if (!uiOrigin || !this.config.uiOrigins.includes(uiOrigin))
+            return 'ui-not-allowed';
+        if (this.allocationFailure)
+            return this.allocationFailure;
+        for (let port = this.config.ports[0]; port <= this.config.ports[1]; port++)
+            if (!this.reserved.has(port))
+                return undefined;
+        return 'ports-exhausted';
+    }
+    permits(headers, method, path) {
+        if ((method === 'GET' || method === 'HEAD') && path === '/' && !headers.upgrade
+            && headers['sec-fetch-mode'] === 'navigate' && headers['sec-fetch-dest'] === 'document')
+            return true;
+        // App configuration must not become an allowlist for ordinary DSH addresses.
+        // Block only origins owned by this app transport, including retired ports.
+        for (const value of [headers.origin, headers.referer]) {
+            if (value === undefined)
+                continue;
+            try {
+                const url = new URL(value);
+                if (url.hostname === this.config.publicHost && this.reserved.has(Number(url.port || 443)))
+                    return false;
+            }
+            catch {
+                if (value === 'null')
+                    return false;
+            }
+        }
+        return true;
+    }
+    open(handler, uiOrigin) {
+        const operation = this.pending.catch(() => undefined).then(() => this.allocate(handler, uiOrigin));
+        this.pending = operation.then(() => undefined, () => undefined);
+        return operation;
+    }
+    async allocate(handler, uiOrigin) {
+        const reason = this.diagnostic(uiOrigin);
+        if (reason)
+            throw unavailable(reason);
+        if (this.active.size >= QUICK_APP_LIMITS.launches)
+            throw unavailable('ports-busy');
+        const generation = this.generation;
+        let busy = false;
+        for (let port = this.config.ports[0]; port <= this.config.ports[1]; port++) {
+            if (this.reserved.has(port))
+                continue;
+            const origin = `https://${this.config.publicHost}:${port}`;
+            const cookieName = `__Host-quickapp-${randomBytes(16).toString('hex')}`;
+            const credentials = quickAppCredentials(origin, uiOrigin, cookieName);
+            let alive = true;
+            const server = createServer({ ...this.tls, minVersion: 'TLSv1.2', maxHeaderSize: 16 * 1024, handshakeTimeout: 10_000 }, (req, res) => {
+                res.setHeader('Cache-Control', 'no-store');
+                res.setHeader('Referrer-Policy', 'same-origin');
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                const sni = req.socket.servername;
+                if (!alive || generation !== this.generation)
+                    return endQuickAppResponse(res, 410);
+                if (req.headers.host !== new URL(origin).host || sni && sni !== this.config.publicHost
+                    || req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === 'host').length !== 1)
+                    return endQuickAppResponse(res, 421);
+                // Only the one-use landing page accepts cross-origin navigation from the DSH viewer.
+                if (req.url !== '/__quickapp/bootstrap' && !sameBrowserOrigin(req.headers, origin))
+                    return endQuickAppResponse(res, 403);
+                // Browser cookies have no port scope. Strip every cookie except this launch's before
+                // passing the request to the application service; never forward general credentials.
+                const cookies = (req.headers.cookie ?? '').split(';').map(value => value.trim()).filter(value => value.startsWith(`${cookieName}=`));
+                req.headers.cookie = cookies.join('; ');
+                delete req.headers.authorization;
+                req.rawHeaders = req.rawHeaders.flatMap((value, i, headers) => i % 2 || ['cookie', 'authorization'].includes(value.toLowerCase()) ? [] : [value, headers[i + 1]]);
+                if (cookies.length)
+                    req.rawHeaders.push('Cookie', cookies.join('; '));
+                void credentials.handle(req, res).then(handled => { if (!handled && alive)
+                    handler(req, res); }).catch(() => endQuickAppResponse(res, 400));
+            });
+            server.requestTimeout = 15_000;
+            server.headersTimeout = 10_000;
+            server.timeout = 30_000;
+            server.keepAliveTimeout = 5_000;
+            server.maxConnections = 128;
+            server.maxRequestsPerSocket = 100;
+            const dispose = async () => {
+                if (!alive)
+                    return;
+                alive = false;
+                credentials.dispose();
+                this.active.delete(dispose);
+                await close(server);
+            };
+            try {
+                await new Promise((resolve, reject) => {
+                    server.once('error', reject);
+                    server.listen(port, this.listenHost, () => { server.removeListener('error', reject); resolve(); });
+                });
+                server.on('error', () => { void dispose(); });
+                // Atomic create makes independent Host instances sharing this history race safely.
