@knpkv/codecommit-web 0.17.0 → 0.18.0

package/README.md

@@ -5,9 +5,12 @@ the owner, CSRF, and bootstrap credentials; the bootstrap credential is valid fo
 60 seconds, single-use, and limited to five failed unauthenticated attempts. The
 owner cookie is HttpOnly and SameSite=Strict. This intentionally differs from
 Control Center's durable workspace session (12-hour idle and 30-day absolute
-lifetimes); the shared `@knpkv/browser-pairing` package supplies only credential
-validation, issuance, hashing, expiry, cookie serialization, and one-time state
-transitions. Each application keeps its own persistence and authorization policy.
+lifetimes). The policy is the shared single-operator Owner Session from
+`@knpkv/browser-pairing/owner-session` (ADR-0008); CodeCommit web keeps its API
+middleware, wire errors, `cc_owner` cookie name, and dev-proxy model.
 
 Origin checks use the configured loopback authority captured at bind time. The
-request `Host` header is not an authority source.
+request `Host` header is not an authority source. Browser reads that Fetch
+Metadata marks as cross-site, or as same-site/`none` without the bound Origin,
+are refused; explicit clients without Fetch Metadata still need the owner
+cookie.

package/dist/server/Api.d.ts

@@ -1148,9 +1148,19 @@ declare const AuditGroup_base: HttpApiGroup.HttpApiGroup<"audit", HttpApiEndpoin
 }>>, Schema.toCodecJson<typeof ApiError>, never, never>, false>;
 export declare class AuditGroup extends AuditGroup_base {
 }
-declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.HttpApiGroup<"accounts", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/accounts/", never, never, never, never, Schema.toCodecJson<Schema.Chunk<typeof Account>>, never, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"audit", HttpApiEndpoint.HttpApiEndpoint<"clear", "DELETE", "/api/audit/", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly deleted: Schema.Number;
-}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/audit/", never, Schema.toCodecStringTree<Schema.Struct<{
+declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.HttpApiGroup<"accounts", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/accounts/", never, never, never, never, Schema.toCodecJson<Schema.Chunk<typeof Account>>, never, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"audit", HttpApiEndpoint.HttpApiEndpoint<"export", "GET", "/api/audit/export", never, Schema.toCodecStringTree<Schema.Struct<{
+    readonly from: Schema.optional<Schema.String>;
+    readonly to: Schema.optional<Schema.String>;
+}>>, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
+    readonly id: Schema.Number;
+    readonly timestamp: Schema.String;
+    readonly operation: Schema.String;
+    readonly accountProfile: Schema.String;
+    readonly region: Schema.String;
+    readonly permissionState: Schema.String;
+    readonly context: Schema.String;
+    readonly durationMs: Schema.NullOr<Schema.Number>;
+}>>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/audit/", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly limit: Schema.optional<Schema.NumberFromString>;
     readonly offset: Schema.optional<Schema.NumberFromString>;
     readonly operation: Schema.optional<Schema.String>;
@@ -1172,19 +1182,9 @@ declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.
     }>>;
     readonly total: Schema.Number;
     readonly nextCursor: Schema.optional<Schema.Number>;
-}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"export", "GET", "/api/audit/export", never, Schema.toCodecStringTree<Schema.Struct<{
-    readonly from: Schema.optional<Schema.String>;
-    readonly to: Schema.optional<Schema.String>;
-}>>, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
-    readonly id: Schema.Number;
-    readonly timestamp: Schema.String;
-    readonly operation: Schema.String;
-    readonly accountProfile: Schema.String;
-    readonly region: Schema.String;
-    readonly permissionState: Schema.String;
-    readonly context: Schema.String;
-    readonly durationMs: Schema.NullOr<Schema.Number>;
-}>>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"config", HttpApiEndpoint.HttpApiEndpoint<"reviewSkills", "GET", "/api/config/review-skills", never, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"clear", "DELETE", "/api/audit/", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly deleted: Schema.Number;
+}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"config", HttpApiEndpoint.HttpApiEndpoint<"reviewSkills", "GET", "/api/config/review-skills", never, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
     readonly id: Schema.String;
     readonly name: Schema.String;
     readonly description: Schema.String;
@@ -1307,15 +1307,13 @@ declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.
         }>>;
     }>;
     readonly refreshStatus: Schema.Literals<readonly ["refreshed", "failed"]>;
-}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"events", HttpApiEndpoint.HttpApiEndpoint<"stream", "GET", "/api/events/", never, never, never, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"notifications", HttpApiEndpoint.HttpApiEndpoint<"markRead", "POST", "/api/notifications/read", never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"events", HttpApiEndpoint.HttpApiEndpoint<"stream", "GET", "/api/events/", never, never, never, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"notifications", HttpApiEndpoint.HttpApiEndpoint<"markAllRead", "POST", "/api/notifications/read-all", never, never, never, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"markRead", "POST", "/api/notifications/read", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly id: Schema.Number;
-}>>, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"markAllRead", "POST", "/api/notifications/read-all", never, never, never, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"ssoLogin", "POST", "/api/notifications/sso-login", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly profile: Schema.brand<Schema.String, "AwsProfileName">;
-}>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"ssoLogout", "POST", "/api/notifications/sso-logout", never, never, never, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"markUnread", "POST", "/api/notifications/unread", never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"markUnread", "POST", "/api/notifications/unread", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly id: Schema.Number;
-}>>, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"count", "GET", "/api/notifications/count", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly unread: Schema.Number;
-}>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/notifications/", never, Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"ssoLogin", "POST", "/api/notifications/sso-login", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly profile: Schema.brand<Schema.String, "AwsProfileName">;
+}>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"ssoLogout", "POST", "/api/notifications/sso-logout", never, never, never, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/notifications/", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly limit: Schema.optional<Schema.NumberFromString>;
     readonly cursor: Schema.optional<Schema.NumberFromString>;
     readonly filter: Schema.optional<Schema.Literals<readonly ["system", "prs"]>>;
@@ -1335,24 +1333,37 @@ declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.
         readonly read: Schema.Number;
     }>>;
     readonly nextCursor: Schema.optional<Schema.Number>;
+}>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"count", "GET", "/api/notifications/count", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly unread: Schema.Number;
 }>>, never, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"permissions", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/permissions/", never, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
     readonly operation: Schema.String;
     readonly state: Schema.Literals<readonly ["always_allow", "allow", "deny"]>;
     readonly category: Schema.Literals<readonly ["read", "write"]>;
     readonly description: Schema.String;
-}>>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"updateAuditSettings", "POST", "/api/permissions/audit", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly enabled: Schema.optional<Schema.Boolean>;
-    readonly retentionDays: Schema.optional<Schema.Number>;
-}>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"reset", "POST", "/api/permissions/reset", never, never, never, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"respond", "POST", "/api/permissions/respond", never, never, Schema.toCodecJson<Schema.Struct<{
+}>>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"reset", "POST", "/api/permissions/reset", never, never, never, never, Schema.toCodecJson<Schema.String>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"respond", "POST", "/api/permissions/respond", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly id: Schema.String;
     readonly response: Schema.Literals<readonly ["allow_once", "always_allow", "deny"]>;
 }>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"update", "POST", "/api/permissions/update", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly operation: Schema.String;
     readonly state: Schema.Literals<readonly ["always_allow", "allow", "deny"]>;
+}>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"updateAuditSettings", "POST", "/api/permissions/audit", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly enabled: Schema.optional<Schema.Boolean>;
+    readonly retentionDays: Schema.optional<Schema.Number>;
 }>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"auditSettings", "GET", "/api/permissions/audit", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly enabled: Schema.Boolean;
     readonly retentionDays: Schema.Number;
-}>>, never, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"prs", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/prs/", never, never, never, never, Schema.toCodecJson<Schema.Chunk<typeof PullRequest>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/api/prs/", never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, never, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"prs", HttpApiEndpoint.HttpApiEndpoint<"comments", "GET", "/api/prs/comments", never, Schema.toCodecStringTree<Schema.Struct<{
+    readonly pullRequestId: Schema.String;
+    readonly repositoryName: Schema.String;
+    readonly profile: Schema.brand<Schema.String, "AwsProfileName">;
+    readonly region: Schema.brand<Schema.String, "AwsRegion">;
+}>>, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
+    readonly filePath: Schema.optional<Schema.String>;
+    readonly beforeCommitId: Schema.optional<Schema.String>;
+    readonly afterCommitId: Schema.optional<Schema.String>;
+    readonly relativeFileVersion: Schema.optional<Schema.Literals<readonly ["BEFORE", "AFTER"]>>;
+    readonly comments: Schema.$Array<Schema.Codec<import("@knpkv/codecommit-core/Domain.js").CommentThreadJsonEncoded, import("@knpkv/codecommit-core/Domain.js").CommentThreadJsonEncoded, never, never>>;
+}>>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/prs/", never, never, never, never, Schema.toCodecJson<Schema.Chunk<typeof PullRequest>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/api/prs/", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly repositoryName: Schema.String;
     readonly title: Schema.String;
     readonly description: Schema.optional<Schema.String>;
@@ -1365,12 +1376,6 @@ declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.
     readonly requiredApprovals: Schema.Number;
     readonly poolMembers: Schema.$Array<Schema.String>;
     readonly account: typeof Account;
-}>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"updateApprovalRule", "PUT", "/api/prs/approval-rules", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly pullRequestId: Schema.String;
-    readonly approvalRuleName: Schema.String;
-    readonly requiredApprovals: Schema.Number;
-    readonly poolMembers: Schema.$Array<Schema.String>;
-    readonly account: typeof Account;
 }>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"deleteApprovalRule", "DELETE", "/api/prs/approval-rules", never, never, Schema.toCodecJson<Schema.Struct<{
     readonly pullRequestId: Schema.String;
     readonly approvalRuleName: Schema.String;
@@ -1449,6 +1454,12 @@ declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.
         readonly model: Schema.withDecodingDefaultTypeKey<Schema.Literals<readonly ["configured-default", "default", "gpt-5.6-luna", "gpt-5.6-terra", "gpt-5.6-sol"]>, never>;
         readonly skillIds: Schema.$Array<Schema.String>;
     }>;
+}>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"updateApprovalRule", "PUT", "/api/prs/approval-rules", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly pullRequestId: Schema.String;
+    readonly approvalRuleName: Schema.String;
+    readonly requiredApprovals: Schema.Number;
+    readonly poolMembers: Schema.$Array<Schema.String>;
+    readonly account: typeof Account;
 }>>, never, Schema.toCodecJson<Schema.String>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"diff", "GET", "/api/prs/:awsAccountId/:prId/diff", Schema.toCodecStringTree<Schema.Struct<{
     readonly awsAccountId: Schema.String;
     readonly prId: Schema.brand<Schema.String, "PullRequestId">;
@@ -1468,6 +1479,31 @@ declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.
         readonly beforeMode: Schema.NullOr<Schema.String>;
         readonly afterMode: Schema.NullOr<Schema.String>;
     }>>;
+}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"refreshSingle", "POST", "/api/prs/:awsAccountId/:prId/refresh", Schema.toCodecStringTree<Schema.Struct<{
+    readonly awsAccountId: Schema.String;
+    readonly prId: Schema.brand<Schema.String, "PullRequestId">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+    readonly repositoryName: Schema.optional<Schema.String>;
+    readonly region: Schema.optional<Schema.brand<Schema.String, "AwsRegion">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly revisionId: Schema.String;
+    readonly headCommit: Schema.String;
+}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"diffContent", "GET", "/api/prs/:awsAccountId/:prId/diff/:fileIndex", Schema.toCodecStringTree<Schema.Struct<{
+    readonly awsAccountId: Schema.String;
+    readonly prId: Schema.brand<Schema.String, "PullRequestId">;
+    readonly fileIndex: Schema.NumberFromString;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+    readonly repositoryName: Schema.String;
+    readonly region: Schema.brand<Schema.String, "AwsRegion">;
+    readonly revisionId: Schema.String;
+    readonly baseCommit: Schema.String;
+    readonly headCommit: Schema.String;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly fileIndex: Schema.Int;
+    readonly revisionId: Schema.String;
+    readonly state: Schema.Literals<readonly ["text", "binary", "oversized"]>;
+    readonly before: Schema.NullOr<Schema.String>;
+    readonly after: Schema.NullOr<Schema.String>;
 }>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"relayReview", "POST", "/api/prs/:awsAccountId/:prId/relay-review", Schema.toCodecStringTree<Schema.Struct<{
     readonly awsAccountId: Schema.String;
     readonly prId: Schema.brand<Schema.String, "PullRequestId">;
@@ -1563,15 +1599,6 @@ declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.
     readonly findingId: Schema.String;
     readonly operationId: Schema.String;
     readonly summary: Schema.String;
-}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"refreshSingle", "POST", "/api/prs/:awsAccountId/:prId/refresh", Schema.toCodecStringTree<Schema.Struct<{
-    readonly awsAccountId: Schema.String;
-    readonly prId: Schema.brand<Schema.String, "PullRequestId">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-    readonly repositoryName: Schema.optional<Schema.String>;
-    readonly region: Schema.optional<Schema.brand<Schema.String, "AwsRegion">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly revisionId: Schema.String;
-    readonly headCommit: Schema.String;
 }>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"search", "GET", "/api/prs/search", never, Schema.toCodecStringTree<Schema.Struct<{
     readonly q: Schema.String;
     readonly limit: Schema.optional<Schema.NumberFromString>;
@@ -1599,33 +1626,6 @@ declare const CodeCommitApi_base: HttpApi.HttpApi<"CodeCommitApi", HttpApiGroup.
     }>>;
     readonly total: Schema.Number;
     readonly hasMore: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"comments", "GET", "/api/prs/comments", never, Schema.toCodecStringTree<Schema.Struct<{
-    readonly pullRequestId: Schema.String;
-    readonly repositoryName: Schema.String;
-    readonly profile: Schema.brand<Schema.String, "AwsProfileName">;
-    readonly region: Schema.brand<Schema.String, "AwsRegion">;
-}>>, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
-    readonly filePath: Schema.optional<Schema.String>;
-    readonly beforeCommitId: Schema.optional<Schema.String>;
-    readonly afterCommitId: Schema.optional<Schema.String>;
-    readonly relativeFileVersion: Schema.optional<Schema.Literals<readonly ["BEFORE", "AFTER"]>>;
-    readonly comments: Schema.$Array<Schema.Codec<import("@knpkv/codecommit-core/Domain.js").CommentThreadJsonEncoded, import("@knpkv/codecommit-core/Domain.js").CommentThreadJsonEncoded, never, never>>;
-}>>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"diffContent", "GET", "/api/prs/:awsAccountId/:prId/diff/:fileIndex", Schema.toCodecStringTree<Schema.Struct<{
-    readonly awsAccountId: Schema.String;
-    readonly prId: Schema.brand<Schema.String, "PullRequestId">;
-    readonly fileIndex: Schema.NumberFromString;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-    readonly repositoryName: Schema.String;
-    readonly region: Schema.brand<Schema.String, "AwsRegion">;
-    readonly revisionId: Schema.String;
-    readonly baseCommit: Schema.String;
-    readonly headCommit: Schema.String;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly fileIndex: Schema.Int;
-    readonly revisionId: Schema.String;
-    readonly state: Schema.Literals<readonly ["text", "binary", "oversized"]>;
-    readonly before: Schema.NullOr<Schema.String>;
-    readonly after: Schema.NullOr<Schema.String>;
 }>>, Schema.toCodecJson<typeof ApiError>, OwnerSessionAuth, never>, false> | HttpApiGroup.HttpApiGroup<"sandbox", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/api/sandbox/", never, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
     readonly id: Schema.String;
     readonly pullRequestId: Schema.String;

