@knpkv/jcf-web 0.2.0 → 0.4.0

package/dist/server/OwnerSession.js

@@ -1,219 +1,27 @@
-/**
- * Who may talk to this server.
- *
- * **Mental model**
- *
- * - **One process, one operator.** The server binds a loopback address and mints a session token for
- *   itself at startup. There is no user table and no login: the person who can read the terminal is
- *   the person who gets in, which is exactly the authority a tool that writes to their own timesheet
- *   should have.
- * - **The URL is the handshake.** The bootstrap code is printed once, in a fragment the browser
- *   never sends upstream, and is spent the first time it is exchanged for the session cookie.
- * - **A read needs the cookie and must not be a browser cross-origin request; a write also needs the
- *   expected origin and CSRF header.** Another page in the same browser can make the browser send a
- *   cookie, but Fetch Metadata keeps that page from starting agent-backed reads without an Origin.
- *
- * The rules are those of `@knpkv/codecommit-web`'s owner session, over the same
- * `@knpkv/browser-pairing` credential primitives. They are re-stated here rather than imported
- * because that module is private to that application; the shared home for them is a later job than
- * this one, and duplicating the *policy* while sharing the *primitives* is the smaller of the two
- * mistakes available.
- *
- * @module
- */
-import { credentialValuesEqual, decideOneTimeCredential, expiresAt, issueCsrfToken, issuePairingCode, issueSessionToken, serializeCredentialCookie } from "@knpkv/browser-pairing";
-import { Clock, Context, Effect, Layer, Redacted, Ref, Schema } from "effect";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
+import { Effect, Layer, Redacted } from "effect";
 import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "./Api.js";
-/** How long the printed bootstrap URL stays usable. Long enough to click, short enough to forget. */
-const BOOTSTRAP_LIFETIME_MILLIS = 60_000;
-/**
- * Failed bootstrap exchanges before the exchange closes for the life of the process.
- *
- * The code is high-entropy, so this is not what makes guessing hard — it is what stops a process
- * that is being guessed at from staying open all afternoon.
- */
-const MAX_BOOTSTRAP_FAILURES = 5;
-/** Methods that only read. They need the session, but no origin and no CSRF token. */
-const safeMethods = new Set(["GET", "HEAD", "OPTIONS"]);
-/**
- * The one origin other than the bound server that may hold a session: the Vite dev server, which
- * proxies both the API and the bootstrap exchange, so the browser stays on a single origin.
- */
-const devPublicOrigin = "http://localhost:5173";
-export class OwnerSessionSecrets extends Context.Service()("@knpkv/jcf-web/OwnerSessionSecrets") {
-}
-export class UnsafeServerOriginError extends Schema.TaggedError()("UnsafeServerOriginError", { message: Schema.String, origin: Schema.String }) {
-}
-export const isLoopbackHostname = (hostname) => hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
-export const ownerSessionOrigin = (hostname, port) => `http://${hostname === "::1" ? "[::1]" : hostname}:${port}`;
-export const requireLoopbackOrigin = Effect.fn("OwnerSession.requireLoopbackOrigin")(function* (origin) {
-    const url = yield* Effect.try({
-        catch: () => new UnsafeServerOriginError({ message: "jcf-web needs a valid HTTP origin", origin }),
-        try: () => new URL(origin)
+/** Build the session for a server bound at `authorityOrigin`, advertised at `configuredPublicOrigin`. */
+export const makeOwnerSession = Effect.fn("JcfWeb.makeOwnerSession")(function* (authorityOrigin, configuredPublicOrigin) {
+    return yield* OwnerSession.make({
+        authorityOrigin,
+        browserOrigin: yield* OwnerSession.resolvePublicOrigin(configuredPublicOrigin, authorityOrigin),
+        cookieName: "jcf_owner",
+        freshUrlHint: "restart jcf-web for a fresh URL",
+        product: "jcf-web",
+        writes: "csrf"
     });
-    if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname) || url.search !== "" || url.hash !== "") {