+                await writeFile(join(this.config.stateDirectory, `${port}.json`), JSON.stringify({ origin, allocatedAt: new Date().toISOString() }), { flag: 'wx', mode: 0o600 });
+                this.reserved.add(port);
+                if (this.stopped || generation !== this.generation) {
+                    await dispose();
+                    throw unavailable('lan-stopped');
+                }
+                this.active.add(dispose);
+                return { origin, uiOrigin: uiOrigin, ownerHostId: 'local', remote: true, cookieName, isolation: 'lan-port', activate: credentials.activate, dispose };
+            }
+            catch (error) {
+                await dispose();
+                const code = error.code;
+                if (code === 'EEXIST') {
+                    this.reserved.add(port);
+                    continue;
+                }
+                if (code === 'EADDRINUSE') {
+                    busy = true;
+                    continue;
+                }
+                throw error;
+            }
+        }
+        if (!busy)
+            this.allocationFailure = 'ports-exhausted';
+        throw unavailable(busy ? 'ports-busy' : 'ports-exhausted');
+    }
+}
+async function close(server) {
+    server.closeAllConnections();
+    if (server.listening)
+        await new Promise(resolve => server.close(() => resolve()));
+}
+//# sourceMappingURL=quick-app-lan-ports.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-lan-ports.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-lan-ports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAG5C,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAA8B,MAAM,sCAAsC,CAAA;AAE/H,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAYrF,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;IACpG,MAAM,CAAC,GAAG,KAA+B,CAAA;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WACpI,CAAC,CAAC,SAAS,KAAK,WAAW,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;WAC5F,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;WAC3E,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;WAC/E,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK;WAC3D,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;WACtG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC1H,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,GAAQ,CAAA;QACZ,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;QAAC,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;eAC7G,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC3J,CAAC;IACD,OAAO,eAAe,CAAC,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC7F,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IACxC,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;IACxH,OAAO,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC;WACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACzF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,OAAsD,EAAE,MAAc;IACtG,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,CAAA;IACpE,oFAAoF;IACpF,IAAI,CAAC;QAAC,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,MAAM,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AACzH,CAAC;AAED,SAAS,WAAW,CAAC,MAA6B;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACvI,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,wBAAwB;IAW0B;IAVpD,SAAS,GAAG,UAAmB,CAAA;IAChC,UAAU,CAAoB;IAC9B,OAAO,GAAG,KAAK,CAAA;IACf,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IACjC,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IACvC,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,iBAAiB,CAAmC;IACpD,UAAU,GAAG,CAAC,CAAA;IACL,MAAM,CAAwB;IAE/C,YAAY,MAA8B,EAAmB,GAAkC;QAAlC,QAAG,GAAH,GAAG,CAA+B;QAC7F,IAAI,CAAC,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;eACjE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;QAC3H,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IAC9E,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,UAAU;QACd,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzE,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,UAAkB,IAAU,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAA,CAAC,CAAC;IACzH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAAC,IAAI,CAAC,UAAU,EAAE,CAAA;QAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC/D,CAAC;IACD,KAAK,CAAC,OAAO,KAAoB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA,CAAC,CAAC;IAC7E,SAAS,CAAC,QAAiB,IAAa,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAA,CAAC,CAAC;IACxF,QAAQ,CAAC,QAAiB,IAAa,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA,CAAC,CAAC;IAC1J,UAAU,CAAC,QAAiB;QAC1B,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,aAAa,CAAA;QAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,gBAAgB,CAAA;QACnF,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAA;QACzD,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAA;QAC1H,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IAED,OAAO,CAAC,OAA+B,EAAE,MAAc,EAAE,IAAY;QACnE,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;eAC1E,OAAO,CAAC,gBAAgB,CAAC,KAAK,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,UAAU;YAAE,OAAO,IAAI,CAAA;QACtG,6EAA6E;QAC7E,2EAA2E;QAC3E,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAQ;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAA;YACzG,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,KAAK,KAAK,MAAM;oBAAE,OAAO,KAAK,CAAA;YAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,OAAqE,EAAE,QAAiB;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QAClG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAAqE,EAAE,QAAiB;QAC7G,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,MAAM;YAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ;YAAE,MAAM,WAAW,CAAC,YAAY,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,IAAI,IAAI,GAAG,KAAK,CAAA;QAChB,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACrC,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,CAAA;YAC1D,MAAM,UAAU,GAAG,mBAAmB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;YACvE,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAS,EAAE,UAAU,CAAC,CAAA;YACtE,IAAI,KAAK,GAAG,IAAI,CAAA;YAChB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACnI,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;gBAC/I,MAAM,GAAG,GAAI,GAAG,CAAC,MAAoB,CAAC,UAAU,CAAA;gBAChD,IAAI,CAAC,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;oBAAE,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAClF,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU;uBACjF,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACnJ,qFAAqF;gBACrF,IAAI,GAAG,CAAC,GAAG,KAAK,uBAAuB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;oBAAE,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACxH,qFAAqF;gBACrF,qFAAqF;gBACrF,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;gBACpI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACvC,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;gBAChC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAA;gBAClK,IAAI,OAAO,CAAC,MAAM;oBAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBACrE,KAAK,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK;oBAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;YAC5I,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;YAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;YAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAA;YACvF,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC;YAAC,MAAM,CAAC,oBAAoB,GAAG,GAAG,CAAA;YAC/F,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;gBACzB,IAAI,CAAC,KAAK;oBAAE,OAAM;gBAClB,KAAK,GAAG,KAAK,CAAC;gBAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACjE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAA;YACrB,CAAC,CAAA;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;gBACnG,CAAC,CAAC,CAAA;gBACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;gBAC5C,mFAAmF;gBACnF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACjK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBAAC,MAAM,OAAO,EAAE,CAAC;oBAAC,MAAM,WAAW,CAAC,aAAa,CAAC,CAAA;gBAAC,CAAC;gBACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;YACxJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,EAAE,CAAA;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;gBAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBAC5D,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;oBAAC,IAAI,GAAG,IAAI,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBACpD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QACrD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,CAAC;CACF;AAED,KAAK,UAAU,KAAK,CAAC,MAAc;IACjC,MAAM,CAAC,mBAAmB,EAAE,CAAA;IAC5B,IAAI,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AACzF,CAAC"}

package/data/build/dist/dsh-capabilities/host/quick-app-origin-adapter.d.ts

@@ -0,0 +1,37 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { QuickAppRuntimeReason, QuickAppProxyRequest, QuickAppProxyResponse } from '../../shared/contracts/quick-apps.js';
+/** Internal service supplied by a verified transport composition, never by an RPC payload. */
+export interface QuickAppOriginLease {
+    readonly origin: string;
+    readonly ownerHostId: string;
+    readonly uiOrigin: string;
+    readonly remote: boolean;
+    readonly cookieName: string;
+    /** Supplied only by the LAN adapter with an attached privileged-request guard. */
+    readonly isolation?: 'lan-port' | 'sandbox-proxy';
+    readonly basePath?: string;
+    /** Deliver only this launch's credential through the transport's verified browser channel. */