package/dist/server/Server.d.ts

@@ -1,15 +1,19 @@
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
 import { Config, Deferred, Effect, Layer } from "effect";
 import * as Stdio from "effect/Stdio";
-import { type OwnerSessionSecretsContract } from "./internal/OwnerSessionSecurity.js";
-export { makeOwnerSessionSecrets, ownerSessionOrigin, OwnerSessionSecrets, type OwnerSessionSecretsContract, ownerSessionUrl, ownerSessionUrlForOrigin, requireLoopbackHostname, requireLoopbackOrigin } from "./internal/OwnerSessionSecurity.js";
+export { loopbackOrigin, requireLoopbackHostname } from "@knpkv/browser-pairing/owner-session";
+export { makeOwnerSession } from "./internal/OwnerSession.js";
 export interface CodeCommitServerOptions {
     readonly hostname?: string;
     readonly port: number;
-    readonly ready?: Deferred.Deferred<void>;
-    readonly security: OwnerSessionSecretsContract;
+    /** The origin the printed URL uses; the bound server's own when omitted. */
+    readonly publicOrigin?: string;
+    /** Completed with the bootstrap URL once the server is listening. */
+    readonly ready?: Deferred.Deferred<string>;
+    readonly security: OwnerSession.OwnerSessionService;
 }
-export declare const makeServer: (options: CodeCommitServerOptions) => Layer.Layer<never, import("@knpkv/browser-pairing").BrowserPairingError | import("effect/http/HttpServerError").ServeError | import("./internal/OwnerSessionSecurity.js").UnsafeServerHostnameError, import("@knpkv/codecommit-core/ChildEnv.js").HostEnvironment>;
-export declare const makeCodeCommitServer: (port: number, security: OwnerSessionSecretsContract) => Layer.Layer<never, import("@knpkv/browser-pairing").BrowserPairingError | import("effect/http/HttpServerError").ServeError | import("./internal/OwnerSessionSecurity.js").UnsafeServerHostnameError, import("@knpkv/codecommit-core/ChildEnv.js").HostEnvironment>;
+export declare const makeServer: (options: CodeCommitServerOptions) => Layer.Layer<never, import("@knpkv/browser-pairing").BrowserPairingError | import("effect/http/HttpServerError").ServeError | OwnerSession.UnsafeLoopbackAddressError, import("@knpkv/codecommit-core/ChildEnv.js").HostEnvironment>;
+export declare const makeCodeCommitServer: (port: number, security: OwnerSession.OwnerSessionService) => Layer.Layer<never, import("@knpkv/browser-pairing").BrowserPairingError | import("effect/http/HttpServerError").ServeError | OwnerSession.UnsafeLoopbackAddressError, import("@knpkv/codecommit-core/ChildEnv.js").HostEnvironment>;
 export declare const Port: Config.Config<number>;
-export declare const CodeCommitServerLive: Effect.Effect<never, import("@knpkv/browser-pairing").BrowserPairingError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | import("./internal/OwnerSessionSecurity.js").UnsafeServerHostnameError, import("effect/Crypto").Crypto | import("@knpkv/codecommit-core/ChildEnv.js").HostEnvironment | Stdio.Stdio>;
+export declare const CodeCommitServerLive: Effect.Effect<never, import("@knpkv/browser-pairing").BrowserPairingError | import("@knpkv/browser-pairing").CredentialCookieError | import("effect/PlatformError").PlatformError | import("effect/http/HttpServerError").ServeError | OwnerSession.UnsafeLoopbackAddressError, import("effect/Crypto").Crypto | import("@knpkv/codecommit-core/ChildEnv.js").HostEnvironment | Stdio.Stdio>;
 //# sourceMappingURL=Server.d.ts.map

package/dist/server/Server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Server.d.ts","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAS,KAAK,EAAkC,MAAM,QAAQ,CAAA;AAK/F,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAiBrC,OAAO,EAOL,KAAK,2BAA2B,EAEjC,MAAM,oCAAoC,CAAA;AAK3C,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,2BAA2B,EAChC,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,oCAAoC,CAAA;AAqR3C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAA;CAC/C;AAED,eAAO,MAAM,UAAU,YAAa,uBAAuB,uQA8B1D,CAAA;AAED,eAAO,MAAM,oBAAoB,SAAU,MAAM,YAAY,2BAA2B,uQACxD,CAAA;AAEhC,eAAO,MAAM,IAAI,uBAAoD,CAAA;AAqBrE,eAAO,MAAM,oBAAoB,oWAgC/B,CAAA"}
+{"version":3,"file":"Server.d.ts","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AAmBpE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAS,KAAK,EAAkC,MAAM,QAAQ,CAAA;AAK/F,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAsBrC,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAA;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAqR7D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,mBAAmB,CAAA;CACpD;AAED,eAAO,MAAM,UAAU,YAAa,uBAAuB,wOA8B1D,CAAA;AAED,eAAO,MAAM,oBAAoB,SAAU,MAAM,YAAY,YAAY,CAAC,mBAAmB,wOAC7D,CAAA;AAEhC,eAAO,MAAM,IAAI,uBAAoD,CAAA;AAqBrE,eAAO,MAAM,oBAAoB,8XAmC/B,CAAA"}