-        return yield* new UnsafeServerOriginError({
-            message: "jcf-web may only be reached over HTTP on a loopback host",
-            origin
-        });
-    }
-    return url.origin;
-});
-/** The advertised origin: the bound server, or the dev server that proxies to it. */
-export const resolvePublicOrigin = Effect.fn("OwnerSession.resolvePublicOrigin")(function* (configuredOrigin, authorityOrigin) {
-    const authority = yield* requireLoopbackOrigin(authorityOrigin);
-    if (configuredOrigin === undefined)
-        return authority;
-    const configured = yield* requireLoopbackOrigin(configuredOrigin);
-    if (configured !== authority && configured !== devPublicOrigin) {
-        return yield* new UnsafeServerOriginError({
-            message: "jcf-web's public origin must be the bound server or its dev proxy",
-            origin: configuredOrigin
-        });
-    }
-    return configured;
-});
-export const makeOwnerSessionSecrets = Effect.fn("OwnerSession.makeSecrets")(function* (authorityOrigin, configuredPublicOrigin) {
-    const validated = yield* requireLoopbackOrigin(authorityOrigin);
-    const browserOrigin = yield* resolvePublicOrigin(configuredPublicOrigin, validated);
-    const [ownerToken, csrfToken, bootstrapToken] = yield* Effect.all([
-        issueSessionToken(),
-        issueCsrfToken(),
-        issuePairingCode()
-    ]);
-    return OwnerSessionSecrets.of({
-        authorityOrigin: validated,
-        bootstrapAttemptState: yield* Ref.make({ failedAttempts: 0, inFlight: 0 }),
-        bootstrapAvailable: yield* Ref.make(true),
-        bootstrapExpiresAtMillis: yield* Ref.make(undefined),
-        bootstrapToken,
-        browserOrigin,
-        csrfToken,
-        ownerToken
-    });
-});
-/** Start the bootstrap clock. Called once the server is actually listening, never before. */
-export const activateOwnerSessionBootstrap = Effect.fn("OwnerSession.activateBootstrap")(function* (secrets) {
-    const now = yield* Clock.currentTimeMillis;
-    yield* Ref.set(secrets.bootstrapExpiresAtMillis, yield* expiresAt(now, BOOTSTRAP_LIFETIME_MILLIS));
-});
-/**
- * The URL to open. The code rides in the fragment, which browsers do not send to servers and
- * proxies do not log, and the page strips it from the address bar once it has been spent.
- */
-export const ownerSessionUrl = (publicOrigin, secrets) => `${publicOrigin.replace(/\/+$/u, "")}/#bootstrap_token=${encodeURIComponent(Redacted.value(secrets.bootstrapToken))}`;
-export const ownerSessionCookie = (secrets) => serializeCredentialCookie(secrets.ownerToken, {
-    httpOnly: true,
-    name: "jcf_owner",
-    path: "/api",
-    sameSite: "strict",
-    secure: false
-});
-const fetchSites = new Set(["cross-site", "none", "same-origin", "same-site"]);
-export const authorizeOwnerRequest = Effect.fn("OwnerSession.authorizeRequest")(function* (request, secrets) {
-    if (credentialValuesEqual(request.credential, Redacted.value(secrets.ownerToken)) !== true) {
-        return yield* new UnauthorizedApiError({ message: "Missing or invalid owner session" });
-    }
-    const sameOrigin = request.origin !== undefined && request.origin === secrets.browserOrigin;
-    if (request.origin !== undefined && !sameOrigin) {
-        return yield* new ForbiddenApiError({ message: "Request origin does not match this jcf-web server" });
-    }
-    if (request.fetchSite !== undefined && !fetchSites.has(request.fetchSite)) {
-        return yield* new ForbiddenApiError({ message: "Request carries invalid browser site metadata" });
-    }
-    if (request.fetchSite === "cross-site" ||
-        (!sameOrigin && (request.fetchSite === "same-site" || request.fetchSite === "none"))) {
-        return yield* new ForbiddenApiError({ message: "Browser request is not from this jcf-web page" });
-    }
-    // An explicit client such as curl carries neither Origin nor Fetch Metadata and remains allowed:
-    // it still has to present the process-scoped session cookie. Browser-marked cross-origin reads
-    // are rejected before their handler can start provider or agent work.
