@knpkv/codecommit-web 0.15.0 → 0.17.0

package/dist/server/internal/OwnerSessionSecurity.js

@@ -1,11 +1,14 @@
-import { Clock, Context, Crypto, Effect, Layer, Redacted, Ref, Schema } from "effect";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import { credentialValuesEqual, decideOneTimeCredential, expiresAt, issueCsrfToken, issuePairingCode, issueSessionToken, serializeCredentialCookie } from "@knpkv/browser-pairing";
+import { Clock, Context, Effect, Layer, Redacted, Ref, Schema } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "../Api.js";
 export class OwnerSessionSecrets extends Context.Service()("@knpkv/codecommit-web/OwnerSessionSecrets") {
 }
 export class UnsafeServerHostnameError extends Schema.TaggedError()("UnsafeServerHostnameError", { hostname: Schema.String, message: Schema.String }) {
 }
 const safeMethods = new Set(["GET", "HEAD", "OPTIONS"]);
+const MAX_BOOTSTRAP_FAILURES = 5;
+const authenticatedDevPublicOrigin = "http://localhost:5173";
 export const isLoopbackHostname = (hostname) => hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
 export const requireLoopbackHostname = Effect.fn("OwnerSessionSecurity.requireLoopbackHostname")(function* (hostname) {
     if (!isLoopbackHostname(hostname)) {
@@ -16,25 +19,29 @@ export const requireLoopbackHostname = Effect.fn("OwnerSessionSecurity.requireLo
     }
     return hostname;
 });
-export const makeOwnerSessionSecrets = Effect.fn("OwnerSessionSecurity.makeSecrets")(function* () {
-    const cryptoService = yield* Crypto.Crypto;
+export const makeOwnerSessionSecrets = Effect.fn("OwnerSessionSecurity.makeSecrets")(function* (authorityOrigin) {
+    const validatedAuthorityOrigin = yield* requireLoopbackOrigin(authorityOrigin);
     const [ownerToken, csrfToken, bootstrapToken] = yield* Effect.all([
-        cryptoService.randomUUIDv4,
-        cryptoService.randomUUIDv4,
-        cryptoService.randomUUIDv4
+        issueSessionToken(),
+        issueCsrfToken(),
+        issuePairingCode()
     ]);
     const bootstrapAvailable = yield* Ref.make(true);
+    const bootstrapAttemptState = yield* Ref.make({ failedAttempts: 0, inFlight: 0 });
     return OwnerSessionSecrets.of({
-        ownerToken: Redacted.make(ownerToken),
-        csrfToken: Redacted.make(csrfToken),
-        bootstrapToken: Redacted.make(bootstrapToken),
+        authorityOrigin: validatedAuthorityOrigin,
+        ownerToken,
+        csrfToken,
+        bootstrapToken,
         bootstrapAvailable,
+        bootstrapAttemptState,
         bootstrapExpiresAtMillis: yield* Ref.make(undefined)
     });
 });
 export const activateOwnerSessionBootstrap = Effect.fn("OwnerSessionSecurity.activateBootstrap")(function* (secrets) {
     const now = yield* Clock.currentTimeMillis;
-    yield* Ref.set(secrets.bootstrapExpiresAtMillis, now + 60_000);
+    const expiry = yield* expiresAt(now, 60_000);
+    yield* Ref.set(secrets.bootstrapExpiresAtMillis, expiry);
 });
 export const ownerSessionOrigin = (hostname, port) => {
     const urlHostname = hostname === "::1" ? "[::1]" : hostname;
@@ -53,7 +60,11 @@ export const requireLoopbackOrigin = Effect.fn("OwnerSessionSecurity.requireLoop
             message: "CodeCommit public origin must be a valid loopback HTTP origin"
         })
     });
-    if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname) || url.pathname !== "/" || url.search || url.hash) {
+    if (url.protocol !== "http:" ||
+        !isLoopbackHostname(url.hostname) ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "") {
         return yield* new UnsafeServerHostnameError({
             hostname: origin,
             message: "CodeCommit public origin must be an HTTP loopback origin without a path, query, or fragment"
@@ -61,12 +72,39 @@ export const requireLoopbackOrigin = Effect.fn("OwnerSessionSecurity.requireLoop
     }
     return url.origin;
 });
-export const ownerSessionCookie = (secrets) => `cc_owner=${Redacted.value(secrets.ownerToken)}; HttpOnly; Path=/api; SameSite=Strict`;
+/** Validate the advertised origin against either the bound server or the supported Vite proxy. */
+export const requireSupportedPublicOrigin = Effect.fn("OwnerSessionSecurity.requireSupportedPublicOrigin")(function* (origin, authorityOrigin) {
+    const validatedOrigin = yield* requireLoopbackOrigin(origin);
+    const validatedAuthority = yield* requireLoopbackOrigin(authorityOrigin);
+    const authorityUrl = new URL(validatedAuthority);
+    const isSupportedProxy = validatedOrigin === authenticatedDevPublicOrigin &&
+        authorityUrl.protocol === "http:" && authorityUrl.hostname === "127.0.0.1";
+    if (validatedOrigin !== validatedAuthority && !isSupportedProxy) {
+        return yield* new UnsafeServerHostnameError({
+            hostname: origin,
+            message: "CodeCommit public origin must be the bound server or its supported Vite proxy"
+        });
+    }
+    return validatedOrigin;
+});
+export const resolvePublicOrigin = Effect.fn("OwnerSessionSecurity.resolvePublicOrigin")(function* (configuredOrigin, authorityOrigin) {
+    return configuredOrigin === undefined
+        ? yield* requireLoopbackOrigin(authorityOrigin)
+        : yield* requireSupportedPublicOrigin(configuredOrigin, authorityOrigin);
+});
+export const ownerSessionCookie = (secrets) => serializeCredentialCookie(secrets.ownerToken, {
+    name: "cc_owner",
+    httpOnly: true,
+    path: "/api",
+    sameSite: "strict",
+    secure: false
