@linkshell/gateway 0.4.2 → 0.4.3

package/Dockerfile

@@ -6,14 +6,19 @@ WORKDIR /app
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY packages/shared-protocol/package.json packages/shared-protocol/
 COPY packages/gateway/package.json packages/gateway/
+COPY apps/web-dashboard/package.json apps/web-dashboard/
 
-RUN pnpm install --frozen-lockfile --filter @linkshell/gateway --filter @linkshell/protocol
+RUN pnpm install --frozen-lockfile --filter @linkshell/gateway --filter @linkshell/protocol --filter @linkshell/web-dashboard
 
 COPY packages/shared-protocol/ packages/shared-protocol/
 COPY packages/gateway/ packages/gateway/
+COPY apps/web-dashboard/ apps/web-dashboard/
 COPY tsconfig.base.json ./
 
-RUN pnpm --filter @linkshell/protocol build && pnpm --filter @linkshell/gateway build
+# Protocol first (gateway + web both depend on its built dist), then both apps.
+RUN pnpm --filter @linkshell/protocol build \
+  && pnpm --filter @linkshell/gateway build \
+  && pnpm --filter @linkshell/web-dashboard build
 
 # Prune to production deps only
 RUN pnpm --filter @linkshell/gateway deploy --legacy --prod /app/pruned
@@ -36,6 +41,9 @@ COPY --from=builder /app/packages/shared-protocol/package.json packages/shared-p
 COPY --from=builder /app/packages/gateway/dist packages/gateway/dist/
 COPY --from=builder /app/packages/gateway/package.json packages/gateway/
 
+# Built web UI — served same-origin by the gateway from WEB_DIST.
+COPY --from=builder /app/apps/web-dashboard/dist web/
+
 # Workspace root package.json needed for module resolution
 COPY --from=builder /app/package.json ./
 
@@ -44,6 +52,7 @@ USER linkshell
 
 ENV NODE_ENV=production
 ENV PORT=8787
+ENV WEB_DIST=/app/web
 EXPOSE 8787
 
 CMD ["node", "packages/gateway/dist/gateway/src/index.js"]

package/dist/gateway/src/agent-permission-http.d.ts

@@ -11,23 +11,23 @@ export declare const agentPermissionHttpBodySchema: z.ZodDiscriminatedUnion<"pro
     terminalId: z.ZodOptional<z.ZodString>;
     agentSessionId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    protocol: "v2";
     sessionId: string;
-    conversationId: string;
     requestId: string;
     outcome: "allow" | "deny" | "cancelled";
-    optionId?: string | undefined;
+    conversationId: string;
+    protocol: "v2";
     terminalId?: string | undefined;
     agentSessionId?: string | undefined;
+    optionId?: string | undefined;
 }, {
-    protocol: "v2";
     sessionId: string;
-    conversationId: string;
     requestId: string;
     outcome: "allow" | "deny" | "cancelled";
-    optionId?: string | undefined;
+    conversationId: string;
+    protocol: "v2";
     terminalId?: string | undefined;
     agentSessionId?: string | undefined;
+    optionId?: string | undefined;
 }>, z.ZodObject<{
     protocol: z.ZodLiteral<"legacy">;
     sessionId: z.ZodString;
@@ -38,23 +38,23 @@ export declare const agentPermissionHttpBodySchema: z.ZodDiscriminatedUnion<"pro
     optionId: z.ZodOptional<z.ZodString>;
     terminalId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    protocol: "legacy";
     sessionId: string;
     requestId: string;
     outcome: "allow" | "deny" | "cancelled";
-    conversationId?: string | undefined;
-    optionId?: string | undefined;
+    protocol: "legacy";
     terminalId?: string | undefined;
     agentSessionId?: string | undefined;
+    optionId?: string | undefined;
+    conversationId?: string | undefined;
 }, {
-    protocol: "legacy";
     sessionId: string;
     requestId: string;
     outcome: "allow" | "deny" | "cancelled";
-    conversationId?: string | undefined;
-    optionId?: string | undefined;
+    protocol: "legacy";
     terminalId?: string | undefined;
     agentSessionId?: string | undefined;
+    optionId?: string | undefined;
+    conversationId?: string | undefined;
 }>, z.ZodObject<{
     protocol: z.ZodLiteral<"terminal">;
     sessionId: z.ZodString;
@@ -65,23 +65,23 @@ export declare const agentPermissionHttpBodySchema: z.ZodDiscriminatedUnion<"pro
     terminalId: z.ZodOptional<z.ZodString>;
     agentSessionId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    protocol: "terminal";
     sessionId: string;
     requestId: string;
     outcome: "allow" | "deny" | "cancelled";
-    conversationId?: string | undefined;
-    optionId?: string | undefined;
+    protocol: "terminal";
     terminalId?: string | undefined;
     agentSessionId?: string | undefined;
+    optionId?: string | undefined;
+    conversationId?: string | undefined;
 }, {
-    protocol: "terminal";
     sessionId: string;
     requestId: string;
     outcome: "allow" | "deny" | "cancelled";
-    conversationId?: string | undefined;
-    optionId?: string | undefined;
+    protocol: "terminal";
     terminalId?: string | undefined;
     agentSessionId?: string | undefined;
+    optionId?: string | undefined;
+    conversationId?: string | undefined;
 }>]>;
 export type AgentPermissionHttpBody = z.infer<typeof agentPermissionHttpBodySchema>;
 export type AgentPermissionHttpResult = {