-    if (safeMethods.has(request.method.toUpperCase()))
-        return;
-    if (!sameOrigin) {
-        return yield* new ForbiddenApiError({ message: "Mutation origin does not match this jcf-web server" });
-    }
-    const csrfMatches = request.csrfToken !== undefined &&
-        credentialValuesEqual(request.csrfToken, Redacted.value(secrets.csrfToken)) === true;
-    if (!csrfMatches)
-        return yield* new ForbiddenApiError({ message: "Missing or invalid CSRF token" });
-});
-const bearerToken = (authorization) => authorization !== undefined && authorization.startsWith("Bearer ")
-    ? authorization.slice("Bearer ".length)
-    : undefined;
-export const authorizeBootstrapRequest = Effect.fn("OwnerSession.authorizeBootstrap")(function* (request, secrets) {
-    if (request.origin !== secrets.browserOrigin) {
-        return yield* new ForbiddenApiError({ message: "Bootstrap origin does not match this jcf-web server" });
-    }
-    const supplied = bearerToken(request.authorization);
-    // Counted before the code is even compared, so a burst of parallel guesses cannot all pass the
-    // check together and then be counted afterwards.
-    const admit = Ref.modify(secrets.bootstrapAttemptState, (state) => {
-        if (state.failedAttempts + state.inFlight >= MAX_BOOTSTRAP_FAILURES)
-            return ["unavailable", state];
-        const matches = supplied !== undefined &&
-            credentialValuesEqual(supplied, Redacted.value(secrets.bootstrapToken)) === true;
-        if (!matches) {
-            return ["invalid", {
-                    failedAttempts: Math.min(MAX_BOOTSTRAP_FAILURES, state.failedAttempts + 1),
-                    inFlight: state.inFlight
-                }];
-        }
-        return ["accepted", { ...state, inFlight: state.inFlight + 1 }];
-    }).pipe(Effect.flatMap((admission) => admission === "unavailable"
-        ? Effect.fail(new UnauthorizedApiError({ message: "Bootstrap is closed for this process" }))
-        : admission === "invalid"
-            ? Effect.fail(new UnauthorizedApiError({ message: "Missing or invalid bootstrap token" }))
-            : Effect.void));
-    return yield* Effect.acquireUseRelease(admit, () => Effect.gen(function* () {
-        const expiry = yield* Ref.get(secrets.bootstrapExpiresAtMillis);
-        if (expiry === undefined)
-            return yield* new UnauthorizedApiError({ message: "Bootstrap is not active yet" });
-        const now = yield* Clock.currentTimeMillis;
-        const decision = yield* Ref.modify(secrets.bootstrapAvailable, (available) => {
-            const next = decideOneTimeCredential({ consumedAt: available ? null : 0, expiresAt: expiry, revokedAt: null }, now);
-            return [next, next === "accepted" ? false : available];
-        });
-        if (decision === "accepted")
-            return;
-        const message = decision === "expired"
-            ? "Bootstrap token has expired — restart jcf-web for a fresh URL"
-            : decision === "consumed"
-                ? "Bootstrap token has already been used"
-                : "Bootstrap token state is invalid";
-        return yield* new UnauthorizedApiError({ message });
-    }), () => Ref.update(secrets.bootstrapAttemptState, (state) => ({ ...state, inFlight: Math.max(0, state.inFlight - 1) })));
 });
 export const ownerSessionAuthLayer = Layer.effect(OwnerSessionAuth, Effect.gen(function* () {
-    const secrets = yield* OwnerSessionSecrets;
+    const session = yield* OwnerSession.OwnerSession;
     return OwnerSessionAuth.of({
-        ownerCookie: Effect.fn("OwnerSession.ownerCookie")(function* (httpEffect, { credential }) {
-            const request = yield* HttpServerRequest.HttpServerRequest;
-            yield* authorizeOwnerRequest({
-                credential: Redacted.value(credential),
-                csrfToken: request.headers["x-csrf-token"],
-                fetchSite: request.headers["sec-fetch-site"],
-                method: request.method,
-                origin: request.headers.origin
-            }, secrets);
+        ownerCookie: Effect.fn("JcfWeb.ownerCookie")(function* (httpEffect, { credential }) {
+            yield* session.authorizeHttp(Redacted.value(credential)).pipe(Effect.catchTags({
+                OwnerSessionForbiddenError: ({ message }) => Effect.fail(new ForbiddenApiError({ message })),
