@jingyi0605/codingns4dsh 0.2.1-beta.9 → 0.2.1-rc.3

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-lan-ports.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-lan-ports.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAgD,KAAK,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAC/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAGtH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAiBlF;AAUD,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOjH;AAMD,qFAAqF;AACrF,qBAAa,wBAAyB,YAAW,sBAAsB,EAAE,oBAAoB;IAW/C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVhE,QAAQ,CAAC,SAAS,EAAG,UAAU,CAAS;IACxC,OAAO,CAAC,UAAU,CAAoB;IACtC,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,iBAAiB,CAAmC;IAC5D,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEnC,MAAM,EAAE,sBAAsB,EAAmB,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAS/F,iGAAiG;IAC3F,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAC3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAKzB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAC9B,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACpC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAQhE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAe/E,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAM9G,QAAQ;CA2DvB"}

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.js

@@ -0,0 +1,240 @@
+import { randomBytes, X509Certificate } from 'node:crypto';
+import { mkdir, readdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:https';
+import { isIP } from 'node:net';
+import { isAbsolute, join } from 'node:path';
+import { QUICK_APP_LIMITS, quickAppTransportErrorCode } from '../../shared/contracts/quick-apps.js';
+import { endQuickAppResponse, quickAppCredentials } from './quick-app-credentials.js';
+export function parseQuickAppLanPortsConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw unavailable('config-invalid');
+    const c = value;
+    if (Object.keys(c).some(key => !['transport', 'publicHost', 'uiOrigins', 'ports', 'stateDirectory', 'certFile', 'keyFile'].includes(key))
+        || c.transport !== 'lan-ports' || typeof c.publicHost !== 'string' || c.publicHost.length > 253
+        || !validHost(c.publicHost) || !Array.isArray(c.ports) || c.ports.length !== 2
+        || !c.ports.every(port => Number.isInteger(port) && port >= 1024 && port <= 65535)
+        || c.ports[0] > c.ports[1] || c.ports[1] - c.ports[0] >= 16384
+        || ![c.stateDirectory, c.certFile, c.keyFile].every(path => typeof path === 'string' && isAbsolute(path))
+        || !Array.isArray(c.uiOrigins) || c.uiOrigins.length < 1 || c.uiOrigins.length > 16)
+        throw unavailable('config-invalid');
+    for (const origin of c.uiOrigins) {
+        let url;
+        try {
+            url = new URL(origin);
+        }
+        catch {
+            throw unavailable('config-invalid');
+        }
+        if (url.origin !== origin || url.protocol !== 'https:' || url.username || url.password || !validHost(url.hostname)
+            || url.hostname === c.publicHost && Number(url.port || 443) >= c.ports[0] && Number(url.port || 443) <= c.ports[1])
+            throw unavailable('config-invalid');
+    }
+    return structuredClone(c);
+}
+function validHost(host) {
+    try {
+        if (new URL(`https://${host}`).hostname !== host)
+            return false;
+    }
+    catch {
+        return false;
+    }
+    const ip = host.replace(/^\[|\]$/gu, '');
+    if (isIP(ip))
+        return ip !== '0.0.0.0' && ip !== '::' && ip !== '::1' && !/^127\./u.test(ip) && !ip.startsWith('::ffff:');
+    return /^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/u.test(host)
+        && host.split('.').every(label => label.length <= 63) && !host.endsWith('.localhost');
+}
+/** Browsers cannot forge these headers; they are an origin fence, never authentication. */
+export function sameBrowserOrigin(headers, origin) {
+    if (headers.origin !== undefined && headers.origin !== origin)
+        return false;
+    const site = headers['sec-fetch-site'];
+    if (site !== undefined && site !== 'same-origin')
+        return false;
+    if (headers.origin === origin || site === 'same-origin')
+        return true;
+    // A fallback for clients that omit Fetch Metadata. No-referrer clients fail closed.
+    try {
+        return typeof headers.referer === 'string' && new URL(headers.referer).origin === origin;
+    }
+    catch {
+        return false;
+    }
+}
+function unavailable(reason) {
+    return Object.assign(new Error(`Quick Apps transport unavailable: ${reason}.`), { code: quickAppTransportErrorCode(reason), reason });
+}
+/** Dedicated app HTTPS ports on the existing LAN bind address; no DSH forwarding. */
+export class QuickAppLanPortsProvider {
+    tls;
+    isolation = 'lan-port';
+    listenHost;
+    stopped = false;
+    pending = Promise.resolve();
+    active = new Set();
+    reserved = new Set();
+    allocationFailure;
+    generation = 0;
+    config;
+    constructor(config, tls) {
+        this.tls = tls;
+        this.config = parseQuickAppLanPortsConfig(config);
+        const cert = new X509Certificate(tls.cert);
+        const ip = config.publicHost.replace(/^\[|\]$/gu, '');
+        if (!(isIP(ip) ? cert.checkIP(ip) : cert.checkHost(config.publicHost))
+            || Date.parse(cert.validFrom) > Date.now() || Date.parse(cert.validTo) <= Date.now())
+            throw unavailable('config-invalid');
+        const probe = createServer({ ...tls, minVersion: 'TLSv1.2' });
+        probe.close();
+    }
+    /** Read persistent reservations before availability is advertised. Never delete this history. */
+    async initialize() {
+        await mkdir(this.config.stateDirectory, { recursive: true, mode: 0o700 });
+        for (const entry of await readdir(this.config.stateDirectory)) {
+            if (/^\d+\.json$/u.test(entry))
+                this.reserved.add(Number(entry.slice(0, -5)));
+        }
+    }
+    started(listenHost) { this.listenHost = listenHost; this.generation++; this.allocationFailure = undefined; }
+    async stopping() {
+        this.listenHost = undefined;
+        this.generation++;
+        await this.pending.catch(() => undefined);
+        await Promise.all([...this.active].map(dispose => dispose()));
+    }
+    async dispose() { this.stopped = true; await this.stopping(); }
+    available(uiOrigin) { return this.diagnostic(uiOrigin) === undefined; }
+    protects(uiOrigin) { return !this.stopped && Boolean(this.listenHost) && Boolean(uiOrigin && this.config.uiOrigins.includes(uiOrigin)); }
+    diagnostic(uiOrigin) {
+        if (this.stopped || !this.listenHost)
+            return 'lan-stopped';
+        if (!uiOrigin || !this.config.uiOrigins.includes(uiOrigin))
+            return 'ui-not-allowed';
+        if (this.allocationFailure)