package/dist/gateway/src/auth-middleware.js

@@ -11,6 +11,31 @@ export function canReadSessionDetail(input) {
         input.sessionUserId &&
         input.authenticatedUserId === input.sessionUserId);
 }
+const tokenAuthCache = new Map();
+const TOKEN_CACHE_TTL = 45_000; // 45s
+function getCachedAuth(token) {
+    const entry = tokenAuthCache.get(token);
+    if (!entry)
+        return null;
+    if (Date.now() > entry.expiresAt) {
+        tokenAuthCache.delete(token);
+        return null;
+    }
+    return entry.result;
+}
+function setCachedAuth(token, result) {
+    // Only cache successful authentications — never pin a failure.
+    if (!result.authenticated)
+        return;
+    tokenAuthCache.set(token, { result, expiresAt: Date.now() + TOKEN_CACHE_TTL });
+    if (tokenAuthCache.size > 1000) {
+        const now = Date.now();
+        for (const [k, v] of tokenAuthCache) {
+            if (now > v.expiresAt)
+                tokenAuthCache.delete(k);
+        }
+    }
+}
 /**
  * Validate a Supabase JWT and check subscription via iTool's profiles table.
  */
@@ -18,6 +43,9 @@ async function validateToken(token) {
     if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
         return { authenticated: false };
     }
+    const cached = getCachedAuth(token);
+    if (cached)
+        return cached;
     try {
         const res = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
             headers: {
@@ -53,7 +81,15 @@ async function validateToken(token) {
             }
         }
         catch { }
-        return { authenticated: true, userId: user.id, email: user.email, plan, subscribed };
+        const authResult = {
+            authenticated: true,
+            userId: user.id,
+            email: user.email,
+            plan,
+            subscribed,
+        };
+        setCachedAuth(token, authResult);
+        return authResult;
     }
     catch {
         return { authenticated: false };

package/dist/gateway/src/auth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../src/auth-middleware.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;AACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;AAC9D,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC;AAC9E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;AAerF,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,OAAO,CACZ,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,aAAa,CAClD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,KAAa;IACxC,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,eAAe,EAAE;YACtD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,iBAAiB;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAE7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;QAElE,iDAAiD;QACjD,IAAI,IAAI,GAAG,MAAM,CAAC;QAClB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAC5B,GAAG,YAAY,2BAA2B,IAAI,CAAC,EAAE,sCAAsC,EACvF;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CACF,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAGtC,CAAC;gBACJ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;oBACvB,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;oBACd,UAAU;wBACR,CAAC,CAAC,IAAI,KAAK,KAAK;4BAChB,CAAC,CAAC,CAAC,CAAC,eAAe;4BACnB,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc;IAEd,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,YAAY,2BAA2B,MAAM,sCAAsC,EACtF;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,yBAAyB,EAAE;gBACpD,MAAM,EAAE,iBAAiB;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG/B,CAAC;QACJ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACrF,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,KAAK,KAAK;YAChB,CAAC,CAAC,CAAC,CAAC,eAAe;YACnB,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB;IAEpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB,EACpB,GAAmB;IAEnB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,4DAA4D;SACtE,CAAC,CACH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB;IAEpB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../src/auth-middleware.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;AACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;AAC9D,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC;AAC9E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;AAerF,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,OAAO,CACZ,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,aAAa,CAClD,CAAC;AACJ,CAAC;AAWD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;AACrD,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,MAAM;AAEtC,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,MAAkB;IACtD,+DAA+D;IAC/D,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO;IAClC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;IAC/E,IAAI,cAAc,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;YACpC,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS;gBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,KAAa;IACxC,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,eAAe,EAAE;YACtD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,iBAAiB;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAE7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;QAElE,iDAAiD;QACjD,IAAI,IAAI,GAAG,MAAM,CAAC;QAClB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAC5B,GAAG,YAAY,2BAA2B,IAAI,CAAC,EAAE,sCAAsC,EACvF;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CACF,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAGtC,CAAC;gBACJ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;oBACvB,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;oBACd,UAAU;wBACR,CAAC,CAAC,IAAI,KAAK,KAAK;4BAChB,CAAC,CAAC,CAAC,CAAC,eAAe;4BACnB,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,MAAM,UAAU,GAAe;YAC7B,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI;YACJ,UAAU;SACX,CAAC;QACF,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc;IAEd,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,YAAY,2BAA2B,MAAM,sCAAsC,EACtF;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,yBAAyB,EAAE;gBACpD,MAAM,EAAE,iBAAiB;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG/B,CAAC;QACJ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACrF,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,KAAK,KAAK;YAChB,CAAC,CAAC,CAAC,CAAC,eAAe;YACnB,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB;IAEpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB,EACpB,GAAmB;IAEnB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,4DAA4D;SACtE,CAAC,CACH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB;IAEpB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/gateway/src/embedded.js