package/dist/server/Server.js

@@ -1,4 +1,5 @@
 import { BunFileSystem, BunHttpServer, BunServices } from "@effect/platform-bun";
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
 import { AwsClient, AwsClientConfig, CacheService, ConfigService, PermissionService, PRService, ReadClient, ReviewClient, SandboxService, StatsService } from "@knpkv/codecommit-core";
 import { AwsClientGatedLive, InnerAwsClient } from "@knpkv/codecommit-core/AwsClient/AwsClientGated.js";
 import { AuditLogRepo } from "@knpkv/codecommit-core/PermissionService/AuditLog.js";
@@ -14,11 +15,12 @@ import { CodeCommitApi } from "./Api.js";
 import { AccountsLive, AuditLive, ConfigLive, EventsLive, NotificationsLive, PermissionsLive, PrsLive, SandboxLive, StatsLive, SubscriptionsLive } from "./handlers/index.js";
 import { BackgroundScopeLive } from "./internal/BackgroundScope.js";
 import { autoRefreshLayer, sandboxStartupLayer } from "./internal/BackgroundWorkers.js";
-import { activateOwnerSessionBootstrap, makeOwnerSessionSecrets, ownerSessionAuthLayer, OwnerSessionBootstrapRouter, ownerSessionOrigin, OwnerSessionSecrets, requireLoopbackHostname } from "./internal/OwnerSessionSecurity.js";
+import { makeOwnerSession, ownerSessionAuthLayer } from "./internal/OwnerSession.js";
 import { InnerCodeCommitReadClient, makePermissionedReadClient } from "./internal/PermissionedReadClient.js";
-import { resolveCodeCommitBootstrapUrlForBind } from "./internal/PublicOrigin.js";
+import { resolveCodeCommitPublicOriginForBind } from "./internal/PublicOrigin.js";
 import { makeRelayFindingPublisher, RelayFindingPublisher } from "./review/RelayFindingPublisher.js";
-export { makeOwnerSessionSecrets, ownerSessionOrigin, OwnerSessionSecrets, ownerSessionUrl, ownerSessionUrlForOrigin, requireLoopbackHostname, requireLoopbackOrigin } from "./internal/OwnerSessionSecurity.js";
+export { loopbackOrigin, requireLoopbackHostname } from "@knpkv/browser-pairing/owner-session";
+export { makeOwnerSession } from "./internal/OwnerSession.js";
 const mimeTypes = {
     ".html": "text/html",
     ".js": "application/javascript",
@@ -137,22 +139,24 @@ const CorsLive = Layer.unwrap(Effect.map(AllowedOrigins, (allowedOrigins) => Htt
     allowedHeaders: ["Content-Type", "Authorization", "X-CSRF-Token"]
 })));
 // Combined routes with CORS — orDie for remaining service construction errors
-const AllRoutes = Layer.mergeAll(ApiLive, OwnerSessionBootstrapRouter, StaticRouter).pipe(Layer.provide(CorsLive), Layer.orDie);
+const AllRoutes = Layer.mergeAll(ApiLive, OwnerSession.BootstrapRouter, StaticRouter).pipe(Layer.provide(CorsLive), Layer.orDie);
 // HttpPlatform + Etag — required by addHttpApi for OpenAPI/multipart support
 const HttpPlatformLive = HttpPlatform.layer.pipe(Layer.provide(BunFileSystem.layer));
 export const makeServer = (options) => {
     const hostname = options.hostname ?? "127.0.0.1";
-    return Layer.unwrap(requireLoopbackHostname(hostname).pipe(Effect.map(() => {
+    return Layer.unwrap(OwnerSession.requireLoopbackHostname(hostname).pipe(
+    // The printed URL carries the bootstrap code, so its origin must be the server or its dev proxy.
+    Effect.andThen(OwnerSession.resolvePublicOrigin(options.publicOrigin, options.security.authorityOrigin)), Effect.map((publicOrigin) => {
         const server = HttpRouter.serve(AllRoutes, {
             // Coordinate tokens include provider-valid repository names up to 100
             // characters; keep one bounded segment for the review route.
             routerConfig: { maxParamLength: coordinateRouterMaxParamLength }
         }).pipe(
         // idleTimeout: 0 disables idle detection — required for long-lived SSE connections
-        Layer.provide(BunHttpServer.layer({ hostname, port: options.port, idleTimeout: 0 })), Layer.provide(Etag.layer), Layer.provide(HttpPlatformLive), Layer.provide(Layer.succeed(OwnerSessionSecrets, options.security)));
-        return server.pipe(Layer.tap(() => activateOwnerSessionBootstrap(options.security).pipe(Effect.andThen(options.ready === undefined
-            ? Effect.void
-            : Deferred.succeed(options.ready, undefined)))));
+        Layer.provide(BunHttpServer.layer({ hostname, port: options.port, idleTimeout: 0 })), Layer.provide(Etag.layer), Layer.provide(HttpPlatformLive), Layer.provide(Layer.succeed(OwnerSession.OwnerSession, options.security)));
+        return server.pipe(Layer.tap(() => 
+        // Minted only once the server is listening, so the printed code is one that can be spent.
+        options.security.mintBootstrapCode.pipe(Effect.map((code) => OwnerSession.bootstrapUrl(publicOrigin, code)), Effect.flatMap((url) => options.ready === undefined ? Effect.void : Deferred.succeed(options.ready, url)))));
     })));
 };
 export const makeCodeCommitServer = (port, security) => makeServer({ port, security });
@@ -175,15 +179,16 @@ export const CodeCommitServerLive = Effect.gen(function* () {
     const publicOriginOverride = yield* PublicOrigin.pipe(Effect.orDie);
     return yield* Effect.forever(Effect.gen(function* () {
         const p = yield* Ref.get(portRef);
-        const directOrigin = ownerSessionOrigin("127.0.0.1", p);
+        const directOrigin = OwnerSession.loopbackOrigin("127.0.0.1", p);
         // Rotate every authority-bearing secret on each bind attempt so a URL
         // emitted for an occupied port cannot authenticate to a later retry.
-        const security = yield* makeOwnerSessionSecrets(directOrigin);
-        const bootstrapUrl = yield* resolveCodeCommitBootstrapUrlForBind(Option.getOrUndefined(publicOriginOverride), requestedPort, p, security);
+        const security = yield* makeOwnerSession(directOrigin);
+        const publicOrigin = yield* resolveCodeCommitPublicOriginForBind(Option.getOrUndefined(publicOriginOverride), requestedPort, p);
         const ready = yield* Deferred.make();
-        const serverFiber = yield* Layer.launch(makeServer({ port: p, ready, security })).pipe(Effect.forkChild({ startImmediately: true }));
-        yield* Effect.raceFirst(Deferred.await(ready), Fiber.join(serverFiber));
-        yield* Effect.logInfo(`Authenticated server ready at ${ownerSessionOrigin("127.0.0.1", p)}`);
+        const serverFiber = yield* Layer.launch(makeServer({ port: p, publicOrigin, ready, security })).pipe(Effect.forkChild({ startImmediately: true }));
+        // The server only ends this race by failing; until it is listening there is no link to print.
+        const bootstrapUrl = yield* Effect.raceFirst(Deferred.await(ready), Fiber.join(serverFiber).pipe(Effect.andThen(Effect.never)));
+        yield* Effect.logInfo(`Authenticated server ready at ${directOrigin}`);
         yield* Stream.make(`Authenticated bootstrap URL: ${bootstrapUrl}\n`).pipe(Stream.run(stdio.stdout()));
         return yield* Fiber.join(serverFiber);
     }).pipe(updatePortOnConflict(portRef, retriesRef)));