+});
 export const authorizeOwnerRequest = Effect.fn("OwnerSessionSecurity.authorizeRequest")(function* (request, secrets) {
-    if (request.credential !== Redacted.value(secrets.ownerToken)) {
+    const ownerCredentialMatches = credentialValuesEqual(request.credential, Redacted.value(secrets.ownerToken)) === true;
+    if (!ownerCredentialMatches) {
         return yield* new UnauthorizedApiError({ message: "Missing or invalid owner session" });
     }
-    const sameOrigin = request.host !== undefined && request.origin === `http://${request.host}`;
+    const sameOrigin = request.origin !== undefined && request.origin === secrets.authorityOrigin;
     if (request.origin !== undefined && !sameOrigin) {
         return yield* new ForbiddenApiError({ message: "Request origin does not match the CodeCommit server" });
     }
@@ -77,29 +115,68 @@ export const authorizeOwnerRequest = Effect.fn("OwnerSessionSecurity.authorizeRe
     if (!sameOrigin) {
         return yield* new ForbiddenApiError({ message: "Mutation origin does not match the CodeCommit server" });
     }
-    if (request.csrfToken !== Redacted.value(secrets.csrfToken)) {
+    const csrfTokenMatches = request.csrfToken !== undefined &&
+        credentialValuesEqual(request.csrfToken, Redacted.value(secrets.csrfToken)) === true;
+    if (!csrfTokenMatches) {
         return yield* new ForbiddenApiError({ message: "Missing or invalid CSRF token" });
     }
 });
 export const authorizeBootstrapRequest = Effect.fn("OwnerSessionSecurity.authorizeBootstrap")(function* (request, secrets) {
-    if (request.authorization !== `Bearer ${Redacted.value(secrets.bootstrapToken)}`) {
-        return yield* new UnauthorizedApiError({ message: "Missing or invalid bootstrap token" });
-    }
-    if (request.host === undefined || request.origin !== `http://${request.host}`) {
+    if (request.origin !== secrets.authorityOrigin) {
         return yield* new ForbiddenApiError({ message: "Bootstrap origin does not match the CodeCommit server" });
     }
-    const expiresAt = yield* Ref.get(secrets.bootstrapExpiresAtMillis);
-    if (expiresAt === undefined) {
-        return yield* new UnauthorizedApiError({ message: "Bootstrap token is not active" });
-    }
-    const now = yield* Clock.currentTimeMillis;
-    if (now >= expiresAt) {
-        return yield* new UnauthorizedApiError({ message: "Bootstrap token has expired" });
-    }
-    const available = yield* Ref.getAndSet(secrets.bootstrapAvailable, false);
-    if (!available) {
-        return yield* new UnauthorizedApiError({ message: "Bootstrap token has already been used" });
-    }
+    const suppliedToken = request.authorization !== undefined && request.authorization.startsWith("Bearer ")
+        ? request.authorization.slice("Bearer ".length)
+        : undefined;
+    const acquireAdmission = Ref.modify(secrets.bootstrapAttemptState, (state) => {
+        if (state.failedAttempts + state.inFlight >= MAX_BOOTSTRAP_FAILURES) {
+            return ["unavailable", state];
+        }
+        const bootstrapTokenMatches = suppliedToken !== undefined &&
+            credentialValuesEqual(suppliedToken, Redacted.value(secrets.bootstrapToken)) === true;
+        if (!bootstrapTokenMatches) {
+            return ["invalid", {
+                    failedAttempts: Math.min(MAX_BOOTSTRAP_FAILURES, state.failedAttempts + 1),
+                    inFlight: state.inFlight
+                }];
+        }
+        return ["accepted", { ...state, inFlight: state.inFlight + 1 }];
+    }).pipe(Effect.flatMap((admission) => {
+        if (admission === "unavailable") {
+            return Effect.fail(new UnauthorizedApiError({ message: "Bootstrap confirmation temporarily unavailable" }));
+        }
+        if (admission === "invalid") {
+            return Effect.fail(new UnauthorizedApiError({ message: "Missing or invalid bootstrap token" }));
+        }
+        return Effect.void;
+    }));
+    return yield* Effect.acquireUseRelease(acquireAdmission, () => Effect.gen(function* () {
+        const expiresAt = yield* Ref.get(secrets.bootstrapExpiresAtMillis);
+        if (expiresAt === undefined) {
+            return yield* new UnauthorizedApiError({ message: "Bootstrap token is not active" });
+        }
+        const now = yield* Clock.currentTimeMillis;
+        const decision = yield* Ref.modify(secrets.bootstrapAvailable, (available) => {
+            const state = {
+                expiresAt,
+                consumedAt: available ? null : 0,
+                revokedAt: null
+            };
+            const next = decideOneTimeCredential(state, now);
+            return [next, next === "accepted" ? false : available];
+        });
+        if (decision === "expired")
+            return yield* new UnauthorizedApiError({ message: "Bootstrap token has expired" });
+        if (decision === "consumed") {
+            return yield* new UnauthorizedApiError({ message: "Bootstrap token has already been used" });
+        }
+        if (decision === "invalid") {
+            return yield* new UnauthorizedApiError({ message: "Bootstrap token state is invalid" });
+        }
+    }), () => Ref.update(secrets.bootstrapAttemptState, (state) => ({
+        ...state,
+        inFlight: Math.max(0, state.inFlight - 1)
+    })));
 });
 export const ownerSessionAuthLayer = Layer.effect(OwnerSessionAuth, Effect.gen(function* () {
     const secrets = yield* OwnerSessionSecrets;