@@ -323,9 +323,21 @@ export function startEmbeddedGateway(options = {}) {
                 protocolVersion: PROTOCOL_VERSION,
             },
         })));
+        // Ping/pong for liveness — terminate sockets that stop answering pings.
+        const liveSocket = socket;
+        liveSocket.isAlive = true;
+        socket.on("pong", () => {
+            liveSocket.isAlive = true;
+        });
         const pingTimer = setInterval(() => {
-            if (socket.readyState === socket.OPEN)
-                socket.ping();
+            if (socket.readyState !== socket.OPEN)
+                return;
+            if (liveSocket.isAlive === false) {
+                socket.terminate();
+                return;
+            }
+            liveSocket.isAlive = false;
+            socket.ping();
         }, PING_INTERVAL);
         socket.on("message", (data) => {
             try {

package/dist/gateway/src/embedded.js.map

@@ -1 +1 @@
-{"version":3,"file":"embedded.js","sourceRoot":"","sources":["../../../src/embedded.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAErC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AAerB,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,uCAAuC;AAErF,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAE5D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACzE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,6BAA6B,EAAE,GAAG;QAClC,8BAA8B,EAAE,oBAAoB;QACpD,8BAA8B,EAAE,6BAA6B;KAC9D,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,aAAa;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAoB;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IAEvC,SAAS,GAAG,CAAC,KAA0C,EAAE,GAAW;QAClE,IAAI,MAAM;YAAE,OAAO;QACnB,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,6BAA6B,EAAE,GAAG;gBAClC,8BAA8B,EAAE,oBAAoB;gBACpD,8BAA8B,EAAE,6BAA6B;gBAC7D,wBAAwB,EAAE,OAAO;aAClC,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;YAEnC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACpD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;gBACtE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;wBACb,KAAK,EAAE,iBAAiB;wBACxB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qCAAqC;qBAClF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;oBAC9C,KAAK;oBACL,IAAI;oBACJ,cAAc;oBACd,YAAY;iBACb,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAChE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;gBACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC,QAAQ,cAAc,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,qCAAqC,IAAI,CAAC,QAAQ,YAAY,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,SAAS,WAAW,MAAM,CAAC,MAAM,cAAc,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC5M,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtD,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;wBACb,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,6BAA6B;qBACvC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,cAAc;qBAC5B,UAAU,EAAE;qBACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;qBACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACX,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;oBACpE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;oBAC3B,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;oBACpC,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;oBAC5B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;oBAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;oBAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;oBAC5B,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI;oBAClB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;iBACnC,CAAC,CAAC,CAAC;gBACN,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACjE,IAAI,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;gBAClC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;wBACb,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,6BAA6B;qBACvC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACpD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACzE,IAAI,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC1D,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,oCAAoC;YACpC,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YAED,mFAAmF;YACnF,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,cAAc,GAAG;oBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,IAAI,EAAE,YAAY,CAAC,IAAI;oBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ;iBACnB,CAAC;gBACF,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,mBAAmB;iBACvD,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,4BAA4B;iBACtC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,uBAAuB;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;QAC9B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,mBAAmB;KAChC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1E,0CAA0C;QAC1C,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC9C,qBAAqB,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;YAC7E,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAG;gBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;gBACjC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ;aACnB,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAClD,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC9C,qBAAqB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CACJ,YAAY,EACZ,CAAC,MAAiB,EAAE,QAAyB,EAAE,GAAQ,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