package/dist/server/Server.js.map

@@ -1 +1 @@
-{"version":3,"file":"Server.js","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EACL,SAAS,EACT,eAAe,EACf,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,YAAY,EACb,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAA;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,sDAAsD,CAAA;AACnF,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,gEAAgE,CAAA;AACvE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/F,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AACnC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EACL,YAAY,EACZ,SAAS,EACT,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,OAAO,EACP,WAAW,EACX,SAAS,EACT,iBAAiB,EAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AACvF,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,mBAAmB,EAEnB,uBAAuB,EACxB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAA;AAC5G,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AAEpG,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EAEnB,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,oCAAoC,CAAA;AAK3C,MAAM,SAAS,GAAmB;IAChC,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,wBAAwB;IAC/B,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;CACnB,CAAA;AAED,iEAAiE;AACjE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAChD,IAAI,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE/C,uBAAuB;IACvB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,QAAQ,GAAG,YAAY,CAAA;IACzB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAElD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAClC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAA;YAChE,OAAO,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE;gBAC5C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;aACzC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,eAAe;IACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAChD,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACjD,OAAO,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE;YAC5C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC9D,CAAC,CAAC,CAAA;AAEF,qBAAqB;AACrB,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CACjC,OAAO,EACP,UAAU,EACV,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,eAAe,EACf,SAAS,CACV,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAE/C,wBAAwB;AACxB,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CACjC,WAAW,CAAC,KAAK,EACjB,eAAe,CAAC,KAAK,CACtB,CAAA;AAED,2DAA2D;AAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,CAAC,IAAI,CACtD,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAC3B,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAC9C,CAAA;AAED,yFAAyF;AACzF,qEAAqE;AACrE,6EAA6E;AAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAC9B,YAAY,CAAC,eAAe,CAAC,OAAO,EACpC,YAAY,CAAC,WAAW,CAAC,OAAO,EAChC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EACrC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EACrC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EACrC,YAAY,CAAC,SAAS,CAAC,OAAO,CAC/B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AAEnB,4BAA4B;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CACnC,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,EAC3C,qBAAqB,CAAC,OAAO,EAC7B,YAAY,CAAC,OAAO,CACrB,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAC3B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CACzB,CAAA;AAED,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,IAAI,CACtD,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAC5C,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CACzB,CAAA;AAED,sCAAsC;AACtC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CACrC,cAAc,EACd,SAAS,CAAC,SAAS,CACpB,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,EACtC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EACtC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CACrC,CAAA;AAED,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,IAAI,CAChD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EACjC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACnC,CAAA;AAED,yBAAyB;AACzB,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAClC,kBAAkB,EAClB,SAAS,CACV,CAAC,IAAI,CACJ,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EACtC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAC5B,CAAA;AAED,kCAAkC;AAClC,MAAM,cAAc,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAA;AAEtF,iEAAiE;AACjE,MAAM,cAAc,GAAG,kBAAkB,CAAA;AAEzC,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CACtC,yBAAyB,EACzB,UAAU,CAAC,oBAAoB,CAChC,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC,EACnD,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CACvC,CAAA;AACD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACjC,UAAU,CAAC,oBAAoB,EAC/B,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,CACtE,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAClC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACnC,CAAA;AAED,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,YAAY,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CACzE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,4BAA4B,CAAC,EACxD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CACvC,CAAA;AACD,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAC5C,qBAAqB,EACrB,yBAAyB,EAAE,CAC5B,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,EACnC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACnC,CAAA;AAED,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CACxC,cAAc,CAAC,cAAc,CAAC,OAAO,EACrC,cAAc,CAAC,aAAa,CAAC,OAAO,EACpC,YAAY,CAAC,WAAW,CAAC,OAAO,CACjC,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAC1B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAC5B,CAAA;AAED,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAC7D,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,EAC7C,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAC7B,CAAA;AAED,kCAAkC;AAClC,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CACpC,cAAc,EACd,WAAW,EACX,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,YAAY,CACb,CAAA;AAED,yCAAyC;AACzC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAA;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9G,IAAI,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,OAAO,iCAAiC,aAAa,OAAO,CAAC,CAAA;AAChH,CAAC,CAAC,CACH,CAAA;AAED,8EAA8E;AAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAC5B,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CACtC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAC3E,EACD,gBAAgB,EAChB,UAAU,EACV,mBAAmB,CACpB,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAC9B,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CACrC,CAAA;AAED,kDAAkD;AAClD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;AAErF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAC/B,MAAM,CAAC,WAAW,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,CACvE,CAAA;AAED,6DAA6D;AAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAC3B,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,cAAc,EAAE,EAAE,CAC5C,UAAU,CAAC,IAAI,CAAC;IACd,cAAc;IACd,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;IACpE,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC;CAClE,CAAC,CAAC,CACN,CAAA;AAED,8EAA8E;AAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,EAAE,YAAY,CAAC,CAAC,IAAI,CACvF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,KAAK,CACZ,CAAA;AAED,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AASpF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgC,EAAE,EAAE;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAA;IAChD,OAAO,KAAK,CAAC,MAAM,CACjB,uBAAuB,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACd,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE;YACzC,sEAAsE;YACtE,6DAA6D;YAC7D,YAAY,EAAE,EAAE,cAAc,EAAE,8BAA8B,EAAE;SACjE,CAAC,CAAC,IAAI;QACL,mFAAmF;QACnF,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,EACpF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CACpE,CAAA;QACD,OAAO,MAAM,CAAC,IAAI,CAChB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CACb,6BAA6B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,OAAO,CACZ,OAAO,CAAC,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAC/C,CACF,CACF,CACF,CAAA;IACH,CAAC,CAAC,CACH,CACF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,QAAqC,EAAE,EAAE,CAC1F,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;AACrE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAA;AAEjF,MAAM,oBAAoB,GAAG,CAC3B,OAAwB,EACxB,UAA2B,EAC3B,EAAE,CACJ,CAAU,IAA4B,EAAE,EAAE,CACxC,IAAI,CAAC,IAAI,CACP,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC1D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACnE,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACvB,CACF,CAAA;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEnE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,YAAY,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACvD,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAA;QAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,oCAAoC,CAC9D,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAC3C,aAAa,EACb,CAAC,EACD,QAAQ,CACT,CAAA;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAA;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CACpF,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAA;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;QACvE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,iCAAiC,kBAAkB,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QAC5F,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,YAAY,IAAI,CAAC,CAAC,IAAI,CACvE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAC3B,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CACnD,CAAA;AACH,CAAC,CAAC,CAAA"}
+{"version":3,"file":"Server.js","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EACL,SAAS,EACT,eAAe,EACf,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,YAAY,EACb,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAA;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,sDAAsD,CAAA;AACnF,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,gEAAgE,CAAA;AACvE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/F,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AACnC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EACL,YAAY,EACZ,SAAS,EACT,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,OAAO,EACP,WAAW,EACX,SAAS,EACT,iBAAiB,EAClB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AACvF,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACpF,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAA;AAC5G,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AAEpG,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAA;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAK7D,MAAM,SAAS,GAAmB;IAChC,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,wBAAwB;IAC/B,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;CACnB,CAAA;AAED,iEAAiE;AACjE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAChD,IAAI,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE/C,uBAAuB;IACvB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,QAAQ,GAAG,YAAY,CAAA;IACzB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAElD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAClC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAA;YAChE,OAAO,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE;gBAC5C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;aACzC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,eAAe;IACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAChD,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACjD,OAAO,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE;YAC5C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC9D,CAAC,CAAC,CAAA;AAEF,qBAAqB;AACrB,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CACjC,OAAO,EACP,UAAU,EACV,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,eAAe,EACf,SAAS,CACV,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAE/C,wBAAwB;AACxB,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CACjC,WAAW,CAAC,KAAK,EACjB,eAAe,CAAC,KAAK,CACtB,CAAA;AAED,2DAA2D;AAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,CAAC,IAAI,CACtD,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAC3B,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAC9C,CAAA;AAED,yFAAyF;AACzF,qEAAqE;AACrE,6EAA6E;AAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAC9B,YAAY,CAAC,eAAe,CAAC,OAAO,EACpC,YAAY,CAAC,WAAW,CAAC,OAAO,EAChC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EACrC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EACrC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EACrC,YAAY,CAAC,SAAS,CAAC,OAAO,CAC/B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AAEnB,4BAA4B;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CACnC,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,EAC3C,qBAAqB,CAAC,OAAO,EAC7B,YAAY,CAAC,OAAO,CACrB,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAC3B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CACzB,CAAA;AAED,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,IAAI,CACtD,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAC5C,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CACzB,CAAA;AAED,sCAAsC;AACtC,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CACrC,cAAc,EACd,SAAS,CAAC,SAAS,CACpB,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,EACtC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EACtC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CACrC,CAAA;AAED,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,IAAI,CAChD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EACjC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACnC,CAAA;AAED,yBAAyB;AACzB,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAClC,kBAAkB,EAClB,SAAS,CACV,CAAC,IAAI,CACJ,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EACtC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAC5B,CAAA;AAED,kCAAkC;AAClC,MAAM,cAAc,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAA;AAEtF,iEAAiE;AACjE,MAAM,cAAc,GAAG,kBAAkB,CAAA;AAEzC,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CACtC,yBAAyB,EACzB,UAAU,CAAC,oBAAoB,CAChC,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC,EACnD,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CACvC,CAAA;AACD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACjC,UAAU,CAAC,oBAAoB,EAC/B,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,CACtE,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAClC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACnC,CAAA;AAED,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,YAAY,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CACzE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,4BAA4B,CAAC,EACxD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CACvC,CAAA;AACD,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAC5C,qBAAqB,EACrB,yBAAyB,EAAE,CAC5B,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,EACnC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAC7B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACnC,CAAA;AAED,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CACxC,cAAc,CAAC,cAAc,CAAC,OAAO,EACrC,cAAc,CAAC,aAAa,CAAC,OAAO,EACpC,YAAY,CAAC,WAAW,CAAC,OAAO,CACjC,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAC1B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAC5B,CAAA;AAED,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAC7D,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,EAC7C,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAC7B,CAAA;AAED,kCAAkC;AAClC,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CACpC,cAAc,EACd,WAAW,EACX,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,YAAY,CACb,CAAA;AAED,yCAAyC;AACzC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAA;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9G,IAAI,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,OAAO,iCAAiC,aAAa,OAAO,CAAC,CAAA;AAChH,CAAC,CAAC,CACH,CAAA;AAED,8EAA8E;AAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAC5B,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CACtC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAC3E,EACD,gBAAgB,EAChB,UAAU,EACV,mBAAmB,CACpB,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,EACpC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAC9B,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CACrC,CAAA;AAED,kDAAkD;AAClD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;AAErF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAC/B,MAAM,CAAC,WAAW,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,CACvE,CAAA;AAED,6DAA6D;AAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAC3B,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,cAAc,EAAE,EAAE,CAC5C,UAAU,CAAC,IAAI,CAAC;IACd,cAAc;IACd,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;IACpE,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC;CAClE,CAAC,CAAC,CACN,CAAA;AAED,8EAA8E;AAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,IAAI,CACxF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,KAAK,CAAC,KAAK,CACZ,CAAA;AAED,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAYpF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgC,EAAE,EAAE;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAA;IAChD,OAAO,KAAK,CAAC,MAAM,CACjB,YAAY,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,IAAI;IACjD,iGAAiG;IACjG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EACxG,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE;YACzC,sEAAsE;YACtE,6DAA6D;YAC7D,YAAY,EAAE,EAAE,cAAc,EAAE,8BAA8B,EAAE;SACjE,CAAC,CAAC,IAAI;QACL,mFAAmF;QACnF,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,EACpF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAC1E,CAAA;QACD,OAAO,MAAM,CAAC,IAAI,CAChB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;QACb,0FAA0F;QAC1F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,EACnE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAC1G,CACF,CACF,CAAA;IACH,CAAC,CAAC,CACH,CACF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,QAA0C,EAAE,EAAE,CAC/F,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;AACrE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAA;AAEjF,MAAM,oBAAoB,GAAG,CAC3B,OAAwB,EACxB,UAA2B,EAC3B,EAAE,CACJ,CAAU,IAA4B,EAAE,EAAE,CACxC,IAAI,CAAC,IAAI,CACP,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC1D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACnE,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACvB,CACF,CAAA;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEnE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,YAAY,GAAG,YAAY,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QAChE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAA;QACtD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,oCAAoC,CAC9D,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAC3C,aAAa,EACb,CAAC,CACF,CAAA;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAU,CAAA;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAClG,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAA;QACD,8FAA8F;QAC9F,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAC1C,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EACrB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC3D,CAAA;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAA;QACtE,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,YAAY,IAAI,CAAC,CAAC,IAAI,CACvE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAC3B,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CACnD,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/server/internal/OwnerSession.d.ts

