@mdbase-dev/sdk 0.1.0-beta.168 → 0.1.0-beta.173

package/dist/app-host/account-key-host.js

@@ -0,0 +1,449 @@
+/** Account-key (AK1) unlock of ONE adopted Private collection on a first-party
+ * installation device. Runs in the owned Worker. Reaches only the fixed status,
+ * challenge and fetch routes over the installation bearer; the fetch proof is
+ * signed by the native device. Setup, password change, strict mode and
+ * recovery-device enrolment are refused here, not routed.
+ * `R` and the password are never stored and never returned: `R` lives in a
+ * RAM-only store for this one call and is wiped when it settles. The sealed
+ * bundle is never persisted or returned either; the owner of a locked
+ * collection may keep that ciphertext in RAM between attempts
+ * ({@link AppAccountKeySealedBundle}), so a mistyped secret does not spend the
+ * account's fetch budget again. */
+import { loopbackHttpOrigin } from "../application/local-build.js";
+import { AccountKeyError, checkPassword, parseRecoveryKey, wipe } from "../account-key.js";
+import { uuidToBytes } from "../codec.js";
+import { PrivateAccount, mapPortError, memorySecretStore, } from "../private-account.js";
+import { appServerBody, appServerProblem } from "./cp-problem.js";
+import { waitForOpenRetry } from "./open-wait.js";
+import { AppAccountKeyProofUnavailableError, AppStrictDeviceApprovalError } from "./wasm-runtime.js";
+export class AppAccountKeyUnlockError extends Error {
+    reason;
+    detail;
+    retryAfterMs;
+    constructor(reason, detail, retryAfterMs) {
+        super(`app account key unlock: ${reason}`);
+        this.reason = reason;
+        this.detail = detail;
+        this.retryAfterMs = retryAfterMs;
+        this.name = "AppAccountKeyUnlockError";
+    }
+}
+/** The sealed account-key bundle that ONE locked Private collection keeps
+ * between unlock attempts, so a mistyped password or a recovery key of another
+ * account key does not spend the account-wide fetch budget (10 per hour, shared
+ * with the person's other devices) again. It is the ciphertext Connect already
+ * gave this device, held in RAM only: never persisted, published or returned
+ * to the app. A held answer is used only while the budget-free status route,
+ * which applies the same account and installation scope checks on every
+ * attempt, still reports the same account-key version and key id for the same
+ * account, connector and device. Anything else drops it and fetches afresh.
+ * `unlockPrivateDevice` drops it on every outcome but a wrong secret; the
+ * owner clears it when the collection closes (which is also sign-out). */
+export class AppAccountKeySealedBundle {
+    held = null;
+    /** True while a sealed bundle is held. */
+    get holding() { return this.held !== null; }
+    /** The held fetch answer for exactly this account-key state, else nothing
+     * (and whatever was held is dropped). An unknown version or key id never matches.
+     * @internal */
+    take(session, version, keyId) {
+        const h = this.held;
+        if (h && version !== null && keyId !== null && h.accountId === session.accountId && h.connectorId === session.connectorId && h.deviceId === session.deviceId
+            && h.version === version && h.keyId === keyId)
+            return { mode: "password", version: h.version, key_id: h.keyId, bundle: h.bundle };
+        this.held = null;
+        return null;
+    }
+    /** Replaces what is held with this fetch answer when it is a well-formed
+     * password bundle, and with nothing otherwise.
