@lamalibre/create-lamaste 4.5.0 → 4.6.0

package/vendor/gatekeeper/dist/server/routes/authz.js

@@ -1,8 +1,8 @@
 import crypto from 'node:crypto';
 import { request as undiciRequest } from 'undici';
-import { AUTHELIA_SESSION_COOKIE, RELAY_ASSERTION_HEADER, RELAY_PANEL_AUDIENCE, RELAY_PANEL_PORT, autheliaSessionCookies, isUserSurfaceUrl, signRelayAssertion, } from '@lamalibre/lamaste';
+import { AUTHELIA_SESSION_COOKIE, RELAY_ASSERTION_HEADER, RELAY_PANEL_AUDIENCE, RELAY_PANEL_PORT, autheliaSessionCookies, isUserSurfaceUrl, signRelayAssertion, userSurfaceHostByFqdn, } from '@lamalibre/lamaste';
 import { AUTHELIA_VERIFY_URL, SESSION_CACHE_TTL_MS } from '../../lib/constants.js';
-import { checkAccess } from '../../lib/authz.js';
+import { checkAccess, isPluginAudienceMember } from '../../lib/authz.js';
 import { buildAccessRequestPage } from '../../lib/templates.js';
 import { logAccessRequest } from '../routes/diagnostic.js';
 /** Hard cap on session cache entries to prevent memory exhaustion on 512MB droplets. */
@@ -184,14 +184,16 @@ export async function authzRoutes(fastify, opts = {}) {
     /**
      * GET /authz/user-surface/:fqdn — the nginx auth_request target of a
      * plugin's user surface: `/api/<route>/app` and everything under it, on
-     * the host of a tunnel bound to the plugin (`userSurface` in
-     * tunnels.json). The vhost names the tunnel as for `/authz/tunnel/:fqdn`.
+     * a host serving it — a tunnel bound to the plugin (`userSurface` in
+     * tunnels.json) or the site the plugin owns (`owner` in sites.json; core
+     * `userSurfaceHosts` reads both). The vhost names the host as for
+     * `/authz/tunnel/:fqdn`.
      *
-     * Gatekeeper authenticates the session — on a restricted tunnel it checks
-     * the user's grant too — and vouches for its user to the panel: a relay
+     * Gatekeeper authenticates the session — on a restricted host it checks
+     * the user's grant for the tunnel or the site too — and vouches for its user to the panel: a relay
      * assertion for the panel's audience and port, naming the username alone
      * and bound to the method and the raw request target, which must lie on
-     * the user surface of a route bound to this tunnel. The panel takes
+     * the user surface of a route this host serves. The panel takes
      * everything else about the user from its own directory.
      *
      * 200 with the assertion (never cacheable, no `Remote-*`), 401 without a
@@ -201,6 +203,23 @@ export async function authzRoutes(fastify, opts = {}) {
      * signing key is unusable.
      */
     fastify.get('/authz/user-surface/:fqdn', { config: authzRateLimit }, async (request, reply) => authorizeUserSurfaceRequest(fastify, request, reply, request.params.fqdn));
+    /**
+     * GET /authz/user-surface-shell/:fqdn — the nginx auth_request target of
+     * every path of a plugin-owned site but its user surface's API: the shell
+     * of the plugin's web surface (`userSurface.web`). The vhost names the
+     * site in the path, as a tunnel vhost names its tunnel.
+     *
+     * The shell is the front of an API that knows its users, so it is gated
+     * as that API is: the site's route must be served (its plugin hosted, no
+     * other host serving it), the session valid, the user in the plugin's
+     * audience (an entitlement with roles, to the user or a group of theirs)
+     * and, on a restricted site, holding the site's grant. 200 (nothing else:
+     * nginx serves the shell from disk), 401 without a session
+     * (nginx redirects a page to the login), 403 otherwise — with the
+     * access-request page when the user lacks an entitlement or a grant
+     * (nginx serves it inline, as for a restricted tunnel).