+            return this.allocationFailure;
+        for (let port = this.config.ports[0]; port <= this.config.ports[1]; port++)
+            if (!this.reserved.has(port))
+                return undefined;
+        return 'ports-exhausted';
+    }
+    permits(headers, method, path) {
+        if ((method === 'GET' || method === 'HEAD') && path === '/' && !headers.upgrade
+            && headers['sec-fetch-mode'] === 'navigate' && headers['sec-fetch-dest'] === 'document')
+            return true;
+        // App configuration must not become an allowlist for ordinary DSH addresses.
+        // Block only origins owned by this app transport, including retired ports.
+        for (const value of [headers.origin, headers.referer]) {
+            if (value === undefined)
+                continue;
+            try {
+                const url = new URL(value);
+                if (url.hostname === this.config.publicHost && this.reserved.has(Number(url.port || 443)))
+                    return false;
+            }
+            catch {
+                if (value === 'null')
+                    return false;
+            }
+        }
+        return true;
+    }
+    open(handler, uiOrigin) {
+        const operation = this.pending.catch(() => undefined).then(() => this.allocate(handler, uiOrigin));
+        this.pending = operation.then(() => undefined, () => undefined);
+        return operation;
+    }
+    async allocate(handler, uiOrigin) {
+        const reason = this.diagnostic(uiOrigin);
+        if (reason)
+            throw unavailable(reason);
+        if (this.active.size >= QUICK_APP_LIMITS.launches)
+            throw unavailable('ports-busy');
+        const generation = this.generation;
+        let busy = false;
+        for (let port = this.config.ports[0]; port <= this.config.ports[1]; port++) {
+            if (this.reserved.has(port))
+                continue;
+            const origin = `https://${this.config.publicHost}:${port}`;
+            const cookieName = `__Host-quickapp-${randomBytes(16).toString('hex')}`;
+            const credentials = quickAppCredentials(origin, uiOrigin, cookieName);
+            let alive = true;
+            const server = createServer({ ...this.tls, minVersion: 'TLSv1.2', maxHeaderSize: 16 * 1024, handshakeTimeout: 10_000 }, (req, res) => {
+                res.setHeader('Cache-Control', 'no-store');
+                res.setHeader('Referrer-Policy', 'same-origin');
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                const sni = req.socket.servername;
+                if (!alive || generation !== this.generation)
+                    return endQuickAppResponse(res, 410);
+                if (req.headers.host !== new URL(origin).host || sni && sni !== this.config.publicHost
+                    || req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === 'host').length !== 1)
+                    return endQuickAppResponse(res, 421);
+                // Only the one-use landing page accepts cross-origin navigation from the DSH viewer.
+                if (req.url !== '/__quickapp/bootstrap' && !sameBrowserOrigin(req.headers, origin))
+                    return endQuickAppResponse(res, 403);
+                // Browser cookies have no port scope. Strip every cookie except this launch's before
+                // passing the request to the application service; never forward general credentials.
+                const cookies = (req.headers.cookie ?? '').split(';').map(value => value.trim()).filter(value => value.startsWith(`${cookieName}=`));
+                req.headers.cookie = cookies.join('; ');
+                delete req.headers.authorization;
+                req.rawHeaders = req.rawHeaders.flatMap((value, i, headers) => i % 2 || ['cookie', 'authorization'].includes(value.toLowerCase()) ? [] : [value, headers[i + 1]]);
+                if (cookies.length)
+                    req.rawHeaders.push('Cookie', cookies.join('; '));
+                void credentials.handle(req, res).then(handled => { if (!handled && alive)
+                    handler(req, res); }).catch(() => endQuickAppResponse(res, 400));
+            });
+            server.requestTimeout = 15_000;
+            server.headersTimeout = 10_000;
+            server.timeout = 30_000;
+            server.keepAliveTimeout = 5_000;
+            server.maxConnections = 128;
+            server.maxRequestsPerSocket = 100;
+            const dispose = async () => {
+                if (!alive)
+                    return;
+                alive = false;
+                credentials.dispose();
+                this.active.delete(dispose);
+                await close(server);
+            };
+            try {
+                await new Promise((resolve, reject) => {
+                    server.once('error', reject);
+                    server.listen(port, this.listenHost, () => { server.removeListener('error', reject); resolve(); });
+                });
+                server.on('error', () => { void dispose(); });
+                // Atomic create makes independent Host instances sharing this history race safely.
+                await writeFile(join(this.config.stateDirectory, `${port}.json`), JSON.stringify({ origin, allocatedAt: new Date().toISOString() }), { flag: 'wx', mode: 0o600 });
+                this.reserved.add(port);
+                if (this.stopped || generation !== this.generation) {
+                    await dispose();
+                    throw unavailable('lan-stopped');
+                }
+                this.active.add(dispose);
+                return { origin, uiOrigin: uiOrigin, ownerHostId: 'local', remote: true, cookieName, isolation: 'lan-port', activate: credentials.activate, dispose };
+            }
+            catch (error) {
+                await dispose();
+                const code = error.code;
+                if (code === 'EEXIST') {
+                    this.reserved.add(port);
+                    continue;
+                }
+                if (code === 'EADDRINUSE') {
+                    busy = true;
+                    continue;
+                }
+                throw error;
+            }
+        }
+        if (!busy)
+            this.allocationFailure = 'ports-exhausted';
+        throw unavailable(busy ? 'ports-busy' : 'ports-exhausted');
+    }
+}
+async function close(server) {
+    server.closeAllConnections();
+    if (server.listening)
+        await new Promise(resolve => server.close(() => resolve()));
+}