+     * @internal */
+    keep(session, answer) {
+        this.held = null;
+        const r = answer && typeof answer === "object" && !Array.isArray(answer) ? answer : {};
+        if (r.mode !== "password" || !Number.isSafeInteger(r.version) || r.version < 1 || typeof r.key_id !== "string" || !HEX32.test(r.key_id)
+            || typeof r.bundle !== "string" || !/^([0-9a-f]{2}){1,512}$/.test(r.bundle))
+            return;
+        this.held = Object.freeze({ accountId: session.accountId, connectorId: session.connectorId, deviceId: session.deviceId, version: r.version, keyId: r.key_id, bundle: r.bundle });
+    }
+    clear() { this.held = null; }
+}
+const MAX_BODY = 64 * 1024, REQUEST_MS = 15_000, SETTLE_MS = 45_000;
+const unavailable = (reason) => new AccountKeyError("unavailable", "The account key service refused or was unreachable.", { reason });
+const cancelled = () => new AccountKeyError("cancelled", "Account key request cancelled.");
+const unsupported = () => unavailable("not_supported");
+const hex = (b) => Array.from(b, v => v.toString(16).padStart(2, "0")).join("");
+const HEX32 = /^[0-9a-f]{64}$/;
+/** `AccountKeyControlPort` over the installation bearer: status, challenge and
+ * fetch only. One fixed request each, no retry, bounded decoded bodies. */
+export class AppCpAccountKeyControl {
+    session;
+    sign;
+    accountId;
+    lifetime = new AbortController();
+    origin;
+    deviceId;
+    fetchImpl;
+    now;
+    constructor(session, sign, options = {}) {
+        this.session = session;
+        this.sign = sign;
+        for (const id of [session.accountId, session.connectorId, session.deviceId, session.collection])
+            if (uuidToBytes(id).every(v => v === 0))
+                throw unavailable("binding");
+        const u = new URL(session.cpOrigin);
+        if (u.origin !== session.cpOrigin || u.username || u.password || (u.protocol !== "https:" && !(options.allowLoopbackHttp === true && loopbackHttpOrigin(session.cpOrigin))))
+            throw unavailable("binding");
+        this.accountId = session.accountId;
+        this.deviceId = session.deviceId;
+        this.origin = u.origin;
+        this.fetchImpl = options.fetch ?? globalThis.fetch;
+        this.now = options.now ?? Date.now;
+        if (session.isCurrent() !== true)
+            throw unavailable("fenced");
+    }
+    check(signal) {
+        if (signal.aborted || this.lifetime.signal.aborted)
+            throw cancelled();
+        let current = false;
+        try {
+            current = this.session.isCurrent() === true && this.session.accountId === this.accountId && this.session.deviceId === this.deviceId && this.session.cpOrigin === this.origin;
+        }
+        catch {
+            current = false;
+        }
+        if (!current)
+            throw unavailable("fenced");
+    }
+    async request(method, path, headers, options) {
+        const parent = options.signal ?? this.lifetime.signal;
+        this.check(parent);
+        const bearer = await this.session.connectorBearer({ signal: parent });
+        this.check(parent);
+        if (typeof bearer !== "string" || !bearer || bearer.length > 16384 || /[^\x21-\x7e]/.test(bearer))
+            throw unavailable("binding");
+        const ctrl = new AbortController(), abort = () => ctrl.abort(), timer = setTimeout(abort, REQUEST_MS);
+        timer.unref?.();
+        parent.addEventListener("abort", abort, { once: true });
+        this.lifetime.signal.addEventListener("abort", abort, { once: true });
+        const buffer = new Uint8Array(MAX_BODY);
+        let count = 0, response = null, reader = null;
+        try {
+            const request = this.fetchImpl;
+            try {
+                response = await request(`${this.origin}${path}`, { method, headers: { authorization: `Bearer ${bearer}`, ...headers }, signal: ctrl.signal, redirect: "error", credentials: "omit", cache: "no-store", referrerPolicy: "no-referrer" });
+            }
+            catch {
+                this.check(parent);
+                throw unavailable("network");
+            }
+            this.check(parent);
+            if (ctrl.signal.aborted)
+                throw unavailable("timeout");
+            if (response.body) {
+                reader = response.body.getReader();
+                for (;;) {
+                    let part;
+                    try {
+                        part = await reader.read();
+                    }
+                    catch {
+                        this.check(parent);
+                        throw unavailable("network");
+                    }
+                    try {
+                        this.check(parent);
+                        if (ctrl.signal.aborted)
+                            throw unavailable("timeout");
+                        if (part.done)
+                            break;
+                        if (count + part.value.length > buffer.length) {
+                            ctrl.abort();
+                            throw unavailable("response");
+                        }
+                        buffer.set(part.value, count);
+                        count += part.value.length;
+                    }
+                    finally {
+                        part.value?.fill(0);
+                    }
+                }
+            }
+            const body = appServerBody(buffer.subarray(0, count));
+            // The typed refusal object (status, code, retry delay) is read by PrivateAccount.