+     */
+    fastify.get('/authz/user-surface-shell/:fqdn', { config: authzRateLimit }, async (request, reply) => authorizeUserSurfaceShellRequest(fastify, request, reply, request.params.fqdn));
     /**
      * GET /authz/user-surface-unauthenticated — what a user-surface request
      * without a session is answered with (nginx `error_page 401`): JSON, so
@@ -379,13 +398,11 @@ async function authorizeUserSurfaceRequest(fastify, request, reply, fqdn) {
         const { reason, ...detail } = mismatch;
         return refuse(reason, detail);
     }
-    const tunnel = findTunnelByFqdn(fastify.getTunnels(), fqdn);
-    if (!tunnel)
-        return refuse('unknown_tunnel_fqdn');
-    if (!tunnel.enabled)
-        return refuse('tunnel_disabled');
-    if (tunnel.accessMode === 'public' || !tunnel.userSurface)
+    const host = userSurfaceHostByFqdn(fastify.getUserSurfaceHosts(), fqdn);
+    if (!host)
         return refuse('no_user_surface');
+    if (!host.enabled)
+        return refuse('tunnel_disabled');
     // The request target exactly as the browser sent it — what follows the
     // hostname the vhost wrote — never re-encoded by a URL parser: the panel
     // receives it unchanged and holds the assertion against it byte for byte.
@@ -394,25 +411,27 @@ async function authorizeUserSurfaceRequest(fastify, request, reply, fqdn) {
         return refuse('invalid_original_url');
     }
     const target = originalUrl.slice(prefix.length);
-    const route = tunnel.userSurface.routes.find((r) => isUserSurfaceUrl(target, r));
+    const route = host.routes.find((r) => isUserSurfaceUrl(target, r));
     if (!route)
         return refuse('not_on_user_surface');
-    // Bound, but its plugin is not hosted by the agent carrying this tunnel
-    // (moved, revoked, hosted elsewhere): nothing of it is served here.
-    if (!tunnel.userSurface.served.includes(route))
+    // Bound, but not served here: a tunnel's plugin hosted by another agent
+    // than the one carrying it (moved, revoked, hosted elsewhere), a site's
+    // plugin not hosted at all, or a route another host would serve too.
+    if (!host.served.includes(route))
         return refuse('not_hosting_agent', { route });
     const session = await authenticatedSession(fastify, request, request.headers['cookie'], originalUrl, parsed.hostname);
     if (!session)
         return reply.code(401).send();
-    if (tunnel.accessMode !== 'authenticated') {
-        // restricted — the user's grant for the tunnel, as on its other paths
-        const result = await checkAccess(session.username, 'tunnel', tunnel.id, {
+    if (host.accessMode !== 'authenticated') {
+        // restricted — the user's grant for the host (the tunnel, or the site),
+        // as on its other paths
+        const result = await checkAccess(session.username, host.kind, host.id, {
             adminContact: fastify.getSettings().adminEmail,
             adminName: fastify.getSettings().adminName,
         });
         if (!result.allowed) {
-            // The tunnel and the reason only — never who was refused.
-            return refuse('no_matching_grant', { resourceType: 'tunnel', resourceId: tunnel.id });
+            // The host and the reason only — never who was refused.
+            return refuse('no_matching_grant', { resourceType: host.kind, resourceId: host.id });
         }
     }
     const key = await currentRelayKey(fastify, request);
@@ -437,6 +456,68 @@ async function authorizeUserSurfaceRequest(fastify, request, reply, fqdn) {
     reply.header(RELAY_ASSERTION_HEADER, assertion);
     return reply.code(200).send();
 }
+/**
+ * Authorize one request for the shell of the plugin-owned site named
+ * `fqdn` (see the `/authz/user-surface-shell/:fqdn` route).
+ */
+async function authorizeUserSurfaceShellRequest(fastify, request, reply, fqdn) {
+    const requestId = request.id;
+    reply.header('Cache-Control', 'no-store');
+    const refuse = (reason, extra = {}) => {
+        request.log.info({ requestId, reason, site: fqdn, ...extra }, 'shell authz denied');
+        return reply.code(403).send();
+    };
+    if (!TUNNEL_FQDN_RE.test(fqdn))
+        return refuse('invalid_site_name');
+    const originalUrl = request.headers['x-original-url'];
+    if (typeof originalUrl !== 'string')
+        return refuse('missing_original_request');
+    const parsed = parseOriginalUrl(originalUrl);
+    if (!parsed)
+        return refuse('invalid_original_url');
+    const mismatch = hostnameMismatch(request, fqdn, parsed.hostname);
+    if (mismatch) {
+        const { reason, ...detail } = mismatch;
+        return refuse(reason, detail);
+    }
+    const host = userSurfaceHostByFqdn(fastify.getUserSurfaceHosts(), fqdn);
+    if (!host || host.kind !== 'site')
+        return refuse('not_a_web_surface');
+    const [route] = host.routes;
+    if (route === undefined || !host.served.includes(route))
+        return refuse('not_served', { route });
+    const session = await authenticatedSession(fastify, request, request.headers['cookie'], originalUrl, parsed.hostname);
+    if (!session)
+        return reply.code(401).send();
+    const settings = fastify.getSettings();
+    const templateOptions = { adminContact: settings.adminEmail, adminName: settings.adminName };
+    const deny = (resourceType, resourceId) => {
+        // The host and the reason only — never who was refused.
