@knpkv/agent-usage 0.2.1 → 0.4.0

package/dist/server/OwnerSession.js

@@ -1,214 +1,32 @@
-/**
- * Who may talk to this server.
- *
- * **Mental model**
- *
- * - **One process, one operator.** The server binds a loopback address and mints a session token for
- *   itself at startup. There is no user table and no login: the person who can read the terminal is
- *   the person who gets in, which is the authority a page showing their own agents' usage, ticket
- *   keys and working directories should demand.
- * - **The URL is the handshake.** A bootstrap code rides in a fragment the browser never sends
- *   upstream and is spent the first time it is exchanged for the session cookie. One is minted when
- *   the server starts and another each time `agent-usage login` asks over the control socket; both
- *   go through {@link mintBootstrapUrl}, and a newer code replaces an unspent one.
- * - **Every route only reads, and a read needs the cookie and must not be a browser cross-origin
- *   request.** Another page in the same browser can make the browser send a cookie, but Fetch
- *   Metadata keeps that page from reading usage without an Origin. With no writes there is no CSRF
- *   token to issue.
- *
- * The rules are `@knpkv/jcf-web`'s owner session minus its write path, over the same
- * `@knpkv/browser-pairing` credential primitives. They are re-stated rather than imported because
- * that module is private to that application; duplicating the *policy* while sharing the
- * *primitives* is the smaller of the two mistakes available.
- *
- * @module
- */
-import { credentialValuesEqual, decideOneTimeCredential, expiresAt, issuePairingCode, issueSessionToken, serializeCredentialCookie } from "@knpkv/browser-pairing";
-import { Clock, Context, Effect, Layer, Redacted, Ref, Schema } from "effect";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
+import { Effect, Layer, Redacted } from "effect";
 import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "./Api.js";
-/** How long a minted bootstrap URL stays usable. Long enough to click, short enough to forget. */
-const BOOTSTRAP_LIFETIME_MILLIS = 60_000;
-/**
- * Failed bootstrap exchanges before the exchange closes, until the owner mints a new code.
- *
- * The code is high-entropy, so this is not what makes guessing hard — it is what stops a process
- * that is being guessed at from staying open all afternoon.
- */
-const MAX_BOOTSTRAP_FAILURES = 5;
-/** Methods that only read: the only ones this server answers on its API. */
-const safeMethods = new Set(["GET", "HEAD", "OPTIONS"]);
-/**
- * The one origin other than the bound server that may hold a session: the Vite dev server, which
- * proxies both the API and the bootstrap exchange, so the browser stays on a single origin.
- */
-const devPublicOrigin = "http://localhost:5173";
-export class OwnerSessionSecrets extends Context.Service()("@knpkv/agent-usage/OwnerSessionSecrets") {
-}
-export class UnsafeServerOriginError extends Schema.TaggedError()("UnsafeServerOriginError", { message: Schema.String, origin: Schema.String }) {
-}
-export const isLoopbackHostname = (hostname) => hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
-export const ownerSessionOrigin = (hostname, port) => `http://${hostname === "::1" ? "[::1]" : hostname}:${port}`;
-export const requireLoopbackOrigin = Effect.fn("OwnerSession.requireLoopbackOrigin")(function* (origin) {
-    const url = yield* Effect.try({
-        catch: () => new UnsafeServerOriginError({ message: "agent-usage needs a valid HTTP origin", origin }),
-        try: () => new URL(origin)
-    });
-    if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname) || url.search !== "" || url.hash !== "") {
-        return yield* new UnsafeServerOriginError({
-            message: "agent-usage may only be reached over HTTP on a loopback host",
-            origin
-        });
-    }
-    return url.origin;
-});
-/** The advertised origin: the bound server, or the dev server that proxies to it. */
-export const resolvePublicOrigin = Effect.fn("OwnerSession.resolvePublicOrigin")(function* (configuredOrigin, authorityOrigin) {
-    const authority = yield* requireLoopbackOrigin(authorityOrigin);
-    if (configuredOrigin === undefined)
-        return authority;