package/dist/server/internal/OwnerSessionSecurity.js.map

@@ -1 +1 @@
-{"version":3,"file":"OwnerSessionSecurity.js","sourceRoot":"","sources":["../../../src/server/internal/OwnerSessionSecurity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACrF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAUrF,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,2CAA2C,CAAC;CAAG;AAEnD,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CACpD;CAAG;AAEJ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9D,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAA;AAEpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,8CAA8C,CAAC,CAC9F,QAAQ,CAAC,EAAC,QAAgB;IACxB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ;YACR,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC;IAC5F,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAC1C,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAChE,aAAa,CAAC,YAAY;QAC1B,aAAa,CAAC,YAAY;QAC1B,aAAa,CAAC,YAAY;KAC3B,CAAC,CAAA;IACF,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,OAAO,mBAAmB,CAAC,EAAE,CAAC;QAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QACrC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;QAC7C,kBAAkB;QAClB,wBAAwB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,SAAS,CAAC;KACzE,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,wCAAwC,CAAC,CAC9F,QAAQ,CAAC,EAAC,OAAoC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,GAAG,MAAM,CAAC,CAAA;AAChE,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE;IAC3E,MAAM,WAAW,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3D,OAAO,UAAU,WAAW,IAAI,IAAI,GAAG,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,IAAY,EACZ,OAAoC,EAC5B,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAAc,EACd,OAA4D,EACpD,EAAE;IACV,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAA;IACjF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,cAAc,EAAE,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,4CAA4C,CAAC,CAC1F,QAAQ,CAAC,EAAC,MAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,yBAAyB,CAAC;YAC5B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,+DAA+D;SACzE,CAAC;KACL,CAAC,CAAA;IACF,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAC/G,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAwD,EAChD,EAAE,CAAC,YAAY,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,wCAAwC,CAAA;AAUnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CACrF,QAAQ,CAAC,EAAC,OAAkC,EAAE,OAAoC;IAChF,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,OAAO,CAAC,IAAI,EAAE,CAAA;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC,CACF,CAAA;AAQD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAC3F,QAAQ,CAAC,EAAC,OAA+B,EAAE,OAAoC;IAC7E,IAAI,OAAO,CAAC,aAAa,KAAK,UAAU,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;IACzE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;IAC9F,CAAC;AACH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CACxD,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;YAC1D,KAAK,CAAC,CAAC,qBAAqB,CAC1B;gBACE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;aAC/B,EACD,OAAO,CACR,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CACF;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CACR,MAAM,EACN,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,aAAa,GAAG,yBAAyB,CAC7C;QACE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;KAC/B,EACD,OAAO,CACR,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAA;QAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5C,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SAC1D,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;QACtF,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC;SAC1C;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CACF,CAAA"}
+{"version":3,"file":"OwnerSessionSecurity.js","sourceRoot":"","sources":["../../../src/server/internal/OwnerSessionSecurity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAkBrF,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,2CAA2C,CAAC;CAAG;AAEnD,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CACpD;CAAG;AAEJ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AACvD,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAChC,MAAM,4BAA4B,GAAG,uBAAuB,CAAA;AAG5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9D,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAA;AAEpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,8CAA8C,CAAC,CAC9F,QAAQ,CAAC,EAAC,QAAgB;IACxB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ;YACR,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAClF,QAAQ,CAAC,EAAC,eAAuB;IAC/B,MAAM,wBAAwB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC9E,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAChE,iBAAiB,EAAE;QACnB,cAAc,EAAE;QAChB,gBAAgB,EAAE;KACnB,CAAC,CAAA;IACF,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwB,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IACxG,OAAO,mBAAmB,CAAC,EAAE,CAAC;QAC5B,eAAe,EAAE,wBAAwB;QACzC,UAAU;QACV,SAAS;QACT,cAAc;QACd,kBAAkB;QAClB,qBAAqB;QACrB,wBAAwB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,SAAS,CAAC;KACzE,CAAC,CAAA;AACJ,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,wCAAwC,CAAC,CAC9F,QAAQ,CAAC,EAAC,OAAoC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAA;AAC1D,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE;IAC3E,MAAM,WAAW,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3D,OAAO,UAAU,WAAW,IAAI,IAAI,GAAG,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,IAAY,EACZ,OAAoC,EAC5B,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAAc,EACd,OAA4D,EACpD,EAAE;IACV,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAA;IACjF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,cAAc,EAAE,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,4CAA4C,CAAC,CAC1F,QAAQ,CAAC,EAAC,MAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,yBAAyB,CAAC;YAC5B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,+DAA+D;SACzE,CAAC;KACL,CAAC,CAAA;IACF,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CACF,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,EAAE,CAAC,mDAAmD,CAAC,CACxG,QAAQ,CAAC,EAAC,MAAc,EAAE,eAAuB;IAC/C,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IACxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAChD,MAAM,gBAAgB,GAAG,eAAe,KAAK,4BAA4B;QACvE,YAAY,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,QAAQ,KAAK,WAAW,CAAA;IAC5E,IAAI,eAAe,KAAK,kBAAkB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,+EAA+E;SACzF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,0CAA0C,CAAC,CACtF,QAAQ,CAAC,EAAC,gBAAoC,EAAE,eAAuB;IACrE,OAAO,gBAAgB,KAAK,SAAS;QACnC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC;QAC/C,CAAC,CAAC,KAAK,CAAC,CAAC,4BAA4B,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAA;AAC5E,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAwD,EAChD,EAAE,CACV,yBAAyB,CAAC,OAAO,CAAC,UAAU,EAAE;IAC5C,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AAUJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CACrF,QAAQ,CAAC,EAAC,OAAkC,EAAE,OAAoC;IAChF,MAAM,sBAAsB,GAC1B,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAA;IACxF,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,eAAe,CAAA;IAC7F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS;QACtD,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;IACtF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC,CACF,CAAA;AAQD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAC3F,QAAQ,CAAC,EAAC,OAA+B,EAAE,OAAoC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QACtG,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CACjC,OAAO,CAAC,qBAAqB,EAC7B,CAAC,KAAK,EAAwD,EAAE;QAC9D,IAAI,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,IAAI,sBAAsB,EAAE,CAAC;YACpE,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,qBAAqB,GAAG,aAAa,KAAK,SAAS;YACvD,qBAAqB,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,CAAA;QACvF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,CAAC,SAAS,EAAE;oBACjB,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;oBAC1E,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC3B,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAA;QACjG,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC,CAAC,CACH,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,gBAAgB,EAChB,GAAG,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,EAAE;YAC3E,MAAM,KAAK,GAAG;gBACZ,SAAS;gBACT,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChC,SAAS,EAAE,IAAI;aAChB,CAAA;YACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAChD,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;QAC9G,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;QACzF,CAAC;IACH,CAAC,CAAC,EACJ,GAAG,EAAE,CACH,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,KAAK;QACR,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;KAC1C,CAAC,CAAC,CACN,CAAA;AACH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CACxD,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;YAC1D,KAAK,CAAC,CAAC,qBAAqB,CAC1B;gBACE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;aAC/B,EACD,OAAO,CACR,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CACF;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CACR,MAAM,EACN,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,aAAa,GAAG,yBAAyB,CAC7C;QACE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;KAC/B,EACD,OAAO,CACR,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAA;QAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5C,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SAC1D,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;QACtF,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC;SAC1C;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CACF,CAAA"}