+                OwnerSessionUnauthorizedError: ({ message }) => Effect.fail(new UnauthorizedApiError({ message }))
+            }));
             return yield* httpEffect;
         })
     });
 }));
-/** The one route outside the authenticated API: spending the printed code for a session. */
-export const OwnerSessionBootstrapRouter = HttpRouter.use((router) => router.add("POST", "/auth/bootstrap", Effect.gen(function* () {
-    const secrets = yield* OwnerSessionSecrets;
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const result = yield* Effect.result(authorizeBootstrapRequest({ authorization: request.headers.authorization, origin: request.headers.origin }, secrets));
-    if (result._tag === "Failure") {
-        return HttpServerResponse.text(result.failure.message, {
-            status: result.failure._tag === "UnauthorizedApiError" ? 401 : 403
-        });
-    }
-    return yield* HttpServerResponse.json({ csrfToken: Redacted.value(secrets.csrfToken) }, {
-        headers: { "cache-control": "no-store", "set-cookie": ownerSessionCookie(secrets) },
-        status: 200
-    });
-})));
 //# sourceMappingURL=OwnerSession.js.map

package/dist/server/OwnerSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"OwnerSession.js","sourceRoot":"","sources":["../../src/server/OwnerSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAEpF,qGAAqG;AACrG,MAAM,yBAAyB,GAAG,MAAM,CAAA;AAExC;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEhC,sFAAsF;AACtF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvD;;;GAGG;AACH,MAAM,eAAe,GAAG,uBAAuB,CAAA;AAuB/C,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,oCAAoC,CAAC;CAAG;AAE5C,MAAM,OAAO,uBAAwB,SAAQ,MAAM,CAAC,WAAW,EAA2B,CACxF,yBAAyB,EACzB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAClD;CAAG;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9D,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAA;AAEpG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE,CAC3E,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAA;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAClF,QAAQ,CAAC,EAAC,MAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,CAAC;QAClG,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC1G,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;YACxC,OAAO,EAAE,0DAA0D;YACnE,MAAM;SACP,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CACF,CAAA;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAC9E,QAAQ,CAAC,EAAC,gBAAoC,EAAE,eAAuB;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC/D,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAA;IACjE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC;YACxC,OAAO,EAAE,mEAAmE;YAC5E,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAC1E,QAAQ,CAAC,EAAC,eAAuB,EAAE,sBAA+B;IAChE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAA;IACnF,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAChE,iBAAiB,EAAE;QACnB,cAAc,EAAE;QAChB,gBAAgB,EAAE;KACnB,CAAC,CAAA;IACF,OAAO,mBAAmB,CAAC,EAAE,CAAC;QAC5B,eAAe,EAAE,SAAS;QAC1B,qBAAqB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwB,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACjG,kBAAkB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QACzC,wBAAwB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,SAAS,CAAC;QACxE,cAAc;QACd,aAAa;QACb,SAAS;QACT,UAAU;KACX,CAAC,CAAA;AACJ,CAAC,CACF,CAAA;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CACtF,QAAQ,CAAC,EAAC,OAAoC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;AACpG,CAAC,CACF,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,YAAoB,EACpB,OAA4D,EACpD,EAAE,CACV,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAA;AAEvH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAwD,EAAU,EAAE,CACrG,yBAAyB,CAAC,OAAO,CAAC,UAAU,EAAE;IAC5C,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AAUJ,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAC7E,QAAQ,CAAC,EAAC,OAAqB,EAAE,OAAoC;IACnE,IAAI,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAA;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAA;IACnG,CAAC;IACD,IACE,OAAO,CAAC,SAAS,KAAK,YAAY;QAClC,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EACpF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAA;IACnG,CAAC;IACD,iGAAiG;IACjG,+FAA+F;IAC/F,sEAAsE;IACtE,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS;QACjD,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;IACtF,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AACrG,CAAC,CACF,CAAA;AAID,MAAM,WAAW,GAAG,CAAC