-    const configured = yield* requireLoopbackOrigin(configuredOrigin);
-    if (configured !== authority && configured !== devPublicOrigin) {
-        return yield* new UnsafeServerOriginError({
-            message: "agent-usage's public origin must be the bound server or its dev proxy",
-            origin: configuredOrigin
-        });
-    }
-    return configured;
-});
-export const makeOwnerSessionSecrets = Effect.fn("OwnerSession.makeSecrets")(function* (authorityOrigin, configuredPublicOrigin) {
-    const validated = yield* requireLoopbackOrigin(authorityOrigin);
-    const browserOrigin = yield* resolvePublicOrigin(configuredPublicOrigin, validated);
-    const ownerToken = yield* issueSessionToken();
-    return OwnerSessionSecrets.of({
-        authorityOrigin: validated,
-        bootstrap: yield* Ref.make(undefined),
-        bootstrapAttemptState: yield* Ref.make({ failedAttempts: 0, inFlight: 0 }),
-        browserOrigin,
-        ownerToken
+/** Build the session for a server bound at `authorityOrigin`, advertised at `configuredPublicOrigin`. */
+export const makeOwnerSession = Effect.fn("AgentUsage.makeOwnerSession")(function* (authorityOrigin, configuredPublicOrigin) {
+    return yield* OwnerSession.make({
+        authorityOrigin,
+        browserOrigin: yield* OwnerSession.resolvePublicOrigin(configuredPublicOrigin, authorityOrigin),
+        cookieName: "agent_usage_owner",
+        freshUrlHint: "run `agent-usage login` for a fresh URL",
+        product: "agent-usage",
+        writes: "none"
     });
 });
 /**
- * Mints a fresh one-time code and returns the URL that carries it: usable once, for a minute. The
- * startup link and every `agent-usage login` link come from here; a newer code replaces any unspent
- * one and reopens an exchange that guesses had closed. Call it only once the server is listening.
- *
- * The code rides in the fragment, which browsers do not send to servers and proxies do not log,
- * and the page strips it from the address bar once it has been spent.
+ * Mints a fresh one-time code and returns the URL that carries it. The startup link and every
+ * `agent-usage login` link come from here. Call it only once the server is listening.
  */
-export const mintBootstrapUrl = Effect.fn("OwnerSession.mintBootstrapUrl")(function* (secrets) {
-    const token = yield* issuePairingCode();
-    const now = yield* Clock.currentTimeMillis;
-    const until = yield* expiresAt(now, BOOTSTRAP_LIFETIME_MILLIS);
-    yield* Ref.set(secrets.bootstrap, { token, expiresAt: until, available: true });
-    yield* Ref.set(secrets.bootstrapAttemptState, { failedAttempts: 0, inFlight: 0 });
-    return `${secrets.browserOrigin.replace(/\/+$/u, "")}/#bootstrap_token=${encodeURIComponent(Redacted.value(token))}`;
-});
-export const ownerSessionCookie = (secrets) => serializeCredentialCookie(secrets.ownerToken, {
-    httpOnly: true,
-    name: "agent_usage_owner",
-    path: "/api",
-    sameSite: "strict",
-    secure: false
-});
-const fetchSites = new Set(["cross-site", "none", "same-origin", "same-site"]);
-export const authorizeOwnerRequest = Effect.fn("OwnerSession.authorizeRequest")(function* (request, secrets) {
-    if (credentialValuesEqual(request.credential, Redacted.value(secrets.ownerToken)) !== true) {
-        return yield* new UnauthorizedApiError({ message: "Missing or invalid owner session" });
-    }
-    const sameOrigin = request.origin !== undefined && request.origin === secrets.browserOrigin;
-    if (request.origin !== undefined && !sameOrigin) {
-        return yield* new ForbiddenApiError({ message: "Request origin does not match this agent-usage server" });
-    }
-    if (request.fetchSite !== undefined && !fetchSites.has(request.fetchSite)) {
-        return yield* new ForbiddenApiError({ message: "Request carries invalid browser site metadata" });
-    }
-    if (request.fetchSite === "cross-site" ||
-        (!sameOrigin && (request.fetchSite === "same-site" || request.fetchSite === "none"))) {
-        return yield* new ForbiddenApiError({ message: "Browser request is not from this agent-usage page" });
-    }
-    // An explicit client such as curl carries neither Origin nor Fetch Metadata and remains allowed:
-    // it still has to present the process-scoped session cookie.