@@ -0,0 +1,18 @@
+/**
+ * CodeCommit web's Owner Session: the shared `@knpkv/browser-pairing/owner-session` policy, with
+ * writes.
+ *
+ * Requests are checked against the bound server's own origin. In development the Vite proxy rewrites
+ * Origin to the backend before forwarding (see `tooling/authenticated-dev-proxy.ts`), so the dev
+ * origin is only ever advertised, never accepted.
+ *
+ * @module
+ */
+import type { BrowserPairingError, CredentialCookieError } from "@knpkv/browser-pairing";
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
+import { type Crypto, Effect, Layer } from "effect";
+import { OwnerSessionAuth } from "../Api.js";
+/** Build the session for a server bound at `authorityOrigin`. Rotate it on every bind attempt. */
+export declare const makeOwnerSession: (authorityOrigin: string) => Effect.Effect<OwnerSession.OwnerSessionService, BrowserPairingError | CredentialCookieError | OwnerSession.UnsafeLoopbackAddressError, Crypto.Crypto>;
+export declare const ownerSessionAuthLayer: Layer.Layer<OwnerSessionAuth, never, OwnerSession.OwnerSession>;
+//# sourceMappingURL=OwnerSession.d.ts.map

package/dist/server/internal/OwnerSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OwnerSession.d.ts","sourceRoot":"","sources":["../../../src/server/internal/OwnerSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACxF,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAY,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAqB,gBAAgB,EAAwB,MAAM,WAAW,CAAA;AAErF,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,oLAe5B,CAAA;AAED,eAAO,MAAM,qBAAqB,iEAgBjC,CAAA"}

package/dist/server/internal/OwnerSession.js

@@ -0,0 +1,27 @@
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
+import { Effect, Layer, Redacted } from "effect";
+import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "../Api.js";
+/** Build the session for a server bound at `authorityOrigin`. Rotate it on every bind attempt. */
+export const makeOwnerSession = Effect.fn("CodeCommitWeb.makeOwnerSession")(function* (authorityOrigin) {
+    return yield* OwnerSession.make({
+        authorityOrigin,
+        browserOrigin: authorityOrigin,
+        cookieName: "cc_owner",
+        freshUrlHint: "restart codecommit web for a fresh URL",
+        product: "CodeCommit web",
+        writes: "csrf"
+    });
+});
+export const ownerSessionAuthLayer = Layer.effect(OwnerSessionAuth, Effect.gen(function* () {
+    const session = yield* OwnerSession.OwnerSession;
+    return OwnerSessionAuth.of({
+        ownerCookie: Effect.fn("CodeCommitWeb.ownerCookie")(function* (httpEffect, { credential }) {
+            yield* session.authorizeHttp(Redacted.value(credential)).pipe(Effect.catchTags({
+                OwnerSessionForbiddenError: ({ message }) => Effect.fail(new ForbiddenApiError({ message })),
+                OwnerSessionUnauthorizedError: ({ message }) => Effect.fail(new UnauthorizedApiError({ message }))
+            }));
+            return yield* httpEffect;
+        })
+    });
+}));
+//# sourceMappingURL=OwnerSession.js.map

package/dist/server/internal/OwnerSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OwnerSession.js","sourceRoot":"","sources":["../../../src/server/internal/OwnerSession.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAe,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErF,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CACzE,QAAQ,CAAC,EAAC,eAAuB;IAK/B,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;QAC9B,eAAe;QACf,aAAa,EAAE,eAAe;QAC9B,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,wCAAwC;QACtD,OAAO,EAAE,gBAAgB;QACzB,MAAM,EAAE,MAAM;KACf,CAAC,CAAA;AACJ,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,YAAY,CAAA;IAChD,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YACtF,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,SAAS,CAAC;gBACf,0BAA0B,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5F,6BAA6B,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;aACnG,CAAC,CACH,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA"}

package/dist/server/internal/PublicOrigin.d.ts

@@ -1,9 +1,6 @@
 import { Effect } from "effect";
-import { type OwnerSessionSecretsContract } from "./OwnerSessionSecurity.js";
 /** Resolve the advertised origin for one concrete server bind attempt. */
-export declare const resolveCodeCommitPublicOrigin: (configuredOrigin: string | undefined, port: number) => Effect.Effect<string, import("./OwnerSessionSecurity.js").UnsafeServerHostnameError, never>;
-/** Resolve the startup origin before constructing the token-bearing bootstrap URL. */
-export declare const resolveCodeCommitBootstrapUrl: (configuredOrigin: string | undefined, port: number, secrets: OwnerSessionSecretsContract) => Effect.Effect<string, import("./OwnerSessionSecurity.js").UnsafeServerHostnameError, never>;
+export declare const resolveCodeCommitPublicOrigin: (configuredOrigin: string | undefined, port: number) => Effect.Effect<string, import("@knpkv/browser-pairing/owner-session").UnsafeLoopbackAddressError, never>;
 /** Keep a retrying backend off the stale Vite proxy port; advertise it directly. */
-export declare const resolveCodeCommitBootstrapUrlForBind: (configuredOrigin: string | undefined, requestedPort: number, actualPort: number, secrets: OwnerSessionSecretsContract) => Effect.Effect<string, import("./OwnerSessionSecurity.js").UnsafeServerHostnameError, never>;
+export declare const resolveCodeCommitPublicOriginForBind: (configuredOrigin: string | undefined, requestedPort: number, actualPort: number) => Effect.Effect<string, import("@knpkv/browser-pairing/owner-session").UnsafeLoopbackAddressError, never>;
 //# sourceMappingURL=PublicOrigin.d.ts.map

package/dist/server/internal/PublicOrigin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PublicOrigin.d.ts","sourceRoot":"","sources":["../../../src/server/internal/PublicOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAEL,KAAK,2BAA2B,EAGjC,MAAM,2BAA2B,CAAA;AAElC,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,qJAIzC,CAAA;AAED,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,2LAKzC,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,oCAAoC,wNAUhD,CAAA"}
+{"version":3,"file":"PublicOrigin.d.ts","sourceRoot":"","sources":["../../../src/server/internal/PublicOrigin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,iKAIzC,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,oCAAoC,8LAKhD,CAAA"}

package/dist/server/internal/PublicOrigin.js

@@ -1,17 +1,12 @@
+import { loopbackOrigin, resolvePublicOrigin } from "@knpkv/browser-pairing/owner-session";
 import { Effect } from "effect";
-import { ownerSessionOrigin, ownerSessionUrlForOrigin, resolvePublicOrigin } from "./OwnerSessionSecurity.js";
 /** Resolve the advertised origin for one concrete server bind attempt. */
 export const resolveCodeCommitPublicOrigin = Effect.fn("CodeCommitServer.resolvePublicOrigin")(function* (configuredOrigin, port) {
-    return yield* resolvePublicOrigin(configuredOrigin, ownerSessionOrigin("127.0.0.1", port));
-});
-/** Resolve the startup origin before constructing the token-bearing bootstrap URL. */
-export const resolveCodeCommitBootstrapUrl = Effect.fn("CodeCommitServer.resolveBootstrapUrl")(function* (configuredOrigin, port, secrets) {
-    const publicOrigin = yield* resolveCodeCommitPublicOrigin(configuredOrigin, port);
-    return ownerSessionUrlForOrigin(publicOrigin, secrets);
+    return yield* resolvePublicOrigin(configuredOrigin, loopbackOrigin("127.0.0.1", port));
 });
 /** Keep a retrying backend off the stale Vite proxy port; advertise it directly. */
-export const resolveCodeCommitBootstrapUrlForBind = Effect.fn("CodeCommitServer.resolveBootstrapUrlForBind")(function* (configuredOrigin, requestedPort, actualPort, secrets) {
+export const resolveCodeCommitPublicOriginForBind = Effect.fn("CodeCommitServer.resolvePublicOriginForBind")(function* (configuredOrigin, requestedPort, actualPort) {
     const originOverride = requestedPort === actualPort ? configuredOrigin : undefined;
-    return yield* resolveCodeCommitBootstrapUrl(originOverride, actualPort, secrets);
+    return yield* resolveCodeCommitPublicOrigin(originOverride, actualPort);
 });
 //# sourceMappingURL=PublicOrigin.js.map

package/dist/server/internal/PublicOrigin.js.map

@@ -1 +1 @@
-{"version":3,"file":"PublicOrigin.js","sourceRoot":"","sources":["../../../src/server/internal/PublicOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EACL,kBAAkB,EAElB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,2BAA2B,CAAA;AAElC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,sCAAsC,CAAC,CAC5F,QAAQ,CAAC,EAAC,gBAAoC,EAAE,IAAY;IAC1D,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;AAC5F,CAAC,CACF,CAAA;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,sCAAsC,CAAC,CAC5F,QAAQ,CAAC,EAAC,gBAAoC,EAAE,IAAY,EAAE,OAAoC;IAChG,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IACjF,OAAO,wBAAwB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;AACxD,CAAC,CACF,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC,EAAE,CAAC,6CAA6C,CAAC,CAC1G,QAAQ,CAAC,EACP,gBAAoC,EACpC,aAAqB,EACrB,UAAkB,EAClB,OAAoC;IAEpC,MAAM,cAAc,GAAG,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAA;IAClF,OAAO,KAAK,CAAC,CAAC,6BAA6B,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AAClF,CAAC,CACF,CAAA"}
+{"version":3,"file":"PublicOrigin.js","sourceRoot":"","sources":["../../../src/server/internal/PublicOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAA;AAC1F,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,sCAAsC,CAAC,CAC5F,QAAQ,CAAC,EAAC,gBAAoC,EAAE,IAAY;IAC1D,OAAO,KAAK,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;AACxF,CAAC,CACF,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC,EAAE,CAAC,6CAA6C,CAAC,CAC1G,QAAQ,CAAC,EAAC,gBAAoC,EAAE,aAAqB,EAAE,UAAkB;IACvF,MAAM,cAAc,GAAG,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAA;IAClF,OAAO,KAAK,CAAC,CAAC,6BAA6B,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;AACzE,CAAC,CACF,CAAA"}