;QAEtE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;QAElE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAEnE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,WAAW,GACf,eAAe;gBACf,eAAe,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;gBAChC,eAAe,CAAC,KAAK,KAAK,mBAAmB,CAAC;YAChD,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,YAAY,GAAG,iBAAiB,CACpC,cAAc,CAAC;oBACb,IAAI,EAAE,0BAA0B;oBAChC,SAAS;oBACT,OAAO,EAAE,EAAE;iBACZ,CAAC,CACH,CAAC;gBACF,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;oBACjD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI;wBACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,CAAC,IAAI,CACT,iBAAiB,CACf,cAAc,CAAC;YACb,IAAI,EAAE,iBAAiB;YACvB,SAAS;YACT,OAAO,EAAE;gBACP,IAAI;gBACJ,UAAU,EAAE,QAAQ;gBACpB,eAAe,EAAE,gBAAgB;aAClC;SACF,CAAC,CACH,CACF,CAAC;QAEF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACvD,CAAC,EAAE,aAAa,CAAC,CAAC;QAElB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAuB,EAAE,EAAE;YAC/C,IAAI,CAAC;gBACH,mBAAmB,CACjB,MAAM,EACN,IAAI,CAAC,QAAQ,EAAE,EACf,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,OAAO,EAAE,iDAAiD,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChI,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CACT,iBAAiB,CACf,cAAc,CAAC;wBACb,IAAI,EAAE,eAAe;wBACrB,SAAS;wBACT,OAAO,EAAE;4BACP,IAAI,EAAE,iBAAiB;4BACvB,OAAO,EAAE,0BAA0B;yBACpC;qBACF,CAAC,CACH,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,YAAY,GAAG,iBAAiB,CACpC,cAAc,CAAC;wBACb,IAAI,EAAE,2BAA2B;wBACjC,SAAS;wBACT,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;qBAC9C,CAAC,CACH,CAAC;oBACF,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACxC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI;4BACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBACrC,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/B,CAAC,CACF,CAAC;IAEF,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,GACd,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;YAC5D,GAAG,CAAC,MAAM,EAAE,4BAA4B,UAAU,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC;gBACN,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,oBAAoB,UAAU,EAAE;gBACzC,KAAK,EAAE,kBAAkB,UAAU,KAAK;gBACxC,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE;oBACxB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;oBAC7D,cAAc,CAAC,OAAO,EAAE,CAAC;oBACzB,cAAc,CAAC,OAAO,EAAE,CAAC;oBACzB,YAAY,CAAC,OAAO,EAAE,CAAC;oBACvB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"embedded.js","sourceRoot":"","sources":["../../../src/embedded.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAErC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AAerB,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,uCAAuC;AAErF,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAE5D,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACzE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,6BAA6B,EAAE,GAAG;QAClC,8BAA8B,EAAE,oBAAoB;QACpD,8BAA8B,EAAE,6BAA6B;KAC9D,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,aAAa;YAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAoB;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IAEvC,SAAS,GAAG,CAAC,KAA0C,EAAE,GAAW;QAClE,IAAI,MAAM;YAAE,OAAO;QACnB,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,6BAA6B,EAAE,GAAG;gBAClC,8BAA8B,EAAE,oBAAoB;gBACpD,8BAA8B,EAAE,6BAA6B;gBAC7D,wBAAwB,EAAE,OAAO;aAClC,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;YAEnC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACpD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;gBACtE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;wBACb,KAAK,EAAE,iBAAiB;wBACxB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,qCAAqC;qBAClF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;oBAC9C,KAAK;oBACL,IAAI;oBACJ,cAAc;oBACd,YAAY;iBACb,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAChE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;gBACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC,QAAQ,cAAc,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,qCAAqC,IAAI,CAAC,QAAQ,YAAY,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,SAAS,WAAW,MAAM,CAAC,MAAM,cAAc,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC5M,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACtD,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;wBACb,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,6BAA6B;qBACvC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,cAAc;qBAC5B,UAAU,EAAE;qBACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;qBACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACX,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;oBACpE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;oBAC3B,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;oBACpC,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;oBAC5B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;oBAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;oBAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;oBAC5B,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI;oBAClB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;iBACnC,CAAC,CAAC,CAAC;gBACN,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACjE,IAAI,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;gBAClC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;wBACb,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,6BAA6B;qBACvC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACpD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACzE,IAAI,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC1D,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,oCAAoC;YACpC,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YAED,mFAAmF;YACnF,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,cAAc,GAAG;oBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,IAAI,EAAE,YAAY,CAAC,IAAI;oBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ;iBACnB,CAAC;gBACF,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,mBAAmB;iBACvD,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBAC5C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,4BAA4B;iBACtC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,uBAAuB;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;QAC9B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,mBAAmB;KAChC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1E,0CAA0C;QAC1C,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC9C,qBAAqB,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;YAC7E,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAG;gBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;gBACjC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ;aACnB,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAClD,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC9C,qBAAqB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CACJ,YAAY,EACZ,CAAC,MAAiB,EAAE,QAAyB,EAAE,GAAQ,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;QAEtE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;QAElE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAEnE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,WAAW,GACf,eAAe;gBACf,eAAe,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;gBAChC,eAAe,CAAC,KAAK,KAAK,mBAAmB,CAAC;YAChD,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,YAAY,GAAG,iBAAiB,CACpC,cAAc,CAAC;oBACb,IAAI,EAAE,0BAA0B;oBAChC,SAAS;oBACT,OAAO,EAAE,EAAE;iBACZ,CAAC,CACH,CAAC;gBACF,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;oBACjD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI;wBACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,CAAC,IAAI,CACT,iBAAiB,CACf,cAAc,CAAC;YACb,IAAI,EAAE,iBAAiB;YACvB,SAAS;YACT,OAAO,EAAE;gBACP,IAAI;gBACJ,UAAU,EAAE,QAAQ;gBACpB,eAAe,EAAE,gBAAgB;aAClC;SACF,CAAC,CACH,CACF,CAAC;QAEF,wEAAwE;QACxE,MAAM,UAAU,GAAG,MAA2C,CAAC;QAC/D,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;gBAAE,OAAO;YAC9C,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACjC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC,EAAE,aAAa,CAAC,CAAC;QAElB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAuB,EAAE,EAAE;YAC/C,IAAI,CAAC;gBACH,mBAAmB,CACjB,MAAM,EACN,IAAI,CAAC,QAAQ,EAAE,EACf,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,OAAO,EAAE,iDAAiD,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChI,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CACT,iBAAiB,CACf,cAAc,CAAC;wBACb,IAAI,EAAE,eAAe;wBACrB,SAAS;wBACT,OAAO,EAAE;4BACP,IAAI,EAAE,iBAAiB;4BACvB,OAAO,EAAE,0BAA0B;yBACpC;qBACF,CAAC,CACH,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,YAAY,GAAG,iBAAiB,CACpC,cAAc,CAAC;wBACb,IAAI,EAAE,2BAA2B;wBACjC,SAAS;wBACT,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;qBAC9C,CAAC,CACH,CAAC;oBACF,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACxC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI;4BACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBACrC,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/B,CAAC,CACF,CAAC;IAEF,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,GACd,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;YAC5D,GAAG,CAAC,MAAM,EAAE,4BAA4B,UAAU,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC;gBACN,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,oBAAoB,UAAU,EAAE;gBACzC,KAAK,EAAE,kBAAkB,UAAU,KAAK;gBACxC,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE;oBACxB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;oBAC7D,cAAc,CAAC,OAAO,EAAE,CAAC;oBACzB,cAAc,CAAC,OAAO,EAAE,CAAC;oBACzB,YAAY,CAAC,OAAO,EAAE,CAAC;oBACvB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/gateway/src/host-auth.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Binds a session to the secret host token issued when its pairing was created,
+ * so only the original host (the CLI that created the pairing) can connect as
+ * `role=host`. Without this, anyone who learns a sessionId could connect as host
+ * and capture every controller keystroke or inject terminal output.
+ *
+ * Kept separate from PairingManager because a host connection long outlives the
+ * pairing code's 10-minute TTL (and reconnects days later), so the binding needs
+ * its own longer lifetime.
+ */
+export declare class HostAuthManager {
+    private bindings;
+    private cleanupTimer;
+    constructor();
+    /** Issue a fresh host token for a session (called at pairing creation). */
+    issue(sessionId: string): string;
+    /** Trust-on-first-use: register a host-provided token when no binding exists
+     *  yet (e.g. after a gateway restart lost the in-memory binding). */
+    adopt(sessionId: string, hostToken: string): void;
+    has(sessionId: string): boolean;
+    verify(sessionId: string, hostToken: string | undefined): boolean;
+    private cleanup;
+    destroy(): void;
+}