-    if (!safeMethods.has(request.method.toUpperCase())) {
-        return yield* new ForbiddenApiError({ message: "This server only answers reads" });
-    }
-});
-const bearerToken = (authorization) => authorization !== undefined && authorization.startsWith("Bearer ")
-    ? authorization.slice("Bearer ".length)
-    : undefined;
-export const authorizeBootstrapRequest = Effect.fn("OwnerSession.authorizeBootstrap")(function* (request, secrets) {
-    if (request.origin !== secrets.browserOrigin) {
-        return yield* new ForbiddenApiError({ message: "Bootstrap origin does not match this agent-usage server" });
-    }
-    const supplied = bearerToken(request.authorization);
-    const current = yield* Ref.get(secrets.bootstrap);
-    // Counted before the code is even compared, so a burst of parallel guesses cannot all pass the
-    // check together and then be counted afterwards.
-    const admit = Ref.modify(secrets.bootstrapAttemptState, (state) => {
-        if (state.failedAttempts + state.inFlight >= MAX_BOOTSTRAP_FAILURES)
-            return ["unavailable", state];
-        const matches = supplied !== undefined && current !== undefined &&
-            credentialValuesEqual(supplied, Redacted.value(current.token)) === true;
-        if (!matches) {
-            return ["invalid", {
-                    failedAttempts: Math.min(MAX_BOOTSTRAP_FAILURES, state.failedAttempts + 1),
-                    inFlight: state.inFlight
-                }];
-        }
-        return ["accepted", { ...state, inFlight: state.inFlight + 1 }];
-    }).pipe(Effect.flatMap((admission) => admission === "unavailable"
-        ? Effect.fail(new UnauthorizedApiError({ message: "Bootstrap is closed for this process" }))
-        : admission === "invalid"
-            ? Effect.fail(new UnauthorizedApiError({ message: "Missing or invalid bootstrap token" }))
-            : Effect.void));
-    return yield* Effect.acquireUseRelease(admit, () => Effect.gen(function* () {
-        const now = yield* Clock.currentTimeMillis;
-        // Spent only if it is still the code that was compared: a newer mint replaced it otherwise.
-        const decision = yield* Ref.modify(secrets.bootstrap, (code) => {
-            if (code === undefined || current === undefined || code.token !== current.token) {
-                return ["consumed", code];
-            }
-            const next = decideOneTimeCredential({ consumedAt: code.available ? null : 0, expiresAt: code.expiresAt, revokedAt: null }, now);
-            return [next, next === "accepted" ? { ...code, available: false } : code];
-        });
-        if (decision === "accepted")
-            return;
-        const message = decision === "expired"
-            ? "Bootstrap token has expired"
-            : decision === "consumed"
-                ? "Bootstrap token has already been used"
-                : "Bootstrap token state is invalid";
-        return yield* new UnauthorizedApiError({ message });
-    }), () => Ref.update(secrets.bootstrapAttemptState, (state) => ({ ...state, inFlight: Math.max(0, state.inFlight - 1) })));
-});
+export const mintBootstrapUrl = (session) => Effect.map(session.mintBootstrapCode, (code) => OwnerSession.bootstrapUrl(session.browserOrigin, code));
 export const ownerSessionAuthLayer = Layer.effect(OwnerSessionAuth, Effect.gen(function* () {
-    const secrets = yield* OwnerSessionSecrets;
+    const session = yield* OwnerSession.OwnerSession;
     return OwnerSessionAuth.of({
-        ownerCookie: Effect.fn("OwnerSession.ownerCookie")(function* (httpEffect, { credential }) {
-            const request = yield* HttpServerRequest.HttpServerRequest;
-            yield* authorizeOwnerRequest({
-                credential: Redacted.value(credential),
-                fetchSite: request.headers["sec-fetch-site"],
-                method: request.method,
-                origin: request.headers.origin
-            }, secrets);
+        ownerCookie: Effect.fn("AgentUsage.ownerCookie")(function* (httpEffect, { credential }) {
+            yield* session.authorizeHttp(Redacted.value(credential)).pipe(Effect.catchTags({
+                OwnerSessionForbiddenError: ({ message }) => Effect.fail(new ForbiddenApiError({ message })),
+                OwnerSessionUnauthorizedError: ({ message }) => Effect.fail(new UnauthorizedApiError({ message }))
+            }));
             return yield* httpEffect;
         })
     });
 }));
-/** The one route outside the authenticated API: spending the printed code for a session. */
-export const OwnerSessionBootstrapRouter = HttpRouter.use((router) => router.add("POST", "/auth/bootstrap", Effect.gen(function* () {
-    const secrets = yield* OwnerSessionSecrets;
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const result = yield* Effect.result(authorizeBootstrapRequest({ authorization: request.headers.authorization, origin: request.headers.origin }, secrets));
-    if (result._tag === "Failure") {
-        return HttpServerResponse.text(result.failure.message, {