package/dist/tooling/authenticated-dev-proxy.test.js

@@ -1,10 +1,12 @@
+import { NodeCrypto } from "@effect/platform-node";
 import { describe, expect, it, vi } from "@effect/vitest";
-import { CsrfToken, PairingCode, SessionToken } from "@knpkv/browser-pairing/schema";
-import { Effect, Redacted, Ref, Result, Schema } from "effect";
+import { bootstrapUrl, loopbackOrigin } from "@knpkv/browser-pairing/owner-session";
+import { PairingCode } from "@knpkv/browser-pairing/schema";
+import { Effect, Redacted, Result, Schema } from "effect";
 import { IncomingMessage, ServerResponse } from "node:http";
 import { Socket } from "node:net";
 import packageJson from "../../package.json" with { type: "json" };
-import { authorizeBootstrapRequest, ownerSessionOrigin, ownerSessionUrlForOrigin, requireLoopbackOrigin } from "../server/internal/OwnerSessionSecurity.js";
+import { makeOwnerSession } from "../server/internal/OwnerSession.js";
 import { authenticatedDevBackendOrigin, authenticatedDevProxyConfig, authenticatedDevProxyOriginDecision, authenticatedDevPublicOrigin, authenticatedDevPublicOriginEnvironment, authenticatedDevServerOptions, makeAuthenticatedDevProxyConfig, setAuthenticatedDevProxyOrigin } from "./authenticated-dev-proxy.js";
 describe("authenticated development proxy", () => {
     it("pins Vite to the advertised development port", () => {
@@ -76,23 +78,17 @@ describe("authenticated development proxy", () => {
         expect(setHeader).toHaveBeenCalledTimes(2);
         expect(setHeader).toHaveBeenCalledWith("origin", retryOrigin);
     });
-    it.effect("accepts a bootstrap request after the proxy origin rewrite", () => Effect.gen(function* () {
-        const secrets = {
-            authorityOrigin: yield* requireLoopbackOrigin(ownerSessionOrigin("127.0.0.1", 3000)),
-            bootstrapAvailable: yield* Ref.make(true),
-            bootstrapAttemptState: yield* Ref.make({ failedAttempts: 0, inFlight: 0 }),
-            bootstrapExpiresAtMillis: yield* Ref.make(Number.MAX_SAFE_INTEGER),
-            bootstrapToken: Redacted.make(Schema.decodeSync(PairingCode)("ab".repeat(32))),
-            csrfToken: Redacted.make(Schema.decodeSync(CsrfToken)("cd".repeat(32))),
-            ownerToken: Redacted.make(Schema.decodeSync(SessionToken)("ef".repeat(32)))
-        };
-        const result = yield* Effect.result(authorizeBootstrapRequest({
-            authorization: `Bearer ${Redacted.value(secrets.bootstrapToken)}`,
-            host: "127.0.0.1:3000",
-            origin: authenticatedDevBackendOrigin
-        }, secrets));
-        expect(Result.isSuccess(result)).toBe(true);
-    }));
+    it.layer(NodeCrypto.layer)("owner session", (it) => {
+        it.effect("accepts a bootstrap request after the proxy origin rewrite", () => Effect.gen(function* () {
+            const session = yield* makeOwnerSession(loopbackOrigin("127.0.0.1", 3000));
+            const code = yield* session.mintBootstrapCode;
+            const result = yield* Effect.result(session.authorizeBootstrap({
+                authorization: `Bearer ${Redacted.value(code)}`,
+                origin: authenticatedDevBackendOrigin
+            }));
+            expect(Result.isSuccess(result)).toBe(true);
+        }));
+    });
     it("advertises the token-bearing bootstrap URL on the Vite origin", () => {
         expect(packageJson.scripts.dev).toContain(authenticatedDevPublicOriginEnvironment);
         const predev = packageJson.scripts.predev;
@@ -102,14 +98,12 @@ describe("authenticated development proxy", () => {
         expect(predev.endsWith("pnpm build")).toBe(true);
         expect(predev.indexOf("@knpkv/browser-pairing")).toBeLessThan(predev.indexOf("@knpkv/relay-product..."));
         expect(predev.indexOf("@knpkv/relay-product...")).toBeLessThan(predev.indexOf("@knpkv/review..."));
-        const url = ownerSessionUrlForOrigin(authenticatedDevPublicOrigin, {
-            bootstrapToken: Redacted.make(Schema.decodeSync(PairingCode)("ab".repeat(32)))
-        });
+        const url = bootstrapUrl(authenticatedDevPublicOrigin, Redacted.make(Schema.decodeSync(PairingCode)("ab".repeat(32))));
         expect(url).toBe(`http://localhost:5173/#bootstrap_token=${"ab".repeat(32)}`);
         expect(url).not.toContain(authenticatedDevBackendOrigin);
     });
     it("keeps the configured backend authority separate from the advertised Vite origin", () => {
-        expect(ownerSessionOrigin("127.0.0.1", 3000)).toBe(`${authenticatedDevBackendOrigin}/`);
+        expect(loopbackOrigin("127.0.0.1", 3000)).toBe(authenticatedDevBackendOrigin);
         expect(authenticatedDevPublicOrigin).not.toBe(authenticatedDevBackendOrigin);
         expect(setAuthenticatedDevProxyOrigin).toBeTypeOf("function");
     });

package/dist/tooling/authenticated-dev-proxy.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-dev-proxy.test.js","sourceRoot":"","sources":["../../src/tooling/authenticated-dev-proxy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,WAAW,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAClE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAElB,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,mCAAmC,EACnC,4BAA4B,EAC5B,uCAAuC,EACvC,6BAA6B,EAC7B,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,8BAA8B,CAAA;AAErC,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAClF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC1D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,8BAA8B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,mCAAmC,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzF,MAAM,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtE,MAAM,CAAC,mCAAmC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAQ;YAC1C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,MAAM,EAAE,CAAC,CAAA;YACjD,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,uBAAuB,CAAA;YAChD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC3E,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;YACzD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,EAAE,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,SAAS,GAA4F,EAAE,CAAA;QAC7G,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,CACF,MAAkB,EAClB,QAA0F,EAC1F,EAAE;gBACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;SACF,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC;YAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACnG,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,WAAW,GAAG,uBAAuB,CAAA;QAC3C,MAAM,MAAM,GAAG,+BAA+B,CAAC,WAAW,CAAC,CAAA;QAC3D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACxC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,SAAS,GAA4F,EAAE,CAAA;QAC7G,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,CACF,MAAkB,EAClB,QAA0F,EAC1F,EAAE;gBACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;SACF,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC9E,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,MAAM,CAAC,4DAA4D,EAAE,GAAG,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG;YACd,eAAe,EAAE,KAAK,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpF,kBAAkB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,qBAAqB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC1E,wBAAwB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,MAAM,CAAC,gBAAgB,CAAC;YACtF,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACvE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;SACtC,CAAA;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC5D,aAAa,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE;YACjE,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,6BAA6B;SACtC,EAAE,OAAO,CAAC,CAAC,CAAA;QACZ,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAC,CAAA;IAEL,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAA;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAA;QACxG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAClG,MAAM,GAAG,GAAG,wBAAwB,CAAC,4BAA4B,EAAE;YACjE,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;SAC/E,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,6BAA6B,GAAG,CAAC,CAAA;QACvF,MAAM,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC5E,MAAM,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"authenticated-dev-proxy.test.js","sourceRoot":"","sources":["../../src/tooling/authenticated-dev-proxy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,WAAW,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AACrE,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,mCAAmC,EACnC,4BAA4B,EAC5B,uCAAuC,EACvC,6BAA6B,EAC7B,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,8BAA8B,CAAA;AAErC,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAClF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC1D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,8BAA8B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,mCAAmC,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzF,MAAM,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtE,MAAM,CAAC,mCAAmC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAQ;YAC1C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,MAAM,EAAE,CAAC,CAAA;YACjD,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,uBAAuB,CAAA;YAChD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC3E,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;YACzD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,EAAE,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,SAAS,GAA4F,EAAE,CAAA;QAC7G,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,CACF,MAAkB,EAClB,QAA0F,EAC1F,EAAE;gBACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;SACF,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC;YAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACnG,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,WAAW,GAAG,uBAAuB,CAAA;QAC3C,MAAM,MAAM,GAAG,+BAA+B,CAAC,WAAW,CAAC,CAAA;QAC3D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACxC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,SAAS,GAA4F,EAAE,CAAA;QAC7G,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,CACF,MAAkB,EAClB,QAA0F,EAC1F,EAAE;gBACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;SACF,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC9E,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE;QACjD,EAAE,CAAC,MAAM,CAAC,4DAA4D,EAAE,GAAG,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;YAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAA;YAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBAC7D,aAAa,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;gBAC/C,MAAM,EAAE,6BAA6B;aACtC,CAAC,CAAC,CAAA;YACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAC,CAAA;IACP,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAA;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAA;QACxG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAClG,MAAM,GAAG,GAAG,YAAY,CACtB,4BAA4B,EAC5B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAC/D,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC7E,MAAM,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC5E,MAAM,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knpkv/codecommit-web",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Web server and frontend for CodeCommit PR browser",
   "type": "module",
   "main": "dist/index.js",
@@ -39,11 +39,11 @@
     "tw-animate-css": "^1.4.0",
     "@knpkv/ai-claude": "^0.4.0",
     "@knpkv/ai-codex": "^0.5.0",
-    "@knpkv/relay-product": "^0.2.0",
+    "@knpkv/browser-pairing": "^0.3.0",
     "@knpkv/codecommit-core": "^0.17.0",
+    "@knpkv/relay-product": "^0.2.0",
     "@knpkv/review": "^0.3.0",
-    "@knpkv/browser-pairing": "^0.2.0",
-    "@knpkv/rly": "^0.6.0"
+    "@knpkv/rly": "^0.6.1"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0",