package/dist/server/internal/PublicOrigin.d.ts

@@ -0,0 +1,9 @@
+import { Effect } from "effect";
+import { type OwnerSessionSecretsContract } from "./OwnerSessionSecurity.js";
+/** Resolve the advertised origin for one concrete server bind attempt. */
+export declare const resolveCodeCommitPublicOrigin: (configuredOrigin: string | undefined, port: number) => Effect.Effect<string, import("./OwnerSessionSecurity.js").UnsafeServerHostnameError, never>;
+/** Resolve the startup origin before constructing the token-bearing bootstrap URL. */
+export declare const resolveCodeCommitBootstrapUrl: (configuredOrigin: string | undefined, port: number, secrets: OwnerSessionSecretsContract) => Effect.Effect<string, import("./OwnerSessionSecurity.js").UnsafeServerHostnameError, never>;
+/** Keep a retrying backend off the stale Vite proxy port; advertise it directly. */
+export declare const resolveCodeCommitBootstrapUrlForBind: (configuredOrigin: string | undefined, requestedPort: number, actualPort: number, secrets: OwnerSessionSecretsContract) => Effect.Effect<string, import("./OwnerSessionSecurity.js").UnsafeServerHostnameError, never>;
+//# sourceMappingURL=PublicOrigin.d.ts.map

package/dist/server/internal/PublicOrigin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicOrigin.d.ts","sourceRoot":"","sources":["../../../src/server/internal/PublicOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAEL,KAAK,2BAA2B,EAGjC,MAAM,2BAA2B,CAAA;AAElC,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,qJAIzC,CAAA;AAED,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,2LAKzC,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,oCAAoC,wNAUhD,CAAA"}

package/dist/server/internal/PublicOrigin.js

@@ -0,0 +1,17 @@
+import { Effect } from "effect";
+import { ownerSessionOrigin, ownerSessionUrlForOrigin, resolvePublicOrigin } from "./OwnerSessionSecurity.js";
+/** Resolve the advertised origin for one concrete server bind attempt. */
+export const resolveCodeCommitPublicOrigin = Effect.fn("CodeCommitServer.resolvePublicOrigin")(function* (configuredOrigin, port) {
+    return yield* resolvePublicOrigin(configuredOrigin, ownerSessionOrigin("127.0.0.1", port));
+});
+/** Resolve the startup origin before constructing the token-bearing bootstrap URL. */
+export const resolveCodeCommitBootstrapUrl = Effect.fn("CodeCommitServer.resolveBootstrapUrl")(function* (configuredOrigin, port, secrets) {
+    const publicOrigin = yield* resolveCodeCommitPublicOrigin(configuredOrigin, port);
+    return ownerSessionUrlForOrigin(publicOrigin, secrets);
+});
+/** Keep a retrying backend off the stale Vite proxy port; advertise it directly. */
+export const resolveCodeCommitBootstrapUrlForBind = Effect.fn("CodeCommitServer.resolveBootstrapUrlForBind")(function* (configuredOrigin, requestedPort, actualPort, secrets) {
+    const originOverride = requestedPort === actualPort ? configuredOrigin : undefined;
+    return yield* resolveCodeCommitBootstrapUrl(originOverride, actualPort, secrets);
+});
+//# sourceMappingURL=PublicOrigin.js.map

package/dist/server/internal/PublicOrigin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicOrigin.js","sourceRoot":"","sources":["../../../src/server/internal/PublicOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EACL,kBAAkB,EAElB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,2BAA2B,CAAA;AAElC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,sCAAsC,CAAC,CAC5F,QAAQ,CAAC,EAAC,gBAAoC,EAAE,IAAY;IAC1D,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;AAC5F,CAAC,CACF,CAAA;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,sCAAsC,CAAC,CAC5F,QAAQ,CAAC,EAAC,gBAAoC,EAAE,IAAY,EAAE,OAAoC;IAChG,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IACjF,OAAO,wBAAwB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;AACxD,CAAC,CACF,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC,EAAE,CAAC,6CAA6C,CAAC,CAC1G,QAAQ,CAAC,EACP,gBAAoC,EACpC,aAAqB,EACrB,UAAkB,EAClB,OAAoC;IAEpC,MAAM,cAAc,GAAG,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAA;IAClF,OAAO,KAAK,CAAC,CAAC,6BAA6B,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AAClF,CAAC,CACF,CAAA"}