+            if (!response.ok)
+                throw appServerProblem(response.status, body, response.headers);
+            if (!body || typeof body !== "object" || Array.isArray(body))
+                throw unavailable("response");
+            return body;
+        }
+        finally {
+            buffer.fill(0);
+            void (reader?.cancel() ?? response?.body?.cancel())?.catch(() => { });
+            try {
+                reader?.releaseLock();
+            }
+            catch { /* cancelled */ }
+            clearTimeout(timer);
+            parent.removeEventListener("abort", abort);
+            this.lifetime.signal.removeEventListener("abort", abort);
+        }
+    }
+    status(options) { return this.request("GET", "/v1/next/account-key/status", {}, options); }
+    challenge(options) { return this.request("POST", "/v1/next/devices/challenge", {}, options); }
+    /** A fresh single-use challenge, the native fetch proof over it, then the
+     * bundle. The challenge and signature are wiped here; the bundle is returned
+     * to PrivateAccount only. */
+    async fetch(options) {
+        let nonce = null, signature = null;
+        try {
+            const issued = await this.request("POST", "/v1/next/devices/challenge", {}, options);
+            const text = issued.challenge, expires = issued.expires_at;
+            if (typeof text !== "string" || !/^[0-9a-f]{64}$/.test(text) || typeof expires !== "number" || !Number.isSafeInteger(expires) || expires - this.now() <= 5_000 || expires - this.now() > 16 * 60_000)
+                throw unavailable("response");
+            nonce = Uint8Array.from(text.match(/../g).map(v => parseInt(v, 16)));
+            try {
+                signature = this.sign(nonce);
+            }
+            catch (error) {
+                if (error instanceof AppAccountKeyProofUnavailableError)
+                    throw unavailable(error.reason);
+                if (error instanceof AppStrictDeviceApprovalError)
+                    throw new AccountKeyError("strict_mode", "The account is in strict mode.");
+                throw unavailable("proof");
+            }
+            if (!(signature instanceof Uint8Array) || signature.length !== 64)
+                throw unavailable("proof");
+            return await this.request("GET", "/v1/next/account-key", { "x-mdbase-device-id": this.deviceId, "x-mdbase-challenge": text, "x-mdbase-signature": hex(signature) }, options);
+        }
+        finally {
+            nonce?.fill(0);
+            signature?.fill(0);
+        }
+    }
+    put() { return Promise.reject(unsupported()); }
+    strict() { return Promise.reject(unsupported()); }
+    enrolRecoveryDevice() { return Promise.reject(unsupported()); }
+    close() { this.lifetime.abort(); }
+}
+function problem(error) {
+    if (error instanceof AppAccountKeyUnlockError)
+        return error;
+    if (error instanceof AppStrictDeviceApprovalError)
+        return new AppAccountKeyUnlockError("unlock_strict");
+    if (error instanceof AppAccountKeyProofUnavailableError)
+        return new AppAccountKeyUnlockError("unlock_unavailable");
+    if (!(error instanceof AccountKeyError))
+        return null;
+    switch (error.code) {
+        case "wrong_secret": return new AppAccountKeyUnlockError("wrong_secret");
+        case "invalid_recovery_key": return new AppAccountKeyUnlockError("invalid_recovery_key", error.reason);
+        case "no_account_key": return new AppAccountKeyUnlockError("no_account_key");
+        case "strict_mode": return new AppAccountKeyUnlockError("unlock_strict");
+        case "rate_limited": return new AppAccountKeyUnlockError("rate_limited", undefined, error.retryAfterMs);
+        case "cancelled": return null;
+        default: return error.reason === "account_key_proof_unavailable" ? new AppAccountKeyUnlockError("unlock_unavailable")
+            : new AppAccountKeyUnlockError("unavailable", error.reason ?? error.code, error.retryAfterMs);
+    }
+}
+/** Which of the three states the account key is in: a password is set, strict,
+ * or none. Only `mode` is read. Connect answers an installation with less than
+ * it answers the account's own devices (no strict `complete`/`pending`