+        request.log.info({ requestId, reason: 'no_matching_grant', site: fqdn, resourceType, resourceId }, 'shell authz denied');
+        if (settings.accessLoggingEnabled) {
+            logAccessRequest({
+                timestamp: new Date().toISOString(),
+                username: session.username,
+                resourceType,
+                resourceId,
+                resourceFqdn: parsed.hostname,
+            });
+        }
+        return reply
+            .code(403)
+            .type('text/html; charset=utf-8')
+            .send(buildAccessRequestPage(session.username, parsed.hostname, templateOptions));
+    };
+    if (!(await isPluginAudienceMember(session.username, route)))
+        return deny('plugin', route);
+    if (host.accessMode !== 'authenticated') {
+        const result = await checkAccess(session.username, 'site', host.id, templateOptions);
+        if (!result.allowed)
+            return deny('site', host.id);
+    }
+    // Nothing to pass on: nginx serves the shell from disk, no backend gets a user.
+    return reply.code(200).send();
+}
 /** The relay signing key, or null when there is none or it is unusable (logged). */
 async function currentRelayKey(fastify, request) {
     try {

package/vendor/gatekeeper/dist/server/routes/authz.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,wFAAwF;AACxF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,qFAAqF;AACrF,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,mFAAmF;AACnF,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAiB/C,SAAS,gBAAgB,CAAC,YAA2C;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACvB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,IAAY;IACpD,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;SACrC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAe,EACf,WAAmB,EACnB,SAAiB;IAEjB,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;YACvE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,uBAAuB,IAAI,OAAO,EAAE;gBAC/C,gBAAgB,EAAE,WAAW;gBAC7B,mBAAmB,EAAE,KAAK;gBAC1B,iBAAiB,EAAE,WAAW;gBAC9B,cAAc,EAAE,SAAS;aAC1B;YACD,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE;YACjD,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;YACpD,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA8B,EAAE,IAAY;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,OAAuB,EACvB,IAAY,EACZ,YAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,UAAU,GAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;QACjE,YAAY;QACZ,UAAU;KACX,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAClB,+FAA+F,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAuB;IAChD,MAAM,IAAI,GAAI,OAAO,CAAC,MAAyC,EAAE,IAAI,CAAC;IACtE,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC/C,CAAC;AAQD;;;GAGG;AACH,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAwB,EACxB,OAA2B,EAAE;IAE7B,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE;YACT,GAAG,EAAE,IAAI,CAAC,kBAAkB,IAAI,2BAA2B;YAC3D,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,iBAAiB;SAChC;KACF,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,qBAAqB,EACrB,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/F,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,2BAA2B,EAC3B,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5E,CAAC;IAEF;;;;OAIG;IACH,OAAO,CAAC,GAAG,CACT,qCAAqC,EACrC,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACzF,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CACf;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,6BAA6B;YACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,EACD,8HAA8H,CAC/H,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,2BAA2B,CAAC;aACjC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAwB,EACxB,OAAuB,EACvB,YAA2C,EAC3C,WAAmB,EACnB,QAAgB;IAEhB,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS;YACT,MAAM,EAAE,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B;YAC3F,IAAI,EAAE,QAAQ;SACf,EACD,cAAc,CACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,0DAA0D;QAC1D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,OAAO,YAAY,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM;QACnC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,WAAW,GAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAY,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,MAAM,EACN,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,oBAAoB;IACpB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;QACE,SAAS;QACT,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,QAAQ;QACtB,UAAU,EAAE,MAAM,CAAC,EAAE;KACtB,EACD,cAAc,CACf,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/C,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QACrE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,IAAI,CAAC,0BAA0B,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CACxC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE,EAAgB,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE5F,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/C,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACjD,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9F,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EACzB,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC1C,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;YACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,0DAA0D;YAC1D,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,EACpE,2BAA2B,CAC5B,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,oBAAoB;YACzB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YACpD,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;SAChC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,0DAA0D;QAC1D,OAAO,MAAM,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,eAAe,CAC5B,OAAwB,EACxB,OAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,4BAA4B,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,KAAK,CAClB,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,MAAkB,EAClB,OAAwB;IAExB,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,6BAA6B,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACrF,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,MAAM,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;YACnE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;SACvC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,4DAA4D;QAC5D,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAmB,EAAE,OAAwB;IACvE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,wFAAwF;AACxF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,qFAAqF;AACrF,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,mFAAmF;AACnF,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAiB/C,SAAS,gBAAgB,CAAC,YAA2C;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACvB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,IAAY;IACpD,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;SACrC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAe,EACf,WAAmB,EACnB,SAAiB;IAEjB,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;YACvE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,uBAAuB,IAAI,OAAO,EAAE;gBAC/C,gBAAgB,EAAE,WAAW;gBAC7B,mBAAmB,EAAE,KAAK;gBAC1B,iBAAiB,EAAE,WAAW;gBAC9B,cAAc,EAAE,SAAS;aAC1B;YACD,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE;YACjD,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;YACpD,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA8B,EAAE,IAAY;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,OAAuB,EACvB,IAAY,EACZ,YAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,UAAU,GAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;QACjE,YAAY;QACZ,UAAU;KACX,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAClB,+FAA+F,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAuB;IAChD,MAAM,IAAI,GAAI,OAAO,CAAC,MAAyC,EAAE,IAAI,CAAC;IACtE,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC/C,CAAC;AAQD;;;GAGG;AACH,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAwB,EACxB,OAA2B,EAAE;IAE7B,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE;YACT,GAAG,EAAE,IAAI,CAAC,kBAAkB,IAAI,2BAA2B;YAC3D,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,iBAAiB;SAChC;KACF,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,qBAAqB,EACrB,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/F,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,GAAG,CACT,2BAA2B,EAC3B,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5E,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,GAAG,CACT,iCAAiC,EACjC,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvB,gCAAgC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACjF,CAAC;IAEF;;;;OAIG;IACH,OAAO,CAAC,GAAG,CACT,qCAAqC,EACrC,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACzF,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CACf;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,6BAA6B;YACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,EACD,8HAA8H,CAC/H,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,2BAA2B,CAAC;aACjC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAwB,EACxB,OAAuB,EACvB,YAA2C,EAC3C,WAAmB,EACnB,QAAgB;IAEhB,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS;YACT,MAAM,EAAE,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B;YAC3F,IAAI,EAAE,QAAQ;SACf,EACD,cAAc,CACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,0DAA0D;QAC1D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,OAAO,YAAY,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM;QACnC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,WAAW,GAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAY,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,MAAM,EACN,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,oBAAoB;IACpB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;QACE,SAAS;QACT,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,QAAQ;QACtB,UAAU,EAAE,MAAM,CAAC,EAAE;KACtB,EACD,cAAc,CACf,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/C,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QACrE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,IAAI,CAAC,0BAA0B,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CACxC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE,EAAgB,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAEpD,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/C,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACjD,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EACzB,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,wEAAwE;QACxE,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;YACrE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,wDAAwD;YACxD,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,EACpE,2BAA2B,CAC5B,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,oBAAoB;YACzB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YACpD,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;SAChC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,0DAA0D;QAC1D,OAAO,MAAM,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gCAAgC,CAC7C,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE,EAAgB,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAA2B,qBAAqB,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhG,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EACzB,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,eAAe,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;IAC7F,MAAM,IAAI,GAAG,CAAC,YAA+B,EAAE,UAAkB,EAAgB,EAAE;QACjF,wDAAwD;QACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAChF,oBAAoB,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAClC,gBAAgB,CAAC;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY;gBACZ,UAAU;gBACV,YAAY,EAAE,MAAM,CAAC,QAAQ;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,IAAI,CAAC,0BAA0B,CAAC;aAChC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC;IAEF,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3F,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,gFAAgF;IAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,eAAe,CAC5B,OAAwB,EACxB,OAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,4BAA4B,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,KAAK,CAClB,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,MAAkB,EAClB,OAAwB;IAExB,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,6BAA6B,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACrF,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,MAAM,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;YACnE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;SACvC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,4DAA4D;QAC5D,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAmB,EAAE,OAAwB;IACvE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/vendor/gatekeeper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-gatekeeper",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Authorization layer for Lamaste — groups, grants, and tunnel access control",
   "type": "module",
   "exports": {
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@fastify/rate-limit": "^10.3.0",
-    "@lamalibre/lamaste": "^4.5.0",
+    "@lamalibre/lamaste": "^4.6.0",
     "fastify": "^5.3.3",
     "undici": "^7.8.0",
     "zod": "^3.24.4"

package/vendor/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/lamaste-server",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Server operations CLI for Lamaste",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.8.1",
-    "@lamalibre/lamaste": "^4.5.0",
+    "@lamalibre/lamaste": "^4.6.0",
     "chalk": "^5.3.0",
     "execa": "^9.0.0"
   },

package/vendor/server/src/commands/plugin-web-surface.js

@@ -0,0 +1,269 @@
+/**
+ * lamaste-server plugins web-surface — the web surface of an agent-hosted
+ * plugin that declares one (its manifest's `userSurface.web`): the site it
+ * owns, where the relay serves the static shell its server package ships
+ * beside its user surface's API.
+ *
+ *   web-surface <name>    What its installed version declares, its site,
+ *                         whether the site serves (and why not), the trees
+ *                         the relay holds, the tunnel still bound as its user
+ *                         surface, and — while it owns no site — the offer
+ *   web-surface <name> create [--subdomain <label>] [--access-mode authenticated|restricted]
+ *                         Give it its site (default: the subdomain and access
+ *                         mode it declares)
+ *   web-surface <name> move --tunnel <id | subdomain | fqdn>
+ *                         Hand the host of the tunnel bound as its user
+ *                         surface to its site, in one reload; the tunnel
+ *                         stays, disabled and unbound
+ *   web-surface <name> delete [--yes]
+ *                         Delete its site, its trees and the grants on it,
+ *                         after typing the site's FQDN (--yes skips it)
+ *
+ * The plugin is named by its name or its route (as `sites list` shows a
+ * site's owner). Every action goes through the running panel
+ * (`/api/plugins/:name/web-surface[/move]`, admin certificate). What the
+ * panel says is printed only as `terminalText`; `--json` emits it as it
+ * came.
+ */
+
+import chalk from 'chalk';
+import * as prompts from '@clack/prompts';
+import { panelRequest } from '../panel-api.js';
+import { readTunnels } from '../state.js';
+import { emit, emitComplete, emitError } from '../ndjson.js';
+import { findHostTunnel, findPluginByNameOrRoute } from '../plugin-identity.js';
+import { terminalText } from '../plugin-settings.js';
+import {
+  createBody,
+  parseWebSurfaceArgs,
+  webSurfaceRefusalHint,
+  webSurfaceServedText,
+  webTreeRows,
+} from '../plugin-web-surface.js';
+
+/** `/api/plugins/<name>/web-surface[/<rest>]`. */
+function webSurfacePath(name, rest = '') {
+  return `/api/plugins/${encodeURIComponent(name)}/web-surface${rest ? `/${rest}` : ''}`;
+}
+
+/**
+ * Exit with a usage error or a refused request, as text (with what the
+ * refusal asks next) or NDJSON (with the refusal's `code`).
+ *
+ * @param {string} message
+ * @param {boolean} json
+ * @param {{ code?: string }} [err]
+ * @param {string} [name]  the plugin, for the hint
+ * @returns {never}
+ */
+function fail(message, json, err = {}, name = '<name>') {
+  const code = typeof err.code === 'string' ? err.code : null;
+  if (json) {
+    emitError(message, false, code ? { code } : {});
+  } else {
+    console.error(`\n  ${chalk.red(terminalText(message))}`);
+    const hint = webSurfaceRefusalHint(code, name);
+    if (hint) console.error(`  ${chalk.dim(hint)}`);
+    console.error('');
+  }
+  process.exit(1);
+}
+
+/**
+ * A panel request; a refusal exits through `fail`, with what it asks next
+ * of plugin `name`.