+//# sourceMappingURL=quick-app-lan-ports.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-lan-ports.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-lan-ports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAG5C,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAA8B,MAAM,sCAAsC,CAAA;AAE/H,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAYrF,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;IACpG,MAAM,CAAC,GAAG,KAA+B,CAAA;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WACpI,CAAC,CAAC,SAAS,KAAK,WAAW,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;WAC5F,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;WAC3E,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;WAC/E,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK;WAC3D,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;WACtG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC1H,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,GAAQ,CAAA;QACZ,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;QAAC,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;eAC7G,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC3J,CAAC;IACD,OAAO,eAAe,CAAC,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC7F,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IACxC,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;IACxH,OAAO,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC;WACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACzF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,OAAsD,EAAE,MAAc;IACtG,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,CAAA;IACpE,oFAAoF;IACpF,IAAI,CAAC;QAAC,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,MAAM,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;AACzH,CAAC;AAED,SAAS,WAAW,CAAC,MAA6B;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACvI,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,wBAAwB;IAW0B;IAVpD,SAAS,GAAG,UAAmB,CAAA;IAChC,UAAU,CAAoB;IAC9B,OAAO,GAAG,KAAK,CAAA;IACf,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IACjC,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IACvC,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,iBAAiB,CAAmC;IACpD,UAAU,GAAG,CAAC,CAAA;IACL,MAAM,CAAwB;IAE/C,YAAY,MAA8B,EAAmB,GAAkC;QAAlC,QAAG,GAAH,GAAG,CAA+B;QAC7F,IAAI,CAAC,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;eACjE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAA;QAC3H,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IAC9E,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,UAAU;QACd,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzE,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,UAAkB,IAAU,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAA,CAAC,CAAC;IACzH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAAC,IAAI,CAAC,UAAU,EAAE,CAAA;QAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC/D,CAAC;IACD,KAAK,CAAC,OAAO,KAAoB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA,CAAC,CAAC;IAC7E,SAAS,CAAC,QAAiB,IAAa,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAA,CAAC,CAAC;IACxF,QAAQ,CAAC,QAAiB,IAAa,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA,CAAC,CAAC;IAC1J,UAAU,CAAC,QAAiB;QAC1B,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,aAAa,CAAA;QAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,gBAAgB,CAAA;QACnF,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAA;QACzD,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAA;QAC1H,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IAED,OAAO,CAAC,OAA+B,EAAE,MAAc,EAAE,IAAY;QACnE,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;eAC1E,OAAO,CAAC,gBAAgB,CAAC,KAAK,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,UAAU;YAAE,OAAO,IAAI,CAAA;QACtG,6EAA6E;QAC7E,2EAA2E;QAC3E,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAQ;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAA;YACzG,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,KAAK,KAAK,MAAM;oBAAE,OAAO,KAAK,CAAA;YAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,OAAqE,EAAE,QAAiB;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QAClG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAAqE,EAAE,QAAiB;QAC7G,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,MAAM;YAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ;YAAE,MAAM,WAAW,CAAC,YAAY,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,IAAI,IAAI,GAAG,KAAK,CAAA;QAChB,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACrC,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,CAAA;YAC1D,MAAM,UAAU,GAAG,mBAAmB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;YACvE,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAS,EAAE,UAAU,CAAC,CAAA;YACtE,IAAI,KAAK,GAAG,IAAI,CAAA;YAChB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACnI,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;gBAC/I,MAAM,GAAG,GAAI,GAAG,CAAC,MAAoB,CAAC,UAAU,CAAA;gBAChD,IAAI,CAAC,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;oBAAE,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAClF,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU;uBACjF,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACnJ,qFAAqF;gBACrF,IAAI,GAAG,CAAC,GAAG,KAAK,uBAAuB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;oBAAE,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACxH,qFAAqF;gBACrF,qFAAqF;gBACrF,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;gBACpI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACvC,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;gBAChC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAA;gBAClK,IAAI,OAAO,CAAC,MAAM;oBAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBACrE,KAAK,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK;oBAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;YAC5I,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;YAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;YAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAA;YACvF,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC;YAAC,MAAM,CAAC,oBAAoB,GAAG,GAAG,CAAA;YAC/F,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;gBACzB,IAAI,CAAC,KAAK;oBAAE,OAAM;gBAClB,KAAK,GAAG,KAAK,CAAC;gBAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACjE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAA;YACrB,CAAC,CAAA;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;gBACnG,CAAC,CAAC,CAAA;gBACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;gBAC5C,mFAAmF;gBACnF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACjK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBAAC,MAAM,OAAO,EAAE,CAAC;oBAAC,MAAM,WAAW,CAAC,aAAa,CAAC,CAAA;gBAAC,CAAC;gBACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;YACxJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,EAAE,CAAA;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;gBAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBAC5D,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;oBAAC,IAAI,GAAG,IAAI,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBACpD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QACrD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAA;IAC5D,CAAC;CACF;AAED,KAAK,UAAU,KAAK,CAAC,MAAc;IACjC,MAAM,CAAC,mBAAmB,EAAE,CAAA;IAC5B,IAAI,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AACzF,CAAC"}