package/dist/gateway/src/host-auth.js

@@ -0,0 +1,72 @@
+import { randomUUID, timingSafeEqual } from "node:crypto";
+const CLEANUP_INTERVAL = 5 * 60_000;
+const HOST_TOKEN_TTL = 7 * 24 * 60 * 60_000; // 7 days
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
+/**
+ * Binds a session to the secret host token issued when its pairing was created,
+ * so only the original host (the CLI that created the pairing) can connect as
+ * `role=host`. Without this, anyone who learns a sessionId could connect as host
+ * and capture every controller keystroke or inject terminal output.
+ *
+ * Kept separate from PairingManager because a host connection long outlives the
+ * pairing code's 10-minute TTL (and reconnects days later), so the binding needs
+ * its own longer lifetime.
+ */
+export class HostAuthManager {
+    bindings = new Map();
+    cleanupTimer;
+    constructor() {
+        this.cleanupTimer = setInterval(() => this.cleanup(), CLEANUP_INTERVAL);
+        this.cleanupTimer.unref?.();
+    }
+    /** Issue a fresh host token for a session (called at pairing creation). */
+    issue(sessionId) {
+        const hostToken = randomUUID();
+        this.bindings.set(sessionId, { sessionId, hostToken, lastUsedAt: Date.now() });
+        return hostToken;
+    }
+    /** Trust-on-first-use: register a host-provided token when no binding exists
+     *  yet (e.g. after a gateway restart lost the in-memory binding). */
+    adopt(sessionId, hostToken) {
+        this.bindings.set(sessionId, { sessionId, hostToken, lastUsedAt: Date.now() });
+    }
+    has(sessionId) {
+        const binding = this.bindings.get(sessionId);
+        if (!binding)
+            return false;
+        if (Date.now() - binding.lastUsedAt > HOST_TOKEN_TTL) {
+            this.bindings.delete(sessionId);
+            return false;
+        }
+        return true;
+    }
+    verify(sessionId, hostToken) {
+        if (!hostToken)
+            return false;
+        const binding = this.bindings.get(sessionId);
+        if (!binding)
+            return false;
+        if (!safeEqual(binding.hostToken, hostToken))
+            return false;
+        binding.lastUsedAt = Date.now();
+        return true;
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [sessionId, binding] of this.bindings) {
+            if (now - binding.lastUsedAt > HOST_TOKEN_TTL) {
+                this.bindings.delete(sessionId);
+            }
+        }
+    }
+    destroy() {
+        clearInterval(this.cleanupTimer);
+    }
+}
+//# sourceMappingURL=host-auth.js.map

package/dist/gateway/src/host-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-auth.js","sourceRoot":"","sources":["../../../src/host-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AACpC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,SAAS;AAQtD,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IAClB,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,YAAY,CAAiC;IAErD;QACE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACxE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,SAAiB;QACrB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;yEACqE;IACrE,KAAK,CAAC,SAAiB,EAAE,SAAiB;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,SAAiB,EAAE,SAA6B;QACrD,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjD,IAAI,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/gateway/src/index.js