,aAAiC,EAAsB,EAAE,CAC5E,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;IAChE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;IACvC,CAAC,CAAC,SAAS,CAAA;AAEf,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CACnF,QAAQ,CAAC,EACP,OAA4F,EAC5F,OAAoC;IAEpC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACnD,+FAA+F;IAC/F,iDAAiD;IACjD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CACtB,OAAO,CAAC,qBAAqB,EAC7B,CAAC,KAAK,EAAwD,EAAE;QAC9D,IAAI,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,IAAI,sBAAsB;YAAE,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAClG,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS;YACpC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,CAAA;QAClF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,SAAS,EAAE;oBACjB,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;oBAC1E,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,SAAS,KAAK,aAAa;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC1F,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,CACF,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,KAAK,EACL,GAAG,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAC/D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;QAC5G,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,EAAE;YAC3E,MAAM,IAAI,GAAG,uBAAuB,CAClC,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EACxE,GAAG,CACJ,CAAA;YACD,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAM;QACnC,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS;YACpC,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,QAAQ,KAAK,UAAU;gBACzB,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,kCAAkC,CAAA;QACtC,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC,CAAC,EACJ,GAAG,EAAE,CACH,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAClH,CAAA;AACH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAChD,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;YAC1D,KAAK,CAAC,CAAC,qBAAqB,CAC1B;gBACE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;aAC/B,EACD,OAAO,CACR,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CACF;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CACR,MAAM,EACN,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CACjC,yBAAyB,CACvB,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAChF,OAAO,CACR,CACF,CAAA;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;YACrD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SACnE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;QACtF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACnF,MAAM,EAAE,GAAG;KACZ,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CACF,CAAA"}
+{"version":3,"file":"OwnerSession.js","sourceRoot":"","sources":["../../src/server/OwnerSession.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAe,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAEpF,yGAAyG;AACzG,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAClE,QAAQ,CAAC,EACP,eAAuB,EACvB,sBAA+B;IAM/B,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;QAC9B,eAAe;QACf,aAAa,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,eAAe,CAAC;QAC/F,UAAU,EAAE,WAAW;QACvB,YAAY,EAAE,iCAAiC;QAC/C,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,MAAM;KACf,CAAC,CAAA;AACJ,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,YAAY,CAAA;IAChD,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YAC/E,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,SAAS,CAAC;gBACf,0BAA0B,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5F,6BAA6B,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;aACnG,CAAC,CACH,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA"}

package/dist/server/Server.d.ts

@@ -1,10 +1,11 @@
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
 import { Config, Deferred, Layer, Schema } from "effect";
-import { type OwnerSessionSecretsContract } from "./OwnerSession.js";
 export interface JcfWebServerOptions {
     readonly hostname?: string;
     readonly port: number;
-    readonly ready?: Deferred.Deferred<void>;
-    readonly security: OwnerSessionSecretsContract;
+    /** Completed with the bootstrap URL once the server is listening. */
+    readonly ready?: Deferred.Deferred<string>;
+    readonly security: OwnerSession.OwnerSessionService;
 }
 export declare const makeServer: (options: JcfWebServerOptions) => Layer.Layer<never, import("@knpkv/browser-pairing").BrowserPairingError | Config.ConfigError | Schema.SchemaError | import("effect/http/HttpServerError").ServeError, never>;
 /** The port to bind. Deliberately not 3000: the CodeCommit web app already lives there. */

package/dist/server/Server.js

@@ -13,15 +13,16 @@
  * @module
  */
 import { NodeHttpServer, NodeServices } from "@effect/platform-node";
+import * as OwnerSession from "@knpkv/browser-pairing/owner-session";
 import { Layers } from "@knpkv/jira-clockify";
 import { Config, Deferred, Effect, Layer, Schema } from "effect";
 import { Etag, HttpPlatform, HttpRouter } from "effect/http";
 import { createServer } from "node:http";
 import { application } from "./HttpApplication.js";
-import { activateOwnerSessionBootstrap, OwnerSessionSecrets } from "./OwnerSession.js";
 const HttpPlatformLive = HttpPlatform.layer.pipe(Layer.provide(NodeServices.layer));
-const LoopbackHostname = Schema.Literals(["127.0.0.1", "localhost", "::1"]);
-export const makeServer = (options) => Layer.unwrap(Schema.decodeUnknownEffect(LoopbackHostname)(options.hostname ?? "127.0.0.1").pipe(Effect.map((hostname) => HttpRouter.serve(application.pipe(Layer.provide(Layers.HeadlessLayer))).pipe(Layer.provide(NodeHttpServer.layerServer(createServer, { host: hostname, port: options.port })), Layer.provide(Etag.layer), Layer.provide(HttpPlatformLive), Layer.provide(NodeServices.layer), Layer.provide(Layer.succeed(OwnerSessionSecrets, options.security)), Layer.tap(() => activateOwnerSessionBootstrap(options.security).pipe(Effect.andThen(options.ready === undefined ? Effect.void : Deferred.succeed(options.ready, undefined))))))));
+export const makeServer = (options) => Layer.unwrap(Schema.decodeUnknownEffect(OwnerSession.LoopbackHostname)(options.hostname ?? "127.0.0.1").pipe(Effect.map((hostname) => HttpRouter.serve(application.pipe(Layer.provide(Layers.HeadlessLayer))).pipe(Layer.provide(NodeHttpServer.layerServer(createServer, { host: hostname, port: options.port })), Layer.provide(Etag.layer), Layer.provide(HttpPlatformLive), Layer.provide(NodeServices.layer), Layer.provide(Layer.succeed(OwnerSession.OwnerSession, options.security)), Layer.tap(() => 
+// The startup link: minted only once the server is listening, handed to whoever prints it.
+options.security.mintBootstrapCode.pipe(Effect.map((code) => OwnerSession.bootstrapUrl(options.security.browserOrigin, code)), Effect.flatMap((url) => options.ready === undefined ? Effect.void : Deferred.succeed(options.ready, url))))))));
 /** The port to bind. Deliberately not 3000: the CodeCommit web app already lives there. */
 export const Port = Config.Int("PORT").pipe(Config.withDefault(3111));
 /** Set by `pnpm dev` so the printed URL points at the Vite dev server that proxies here. */

package/dist/server/Server.js.map

@@ -1 +1 @@
-{"version":3,"file":"Server.js","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAoC,MAAM,mBAAmB,CAAA;AAExH,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;AACnF,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;AAS3E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAA4B,EAAE,EAAE,CACzD,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACzG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1E,KAAK,CAAC,OAAO,CACX,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CACjF,EACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EACjC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EACnE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CACb,6BAA6B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CACvG,CACF,CACF,CACF,CAAC,CACH,CAAA;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"Server.js","sourceRoot":"","sources":["../../src/server/Server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;AAUnF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAA4B,EAAE,EAAE,CACzD,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,IAAI,CAC7F,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1E,KAAK,CAAC,OAAO,CACX,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CACjF,EACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC/B,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EACjC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EACzE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;AACb,2FAA2F;AAC3F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,EACrF,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAC1G,CACF,CACF,CACF,CACF,CACF,CAAA;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAA"}