package/data/build/dist/dsh-capabilities/host/quick-app-origin-adapter.d.ts

@@ -0,0 +1,37 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { QuickAppRuntimeReason, QuickAppProxyRequest, QuickAppProxyResponse } from '../../shared/contracts/quick-apps.js';
+/** Internal service supplied by a verified transport composition, never by an RPC payload. */
+export interface QuickAppOriginLease {
+    readonly origin: string;
+    readonly ownerHostId: string;
+    readonly uiOrigin: string;
+    readonly remote: boolean;
+    readonly cookieName: string;
+    /** Supplied only by the LAN adapter with an attached privileged-request guard. */
+    readonly isolation?: 'lan-port' | 'sandbox-proxy';
+    readonly basePath?: string;
+    /** Deliver only this launch's credential through the transport's verified browser channel. */
+    activate(credential: string, entryPath: string): Promise<{
+        readonly url: string;
+    }>;
+    dispose(): Promise<void>;
+}
+export interface QuickAppOriginProvider {
+    readonly isolation?: 'lan-port' | 'sandbox-proxy';
+    open(handler: (request: IncomingMessage, response: ServerResponse) => void, uiOrigin?: string): Promise<QuickAppOriginLease>;
+    available?(uiOrigin?: string): boolean;
+    diagnostic?(uiOrigin?: string): QuickAppRuntimeReason | undefined;
+    requestResource?(basePath: string, request: QuickAppProxyRequest, signal: AbortSignal): Promise<QuickAppProxyResponse>;
+}
+/** LAN lifecycle and request admission stay at the transport boundary. */
+export interface QuickAppLanTransport {
+    started(listenHost: string): void;
+    stopping(): Promise<void>;
+    permits(headers: Record<string, string>, method: string, path: string): boolean;
+    protects(uiOrigin?: string): boolean;
+}
+export declare const QUICK_APP_ORIGIN_UNAVAILABLE = "No verified isolated app origin is available for this connection. DSH path routes and PeerHost relays cannot host executable apps safely.";
+/** A prefix route is deliberately insufficient; the Host must install a dedicated provider. */
+export declare function supportsQuickAppOrigins(provider: unknown): provider is QuickAppOriginProvider;
+export declare function validateQuickAppOrigin(lease: QuickAppOriginLease, ownerHostId: string, occupied: ReadonlySet<string>): void;
+//# sourceMappingURL=quick-app-origin-adapter.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-origin-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-origin-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-origin-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAG9H,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,eAAe,CAAA;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,eAAe,CAAA;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC5H,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACtC,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;IACjE,eAAe,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;CACvH;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrC;AAED,eAAO,MAAM,4BAA4B,8IAA8I,CAAA;AAEvL,+FAA+F;AAC/F,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,IAAI,sBAAsB,CAE7F;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAsB3H"}