package/dist/server/review/PullRequestReview.d.ts

@@ -4,9 +4,9 @@ import { createTwoFilesPatch } from "diff";
 import { Cause, Effect, Option, Schema, Stream } from "effect";
 import * as Crypto from "effect/Crypto";
 import * as FileSystem from "effect/FileSystem";
+import type * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 import type * as Semaphore from "effect/Semaphore";
-import type * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
-import { type PullRequestRelayReviewResponse, type RelayReviewConversationTurn, type RelayReviewKind, type RelayReviewProfile, type RelayReviewProgressPhase, RelayReviewResult, type RelayReviewStreamEvent } from "../Api.js";
+import { type PullRequestRelayReviewResponse, RelayExplainResult, RelayNativeReviewResult, type RelayReviewConversationTurn, type RelayReviewKind, type RelayReviewProfile, type RelayReviewProgressPhase, RelayReviewResult, type RelayReviewStreamEvent } from "../Api.js";
 import type { RelayFindingPublisherService } from "./RelayFindingPublisher.js";
 declare const PullRequestReviewError_base: Schema.Class<PullRequestReviewError, Schema.TaggedStruct<"PullRequestReviewError", {
     readonly operation: Schema.String;
@@ -87,17 +87,72 @@ export declare const withRelayReviewPermit: <A, E, R>(semaphore: Semaphore.Semap
 export declare const withRelayReviewStreamPermit: <A, E, R>(semaphore: Semaphore.Semaphore, stream: Stream.Stream<A, E, R>) => Stream.Stream<A, E | PullRequestReviewError, R>;
 /** Host-authored Relay prompt; repository content is isolated as untrusted evidence. */
 export declare const makeRelayReviewPrompt: (scope: ExactReviewScope, kind: RelayReviewKind, patch: string, skillPrompt?: string) => string;
+declare const RelayReviewConversationResult: Schema.Struct<{
+    readonly reply: Schema.String;
+    readonly review: Schema.Struct<{
+        readonly findings: Schema.$Array<Schema.Struct<{
+            readonly id: Schema.String;
+            readonly priority: Schema.Literals<readonly ["P1", "P2", "P3", "P4"]>;
+            readonly title: Schema.String;
+            readonly summary: Schema.String;
+            readonly details: Schema.String;
+            readonly recommendation: Schema.String;
+            readonly verification: Schema.String;
+            readonly publicationTarget: Schema.Literals<readonly ["pr-comment", "line-comment"]>;
+            readonly location: Schema.Union<readonly [Schema.Struct<{
+                readonly scope: Schema.Literal<"general">;
+            }>, Schema.Struct<{
+                readonly scope: Schema.Literal<"file">;
+                readonly filePath: Schema.String;
+            }>, Schema.Struct<{
+                readonly scope: Schema.Literal<"line">;
+                readonly filePath: Schema.String;
+                readonly line: Schema.Int;
+                readonly side: Schema.Literals<readonly ["before", "after"]>;
+            }>]>;
+        }>>;
+        readonly verdict: Schema.String;
+    }>;
+}>;
+declare const RelayExplainConversationResult: Schema.Struct<{
+    readonly reply: Schema.String;
+    readonly review: Schema.Struct<{
+        readonly findings: Schema.$Array<Schema.Struct<{
+            readonly id: Schema.String;
+            readonly priority: Schema.Literals<readonly ["P1", "P2", "P3", "P4"]>;
+            readonly title: Schema.String;
+            readonly summary: Schema.String;
+            readonly details: Schema.String;
+            readonly recommendation: Schema.String;
+            readonly verification: Schema.String;
+            readonly publicationTarget: Schema.Literals<readonly ["pr-comment", "line-comment"]>;
+            readonly location: Schema.Union<readonly [Schema.Struct<{
+                readonly scope: Schema.Literal<"general">;
+            }>, Schema.Struct<{
+                readonly scope: Schema.Literal<"file">;
+                readonly filePath: Schema.String;
+            }>, Schema.Struct<{
+                readonly scope: Schema.Literal<"line">;
+                readonly filePath: Schema.String;
+                readonly line: Schema.Int;
+                readonly side: Schema.Literals<readonly ["before", "after"]>;
+            }>]>;
+        }>>;
+        readonly verdict: Schema.String;
+        readonly explanation: Schema.String;
+    }>;
+}>;
 /** Exact native output contract selected before the provider process starts. */
-export declare const relayReviewOutputSchema: (kind: RelayReviewKind) => Schema.Top;
+export declare const relayReviewOutputSchema: (kind: RelayReviewKind) => typeof RelayExplainResult | typeof RelayNativeReviewResult;
 export declare const parseRelayReviewResult: (message: string, kind: RelayReviewKind) => Option.Option<RelayReviewResult>;
 /** Execute one ephemeral, read-only Relay pass over the exact provider patch. */
 export declare const runPullRequestRelayReview: (client: ReadClient.CodeCommitReadClientService, pullRequest: Domain.PullRequest, expectedRevision: ExpectedReviewRevision, profile: {
     readonly id: string;
     readonly name: string;
     readonly kind: "explain" | "review" | "security" | "tests";
-    readonly provider: "codex";
-    readonly harness: "native-codex";
-    readonly model: "configured-default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
+    readonly provider: "claude" | "codex";
+    readonly harness: "native-claude" | "native-codex";
+    readonly model: "configured-default" | "default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
     readonly skillIds: readonly string[];
 }, changedFiles?: PullRequestChangedFilesSource | undefined, skillPrompt?: string | undefined, reportProgress?: RelayReviewProgressReporter | undefined) => Effect.Effect<{
     readonly pullRequestId: string & import("effect/Brand").Brand<"PullRequestId">;
@@ -109,9 +164,9 @@ export declare const runPullRequestRelayReview: (client: ReadClient.CodeCommitRe
         readonly id: string;
         readonly name: string;
         readonly kind: "explain" | "review" | "security" | "tests";
-        readonly provider: "codex";
-        readonly harness: "native-codex";
-        readonly model: "configured-default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
+        readonly provider: "claude" | "codex";
+        readonly harness: "native-claude" | "native-codex";
+        readonly model: "configured-default" | "default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
         readonly skillIds: readonly string[];
     };
     readonly result: {
@@ -140,7 +195,7 @@ export declare const runPullRequestRelayReview: (client: ReadClient.CodeCommitRe
         readonly explanation?: string | undefined;
     };
 }, PullRequestReviewError, ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem>;
-export declare const relayConversationOutputSchema: (kind: RelayReviewKind) => Schema.Top;
+export declare const relayConversationOutputSchema: (kind: RelayReviewKind) => typeof RelayExplainConversationResult | typeof RelayReviewConversationResult;
 /** Decode a conversation against the selected review kind without changing its wire shape. */
 export declare const parseRelayConversationResult: (message: string, kind: RelayReviewKind) => Option.Option<{
     readonly reply: string;
@@ -175,9 +230,9 @@ export declare const continuePullRequestRelayReview: (client: ReadClient.CodeCom
     readonly id: string;
     readonly name: string;
     readonly kind: "explain" | "review" | "security" | "tests";
-    readonly provider: "codex";
-    readonly harness: "native-codex";
-    readonly model: "configured-default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
+    readonly provider: "claude" | "codex";
+    readonly harness: "native-claude" | "native-codex";
+    readonly model: "configured-default" | "default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
     readonly skillIds: readonly string[];
 }, currentReview: {
     readonly findings: readonly {
@@ -219,9 +274,9 @@ export declare const continuePullRequestRelayReview: (client: ReadClient.CodeCom
             readonly id: string;
             readonly name: string;
             readonly kind: "explain" | "review" | "security" | "tests";
-            readonly provider: "codex";
-            readonly harness: "native-codex";
-            readonly model: "configured-default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
+            readonly provider: "claude" | "codex";
+            readonly harness: "native-claude" | "native-codex";
+            readonly model: "configured-default" | "default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
             readonly skillIds: readonly string[];
         };
         result: {
@@ -275,9 +330,9 @@ export declare const streamPullRequestRelayReview: (client: ReadClient.CodeCommi
             readonly id: string;
             readonly name: string;
             readonly kind: "explain" | "review" | "security" | "tests";
-            readonly provider: "codex";
-            readonly harness: "native-codex";
-            readonly model: "configured-default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
+            readonly provider: "claude" | "codex";
+            readonly harness: "native-claude" | "native-codex";
+            readonly model: "configured-default" | "default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
             readonly skillIds: readonly string[];
         };
         readonly result: {
@@ -329,9 +384,9 @@ export declare const streamPullRequestRelayConversation: (client: ReadClient.Cod
             readonly id: string;
             readonly name: string;
             readonly kind: "explain" | "review" | "security" | "tests";
-            readonly provider: "codex";
-            readonly harness: "native-codex";
-            readonly model: "configured-default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
+            readonly provider: "claude" | "codex";
+            readonly harness: "native-claude" | "native-codex";
+            readonly model: "configured-default" | "default" | "gpt-5.6-luna" | "gpt-5.6-sol" | "gpt-5.6-terra";
             readonly skillIds: readonly string[];
         };
         readonly result: {