+    activate(credential: string, entryPath: string): Promise<{
+        readonly url: string;
+    }>;
+    dispose(): Promise<void>;
+}
+export interface QuickAppOriginProvider {
+    readonly isolation?: 'lan-port' | 'sandbox-proxy';
+    open(handler: (request: IncomingMessage, response: ServerResponse) => void, uiOrigin?: string): Promise<QuickAppOriginLease>;
+    available?(uiOrigin?: string): boolean;
+    diagnostic?(uiOrigin?: string): QuickAppRuntimeReason | undefined;
+    requestResource?(basePath: string, request: QuickAppProxyRequest, signal: AbortSignal): Promise<QuickAppProxyResponse>;
+}
+/** LAN lifecycle and request admission stay at the transport boundary. */
+export interface QuickAppLanTransport {
+    started(listenHost: string): void;
+    stopping(): Promise<void>;
+    permits(headers: Record<string, string>, method: string, path: string): boolean;
+    protects(uiOrigin?: string): boolean;
+}
+export declare const QUICK_APP_ORIGIN_UNAVAILABLE = "No verified isolated app origin is available for this connection. DSH path routes and PeerHost relays cannot host executable apps safely.";
+/** A prefix route is deliberately insufficient; the Host must install a dedicated provider. */
+export declare function supportsQuickAppOrigins(provider: unknown): provider is QuickAppOriginProvider;
+export declare function validateQuickAppOrigin(lease: QuickAppOriginLease, ownerHostId: string, occupied: ReadonlySet<string>): void;
+//# sourceMappingURL=quick-app-origin-adapter.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-origin-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-origin-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-origin-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAG9H,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,eAAe,CAAA;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,eAAe,CAAA;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC5H,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACtC,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;IACjE,eAAe,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;CACvH;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrC;AAED,eAAO,MAAM,4BAA4B,8IAA8I,CAAA;AAEvL,+FAA+F;AAC/F,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,IAAI,sBAAsB,CAE7F;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAsB3H"}

package/data/build/dist/dsh-capabilities/host/quick-app-origin-adapter.js

@@ -0,0 +1,35 @@
+import { QUICK_APP_DESKTOP_ORIGIN, quickAppProxyBase } from '../../shared/quick-app-proxy-path.js';
+export const QUICK_APP_ORIGIN_UNAVAILABLE = 'No verified isolated app origin is available for this connection. DSH path routes and PeerHost relays cannot host executable apps safely.';
+/** A prefix route is deliberately insufficient; the Host must install a dedicated provider. */
+export function supportsQuickAppOrigins(provider) {
+    return typeof provider === 'object' && provider !== null && typeof provider.open === 'function';
+}
+export function validateQuickAppOrigin(lease, ownerHostId, occupied) {
+    const app = new URL(lease.origin);
+    const ui = new URL(lease.uiOrigin);
+    if (lease.isolation === 'sandbox-proxy') {
+        const matchesUi = lease.uiOrigin === QUICK_APP_DESKTOP_ORIGIN
+            ? app.protocol === 'http:' && app.hostname === '127.0.0.1' && !lease.remote
+            : ['http:', 'https:'].includes(ui.protocol) && ui.origin === lease.uiOrigin && app.origin === ui.origin;
+        if (!matchesUi || app.origin !== lease.origin
+            || lease.ownerHostId !== ownerHostId || !lease.basePath || quickAppProxyBase(lease.basePath) !== lease.basePath)
+            throw new Error(QUICK_APP_ORIGIN_UNAVAILABLE);
+        return;
+    }
+    const loopback = (host) => host === 'localhost' || host.endsWith('.localhost') || /^127\./u.test(host)
+        || host === '[::1]' || host === '[::]' || host === '0.0.0.0' || /^\[::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}\]$/iu.test(host);
+    if (!['http:', 'https:'].includes(ui.protocol) || ui.origin !== lease.uiOrigin || !['http:', 'https:'].includes(app.protocol) || app.origin !== lease.origin || app.username || app.password
+        || app.pathname !== '/' || app.search || app.hash || app.hostname.endsWith('.') || app.origin === ui.origin || occupied.has(app.origin)
+        || lease.ownerHostId !== ownerHostId || (ui.protocol === 'https:' && app.protocol !== 'https:')
+        || (lease.remote && (loopback(app.hostname) || app.protocol !== 'https:'))
+        || !/^[A-Za-z0-9_-]{1,80}$/u.test(lease.cookieName))
+        throw new Error(QUICK_APP_ORIGIN_UNAVAILABLE);
+    // Port isolation also needs cookie admission on both app and privileged LAN listeners.