+ */
+async function request(json, name, method, path, body) {
+  try {
+    return await panelRequest(method, path, body);
+  } catch (err) {
+    fail(err.message, json, err, name);
+  }
+}
+
+/** `label:` padded, then the value. */
+function row(label, value) {
+  console.log(`  ${chalk.dim(`${label}:`.padEnd(16))}${value}`);
+}
+
+/**
+ * Print a web surface's status (`webSurface`) for plugin `name`: what it
+ * declares, its site, whether it is served, its trees, the bound tunnel and
+ * the offer.
+ */
+function printWebSurface(name, view) {
+  const plugin = terminalText(name);
+  console.log('');
+  if (!view.declared && !view.site) {
+    console.log(`  Plugin ${chalk.cyan(plugin)} declares no web surface and owns no site.`);
+    console.log('');
+    return;
+  }
+  console.log(chalk.bold(`  Web surface of ${plugin}`));
+  console.log(chalk.dim('  ' + '─'.repeat(40)));
+  row(
+    'declares',
+    view.declared
+      ? terminalText(
+          `${view.declared.defaultSubdomain} (${view.declared.accessMode}), the shell from ${view.declared.root}/`,
+        )
+      : chalk.yellow('nothing — its installed version declares no web surface'),
+  );
+  row(
+    'site',
+    view.site
+      ? `${chalk.cyan(`https://${terminalText(view.site.fqdn)}/`)}${chalk.dim(` ${terminalText(view.site.accessMode ?? 'access mode unknown')} · id ${terminalText(view.site.id)}`)}`
+      : chalk.dim('none'),
+  );
+  const served = webSurfaceServedText(view, name);
+  row('served', served.served ? chalk.green(served.text) : chalk.yellow(served.text));
+  for (const [label, value] of webTreeRows(view.tree)) row(label, value);
+  if (view.boundTunnel) {
+    const host = terminalText(view.boundTunnel.fqdn ?? view.boundTunnel.id);
+    const others = (view.boundTunnel.routes ?? []).length > 1;
+    row(
+      'bound tunnel',
+      `${chalk.cyan(host)}${chalk.dim(` id ${terminalText(view.boundTunnel.id)}${others ? ` · also serves ${terminalText(view.boundTunnel.routes.join(', '))}` : ''}`)}`,
+    );
+  }
+  if (view.offer) {
+    const offer = `${terminalText(view.offer.subdomain)} (${terminalText(view.offer.accessMode)})`;
+    row(
+      'offer',
+      view.offer.available
+        ? `${offer} ${chalk.green('— free')}`
+        : `${offer} ${chalk.yellow('— taken; create with --subdomain <label>')}`,
+    );
+  }
+  if (!view.site && view.declared) {
+    console.log('');
+    if (view.boundTunnel) {
+      console.log(
+        chalk.dim(
+          `  Move the bound tunnel's host to it: lamaste-server plugins web-surface ${plugin} move --tunnel ${terminalText(view.boundTunnel.fqdn ?? view.boundTunnel.id)}`,
+        ),
+      );
+    } else {
+      console.log(
+        chalk.dim(
+          `  Give it its site: lamaste-server plugins web-surface ${plugin} create [--subdomain <label>] [--access-mode authenticated|restricted]`,
+        ),
+      );
+    }
+  }
+  console.log('');
+}
+
+/**
+ * Ask for the site's FQDN before deleting it — or refuse where nobody can
+ * answer (no terminal, `--json`) without `--yes`.