+ * witnesses, which are the account's inventory), so nothing else in the body
+ * is required or trusted here. An unknown mode is a refusal, never a guess. */
+async function accountKeyMode(control, signal) {
+    return (await accountKeyStatus(control, signal)).mode;
+}
+/** The mode, with the account-key version and key id when the answer carries
+ * them well formed. Those two decide only whether a held sealed bundle is still
+ * the current one: absent or malformed is "not known" (fetch afresh), never a
+ * refusal and never a grant. */
+async function accountKeyStatus(control, signal) {
+    let raw;
+    try {
+        raw = await control.status({ signal });
+    }
+    catch (error) {
+        throw mapPortError(error);
+    }
+    if (signal.aborted)
+        throw cancelled();
+    const r = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {}, mode = r.mode;
+    if (mode !== "password" && mode !== "strict" && mode !== "none")
+        throw unavailable("response");
+    return { mode, version: Number.isSafeInteger(r.version) && r.version >= 1 ? r.version : null,
+        keyId: typeof r.key_id === "string" && HEX32.test(r.key_id) ? r.key_id : null };
+}
+/** The account-key mode from the status route (no bundle, no proof, not on the
+ * fetch budget). A failed read rejects: the mode is never guessed. */
+export async function readAccountKeyMode(session, options) {
+    const control = new AppCpAccountKeyControl(session, () => { throw unavailable("proof"); }, options);
+    try {
+        return await accountKeyMode(control, options.signal);
+    }
+    catch (error) {
+        if (options.signal.aborted)
+            throw error;
+        throw problem(error) ?? error;
+    }
+    finally {
+        control.close();
+    }
+}
+/** Unlock this device's ONE adopted Private collection with the account key.
+ * Resolves only once the native applied policy has this device keyed and
+ * trusted. A typed `AppAccountKeyUnlockError` leaves the collection locked and
+ * open for another attempt; anything else is a lost owner or cancelled call. */
+export async function unlockPrivateDevice(session, native, secret, options) {
+    const signal = options.signal, settleMs = options.settleMs ?? SETTLE_MS, sealed = options.sealed;
+    const password = "password" in secret, recovery = "recoveryKey" in secret;
+    if (password === recovery || typeof (password ? secret.password : secret.recoveryKey) !== "string" || !Number.isSafeInteger(settleMs) || settleMs < 1)
+        throw new AppAccountKeyUnlockError("unavailable", "binding");
+    const current = () => { if (signal.aborted)
+        throw cancelled(); if (session.isCurrent() !== true)
+        throw unavailable("fenced"); };
+    current();
+    // Keyed already (an earlier grant applied): nothing to fetch or derive.
+    if (native.status().state === "keyed") {
+        sealed?.clear();
+        return;
+    }
+    // What can be told from the typed secret alone is refused here, before any
+    // request: it costs no status read and no bundle fetch, and leaves a held
+    // bundle as it was. A mistyped recovery key is not a recovery key. A password
+    // outside the length policy every sealed bundle was made under opens none.
+    if (recovery) {
+        try {
+            wipe(parseRecoveryKey(secret.recoveryKey));
+        }
+        catch (error) {
+            throw problem(error) ?? error;
+        }
+    }
+    else {
+        try {
+            checkPassword(secret.password);
+        }
+        catch {
+            throw new AppAccountKeyUnlockError("wrong_secret");
+        }
+    }
+    let refusal, lost = null;
+    const replica = {
+        privateCollections: async () => [session.collection],
+        keyAccountKeyDevice: () => Promise.reject(unsupported()),
+        async selfGrantWithAccountKey(collectionId, r, request) {
+            const turn = request.signal ?? signal;
+            try {
+                current();
+                if (collectionId !== session.collection || !(r instanceof Uint8Array) || r.length !== 32)
+                    throw unavailable("binding");
+                // The native call consumes its own copy; PrivateAccount wipes `r`.
+                const loan = new Uint8Array(r);
+                let state;
+                try {
+                    state = native.unlockConsuming(loan);
+                }
+                finally {
+                    loan.fill(0);
+                }
+                const until = Date.now() + settleMs;
+                let delay = 100;
+                while (state.state === "pending") {
+                    if (Date.now() >= until) {
+                        refusal = "grant_pending";
+                        throw unavailable("grant_pending");
+                    }
+                    await native.drive({ signal: turn });
+                    current();
+                    state = native.status();
+                    if (state.state !== "pending")
+                        break;
+                    await waitForOpenRetry(delay, turn);
+                    current();
+                    delay = Math.min(1_000, delay * 2);
+                }
+                if (state.state === "refused") {
+                    refusal = state.reason;
+                    throw unavailable(state.reason);
+                }
+            }
+            catch (error) {
+                // PrivateAccount folds a failed collection into `incomplete`; keep what
+                // actually happened. Only a typed native refusal or a pending grant is
+                // a problem the person can retry: the rest ended this owner.
+                if (refusal === undefined)
+                    lost = { error };
+                throw error;
+            }
+        },
+    };
+    const control = new AppCpAccountKeyControl(session, challenge => native.signFetch(challenge), options);
+    let known = null;
+    // The bundle route is asked only when this collection holds no sealed bundle
+    // for the account-key version and key id the status read of THIS attempt reported.
+    const port = !sealed ? control : {
+        accountId: control.accountId,
+        status: request => control.status(request), challenge: request => control.challenge(request),
+        async fetch(request) {
+            const held = sealed.take(session, known?.version ?? null, known?.keyId ?? null);
+            if (held)
+                return held;
+            const answer = await control.fetch(request);
+            sealed.keep(session, answer);
+            return answer;
+        },
+        put: () => control.put(), strict: () => control.strict(), enrolRecoveryDevice: () => control.enrolRecoveryDevice(), close: () => control.close(),
+    };
+    const secrets = memorySecretStore();
+    const account = new PrivateAccount({ control: port, replica, secrets, ...(options.argon2id ? { argon2id: options.argon2id } : {}) });
+    try {
+        known = await accountKeyStatus(control, signal);
+        current();
+        const mode = known.mode;
+        try {
+            options.onMode?.(mode);
+        }
+        catch { /* display observer does not own the unlock */ }
+        if (mode === "none")
+            throw new AppAccountKeyUnlockError("no_account_key");
+        if (mode === "strict")
+            throw new AppAccountKeyUnlockError("unlock_strict");
+        if (!native.supportsFetchProof())
+            throw new AppAccountKeyUnlockError("unlock_unavailable");
+        // The native unlock reads control items up to the head it knows.
+        if (native.headKnown() <= 0) {
+            await native.drive({ signal });
+            current();
+        }
+        if (native.headKnown() <= 0)
+            throw new AppAccountKeyUnlockError("unavailable", "log_head_unknown");
+        const result = await account.unlock(secret, signal);
+        const ended = lost;
+        if (ended)
+            throw ended.error;
+        current();
+        if (result.incomplete?.length)
+            throw new AppAccountKeyUnlockError(refusal === "grant_pending" ? "unavailable" : "unlock_failed", refusal ?? "incomplete");
+        if (native.status().state !== "keyed")
+            throw new AppAccountKeyUnlockError("unlock_failed", "not_keyed");
+        sealed?.clear();
+    }
+    catch (error) {
+        // Only a wrong secret leaves the sealed bundle for the next attempt.
+        if (!(error instanceof AccountKeyError && error.code === "wrong_secret") || signal.aborted || session.isCurrent() !== true)
+            sealed?.clear();
+        if (signal.aborted || session.isCurrent() !== true)
+            throw error;
+        throw problem(error) ?? error;
+    }
+    finally {
+        // RAM-only `R` is wiped on every path; the facade keeps nothing else.