package/data/build/dist/dsh-capabilities/host/quick-app-origin-adapter.js

@@ -0,0 +1,35 @@
+import { QUICK_APP_DESKTOP_ORIGIN, quickAppProxyBase } from '../../shared/quick-app-proxy-path.js';
+export const QUICK_APP_ORIGIN_UNAVAILABLE = 'No verified isolated app origin is available for this connection. DSH path routes and PeerHost relays cannot host executable apps safely.';
+/** A prefix route is deliberately insufficient; the Host must install a dedicated provider. */
+export function supportsQuickAppOrigins(provider) {
+    return typeof provider === 'object' && provider !== null && typeof provider.open === 'function';
+}
+export function validateQuickAppOrigin(lease, ownerHostId, occupied) {
+    const app = new URL(lease.origin);
+    const ui = new URL(lease.uiOrigin);
+    if (lease.isolation === 'sandbox-proxy') {
+        const matchesUi = lease.uiOrigin === QUICK_APP_DESKTOP_ORIGIN
+            ? app.protocol === 'http:' && app.hostname === '127.0.0.1' && !lease.remote
+            : ['http:', 'https:'].includes(ui.protocol) && ui.origin === lease.uiOrigin && app.origin === ui.origin;
+        if (!matchesUi || app.origin !== lease.origin
+            || lease.ownerHostId !== ownerHostId || !lease.basePath || quickAppProxyBase(lease.basePath) !== lease.basePath)
+            throw new Error(QUICK_APP_ORIGIN_UNAVAILABLE);
+        return;
+    }
+    const loopback = (host) => host === 'localhost' || host.endsWith('.localhost') || /^127\./u.test(host)
+        || host === '[::1]' || host === '[::]' || host === '0.0.0.0' || /^\[::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}\]$/iu.test(host);
+    if (!['http:', 'https:'].includes(ui.protocol) || ui.origin !== lease.uiOrigin || !['http:', 'https:'].includes(app.protocol) || app.origin !== lease.origin || app.username || app.password
+        || app.pathname !== '/' || app.search || app.hash || app.hostname.endsWith('.') || app.origin === ui.origin || occupied.has(app.origin)
+        || lease.ownerHostId !== ownerHostId || (ui.protocol === 'https:' && app.protocol !== 'https:')
+        || (lease.remote && (loopback(app.hostname) || app.protocol !== 'https:'))
+        || !/^[A-Za-z0-9_-]{1,80}$/u.test(lease.cookieName))
+        throw new Error(QUICK_APP_ORIGIN_UNAVAILABLE);
+    // Port isolation also needs cookie admission on both app and privileged LAN listeners.
+    if (lease.isolation === 'lan-port') {
+        if (app.protocol !== 'https:')
+            throw new Error(QUICK_APP_ORIGIN_UNAVAILABLE);
+    }
+    else if (app.hostname === ui.hostname || [...occupied].some(origin => new URL(origin).hostname === app.hostname))
+        throw new Error(QUICK_APP_ORIGIN_UNAVAILABLE);
+}
+//# sourceMappingURL=quick-app-origin-adapter.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-origin-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-origin-adapter.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-origin-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AAiClG,MAAM,CAAC,MAAM,4BAA4B,GAAG,2IAA2I,CAAA;AAEvL,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAQ,QAAmC,CAAC,IAAI,KAAK,UAAU,CAAA;AAC7H,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA0B,EAAE,WAAmB,EAAE,QAA6B;IACnH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,KAAK,wBAAwB;YAC3D,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM;YAC3E,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAA;QACzG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;eACxC,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAChK,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;WACzG,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzH,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;WACvL,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;WACpI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;WAC5F,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;WACvE,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACpG,uFAAuF;IACvF,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC9E,CAAC;SAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;AACnK,CAAC"}

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-adapter.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Stable internal boundary; probing must remain safe in the shared client registry. */
+export interface QuickAppProxyServer {
+    getOrigin(): string;
+    register(route: {
+        kind: 'prefix';
+        path: string;
+        handler(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    }): () => void | Promise<void>;
+}
+export declare function supportsQuickAppProxy(context: unknown): boolean;
+export declare function createQuickAppProxy(context: unknown): QuickAppProxyServer;
+//# sourceMappingURL=quick-app-proxy-adapter.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-proxy-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-proxy-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,SAAS,IAAI,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAAG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjJ;AAgBD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAG/D;AACD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAQzE"}