package/dist/server/review/PullRequestReview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PullRequestReview.d.ts","sourceRoot":"","sources":["../../../src/server/review/PullRequestReview.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,MAAM,kCAAkC,CAAA;AAC/D,OAAO,KAAK,KAAK,UAAU,MAAM,sCAAsC,CAAA;AAEvE,OAAO,EAAE,mBAAmB,EAAc,MAAM,MAAM,CAAA;AACtD,OAAO,EAAS,KAAK,EAAQ,MAAM,EAAQ,MAAM,EAAoB,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACnG,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,SAAS,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,KAAK,mBAAmB,MAAM,6CAA6C,CAAA;AAEvF,OAAO,EAGL,KAAK,8BAA8B,EAGnC,KAAK,2BAA2B,EAEhC,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,KAAK,sBAAsB,EAC5B,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;;;;;;AAe9E,qBAAa,sBAAuB,SAAQ,2BAO3C;CAAG;AAEJ,UAAU,gBAAgB;IACxB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,6BAA6B,CAAA;CAC5D;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAWD,yEAAyE;AACzE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,EAAE,CACZ,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,QAAQ,EAAE,UAAU,CAAC,6BAA6B,KAC/C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,sBAAsB,CAAC,CAAA;CAC5F;AAaD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACzC;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,2BAA2B,GAAG,CAAC,QAAQ,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAsEhG,8DAA8D;AAC9D,eAAO,MAAM,iCAAiC;;;;;gBAwB5C,CAAA;AA6CF,wFAAwF;AACxF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;iCAc9B,CAAA;AA4CF,mFAAmF;AACnF,eAAO,MAAM,0BAA0B;;;;;;iCAwBrC,CAAA;AAsLF,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,yPA0CpC,CAAA;AAEF,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,6OAO5B,CAAA;AAEF,uFAAuF;AACvF,eAAO,MAAM,0BAA0B,WAC7B,iBAAiB,YACf,kBAAkB,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAmB5C,CAAA;AAED,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,aAChC,SAAS,CAAC,SAAS,UACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,sBAAsB,EAAE,CAAC,CAU9C,CAAA;AAEH,qEAAqE;AACrE,eAAO,MAAM,2BAA2B,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,aACtC,SAAS,CAAC,SAAS,UACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,sBAAsB,EAAE,CAAC,CAgB9C,CAAA;AAgBH,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,UACzB,gBAAgB,QACjB,eAAe,SACd,MAAM,gBACA,MAAM,KAClB,MAkCF,CAAA;AAiBD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,SAAU,eAAe,KAAG,MAAM,CAAC,GACJ,CAAA;AAEnE,eAAO,MAAM,sBAAsB,YACxB,MAAM,QACT,eAAe,KACpB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAOjC,CAAA;AAED,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FAwFpC,CAAA;AAYF,eAAO,MAAM,6BAA6B,SAAU,eAAe,KAAG,MAAM,CAAC,GACQ,CAAA;AAUrF,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,YAAa,MAAM,QAAQ,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;EAOlF,CAAA;AAED,eAAO,MAAM,2BAA2B,UAC/B,gBAAgB,QACjB,eAAe,SACd,MAAM,eACA,MAAM,iBACJ,OAAO,iBAAiB,CAAC,IAAI,SACrC,aAAa,CAAC,2BAA2B,CAAC,aACtC,MAAM,WACR,MAAM,KACd,MAgCF,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FA8FzC,CAAA;AAQF,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,GAAI,CAAC,EAAE,CAAC,OACzC,CAAC,MAAM,EAAE,2BAA2B,KAAK,MAAM,CAAC,MAAM,CACzD;IAAE,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5E,CAAC,EACD,CAAC,CACF,KACA,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAqB5C,CAAA;AAEL,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B,WAC/B,UAAU,CAAC,2BAA2B,eACjC,MAAM,CAAC,WAAW,oBACb,sBAAsB,WAC/B,kBAAkB,gBACb,6BAA6B,GAAG,SAAS,eAC1C,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAYlB,CAAA;AAEH,gFAAgF;AAChF,eAAO,MAAM,kCAAkC,WACrC,UAAU,CAAC,2BAA2B,eACjC,MAAM,CAAC,WAAW,oBACb,sBAAsB,WAC/B,kBAAkB,iBACZ,OAAO,iBAAiB,CAAC,IAAI,SACrC,aAAa,CAAC,2BAA2B,CAAC,aACtC,MAAM,WACR,MAAM,gBACD,6BAA6B,GAAG,SAAS,eAC1C,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAgBlB,CAAA;AA8CH,kGAAkG;AAClG,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;yCA4CtC,CAAA"}