+    if (lease.isolation === 'lan-port') {
+        if (app.protocol !== 'https:')
+            throw new Error(QUICK_APP_ORIGIN_UNAVAILABLE);
+    }
+    else if (app.hostname === ui.hostname || [...occupied].some(origin => new URL(origin).hostname === app.hostname))
+        throw new Error(QUICK_APP_ORIGIN_UNAVAILABLE);
+}
+//# sourceMappingURL=quick-app-origin-adapter.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-origin-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-origin-adapter.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-origin-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AAiClG,MAAM,CAAC,MAAM,4BAA4B,GAAG,2IAA2I,CAAA;AAEvL,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAQ,QAAmC,CAAC,IAAI,KAAK,UAAU,CAAA;AAC7H,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA0B,EAAE,WAAmB,EAAE,QAA6B;IACnH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,KAAK,wBAAwB;YAC3D,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM;YAC3E,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAA;QACzG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;eACxC,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAChK,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;WACzG,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzH,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;WACvL,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;WACpI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;WAC5F,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;WACvE,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACpG,uFAAuF;IACvF,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC9E,CAAC;SAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;AACnK,CAAC"}

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-adapter.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Stable internal boundary; probing must remain safe in the shared client registry. */
+export interface QuickAppProxyServer {
+    getOrigin(): string;
+    register(route: {
+        kind: 'prefix';
+        path: string;
+        handler(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    }): () => void | Promise<void>;
+}
+export declare function supportsQuickAppProxy(context: unknown): boolean;
+export declare function createQuickAppProxy(context: unknown): QuickAppProxyServer;
+//# sourceMappingURL=quick-app-proxy-adapter.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-proxy-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-proxy-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,SAAS,IAAI,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAAG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjJ;AAgBD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAG/D;AACD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAQzE"}

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-adapter.js

@@ -0,0 +1,30 @@
+function webServer(context) {
+    const ctx = context;
+    try {
+        return (ctx?.get ? ctx.get('webServer') : ctx?.webServer);
+    }
+    catch {
+        return undefined;
+    }
+}
+function hasLocalListener(server) {
+    const { host, port } = server;
+    return (host === '127.0.0.1' || host === '0.0.0.0')
+        && typeof port === 'number' && Number.isInteger(port) && port > 0 && port <= 65535;
+}
+export function supportsQuickAppProxy(context) {
+    const server = webServer(context);
+    return typeof server?.register === 'function' && (typeof server.getOrigin === 'function' || hasLocalListener(server));
+}
+export function createQuickAppProxy(context) {
+    const server = webServer(context);
+    return { getOrigin: () => {
+            if (typeof server.getOrigin === 'function')
+                return server.getOrigin();
+            // rc.2 exposes the listening address directly; wildcard binds are reached over loopback.
+            if (!hasLocalListener(server))
+                throw new Error('The Host HTTP listener is unavailable.');
+            return new URL(`http://127.0.0.1:${server.port}`).origin;
+        }, register: route => server.register(route) };
+}
+//# sourceMappingURL=quick-app-proxy-adapter.js.map