@@ -6,12 +6,14 @@ import { z, ZodError } from "zod";
 import { SessionManager } from "./sessions.js";
 import { PairingManager } from "./pairings.js";
 import { TokenManager } from "./tokens.js";
+import { HostAuthManager } from "./host-auth.js";
 import { createSupabaseStateStore } from "./state-store.js";
 import { handleSocketMessage } from "./relay.js";
 import { agentPermissionHttpBodySchema, forwardAgentPermissionHttp, } from "./agent-permission-http.js";
 import { parseTunnelPath, parseTunnelCookie, handleTunnelRequest, } from "./tunnel.js";
 import { AUTH_REQUIRED, requireAuth, checkWsAuth, validateRequest, checkSubscriptionByUserId, canReadSessionDetail } from "./auth-middleware.js";
 import { setCors } from "./cors.js";
+import { serveWeb, webEnabled, webDistPath } from "./static-web.js";
 const port = Number(process.env.PORT ?? 8787);
 const logLevel = (process.env.LOG_LEVEL ?? "info");
 const LOG_LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
@@ -24,6 +26,7 @@ const stateStore = createSupabaseStateStore();
 const sessionManager = new SessionManager();
 const pairingManager = new PairingManager(stateStore);
 const tokenManager = new TokenManager(stateStore);
+const hostAuthManager = new HostAuthManager();
 await Promise.all([pairingManager.hydrate(), tokenManager.hydrate()]);
 const PING_INTERVAL = 20_000;
 const MAX_BODY_SIZE = 4096;
@@ -37,9 +40,13 @@ class RateLimiter {
     maxHits;
     windowMs;
     hits = new Map();
+    pruneTimer;
     constructor(maxHits, windowMs) {
         this.maxHits = maxHits;
         this.windowMs = windowMs;
+        // Periodically evict expired windows so the map does not grow unbounded.
+        this.pruneTimer = setInterval(() => this.prune(), Math.max(windowMs, 60_000));
+        this.pruneTimer.unref?.();
     }
     allow(key) {
         const now = Date.now();
@@ -51,9 +58,24 @@ class RateLimiter {
         entry.count++;
         return entry.count <= this.maxHits;
     }
+    prune() {
+        const now = Date.now();
+        for (const [key, entry] of this.hits) {
+            if (now >= entry.resetAt)
+                this.hits.delete(key);
+        }
+    }
+    destroy() {
+        clearInterval(this.pruneTimer);
+    }
 }
 const pairingLimiter = new RateLimiter(PAIRING_RATE_LIMIT_MAX, PAIRING_RATE_LIMIT_WINDOW_MS);
 const wsConnectLimiter = new RateLimiter(WS_CONNECT_RATE_LIMIT_MAX, WS_CONNECT_RATE_LIMIT_WINDOW_MS);
+// Gateway-wide cap on failed pairing claims per window, independent of the
+// per-IP creation limiter — mitigates distributed pairing-code guessing.
+const CLAIM_FAILURE_RATE_LIMIT_MAX = Number(process.env.CLAIM_FAILURE_RATE_LIMIT_MAX ?? 100);
+const CLAIM_FAILURE_RATE_LIMIT_WINDOW_MS = Number(process.env.CLAIM_FAILURE_RATE_LIMIT_WINDOW_MS ?? 60_000);
+const claimFailureLimiter = new RateLimiter(CLAIM_FAILURE_RATE_LIMIT_MAX, CLAIM_FAILURE_RATE_LIMIT_WINDOW_MS);
 function isLoopbackIp(ip) {
     const normalized = ip.trim().toLowerCase();
     return (normalized === "127.0.0.1" ||
@@ -63,11 +85,43 @@ function isLoopbackIp(ip) {
 function isRateLimitBypassed(ip) {
     return isLoopbackIp(ip);
 }
+/**
+ * Trusted reverse proxies, parsed from TRUSTED_PROXIES (comma-separated IPs).
+ * X-Forwarded-For is only honored when the immediate peer
+ * (req.socket.remoteAddress) is one of these. Default empty = trust nobody,
+ * so the socket address is always used and the header cannot be spoofed.
+ * IPv6-mapped IPv4 (::ffff:1.2.3.4) is normalized to the bare IPv4 form.
+ */
+function normalizeIp(ip) {
+    const t = ip.trim().toLowerCase();
+    if (t.startsWith("::ffff:"))
+        return t.slice(7);
+    return t;
+}
+function parseTrustedProxies() {
+    const raw = process.env.TRUSTED_PROXIES ?? "";
+    const set = new Set();
+    for (const part of raw.split(",")) {
+        const ip = normalizeIp(part);
+        if (ip)
+            set.add(ip);
+    }
+    return set;
+}
+const TRUSTED_PROXIES = parseTrustedProxies();
 function getClientIp(req) {
-    const forwarded = req.headers["x-forwarded-for"];
-    if (typeof forwarded === "string")
-        return forwarded.split(",")[0].trim();
-    return req.socket.remoteAddress ?? "unknown";
+    const peer = req.socket.remoteAddress ?? "unknown";
+    // Only honor X-Forwarded-For when the direct peer is a configured proxy;
+    // otherwise the header is attacker-controlled and would defeat rate limits.
+    if (TRUSTED_PROXIES.has(normalizeIp(peer))) {
+        const forwarded = req.headers["x-forwarded-for"];
+        if (typeof forwarded === "string") {
+            const first = forwarded.split(",")[0]?.trim();
+            if (first)
+                return first;
+        }
+    }
+    return peer;
 }
 function extractBearerToken(req) {
     const auth = req.headers.authorization;
@@ -237,9 +291,13 @@ async function handleRequest(req, res) {
         }
         const body = createPairingBody.parse(await readJson(req));
         const record = pairingManager.create(body.sessionId);
+        // Issue a secret host token bound to this session. Only the CLI that
+        // created the pairing can later connect as role=host (see WS handler).
+        const hostToken = hostAuthManager.issue(record.sessionId);
         json(res, 201, {