+{"version":3,"file":"PullRequestReview.d.ts","sourceRoot":"","sources":["../../../src/server/review/PullRequestReview.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,MAAM,MAAM,kCAAkC,CAAA;AAC/D,OAAO,KAAK,KAAK,UAAU,MAAM,sCAAsC,CAAA;AAEvE,OAAO,EAAE,mBAAmB,EAAc,MAAM,MAAM,CAAA;AACtD,OAAO,EAAS,KAAK,EAAQ,MAAM,EAAQ,MAAM,EAAoB,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEnG,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,mBAAmB,MAAM,oCAAoC,CAAA;AAC9E,OAAO,KAAK,KAAK,SAAS,MAAM,kBAAkB,CAAA;AAElD,OAAO,EAGL,KAAK,8BAA8B,EACnC,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,2BAA2B,EAEhC,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,KAAK,sBAAsB,EAC5B,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;;;;;;AAqB9E,qBAAa,sBAAuB,SAAQ,2BAO3C;CAAG;AAEJ,UAAU,gBAAgB;IACxB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,6BAA6B,CAAA;CAC5D;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAWD,yEAAyE;AACzE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,EAAE,CACZ,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,QAAQ,EAAE,UAAU,CAAC,6BAA6B,KAC/C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,sBAAsB,CAAC,CAAA;CAC5F;AAaD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACzC;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,2BAA2B,GAAG,CAAC,QAAQ,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAsEhG,8DAA8D;AAC9D,eAAO,MAAM,iCAAiC;;;;;gBAwB5C,CAAA;AA6CF,wFAAwF;AACxF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;iCAc9B,CAAA;AA4CF,mFAAmF;AACnF,eAAO,MAAM,0BAA0B;;;;;;iCAwBrC,CAAA;AAsLF,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,yPA0CpC,CAAA;AAEF,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,6OAO5B,CAAA;AAEF,uFAAuF;AACvF,eAAO,MAAM,0BAA0B,WAC7B,iBAAiB,YACf,kBAAkB,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAmB5C,CAAA;AAED,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,aAChC,SAAS,CAAC,SAAS,UACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,sBAAsB,EAAE,CAAC,CAU9C,CAAA;AAEH,qEAAqE;AACrE,eAAO,MAAM,2BAA2B,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,aACtC,SAAS,CAAC,SAAS,UACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,sBAAsB,EAAE,CAAC,CAgB9C,CAAA;AAgBH,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,UACzB,gBAAgB,QACjB,eAAe,SACd,MAAM,gBACA,MAAM,KAClB,MAkCF,CAAA;AAiBD,QAAA,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;EAGjC,CAAA;AAEF,QAAA,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGlC,CAAA;AAcF,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,SAC5B,eAAe,KACpB,OAAO,kBAAkB,GAAG,OAAO,uBAC6B,CAAA;AAEnE,eAAO,MAAM,sBAAsB,YACxB,MAAM,QACT,eAAe,KACpB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAOjC,CAAA;AAwFD,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FAuFpC,CAAA;AAEF,eAAO,MAAM,6BAA6B,SAClC,eAAe,KACpB,OAAO,8BAA8B,GAAG,OAAO,6BACmC,CAAA;AAUrF,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,YAAa,MAAM,QAAQ,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;EAOlF,CAAA;AAED,eAAO,MAAM,2BAA2B,UAC/B,gBAAgB,QACjB,eAAe,SACd,MAAM,eACA,MAAM,iBACJ,OAAO,iBAAiB,CAAC,IAAI,SACrC,aAAa,CAAC,2BAA2B,CAAC,aACtC,MAAM,WACR,MAAM,KACd,MAgCF,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FA6FzC,CAAA;AAQF,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,GAAI,CAAC,EAAE,CAAC,OACzC,CAAC,MAAM,EAAE,2BAA2B,KAAK,MAAM,CAAC,MAAM,CACzD;IAAE,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5E,CAAC,EACD,CAAC,CACF,KACA,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAqB5C,CAAA;AAEL,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B,WAC/B,UAAU,CAAC,2BAA2B,eACjC,MAAM,CAAC,WAAW,oBACb,sBAAsB,WAC/B,kBAAkB,gBACb,6BAA6B,GAAG,SAAS,eAC1C,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAYlB,CAAA;AAEH,gFAAgF;AAChF,eAAO,MAAM,kCAAkC,WACrC,UAAU,CAAC,2BAA2B,eACjC,MAAM,CAAC,WAAW,oBACb,sBAAsB,WAC/B,kBAAkB,iBACZ,OAAO,iBAAiB,CAAC,IAAI,SACrC,aAAa,CAAC,2BAA2B,CAAC,aACtC,MAAM,WACR,MAAM,gBACD,6BAA6B,GAAG,SAAS,eAC1C,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAgBlB,CAAA;AA8CH,kGAAkG;AAClG,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;yCA4CtC,CAAA"}