+ *
+ * @param {string} name
+ * @param {{ fqdn: string }} site
+ * @param {{ yes: boolean, json: boolean }} options
+ */
+async function confirmDelete(name, site, { yes, json }) {
+  if (yes) return;
+  if (json || !process.stdin.isTTY || !process.stdout.isTTY) {
+    fail(
+      `Deleting the web surface of "${name}" (${site.fqdn}) asks for confirmation — pass --yes`,
+      json,
+    );
+  }
+  const fqdn = terminalText(site.fqdn);
+  console.log('');
+  console.log(chalk.bold.red(`  Delete the web surface of ${terminalText(name)}?`));
+  console.log(`    - ${chalk.cyan(fqdn)} stops answering: its vhost is removed`);
+  console.log('    - the web trees the relay holds for it are deleted');
+  console.log('    - the grants on the site are revoked (a restricted site loses its users)');
+  console.log('    - the plugin stays installed and hosted; create the site again at any time');
+  console.log('');
+  const answer = await prompts.text({ message: `Type ${fqdn} to delete it` });
+  if (prompts.isCancel(answer) || String(answer ?? '').trim() !== site.fqdn) {
+    console.log('\n  Aborted — nothing was deleted.\n');
+    process.exit(0);
+  }
+}
+
+/**
+ * `plugins web-surface <name> [create|move|delete]`.
+ *
+ * @param {string[]} args  what follows the subcommand
+ * @param {{ json: boolean }} options
+ */
+export async function webSurfaceCmd(args, { json }) {
+  const parsed = parseWebSurfaceArgs(args);
+  if (!parsed.ok) fail(parsed.error, json);
+
+  const { plugins = [] } = await request(json, parsed.name, 'GET', '/api/plugins');
+  const named = findPluginByNameOrRoute(plugins, parsed.name);
+  if (named.error) fail(named.error, json, { code: 'not_found' }, parsed.name);
+  const { name } = named.plugin;
+  const plugin = terminalText(name);
+
+  if (parsed.action === 'status') {
+    const result = await request(json, name, 'GET', webSurfacePath(name));
+    if (json) emit(result);
+    else printWebSurface(name, result.webSurface);
+    return;
+  }
+
+  if (parsed.action === 'create') {
+    const result = await request(json, name, 'POST', webSurfacePath(name), createBody(parsed));
+    if (json) {
+      emitComplete({ name, ...result });
+      return;
+    }
+    const fqdn = terminalText(result.webSurface?.site?.fqdn ?? '');
+    console.log(
+      `\n  ${chalk.green('✓')} ${plugin} has its site: ${chalk.cyan(`https://${fqdn}/`)}`,
+    );
+    printWebSurface(name, result.webSurface);
+    return;
+  }
+
+  if (parsed.action === 'move') {
+    const found = findHostTunnel(await readTunnels(), parsed.tunnel);
+    if (found.error) fail(found.error, json);
+    const { tunnel } = found;
+    const result = await request(json, name, 'POST', webSurfacePath(name, 'move'), {
+      tunnelId: tunnel.id,
+    });
+    if (json) {
+      emitComplete({ name, tunnelId: tunnel.id, ...result });
+      return;
+    }
+    const host = terminalText(tunnel.fqdn ?? tunnel.id);
+    console.log(
+      `\n  ${chalk.green('✓')} ${chalk.cyan(host)} is the web surface of ${plugin} now — the shell from its approved tree, the API as before`,
+    );
+    console.log(
+      chalk.dim(
+        `  The tunnel ${terminalText(tunnel.id)} stays, disabled and unbound, its vhost unlinked: delete the web surface, then enable the tunnel, to roll back by hand.`,
+      ),
+    );
+    printWebSurface(name, result.webSurface);
+    return;
+  }
+
+  // delete
+  const current = await request(json, name, 'GET', webSurfacePath(name));
+  const site = current.webSurface?.site ?? null;
+  if (!site) fail(`Plugin "${name}" owns no site — there is no web surface to delete`, json);
+  await confirmDelete(name, site, { yes: parsed.yes, json });
+  const result = await request(json, name, 'DELETE', webSurfacePath(name));
+  if (json) {
+    emitComplete({ name, siteId: site.id, fqdn: site.fqdn, ...result });
+    return;
+  }
+  console.log(
+    `\n  ${chalk.green('✓')} The web surface of ${plugin} is deleted: ${chalk.cyan(terminalText(site.fqdn))} no longer answers\n`,
+  );
+  if (Array.isArray(result.grantsNotRevoked) && result.grantsNotRevoked.length > 0) {
+    console.log(
+      chalk.yellow(
+        `  Gatekeeper kept ${result.grantsNotRevoked.length} grant(s) on the deleted site — they name a site that no longer exists; their ids are in the audit log\n`,
+      ),
+    );
+  }
+}