-            status: result.failure._tag === "UnauthorizedApiError" ? 401 : 403
-        });
-    }
-    return yield* HttpServerResponse.json({}, {
-        headers: { "cache-control": "no-store", "set-cookie": ownerSessionCookie(secrets) },
-        status: 200
-    });
-})));
 //# sourceMappingURL=OwnerSession.js.map

package/dist/server/OwnerSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"OwnerSession.js","sourceRoot":"","sources":["../../src/server/OwnerSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAEpF,kGAAkG;AAClG,MAAM,yBAAyB,GAAG,MAAM,CAAA;AAExC;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEhC,4EAA4E;AAC5E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvD;;;GAGG;AACH,MAAM,eAAe,GAAG,uBAAuB,CAAA;AA4B/C,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,wCAAwC,CAAC;CAAG;AAEhD,MAAM,OAAO,uBAAwB,SAAQ,MAAM,CAAC,WAAW,EAA2B,CACxF,yBAAyB,EACzB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAClD;CAAG;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9D,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAA;AAEpG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE,CAC3E,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAA;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAClF,QAAQ,CAAC,EAAC,MAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,CAAC;QACtG,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC1G,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;YACxC,OAAO,EAAE,8DAA8D;YACvE,MAAM;SACP,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CACF,CAAA;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAC9E,QAAQ,CAAC,EAAC,gBAAoC,EAAE,eAAuB;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC/D,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAA;IACjE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;YACxC,OAAO,EAAE,uEAAuE;YAChF,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAC1E,QAAQ,CAAC,EAAC,eAAuB,EAAE,sBAA+B;IAChE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAA;IACnF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAA;IAC7C,OAAO,mBAAmB,CAAC,EAAE,CAAC;QAC5B,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAA4B,SAAS,CAAC;QAChE,qBAAqB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwB,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACjG,aAAa;QACb,UAAU;KACX,CAAC,CAAA;AACJ,CAAC,CACF,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CACxE,QAAQ,CAAC,EAAC,OAAoC;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;IAC9D,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/E,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IACjF,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;AACtH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAwD,EAAU,EAAE,CACrG,yBAAyB,CAAC,OAAO,CAAC,UAAU,EAAE;IAC5C,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AASJ,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAC7E,QAAQ,CAAC,EAAC,OAAqB,EAAE,OAAoC;IACnE,IAAI,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAA;IAC3G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAA;IACnG,CAAC;IACD,IACE,OAAO,CAAC,SAAS,KAAK,YAAY;QAClC,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EACpF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAA;IACvG,CAAC;IACD,iGAAiG;IACjG,6DAA6D;IAC7D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;IACpF,CAAC;AACH,CAAC,CACF,CAAA;AAID,MAAM,WAAW,GAAG,CAAC,aAAiC,EAAsB,EAAE,CAC5E,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;IAChE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;IACvC,CAAC,CAAC,SAAS,CAAA;AAEf,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CACnF,QAAQ,CAAC,EACP,OAA4F,EAC5F,OAAoC;IAEpC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAA;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjD,+FAA+F;IAC/F,iDAAiD;IACjD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CACtB,OAAO,CAAC,qBAAqB,EAC7B,CAAC,KAAK,EAAwD,EAAE;QAC9D,IAAI,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,IAAI,sBAAsB;YAAE,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAClG,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAC7D,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAA;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,SAAS,EAAE;oBACjB,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;oBAC1E,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,SAAS,KAAK,aAAa;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC1F,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,CACF,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,KAAK,EACL,GAAG,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChF,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC3B,CAAC;YACD,MAAM,IAAI,GAAG,uBAAuB,CAClC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EACrF,GAAG,CACJ,CAAA;YACD,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC3E,CAAC,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAM;QACnC,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS;YACpC,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,QAAQ,KAAK,UAAU;gBACzB,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