package/dist/server/internal/OwnerSessionSecurity.d.ts

@@ -1,57 +0,0 @@
-import type { CsrfToken, PairingCode, SessionToken } from "@knpkv/browser-pairing/schema";
-import { Context, Effect, Layer, Redacted, Ref, Schema } from "effect";
-import { HttpRouter } from "effect/http";
-import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "../Api.js";
-export interface OwnerSessionSecretsContract {
-    /** Validated server authority used for origin checks; request Host is never authoritative. */
-    readonly authorityOrigin: string;
-    readonly bootstrapAvailable: Ref.Ref<boolean>;
-    readonly bootstrapAttemptState: Ref.Ref<BootstrapAttemptState>;
-    readonly bootstrapExpiresAtMillis: Ref.Ref<number | undefined>;
-    readonly bootstrapToken: Redacted.Redacted<PairingCode>;
-    readonly csrfToken: Redacted.Redacted<CsrfToken>;
-    readonly ownerToken: Redacted.Redacted<SessionToken>;
-}
-export interface BootstrapAttemptState {
-    readonly failedAttempts: number;
-    readonly inFlight: number;
-}
-declare const OwnerSessionSecrets_base: Context.ServiceClass<OwnerSessionSecrets, "@knpkv/codecommit-web/OwnerSessionSecrets", OwnerSessionSecretsContract>;
-export declare class OwnerSessionSecrets extends OwnerSessionSecrets_base {
-}
-declare const UnsafeServerHostnameError_base: Schema.Class<UnsafeServerHostnameError, Schema.TaggedStruct<"UnsafeServerHostnameError", {
-    readonly hostname: Schema.String;
-    readonly message: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-export declare class UnsafeServerHostnameError extends UnsafeServerHostnameError_base {
-}
-export declare const isLoopbackHostname: (hostname: string) => boolean;
-export declare const requireLoopbackHostname: (hostname: string) => Effect.Effect<string, UnsafeServerHostnameError, never>;
-export declare const makeOwnerSessionSecrets: (authorityOrigin: string) => Effect.Effect<OwnerSessionSecretsContract, import("@knpkv/browser-pairing").BrowserPairingError | UnsafeServerHostnameError, import("effect/Crypto").Crypto>;
-export declare const activateOwnerSessionBootstrap: (secrets: OwnerSessionSecretsContract) => Effect.Effect<void, import("@knpkv/browser-pairing").BrowserPairingError, never>;
-export declare const ownerSessionOrigin: (hostname: string, port: number) => string;
-export declare const ownerSessionUrl: (hostname: string, port: number, secrets: OwnerSessionSecretsContract) => string;
-export declare const ownerSessionUrlForOrigin: (origin: string, secrets: Pick<OwnerSessionSecretsContract, "bootstrapToken">) => string;
-export declare const requireLoopbackOrigin: (origin: string) => Effect.Effect<string, UnsafeServerHostnameError, never>;
-/** Validate the advertised origin against either the bound server or the supported Vite proxy. */
-export declare const requireSupportedPublicOrigin: (origin: string, authorityOrigin: string) => Effect.Effect<string, UnsafeServerHostnameError, never>;
-export declare const resolvePublicOrigin: (configuredOrigin: string | undefined, authorityOrigin: string) => Effect.Effect<string, UnsafeServerHostnameError, never>;
-export declare const ownerSessionCookie: (secrets: Pick<OwnerSessionSecretsContract, "ownerToken">) => string;
-interface OwnerRequestAuthorization {
-    readonly credential: string;
-    readonly csrfToken: string | undefined;
-    readonly host: string | undefined;
-    readonly method: string;
-    readonly origin: string | undefined;
-}
-export declare const authorizeOwnerRequest: (request: OwnerRequestAuthorization, secrets: OwnerSessionSecretsContract) => Effect.Effect<undefined, ForbiddenApiError | UnauthorizedApiError, never>;
-interface BootstrapAuthorization {
-    readonly authorization: string | undefined;
-    readonly host: string | undefined;
-    readonly origin: string | undefined;
-}
-export declare const authorizeBootstrapRequest: (request: BootstrapAuthorization, secrets: OwnerSessionSecretsContract) => Effect.Effect<undefined, ForbiddenApiError | UnauthorizedApiError, never>;
-export declare const ownerSessionAuthLayer: Layer.Layer<OwnerSessionAuth, never, OwnerSessionSecrets>;
-export declare const OwnerSessionBootstrapRouter: Layer.Layer<never, never, HttpRouter.HttpRouter | HttpRouter.Request<"Error", import("effect/http/HttpBody").HttpBodyError> | HttpRouter.Request<"Requires", OwnerSessionSecrets>>;
-export {};
-//# sourceMappingURL=OwnerSessionSecurity.d.ts.map

package/dist/server/internal/OwnerSessionSecurity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"OwnerSessionSecurity.d.ts","sourceRoot":"","sources":["../../../src/server/internal/OwnerSessionSecurity.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AACzF,OAAO,EAAS,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErF,MAAM,WAAW,2BAA2B;IAC1C,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7C,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAA;IAC9D,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC9D,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACvD,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAChD,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;CACrD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;;AAED,qBAAa,mBAAoB,SAAQ,wBAGO;CAAG;;;;;AAEnD,qBAAa,yBAA0B,SAAQ,8BAG9C;CAAG;AAOJ,eAAO,MAAM,kBAAkB,aAAc,MAAM,KAAG,OAC8C,CAAA;AAEpG,eAAO,MAAM,uBAAuB,+EAUnC,CAAA;AAED,eAAO,MAAM,uBAAuB,2LAoBnC,CAAA;AAED,eAAO,MAAM,6BAA6B,4HAMzC,CAAA;AAED,eAAO,MAAM,kBAAkB,aAAc,MAAM,QAAQ,MAAM,KAAG,MAGnE,CAAA;AAED,eAAO,MAAM,eAAe,aAChB,MAAM,QACV,MAAM,WACH,2BAA2B,KACnC,MAA+E,CAAA;AAElF,eAAO,MAAM,wBAAwB,WAC3B,MAAM,WACL,IAAI,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,KAC3D,MAGF,CAAA;AAED,eAAO,MAAM,qBAAqB,6EAwBjC,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,sGAexC,CAAA;AAED,eAAO,MAAM,mBAAmB,4HAM/B,CAAA;AAED,eAAO,MAAM,kBAAkB,YACpB,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,KACvD,MAOC,CAAA;AAEJ,UAAU,yBAAyB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAED,eAAO,MAAM,qBAAqB,yJAuBjC,CAAA;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAED,eAAO,MAAM,yBAAyB,sJAoErC,CAAA;AAED,eAAO,MAAM,qBAAqB,2DAuBjC,CAAA;AAED,eAAO,MAAM,2BAA2B,oLA+BvC,CAAA"}