package/dist/server/review/PullRequestReview.js

@@ -1,19 +1,21 @@
 /** Immutable CodeCommit diff reads and prompt-only Relay execution for the web review workbench. @module */
+import { model as claudeModel } from "@knpkv/ai-claude";
 import { streamEvents } from "@knpkv/ai-codex";
 import * as ReviewClient from "@knpkv/codecommit-core/ReviewClient.js";
 import { createTwoFilesPatch, parsePatch } from "diff";
 import { Cache, Cause, Data, Effect, Exit, Option, Predicate, Queue, Schema, Stream } from "effect";
+import { LanguageModel } from "effect/ai";
 import * as Crypto from "effect/Crypto";
 import * as FileSystem from "effect/FileSystem";
 import { RelayExplainResult, RelayNativeReviewResult, RelayReviewMessage, RelayReviewResult } from "../Api.js";
-import { MAXIMUM_RELAY_PATCH_BYTES, MAXIMUM_RELAY_PROMPT_BYTES } from "./ReviewPromptBudget.js";
+import { MAXIMUM_RELAY_CLAUDE_OUTPUT_BYTES, MAXIMUM_RELAY_PATCH_BYTES, MAXIMUM_RELAY_PROMPT_BYTES, MAXIMUM_RELAY_REVIEW_MESSAGE_BYTES } from "./ReviewPromptBudget.js";
 const MAXIMUM_DIFF_FILES = 1_000;
 const MAXIMUM_RELAY_DIFF_INPUT_LINES = 5_000;
 const MAXIMUM_RELAY_DIFF_LINE_PAIRS = 4_000_000;
 const RELAY_PATCH_SEPARATOR = "\n";
 const textDecoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 const textEncoder = new TextEncoder();
-const withProfileModel = (profile, options) => profile.model === "configured-default" ? options : { ...options, model: profile.model };
+const withProfileModel = (profile, options) => profile.model === "configured-default" || profile.model === "default" ? options : { ...options, model: profile.model };
 export class PullRequestReviewError extends Schema.TaggedError()("PullRequestReviewError", {
     operation: Schema.String,
     message: Schema.String,
@@ -438,6 +440,14 @@ const CodexProgressEvent = Schema.fromJsonString(Schema.Struct({
 const decodeCodexProgress = Schema.decodeUnknownOption(CodexProgressEvent);
 const decodeRelayResult = Schema.decodeUnknownOption(Schema.fromJsonString(RelayReviewResult));
 const decodeRelayExplainResult = Schema.decodeUnknownOption(Schema.fromJsonString(RelayExplainResult));
+const RelayReviewConversationResult = Schema.Struct({
+    reply: RelayReviewMessage,
+    review: RelayNativeReviewResult
+});
+const RelayExplainConversationResult = Schema.Struct({
+    reply: RelayReviewMessage,
+    review: RelayExplainResult
+});
 /** Exact native output contract selected before the provider process starts. */
 export const relayReviewOutputSchema = (kind) => kind === "explain" ? RelayExplainResult : RelayNativeReviewResult;
 export const parseRelayReviewResult = (message, kind) => {
@@ -446,6 +456,49 @@ export const parseRelayReviewResult = (message, kind) => {
     const decode = kind === "explain" ? decodeRelayExplainResult : decodeRelayResult;
     return decode(trimmed).pipe(Option.orElse(() => fenced === undefined ? Option.none() : decode(fenced)));
 };
+const encodeClaudeAgentMessage = (value) => Effect.try({
+    try: () => JSON.stringify(value),
+    catch: (cause) => reviewError("relay-review-encode", "Claude returned an unencodable structured result", cause)
+}).pipe(Effect.flatMap((encoded) => encoded === undefined
+    ? Effect.fail(reviewError("relay-review-encode", "Claude returned no structured review result"))
+    : Effect.succeed(encoded)));
+const claudeAgentMessage = (profile, request) => LanguageModel.generateObject({
+    objectName: "relay-review",
+    prompt: request.prompt,
+    schema: request.outputSchema
+}).pipe(
+// Dynamic per-review model layer: the application supplies ChildProcessSpawner at its entry point.
+// @effect-diagnostics-next-line strictEffectProvide:off
+Effect.provide(claudeModel({
+    access: "prompt-only",
+    cwd: request.cwd,
+    ...((profile.model !== "configured-default") && { model: profile.model }),
+    timeout: request.timeout,
+    maxOutputBytes: MAXIMUM_RELAY_CLAUDE_OUTPUT_BYTES,
+    maxStderrBytes: MAXIMUM_RELAY_REVIEW_MESSAGE_BYTES
+})), Effect.map((response) => response.value), Effect.flatMap(encodeClaudeAgentMessage), Effect.mapError((cause) => Predicate.isTagged(cause, "PullRequestReviewError")
+    ? cause
+    : reviewError("relay-review", "Claude review execution failed", cause)));
+const streamRelayAgent = (profile, request) => {
+    if (profile.provider === "codex" && profile.harness === "native-codex") {
+        return streamEvents(withProfileModel(profile, {
+            access: "read-only",
+            cwd: request.cwd,
+            maxPromptBytes: request.maxPromptBytes,
+            outputSchema: request.outputSchema,
+            prompt: request.prompt,
+            promptOnly: true,
+            timeout: request.timeout
+        })).pipe(Stream.mapError((cause) => reviewError("relay-review", "Codex review execution failed", cause)));
+    }
+    if (profile.provider === "claude" && profile.harness === "native-claude") {
+        return Stream.fromEffect(claudeAgentMessage(profile, request).pipe(Effect.map((message) => JSON.stringify({
+            type: "item.completed",
+            item: { type: "agent_message", text: message }
+        }))));
+    }
+    return Stream.fail(reviewError("relay-review-config", `Unsupported Relay reviewer configuration: ${profile.provider}/${profile.harness}/${profile.model}`));
+};
 /** Execute one ephemeral, read-only Relay pass over the exact provider patch. */
 export const runPullRequestRelayReview = Effect.fn("PullRequestReview.runPullRequestRelayReview")(function* (client, pullRequest, expectedRevision, profile, changedFiles, skillPrompt = "", reportProgress = noProgress) {
     const kind = profile.kind;
@@ -467,15 +520,14 @@ export const runPullRequestRelayReview = Effect.fn("PullRequestReview.runPullReq
         const fileSystem = yield* FileSystem.FileSystem;
         const workspace = yield* fileSystem.makeTempDirectoryScoped({ prefix: "codecommit-web-relay-" });
         yield* reportProgress({ phase: "agent", message: "Relay is reviewing the exact patch" });
-        const message = yield* streamEvents(withProfileModel(profile, {
-            access: "read-only",
+        const message = yield* streamRelayAgent(profile, {
             cwd: workspace,
+            kind,
             maxPromptBytes: MAXIMUM_RELAY_PROMPT_BYTES,
             outputSchema: relayReviewOutputSchema(kind),
             prompt,
-            promptOnly: true,
             timeout: "5 minutes"
-        })).pipe(Stream.tap((line) => {
+        }).pipe(Stream.tap((line) => {
             const event = decodeCodexProgress(line);
             if (Option.isNone(event))
                 return Effect.void;
@@ -509,14 +561,6 @@ export const runPullRequestRelayReview = Effect.fn("PullRequestReview.runPullReq
         ? cause
         : reviewError("relay-review", "Relay review execution failed", cause)));
 });
-const RelayReviewConversationResult = Schema.Struct({
-    reply: RelayReviewMessage,
-    review: RelayNativeReviewResult
-});
-const RelayExplainConversationResult = Schema.Struct({
-    reply: RelayReviewMessage,
-    review: RelayExplainResult
-});
 export const relayConversationOutputSchema = (kind) => kind === "explain" ? RelayExplainConversationResult : RelayReviewConversationResult;
 const decodeRelayReviewConversationResult = Schema.decodeUnknownOption(Schema.fromJsonString(RelayReviewConversationResult));
 const decodeRelayExplainConversationResult = Schema.decodeUnknownOption(Schema.fromJsonString(RelayExplainConversationResult));
@@ -577,15 +621,14 @@ export const continuePullRequestRelayReview = Effect.fn("PullRequestReview.conti
         const fileSystem = yield* FileSystem.FileSystem;
         const workspace = yield* fileSystem.makeTempDirectoryScoped({ prefix: "codecommit-web-relay-" });
         yield* reportProgress({ phase: "agent", message: "Relay is reconciling the finding deck" });
-        const response = yield* streamEvents(withProfileModel(profile, {
-            access: "read-only",
+        const response = yield* streamRelayAgent(profile, {
             cwd: workspace,
+            kind,
             maxPromptBytes: MAXIMUM_RELAY_PROMPT_BYTES,
             outputSchema: relayConversationOutputSchema(kind),
             prompt,
-            promptOnly: true,
             timeout: "5 minutes"
-        })).pipe(Stream.tap((line) => {
+        }).pipe(Stream.tap((line) => {
             const event = decodeCodexProgress(line);
             return Option.isSome(event) && event.value.type === "item.completed" && event.value.item?.type === "reasoning"
                 ? reportProgress({ phase: "agent", message: "Reconciliation step completed" })