             sessionId: record.sessionId,
             pairingCode: record.pairingCode,
+            hostToken,
             expiresAt: new Date(record.expiresAt).toISOString(),
         });
         return;
@@ -250,7 +308,24 @@ async function handleRequest(req, res) {
             json(res, 429, { error: "rate_limited", message: "Too many requests" });
             return;
         }
+        // Gateway-wide cap on failed claims, independent of per-IP limiter, to
+        // blunt distributed brute-forcing across many source IPs.
+        if (!isRateLimitBypassed(ip) && !claimFailureLimiter.allow("global")) {
+            json(res, 429, { error: "rate_limited", message: "Too many failed claims" });
+            return;
+        }
         const body = claimPairingBody.parse(await readJson(req));
+        // Idempotent re-claim: if the requester's device token already owns the
+        // session this code maps to, re-issue success instead of erroring with
+        // already_claimed. Only a token that has PROVEN ownership takes this path,
+        // so it can't be used to bypass brute-force protection. This lets a browser
+        // that refreshes or re-enters its code reconnect smoothly.
+        const peeked = pairingManager.peek(body.pairingCode);
+        if (peeked && body.deviceToken && tokenManager.owns(body.deviceToken, peeked.sessionId)) {
+            tokenManager.bind(body.deviceToken, peeked.sessionId); // refresh lastUsedAt
+            json(res, 200, { sessionId: peeked.sessionId, deviceToken: body.deviceToken });
+            return;
+        }
         const result = pairingManager.claim(body.pairingCode);
         if ("error" in result) {
             json(res, result.status, { error: result.error });
@@ -326,6 +401,10 @@ async function handleRequest(req, res) {
         json(res, 200, result);
         return;
     }
+    // Web UI: serve the built SPA for any unmatched GET (after all API routes, so
+    // it never shadows them). No-op when WEB_DIST isn't present (API-only mode).
+    if (await serveWeb(req, res))
+        return;
     json(res, 404, { error: "not_found" });
 }
 // ── WebSocket ───────────────────────────────────────────────────────
@@ -437,6 +516,24 @@ wss.on("connection", (socket, _request, url) => {
         connectedAt: Date.now(),
     };
     if (role === "host") {
+        // Verify the host token issued when this session's pairing was created.
+        // Without this, anyone who learns a sessionId could connect as host and
+        // capture controller keystrokes or inject terminal output.
+        const hdr = _request.headers["x-linkshell-host-token"];
+        const providedHostToken = Array.isArray(hdr) ? hdr[0] : hdr;
+        if (hostAuthManager.has(sessionId)) {
+            if (!hostAuthManager.verify(sessionId, providedHostToken)) {
+                log("warn", `rejected host connect with bad host token for ${sessionId}`);
+                socket.close(4003, "host authentication failed");
+                return;
+            }
+        }
+        else if (providedHostToken) {
+            // No binding yet (e.g. gateway restarted and lost in-memory state) —
+            // trust the first host token presented for this session.
+            hostAuthManager.adopt(sessionId, providedHostToken);
+        }
+        // else: legacy host without a token — allowed for backward compatibility.
         // Check if this is a reconnect (session already exists with clients)
         const existingSession = sessionManager.get(sessionId);
         const isReconnect = existingSession &&
@@ -493,11 +590,22 @@ wss.on("connection", (socket, _request, url) => {
             }
         }
     }
-    // Ping/pong for liveness
+    // Ping/pong for liveness — terminate connections that stop responding
+    // to pings (dead/half-open sockets) instead of leaking them.
+    const liveSocket = socket;
+    liveSocket.isAlive = true;
+    socket.on("pong", () => {
+        liveSocket.isAlive = true;
+    });
     const pingTimer = setInterval(() => {
-        if (socket.readyState === socket.OPEN) {
-            socket.ping();
+        if (socket.readyState !== socket.OPEN)
+            return;
+        if (liveSocket.isAlive === false) {
+            socket.terminate();
+            return;
         }
+        liveSocket.isAlive = false;
+        socket.ping();
     }, PING_INTERVAL);
     socket.on("message", (data) => {
         try {
@@ -550,6 +658,7 @@ function shutdown() {
     sessionManager.destroy();
     pairingManager.destroy();
     tokenManager.destroy();
+    hostAuthManager.destroy();
     server.close(() => {
         process.stdout.write("[gateway] stopped\n");
         process.exit(0);
@@ -611,6 +720,12 @@ server.listen(port, () => {
     log("info", `LinkShell Gateway v0.1.0`);
     log("info", `listening on http://0.0.0.0:${port}`);
     log("info", `log level: ${logLevel}`);
+    if (webEnabled()) {
+        log("info", `web UI served from ${webDistPath()} (open http://0.0.0.0:${port}/)`);
+    }
+    else {
+        log("info", `web UI not bundled (API-only); set WEB_DIST to enable`);
+    }
 });
 // ── Helpers ─────────────────────────────────────────────────────────
 class BodyTooLargeError extends Error {