package/dist/server/internal/OwnerSessionSecurity.js

@@ -1,220 +0,0 @@
-import { credentialValuesEqual, decideOneTimeCredential, expiresAt, issueCsrfToken, issuePairingCode, issueSessionToken, serializeCredentialCookie } from "@knpkv/browser-pairing";
-import { Clock, Context, Effect, Layer, Redacted, Ref, Schema } from "effect";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
-import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "../Api.js";
-export class OwnerSessionSecrets extends Context.Service()("@knpkv/codecommit-web/OwnerSessionSecrets") {
-}
-export class UnsafeServerHostnameError extends Schema.TaggedError()("UnsafeServerHostnameError", { hostname: Schema.String, message: Schema.String }) {
-}
-const safeMethods = new Set(["GET", "HEAD", "OPTIONS"]);
-const MAX_BOOTSTRAP_FAILURES = 5;
-const authenticatedDevPublicOrigin = "http://localhost:5173";
-export const isLoopbackHostname = (hostname) => hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
-export const requireLoopbackHostname = Effect.fn("OwnerSessionSecurity.requireLoopbackHostname")(function* (hostname) {
-    if (!isLoopbackHostname(hostname)) {
-        return yield* new UnsafeServerHostnameError({
-            hostname,
-            message: "CodeCommit web may only listen on a loopback hostname"
-        });
-    }
-    return hostname;
-});
-export const makeOwnerSessionSecrets = Effect.fn("OwnerSessionSecurity.makeSecrets")(function* (authorityOrigin) {
-    const validatedAuthorityOrigin = yield* requireLoopbackOrigin(authorityOrigin);
-    const [ownerToken, csrfToken, bootstrapToken] = yield* Effect.all([
-        issueSessionToken(),
-        issueCsrfToken(),
-        issuePairingCode()
-    ]);
-    const bootstrapAvailable = yield* Ref.make(true);
-    const bootstrapAttemptState = yield* Ref.make({ failedAttempts: 0, inFlight: 0 });
-    return OwnerSessionSecrets.of({
-        authorityOrigin: validatedAuthorityOrigin,
-        ownerToken,
-        csrfToken,
-        bootstrapToken,
-        bootstrapAvailable,
-        bootstrapAttemptState,
-        bootstrapExpiresAtMillis: yield* Ref.make(undefined)
-    });
-});
-export const activateOwnerSessionBootstrap = Effect.fn("OwnerSessionSecurity.activateBootstrap")(function* (secrets) {
-    const now = yield* Clock.currentTimeMillis;
-    const expiry = yield* expiresAt(now, 60_000);
-    yield* Ref.set(secrets.bootstrapExpiresAtMillis, expiry);
-});
-export const ownerSessionOrigin = (hostname, port) => {
-    const urlHostname = hostname === "::1" ? "[::1]" : hostname;
-    return `http://${urlHostname}:${port}/`;
-};
-export const ownerSessionUrl = (hostname, port, secrets) => ownerSessionUrlForOrigin(ownerSessionOrigin(hostname, port), secrets);
-export const ownerSessionUrlForOrigin = (origin, secrets) => {
-    const bootstrapToken = encodeURIComponent(Redacted.value(secrets.bootstrapToken));
-    return `${origin.replace(/\/+$/u, "")}/#bootstrap_token=${bootstrapToken}`;
-};
-export const requireLoopbackOrigin = Effect.fn("OwnerSessionSecurity.requireLoopbackOrigin")(function* (origin) {
-    const url = yield* Effect.try({
-        try: () => new URL(origin),
-        catch: () => new UnsafeServerHostnameError({
-            hostname: origin,
-            message: "CodeCommit public origin must be a valid loopback HTTP origin"
-        })
-    });
-    if (url.protocol !== "http:" ||
-        !isLoopbackHostname(url.hostname) ||
-        url.pathname !== "/" ||
-        url.search !== "" ||
-        url.hash !== "") {
-        return yield* new UnsafeServerHostnameError({
-            hostname: origin,
-            message: "CodeCommit public origin must be an HTTP loopback origin without a path, query, or fragment"
-        });
-    }
-    return url.origin;
-});
-/** Validate the advertised origin against either the bound server or the supported Vite proxy. */
-export const requireSupportedPublicOrigin = Effect.fn("OwnerSessionSecurity.requireSupportedPublicOrigin")(function* (origin, authorityOrigin) {
-    const validatedOrigin = yield* requireLoopbackOrigin(origin);
-    const validatedAuthority = yield* requireLoopbackOrigin(authorityOrigin);
-    const authorityUrl = new URL(validatedAuthority);
-    const isSupportedProxy = validatedOrigin === authenticatedDevPublicOrigin &&
-        authorityUrl.protocol === "http:" && authorityUrl.hostname === "127.0.0.1";
-    if (validatedOrigin !== validatedAuthority && !isSupportedProxy) {
-        return yield* new UnsafeServerHostnameError({
-            hostname: origin,
-            message: "CodeCommit public origin must be the bound server or its supported Vite proxy"
-        });
-    }
-    return validatedOrigin;
-});
-export const resolvePublicOrigin = Effect.fn("OwnerSessionSecurity.resolvePublicOrigin")(function* (configuredOrigin, authorityOrigin) {
-    return configuredOrigin === undefined
-        ? yield* requireLoopbackOrigin(authorityOrigin)
-        : yield* requireSupportedPublicOrigin(configuredOrigin, authorityOrigin);
-});
-export const ownerSessionCookie = (secrets) => serializeCredentialCookie(secrets.ownerToken, {
-    name: "cc_owner",
-    httpOnly: true,
-    path: "/api",
-    sameSite: "strict",
-    secure: false
-});
-export const authorizeOwnerRequest = Effect.fn("OwnerSessionSecurity.authorizeRequest")(function* (request, secrets) {
-    const ownerCredentialMatches = credentialValuesEqual(request.credential, Redacted.value(secrets.ownerToken)) === true;
-    if (!ownerCredentialMatches) {
-        return yield* new UnauthorizedApiError({ message: "Missing or invalid owner session" });
-    }
-    const sameOrigin = request.origin !== undefined && request.origin === secrets.authorityOrigin;
-    if (request.origin !== undefined && !sameOrigin) {
-        return yield* new ForbiddenApiError({ message: "Request origin does not match the CodeCommit server" });
-    }
-    // Safe reads intentionally allow non-browser callers without Origin or CSRF
-    // headers; every read still requires the process-scoped owner credential.
-    if (safeMethods.has(request.method.toUpperCase()))
-        return;
-    if (!sameOrigin) {
-        return yield* new ForbiddenApiError({ message: "Mutation origin does not match the CodeCommit server" });
-    }
-    const csrfTokenMatches = request.csrfToken !== undefined &&
-        credentialValuesEqual(request.csrfToken, Redacted.value(secrets.csrfToken)) === true;
-    if (!csrfTokenMatches) {
-        return yield* new ForbiddenApiError({ message: "Missing or invalid CSRF token" });
-    }
-});
-export const authorizeBootstrapRequest = Effect.fn("OwnerSessionSecurity.authorizeBootstrap")(function* (request, secrets) {
-    if (request.origin !== secrets.authorityOrigin) {
-        return yield* new ForbiddenApiError({ message: "Bootstrap origin does not match the CodeCommit server" });
-    }
-    const suppliedToken = request.authorization !== undefined && request.authorization.startsWith("Bearer ")
-        ? request.authorization.slice("Bearer ".length)
-        : undefined;
-    const acquireAdmission = Ref.modify(secrets.bootstrapAttemptState, (state) => {
-        if (state.failedAttempts + state.inFlight >= MAX_BOOTSTRAP_FAILURES) {
-            return ["unavailable", state];
-        }
-        const bootstrapTokenMatches = suppliedToken !== undefined &&
-            credentialValuesEqual(suppliedToken, Redacted.value(secrets.bootstrapToken)) === true;
-        if (!bootstrapTokenMatches) {
-            return ["invalid", {
-                    failedAttempts: Math.min(MAX_BOOTSTRAP_FAILURES, state.failedAttempts + 1),
-                    inFlight: state.inFlight
-                }];
-        }
-        return ["accepted", { ...state, inFlight: state.inFlight + 1 }];
-    }).pipe(Effect.flatMap((admission) => {
-        if (admission === "unavailable") {
-            return Effect.fail(new UnauthorizedApiError({ message: "Bootstrap confirmation temporarily unavailable" }));
-        }
-        if (admission === "invalid") {
-            return Effect.fail(new UnauthorizedApiError({ message: "Missing or invalid bootstrap token" }));
-        }
-        return Effect.void;
-    }));
-    return yield* Effect.acquireUseRelease(acquireAdmission, () => Effect.gen(function* () {
-        const expiresAt = yield* Ref.get(secrets.bootstrapExpiresAtMillis);
-        if (expiresAt === undefined) {
-            return yield* new UnauthorizedApiError({ message: "Bootstrap token is not active" });
-        }
-        const now = yield* Clock.currentTimeMillis;
-        const decision = yield* Ref.modify(secrets.bootstrapAvailable, (available) => {
-            const state = {
-                expiresAt,
-                consumedAt: available ? null : 0,
-                revokedAt: null
-            };
-            const next = decideOneTimeCredential(state, now);
-            return [next, next === "accepted" ? false : available];
-        });
-        if (decision === "expired")
-            return yield* new UnauthorizedApiError({ message: "Bootstrap token has expired" });
-        if (decision === "consumed") {
-            return yield* new UnauthorizedApiError({ message: "Bootstrap token has already been used" });
-        }
-        if (decision === "invalid") {
-            return yield* new UnauthorizedApiError({ message: "Bootstrap token state is invalid" });
-        }
-    }), () => Ref.update(secrets.bootstrapAttemptState, (state) => ({
-        ...state,
-        inFlight: Math.max(0, state.inFlight - 1)
-    })));
-});
-export const ownerSessionAuthLayer = Layer.effect(OwnerSessionAuth, Effect.gen(function* () {
-    const secrets = yield* OwnerSessionSecrets;
-    return OwnerSessionAuth.of({
-        ownerCookie: Effect.fn("OwnerSessionSecurity.ownerCookie")(function* (httpEffect, { credential }) {
-            const request = yield* HttpServerRequest.HttpServerRequest;
-            yield* authorizeOwnerRequest({
-                credential: Redacted.value(credential),
-                csrfToken: request.headers["x-csrf-token"],
-                host: request.headers.host,
-                method: request.method,
-                origin: request.headers.origin
-            }, secrets);
-            return yield* httpEffect;
-        })
-    });
-}));
-export const OwnerSessionBootstrapRouter = HttpRouter.use((router) => router.add("POST", "/auth/bootstrap", Effect.gen(function* () {
-    const secrets = yield* OwnerSessionSecrets;
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const authorization = authorizeBootstrapRequest({
-        authorization: request.headers.authorization,
-        host: request.headers.host,
-        origin: request.headers.origin
-    }, secrets);
-    const result = yield* Effect.result(authorization);
-    if (result._tag === "Failure") {
-        const error = result.failure;
-        return HttpServerResponse.text(error.message, {
-            status: error._tag === "UnauthorizedApiError" ? 401 : 403
-        });
-    }
-    return yield* HttpServerResponse.json({ csrfToken: Redacted.value(secrets.csrfToken) }, {
-        status: 200,
-        headers: {
-            "cache-control": "no-store",
-            "set-cookie": ownerSessionCookie(secrets)
-        }
-    });
-})));
-//# sourceMappingURL=OwnerSessionSecurity.js.map

package/dist/server/internal/OwnerSessionSecurity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"OwnerSessionSecurity.js","sourceRoot":"","sources":["../../../src/server/internal/OwnerSessionSecurity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAkBrF,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,2CAA2C,CAAC;CAAG;AAEnD,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CACpD;CAAG;AAEJ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AACvD,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAChC,MAAM,4BAA4B,GAAG,uBAAuB,CAAA;AAG5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9D,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAA;AAEpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,8CAA8C,CAAC,CAC9F,QAAQ,CAAC,EAAC,QAAgB;IACxB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ;YACR,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAClF,QAAQ,CAAC,EAAC,eAAuB;IAC/B,MAAM,wBAAwB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC9E,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAChE,iBAAiB,EAAE;QACnB,cAAc,EAAE;QAChB,gBAAgB,EAAE;KACnB,CAAC,CAAA;IACF,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwB,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IACxG,OAAO,mBAAmB,CAAC,EAAE,CAAC;QAC5B,eAAe,EAAE,wBAAwB;QACzC,UAAU;QACV,SAAS;QACT,cAAc;QACd,kBAAkB;QAClB,qBAAqB;QACrB,wBAAwB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,SAAS,CAAC;KACzE,CAAC,CAAA;AACJ,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,wCAAwC,CAAC,CAC9F,QAAQ,CAAC,EAAC,OAAoC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAA;AAC1D,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE;IAC3E,MAAM,WAAW,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3D,OAAO,UAAU,WAAW,IAAI,IAAI,GAAG,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,IAAY,EACZ,OAAoC,EAC5B,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAAc,EACd,OAA4D,EACpD,EAAE;IACV,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAA;IACjF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,cAAc,EAAE,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,4CAA4C,CAAC,CAC1F,QAAQ,CAAC,EAAC,MAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,yBAAyB,CAAC;YAC5B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,+DAA+D;SACzE,CAAC;KACL,CAAC,CAAA;IACF,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CACF,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,EAAE,CAAC,mDAAmD,CAAC,CACxG,QAAQ,CAAC,EAAC,MAAc,EAAE,eAAuB;IAC/C,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IACxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAChD,MAAM,gBAAgB,GAAG,eAAe,KAAK,4BAA4B;QACvE,YAAY,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,QAAQ,KAAK,WAAW,CAAA;IAC5E,IAAI,eAAe,KAAK,kBAAkB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,+EAA+E;SACzF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,0CAA0C,CAAC,CACtF,QAAQ,CAAC,EAAC,gBAAoC,EAAE,eAAuB;IACrE,OAAO,gBAAgB,KAAK,SAAS;QACnC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC;QAC/C,CAAC,CAAC,KAAK,CAAC,CAAC,4BAA4B,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAA;AAC5E,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAwD,EAChD,EAAE,CACV,yBAAyB,CAAC,OAAO,CAAC,UAAU,EAAE;IAC5C,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AAUJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CACrF,QAAQ,CAAC,EAAC,OAAkC,EAAE,OAAoC;IAChF,MAAM,sBAAsB,GAC1B,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAA;IACxF,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,eAAe,CAAA;IAC7F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS;QACtD,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;IACtF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC,CACF,CAAA;AAQD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAC3F,QAAQ,CAAC,EAAC,OAA+B,EAAE,OAAoC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QACtG,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CACjC,OAAO,CAAC,qBAAqB,EAC7B,CAAC,KAAK,EAAwD,EAAE;QAC9D,IAAI,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,IAAI,sBAAsB,EAAE,CAAC;YACpE,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,qBAAqB,GAAG,aAAa,KAAK,SAAS;YACvD,qBAAqB,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,CAAA;QACvF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,CAAC,SAAS,EAAE;oBACjB,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;oBAC1E,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC3B,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAA;QACjG,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC,CAAC,CACH,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,gBAAgB,EAChB,GAAG,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,EAAE;YAC3E,MAAM,KAAK,GAAG;gBACZ,SAAS;gBACT,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChC,SAAS,EAAE,IAAI;aAChB,CAAA;YACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAChD,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;QAC9G,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;QACzF,CAAC;IACH,CAAC,CAAC,EACJ,GAAG,EAAE,CACH,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,KAAK;QACR,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;KAC1C,CAAC,CAAC,CACN,CAAA;AACH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CACxD,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;YAC1D,KAAK,CAAC,CAAC,qBAAqB,CAC1B;gBACE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;aAC/B,EACD,OAAO,CACR,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CACF;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CACR,MAAM,EACN,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,aAAa,GAAG,yBAAyB,CAC7C;QACE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;KAC/B,EACD,OAAO,CACR,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAA;QAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5C,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SAC1D,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;QACtF,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC;SAC1C;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CACF,CAAA"}