,kCAAkC,CAAA;QACtC,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC,CAAC,EACJ,GAAG,EAAE,CACH,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAClH,CAAA;AACH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAChD,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;YAC1D,KAAK,CAAC,CAAC,qBAAqB,CAC1B;gBACE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;aAC/B,EACD,OAAO,CACR,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CACF;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CACR,MAAM,EACN,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CACjC,yBAAyB,CACvB,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAChF,OAAO,CACR,CACF,CAAA;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;YACrD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SACnE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;QACxC,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACnF,MAAM,EAAE,GAAG;KACZ,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CACF,CAAA"}
+{"version":3,"file":"OwnerSession.js","sourceRoot":"","sources":["../../src/server/OwnerSession.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAe,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAEpF,yGAAyG;AACzG,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CACtE,QAAQ,CAAC,EACP,eAAuB,EACvB,sBAA+B;IAM/B,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;QAC9B,eAAe;QACf,aAAa,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,eAAe,CAAC;QAC/F,UAAU,EAAE,mBAAmB;QAC/B,YAAY,EAAE,yCAAyC;QACvD,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,MAAM;KACf,CAAC,CAAA;AACJ,CAAC,CACF,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAyC,EAAE,EAAE,CAC5E,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAA;AAEzG,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,YAAY,CAAA;IAChD,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YACnF,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,SAAS,CAAC;gBACf,0BAA0B,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5F,6BAA6B,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;aACnG,CAAC,CACH,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA"}

package/dist/server/Server.d.ts

@@ -1,14 +1,14 @@
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
 import { Config, Deferred, Layer, Schema } from "effect";
 import type { AgentUsageConfig } from "./Config.js";
-import { type OwnerSessionSecretsContract } from "./OwnerSession.js";
 export interface AgentUsageServerOptions {
     readonly config: AgentUsageConfig;
     readonly hostname?: string;
     readonly port: number;
     readonly ready?: Deferred.Deferred<string>;
-    readonly security: OwnerSessionSecretsContract;
+    readonly security: OwnerSession.OwnerSessionService;
 }
-export declare const makeServer: (options: AgentUsageServerOptions) => Layer.Layer<never, import("@knpkv/browser-pairing").BrowserPairingError | Schema.SchemaError | import("effect/http/HttpServerError").ServeError | import("./ControlSocket.js").ServerAlreadyRunning | import("./ControlSocket.js").SocketPathUnsafe | import("./ControlSocket.js").SocketRefused | import("../core/Store.js").StoreError, import("effect/Crypto").Crypto>;
+export declare const makeServer: (options: AgentUsageServerOptions) => Layer.Layer<never, import("@knpkv/browser-pairing").BrowserPairingError | Schema.SchemaError | import("effect/http/HttpServerError").ServeError | import("./ControlSocket.js").ServerAlreadyRunning | import("./ControlSocket.js").SocketPathUnsafe | import("./ControlSocket.js").SocketRefused | import("../core/Store.js").StoreError, never>;
 /** The port to bind: next to jcf-web's 3111. */
 export declare const Port: Config.Config<number>;
 /** Set by `pnpm dev` so the printed URL points at the Vite dev server that proxies here. */

package/dist/server/Server.js

@@ -11,6 +11,7 @@
  * @module
  */
 import { NodeHttpServer, NodeServices } from "@effect/platform-node";
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
 import { Config, Deferred, Effect, Layer, Schema } from "effect";
 import { Etag, FetchHttpClient, HttpPlatform, HttpRouter } from "effect/http";
 import * as Reactivity from "effect/reactivity/Reactivity";
@@ -20,7 +21,7 @@ import { databaseLayer } from "../core/Database.js";
 import { acliTicketSearch } from "../core/Tickets.js";
 import { controlSocket } from "./ControlSocket.js";
 import { application } from "./HttpApplication.js";
-import { mintBootstrapUrl, OwnerSessionSecrets } from "./OwnerSession.js";
+import { mintBootstrapUrl } from "./OwnerSession.js";
 import { backgroundLayer, RuntimeState } from "./Runtime.js";
 const HttpPlatformLive = HttpPlatform.layer.pipe(Layer.provide(NodeServices.layer));
 const LoopbackHostname = Schema.Literals(["127.0.0.1", "localhost", "::1"]);
@@ -41,7 +42,7 @@ export const makeServer = (options) => Layer.unwrap(Effect.gen(function* () {
     const services = Layer.mergeAll(store, RuntimeState.layer(options.config.roots.machine, options.config.projects));
     // Bound only once the control layer holds the store's lock.