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-adapter.js

@@ -0,0 +1,30 @@
+function webServer(context) {
+    const ctx = context;
+    try {
+        return (ctx?.get ? ctx.get('webServer') : ctx?.webServer);
+    }
+    catch {
+        return undefined;
+    }
+}
+function hasLocalListener(server) {
+    const { host, port } = server;
+    return (host === '127.0.0.1' || host === '0.0.0.0')
+        && typeof port === 'number' && Number.isInteger(port) && port > 0 && port <= 65535;
+}
+export function supportsQuickAppProxy(context) {
+    const server = webServer(context);
+    return typeof server?.register === 'function' && (typeof server.getOrigin === 'function' || hasLocalListener(server));
+}
+export function createQuickAppProxy(context) {
+    const server = webServer(context);
+    return { getOrigin: () => {
+            if (typeof server.getOrigin === 'function')
+                return server.getOrigin();
+            // rc.2 exposes the listening address directly; wildcard binds are reached over loopback.
+            if (!hasLocalListener(server))
+                throw new Error('The Host HTTP listener is unavailable.');
+            return new URL(`http://127.0.0.1:${server.port}`).origin;
+        }, register: route => server.register(route) };
+}
+//# sourceMappingURL=quick-app-proxy-adapter.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-proxy-adapter.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-proxy-adapter.ts"],"names":[],"mappings":"AAaA,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,GAAG,GAAG,OAA2E,CAAA;IACvF,IAAI,CAAC;QAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAA0C,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AACvI,CAAC;AACD,SAAS,gBAAgB,CAAC,MAAiC;IACzD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IAC7B,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,CAAC;WAC9C,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,CAAA;AACtF,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,OAAO,MAAM,EAAE,QAAQ,KAAK,UAAU,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAA;AACvH,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAE,CAAA;IAClC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE;YACvB,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU;gBAAE,OAAO,MAAM,CAAC,SAAS,EAAE,CAAA;YACrE,yFAAyF;YACzF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;YACxF,OAAO,IAAI,GAAG,CAAC,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;QAC1D,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AAChD,CAAC"}

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-provider.d.ts

@@ -0,0 +1,21 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import type { QuickAppOriginLease, QuickAppOriginProvider } from './quick-app-origin-adapter.js';
+import { type QuickAppProxyRequest, type QuickAppProxyResponse } from '../../shared/contracts/quick-apps.js';
+import type { QuickAppProxyServer } from './quick-app-proxy-adapter.js';
+/** Use the existing Host listener. Each viewer gets an opaque sandbox and a scoped route. */
+export declare class QuickAppProxyProvider implements QuickAppOriginProvider {
+    private readonly server;
+    readonly isolation: "sandbox-proxy";
+    private stopped;
+    private readonly releases;
+    private readonly handlers;
+    private releaseRoute;
+    constructor(server: QuickAppProxyServer);
+    private previewOrigin;
+    available(uiOrigin?: string): boolean;
+    open(handler: (req: IncomingMessage, res: ServerResponse) => void, uiOrigin?: string): Promise<QuickAppOriginLease>;
+    dispose(): Promise<void>;
+    /** Existing local Host listener only; callers cannot supply an upstream address. */
+    requestResource(basePath: string, input: QuickAppProxyRequest, signal: AbortSignal): Promise<QuickAppProxyResponse>;
+}
+//# sourceMappingURL=quick-app-proxy-provider.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-proxy-provider.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-proxy-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAEhG,OAAO,EAAoB,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAE9H,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAEvE,6FAA6F;AAC7F,qBAAa,qBAAsB,YAAW,sBAAsB;IAMtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IALnC,QAAQ,CAAC,SAAS,EAAG,eAAe,CAAS;IAC7C,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkF;IAC3G,OAAO,CAAC,YAAY,CAA0C;gBACjC,MAAM,EAAE,mBAAmB;IACxD,OAAO,CAAC,aAAa;IAUrB,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAG/B,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAsCnH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B,oFAAoF;IAC9E,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA6B1H"}