     const listener = NodeHttpServer.layerServer(createServer, { host: hostname, port: options.port }).pipe(Layer.provide(control));
-    return Layer.mergeAll(HttpRouter.serve(application), background(options.config)).pipe(Layer.provide(services), Layer.provide(listener), Layer.provide(Etag.layer), Layer.provide(HttpPlatformLive), Layer.provide(FetchHttpClient.layer), Layer.provide(NodeServices.layer), Layer.provide(Layer.succeed(OwnerSessionSecrets, options.security)), Layer.tap(() => 
+    return Layer.mergeAll(HttpRouter.serve(application), background(options.config)).pipe(Layer.provide(services), Layer.provide(listener), Layer.provide(Etag.layer), Layer.provide(HttpPlatformLive), Layer.provide(FetchHttpClient.layer), Layer.provide(NodeServices.layer), Layer.provide(Layer.succeed(OwnerSession.OwnerSession, options.security)), Layer.tap(() => 
     // The startup link: minted only once the server is listening, handed to whoever prints it.
     mintBootstrapUrl(options.security).pipe(Effect.tap(() => Deferred.succeed(listening, undefined)), Effect.flatMap((url) => options.ready === undefined ? Effect.void : Deferred.succeed(options.ready, url)))));
 }));

package/dist/server/Server.js.map

@@ -1 +1 @@
-{"version":3,"file":"Server.js","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAoC,MAAM,mBAAmB,CAAA;AAC3G,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE5D,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;AACnF,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;AAU3E,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,MAAwB,EAAE,EAAE,CAC9C,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACnE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAA;IAC5C,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;AACvE,CAAC,CAAC,CAAC,CAAA;AAEL,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgC,EAAE,EAAE,CAC7D,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAA;IACrG,qFAAqF;IACrF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAA;IAC9C,6FAA6F;IAC7F,qFAAqF;IACrF,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CACjC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC1F,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAClC,CAAA;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAC7B,KAAK,EACL,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC1E,CAAA;IACD,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACpG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CACvB,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACnF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EACjC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EACnE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;IACb,2FAA2F;IAC3F,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EACxD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAC1G,CACF,CACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAA"}
+{"version":3,"file":"Server.js","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE5D,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;AACnF,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;AAU3E,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,MAAwB,EAAE,EAAE,CAC9C,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACnE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAA;IAC5C,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;AACvE,CAAC,CAAC,CAAC,CAAA;AAEL,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgC,EAAE,EAAE,CAC7D,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAA;IACrG,qFAAqF;IACrF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAA;IAC9C,6FAA6F;IAC7F,qFAAqF;IACrF,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CACjC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC1F,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAClC,CAAA;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAC7B,KAAK,EACL,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC1E,CAAA;IACD,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACpG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CACvB,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACnF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EACjC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EACzE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;IACb,2FAA2F;IAC3F,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EACxD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAC1G,CACF,CACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAA"}