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-provider.js

@@ -0,0 +1,132 @@
+import { randomBytes } from 'node:crypto';
+import { request } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { QUICK_APP_DESKTOP_ORIGIN, QUICK_APP_PROXY_PREFIX } from '../../shared/quick-app-proxy-path.js';
+import { QUICK_APP_LIMITS } from '../../shared/contracts/quick-apps.js';
+import { quickAppProxyBase } from '../../shared/quick-app-proxy-path.js';
+/** Use the existing Host listener. Each viewer gets an opaque sandbox and a scoped route. */
+export class QuickAppProxyProvider {
+    server;
+    isolation = 'sandbox-proxy';
+    stopped = false;
+    releases = new Set();
+    handlers = new Map();
+    releaseRoute;
+    constructor(server) {
+        this.server = server;
+    }
+    previewOrigin(uiOrigin) {
+        try {
+            const desktop = uiOrigin === QUICK_APP_DESKTOP_ORIGIN;
+            const origin = desktop ? this.server.getOrigin() : uiOrigin;
+            const url = new URL(origin);
+            if (!['http:', 'https:'].includes(url.protocol) || url.origin !== origin)
+                return undefined;
+            if (desktop && (url.protocol !== 'http:' || url.hostname !== '127.0.0.1'))
+                return undefined;
+            return origin;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    available(uiOrigin) {
+        return !this.stopped && this.previewOrigin(uiOrigin) !== undefined;
+    }
+    async open(handler, uiOrigin) {
+        const origin = this.previewOrigin(uiOrigin);
+        if (this.stopped || !origin)
+            throw Object.assign(new Error('The Host preview route is unavailable on this connection.'), { code: 'QUICK_APP_ORIGIN_UNAVAILABLE' });
+        const basePath = `${QUICK_APP_PROXY_PREFIX}${randomBytes(32).toString('base64url')}/`;
+        const cookieName = 'quickapp-proxy';
+        let credential;
+        let active = true;
+        if (!this.releaseRoute)
+            this.releaseRoute = this.server.register({ kind: 'prefix', path: QUICK_APP_PROXY_PREFIX.slice(0, -1), handler: async (req, res) => {
+                    const base = quickAppProxyBase(req.url ?? '');
+                    const serve = base && this.handlers.get(base);
+                    if (serve)
+                        await serve(req, res);
+                    else
+                        res.writeHead(404, { 'Cache-Control': 'no-store' }).end();
+                } });
+        this.handlers.set(basePath, async (req, res) => {
+            res.setHeader('Cache-Control', 'no-store');
+            if (!active || !credential || !req.url?.startsWith(basePath)) {
+                res.writeHead(404).end();
+                return;
+            }
+            if (![new URL(origin).host, new URL(this.server.getOrigin()).host].includes(req.headers.host ?? '')) {
+                res.writeHead(421).end();
+                return;
+            }
+            // The authenticated management connection created this route. The random route
+            // binds the request to that launch; browser headers never select a workspace.
+            req.url = `/${req.url.slice(basePath.length)}`;
+            req.headers.cookie = `${cookieName}=${credential}`;
+            delete req.headers.authorization;
+            req.headers.host = new URL(origin).host;
+            req.rawHeaders = req.rawHeaders.flatMap((name, index, headers) => index % 2 || ['cookie', 'authorization', 'host'].includes(name.toLowerCase()) ? [] : [name, headers[index + 1]]);
+            req.rawHeaders.push('Host', req.headers.host, 'Cookie', req.headers.cookie);
+            handler(req, res);
+        });
+        const dispose = async () => { if (!active)
+            return; active = false; credential = undefined; this.handlers.delete(basePath); this.releases.delete(dispose); };
+        this.releases.add(dispose);
+        return { origin, uiOrigin: uiOrigin, ownerHostId: 'local', remote: false, isolation: 'sandbox-proxy', basePath, cookieName,
+            activate: async (value, path) => {
+                if (!active)
+                    throw new Error('Preview closed.');
+                credential = value;
+                return { url: `${origin}${basePath}${path.replace(/^\//u, '')}` };
+            }, dispose };
+    }
+    async dispose() {
+        this.stopped = true;
+        await Promise.all([...this.releases].map(release => release()));
+        await this.releaseRoute?.();
+        this.releaseRoute = undefined;
+    }
+    /** Existing local Host listener only; callers cannot supply an upstream address. */
+    async requestResource(basePath, input, signal) {
+        if (this.stopped || quickAppProxyBase(basePath) !== basePath || !input || !['GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'OPTIONS'].includes(input.method)
+            || typeof input.path !== 'string' || !input.path.startsWith('/') || input.path.startsWith('//') || input.path.length > 8192
+            || /[\r\n#]/u.test(input.path) || typeof input.headers !== 'object' || !input.headers
+            || input.body !== undefined && (typeof input.body !== 'string' || Buffer.byteLength(input.body) > QUICK_APP_LIMITS.textBytes))
+            throw new Error('Invalid preview resource request.');
+        const headers = {};
+        for (const name of ['accept', 'origin', 'content-type', 'if-match', 'if-none-match', 'sec-fetch-mode', 'sec-fetch-dest']) {
+            const value = input.headers[name];
+            if (typeof value === 'string' && value.length < 8192)
+                headers[name] = value;
+        }
+        const endpoint = new URL(this.server.getOrigin());
+        if (!['http:', 'https:'].includes(endpoint.protocol))
+            throw new Error('The Host listener is unavailable.');
+        return new Promise((resolve, reject) => {
+            const req = (endpoint.protocol === 'https:' ? httpsRequest : request)({ hostname: endpoint.hostname.replace(/^\[|\]$/gu, ''), port: endpoint.port || (endpoint.protocol === 'https:' ? 443 : 80), path: basePath + input.path.slice(1), method: input.method, headers,
+                signal, agent: false, timeout: 30_000 }, res => {
+                const chunks = [];
+                let size = 0;
+                res.on('data', chunk => { size += chunk.length; if (size > QUICK_APP_LIMITS.staticBytes)
+                    res.destroy(new Error('Preview response is too large.'));
+                else
+                    chunks.push(chunk); });
+                res.on('error', reject);
+                res.on('end', () => {
+                    const responseHeaders = {};
+                    for (const name of ['content-type', 'content-length', 'content-security-policy', 'cache-control', 'referrer-policy', 'x-content-type-options', 'location', 'access-control-allow-origin', 'access-control-allow-methods', 'access-control-allow-headers']) {
+                        const value = res.headers[name];
+                        if (typeof value === 'string')
+                            responseHeaders[name] = value;
+                    }
+                    resolve({ status: res.statusCode, headers: responseHeaders, bodyBase64: Buffer.concat(chunks).toString('base64') });
+                });
+            });
+            req.on('error', reject);
+            req.on('timeout', () => req.destroy(new Error('Preview resource request timed out.')));
+            req.end(input.body);
+        });
+    }
+}
+//# sourceMappingURL=quick-app-proxy-provider.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-proxy-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-proxy-provider.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-proxy-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,OAAO,EAA6C,MAAM,WAAW,CAAA;AAC9E,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AAEpD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AACvG,OAAO,EAAE,gBAAgB,EAAyD,MAAM,sCAAsC,CAAA;AAC9H,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AAGxE,6FAA6F;AAC7F,MAAM,OAAO,qBAAqB;IAMH;IALpB,SAAS,GAAG,eAAwB,CAAA;IACrC,OAAO,GAAG,KAAK,CAAA;IACN,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAA;IACzC,QAAQ,GAAG,IAAI,GAAG,EAAwE,CAAA;IACnG,YAAY,CAA0C;IAC9D,YAA6B,MAA2B;QAA3B,WAAM,GAAN,MAAM,CAAqB;IAAG,CAAC;IACpD,aAAa,CAAC,QAAiB;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,KAAK,wBAAwB,CAAA;YACrD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAS,CAAA;YAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAA;YAC1F,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC3F,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;IAC9B,CAAC;IACD,SAAS,CAAC,QAAiB;QACzB,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAA;IACpE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,OAA4D,EAAE,QAAiB;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAClK,MAAM,QAAQ,GAAG,GAAG,sBAAsB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAA;QACrF,MAAM,UAAU,GAAG,gBAAgB,CAAA;QACnC,IAAI,UAA8B,CAAA;QAClC,IAAI,MAAM,GAAG,IAAI,CAAA;QACjB,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;oBACxJ,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;oBAC7C,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBAC7C,IAAI,KAAK;wBAAE,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;;wBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;gBAChE,CAAC,EAAE,CAAC,CAAA;QACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC7C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;YAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAM;YAAC,CAAC;YAClG,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAM;YAClC,CAAC;YACD,+EAA+E;YAC/E,8EAA8E;YAC9E,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAA;YAC9C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,UAAU,IAAI,UAAU,EAAE,CAAA;YAClD,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;YAChC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;YACvC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC,CAAA;YACnL,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC3E,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA,CAAC,CAAC,CAAA;QAC1J,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU;YACzH,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC9B,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;gBAC/C,UAAU,GAAG,KAAK,CAAA;gBAClB,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAA;YACnE,CAAC,EAAE,OAAO,EAAE,CAAA;IAChB,CAAC;IACD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACpF,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QAAC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAA;IAC5D,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,KAA2B,EAAE,MAAmB;QACtF,IAAI,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;eAChJ,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI;eACxH,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO;eAClF,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACrL,MAAM,OAAO,GAA2B,EAAE,CAAA;QAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACzH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;QAC7E,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAC1G,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO;gBACnQ,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE;gBAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;gBAAC,IAAI,IAAI,GAAG,CAAC,CAAA;gBACzC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,gBAAgB,CAAC,WAAW;oBAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;;oBAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;gBAC7K,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACvB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,MAAM,eAAe,GAA2B,EAAE,CAAA;oBAClD,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,UAAU,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,8BAA8B,CAAC,EAAE,CAAC;wBAC1P,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;4BAAE,eAAe,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;oBAC/F,CAAC;oBACD,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAW,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBACtH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACtI,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/data/build/dist/dsh-capabilities/host/quick-app-transport.d.ts

@@ -0,0 +1,10 @@
+import type { QuickAppLanTransport, QuickAppOriginProvider } from './quick-app-origin-adapter.js';
+export interface ConfiguredQuickAppTransport {
+    readonly origins: QuickAppOriginProvider;
+    readonly lan?: QuickAppLanTransport;
+    readonly configurationError?: boolean;
+    dispose(): Promise<void>;
+}
+/** Host-only configuration; never inferred from forwarded headers or browser settings. */
+export declare function configuredQuickAppTransport(configPath?: string | undefined): Promise<ConfiguredQuickAppTransport>;
+//# sourceMappingURL=quick-app-transport.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-transport.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-transport.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAIjG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED,0FAA0F;AAC1F,wBAAsB,2BAA2B,CAAC,UAAU,qBAA+C,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAejJ"}