+        try {
+            await secrets.clear();
+        }
+        finally {
+            account.close();
+        }
+    }
+}
+//# sourceMappingURL=account-key-host.js.map

package/dist/app-host/account-key-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-key-host.js","sourceRoot":"","sources":["../../src/app-host/account-key-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;mCAUmC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAuB,MAAM,mBAAmB,CAAC;AAChH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,cAAc,EAAE,YAAY,EAAE,iBAAiB,GAEhD,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,kCAAkC,EAAE,4BAA4B,EAA2B,MAAM,mBAAmB,CAAC;AAuB9H,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B;IAA6C;IAA0B;IAA5F,YAAqB,MAAkC,EAAW,MAAe,EAAW,YAAqB;QAC/G,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;QADxB,WAAM,GAAN,MAAM,CAA4B;QAAW,WAAM,GAAN,MAAM,CAAS;QAAW,iBAAY,GAAZ,YAAY,CAAS;QACnE,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACrF,CAAC;CACF;AAoCD;;;;;;;;;;0EAU0E;AAC1E,MAAM,OAAO,yBAAyB;IAC5B,IAAI,GAAoF,IAAI,CAAC;IACrG,0CAA0C;IAC1C,IAAI,OAAO,KAAc,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;IACrD;;mBAEe;IACf,IAAI,CAAC,OAAoB,EAAE,OAAsB,EAAE,KAAoB;QACrE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;eACvJ,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,EAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAC,CAAC;QAClI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC;IAChC,CAAC;IACD;;mBAEe;IACf,IAAI,CAAC,OAAoB,EAAE,MAAe;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAK,CAAC,CAAC,OAAkB,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;eAC9I,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO;QACtF,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC;IAC3L,CAAC;IACD,KAAK,KAAW,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;CACpC;AAED,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;AACpE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,qDAAqD,EAAE,EAAC,MAAM,EAAC,CAAC,CAAC;AAC5I,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;AAC3F,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;AACvD,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5F,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B;2EAC2E;AAC3E,MAAM,OAAO,sBAAsB;IAOJ;IAAgD;IANpE,SAAS,CAAS;IACV,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,CAAS;IACf,QAAQ,CAAS;IACjB,SAAS,CAAe;IACxB,GAAG,CAAe;IACnC,YAA6B,OAA6B,EAAmB,IAA2C,EAAE,UAAoC,EAAE;QAAnI,YAAO,GAAP,OAAO,CAAsB;QAAmB,SAAI,GAAJ,IAAI,CAAuC;QACtH,KAAK,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC;YAAE,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QACvK,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1M,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7F,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAAC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACvF,IAAI,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI;YAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACO,KAAK,CAAC,MAAmB;QAC/B,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,SAAS,EAAE,CAAC;QACtE,IAAI,OAAO,GAAG,KAAK,CAAC;QAAC,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,KAAK,CAAC;QAAC,CAAC;QACrO,IAAI,CAAC,OAAO;YAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,MAAsB,EAAE,IAA2F,EACvI,OAAyC,EAAE,OAAqC;QAChF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAC,MAAM,EAAE,MAAM,EAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAChI,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,EAAE,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAAE,KAA8B,CAAC,KAAK,EAAE,EAAE,CAAC;QACjJ,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAC,IAAI,EAAE,IAAI,EAAC,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAC,IAAI,EAAE,IAAI,EAAC,CAAC,CAAC;QAC3H,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,EAAE,QAAQ,GAAoB,IAAI,EAAE,MAAM,GAAmD,IAAI,CAAC;QACxJ,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC/B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE,EAAC,MAAM,EAAE,OAAO,EAAE,EAAC,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,GAAG,OAAO,EAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAC,CAAC,CAAC;YACvO,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAC1E,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnC,SAAS,CAAC;oBACR,IAAI,IAA0C,CAAC;oBAC/C,IAAI,CAAC;wBAAC,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAAC,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAC/F,IAAI,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;wBAAC,IAAI,IAAI,CAAC,IAAI;4BAAE,MAAM;wBACpG,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;4BAAC,IAAI,CAAC,KAAK,EAAE,CAAC;4BAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;wBAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBAAC,CAAC;4BACtJ,CAAC;wBAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACtD,kFAAkF;YAClF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;YAC5F,OAAO,IAA+B,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC9I,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,MAAM,CAAC,OAAqC,IAAsB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,6BAA6B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3I,SAAS,CAAC,OAAqC,IAAsB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9I;;iCAE6B;IAC7B,KAAK,CAAC,KAAK,CAAC,OAAqC;QAC/C,IAAI,KAAK,GAAsB,IAAI,EAAE,SAAS,GAAsB,IAAI,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM;gBAAE,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;YACpO,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YACrC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,kCAAkC;oBAAE,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACzF,IAAI,KAAK,YAAY,4BAA4B;oBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;gBAC9H,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC9F,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,sBAAsB,EAAE,EAAC,oBAAoB,EAAE,IAAI,CAAC,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAC,EAAE,OAAO,CAAC,CAAC;QAC7K,CAAC;gBAAS,CAAC;YAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACnD,CAAC;IACD,GAAG,KAAuB,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,KAAuB,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,mBAAmB,KAAuB,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,KAAK,KAAW,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACzC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,YAAY,wBAAwB;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,KAAK,YAAY,4BAA4B;QAAE,OAAO,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACxG,IAAI,KAAK,YAAY,kCAAkC;QAAE,OAAO,IAAI,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;IACnH,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,cAAc,CAAC,CAAC,OAAO,IAAI,wBAAwB,CAAC,cAAc,CAAC,CAAC;QACzE,KAAK,sBAAsB,CAAC,CAAC,OAAO,IAAI,wBAAwB,CAAC,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvG,KAAK,gBAAgB,CAAC,CAAC,OAAO,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7E,KAAK,aAAa,CAAC,CAAC,OAAO,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;QACzE,KAAK,cAAc,CAAC,CAAC,OAAO,IAAI,wBAAwB,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxG,KAAK,WAAW,CAAC,CAAC,OAAO,IAAI,CAAC;QAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,+BAA+B,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,oBAAoB,CAAC;YACnH,CAAC,CAAC,IAAI,wBAAwB,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;+EAI+E;AAC/E,KAAK,UAAU,cAAc,CAAC,OAA+B,EAAE,MAAmB;IAChF,OAAO,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AACD;;;gCAGgC;AAChC,KAAK,UAAU,gBAAgB,CAAC,OAA+B,EAAE,MAAmB;IAClF,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,SAAS,EAAE,CAAC;IACtC,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAA8B,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACrH,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;IAC/F,OAAO,EAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAK,CAAC,CAAC,OAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC,CAAC,IAAI;QAC/G,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAC,CAAC;AACnF,CAAC;AAED;sEACsE;AACtE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA6B,EAAE,OAAyD;IAC/H,MAAM,OAAO,GAAG,IAAI,sBAAsB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC;QAAC,OAAO,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC7D,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;IAAC,CAAC;YACjF,CAAC;QAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED;;;gFAGgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA6B,EAAE,MAA2B,EAAE,MAA2B,EAC/H,OAEqC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACjG,MAAM,QAAQ,GAAG,UAAU,IAAI,MAAM,EAAE,QAAQ,GAAG,aAAa,IAAI,MAAM,CAAC;IAC1E,IAAI,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,MAAgC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QAC9K,MAAM,IAAI,wBAAwB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,SAAS,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI;QAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAChI,OAAO,EAAE,CAAC;IACV,wEAAwE;IACxE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IACnE,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,QAAQ,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,CAAC,gBAAgB,CAAE,MAAgC,CAAC,WAAW,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAAC,CAAC;IAAC,CAAC;SAC5I,CAAC;QAAC,IAAI,CAAC;YAAC,aAAa,CAAE,MAA6B,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,wBAAwB,CAAC,cAAc,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC;IACtI,IAAI,OAA2B,EAAE,IAAI,GAA4B,IAAI,CAAC;IACtE,MAAM,OAAO,GAA0B;QACrC,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACpD,mBAAmB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxD,KAAK,CAAC,uBAAuB,CAAC,YAAY,EAAE,CAAC,EAAE,OAAO;YACpD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC;gBAAC,IAAI,YAAY,KAAK,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;oBAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;gBAClI,mEAAmE;gBACnE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAI,KAAyB,CAAC;gBAC9D,IAAI,CAAC;oBAAC,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;wBAAS,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;gBAAC,IAAI,KAAK,GAAG,GAAG,CAAC;gBACrD,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC;wBAAC,OAAO,GAAG,eAAe,CAAC;wBAAC,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC;oBAAC,CAAC;oBAC3F,MAAM,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,IAAI,EAAC,CAAC,CAAC;oBAAC,OAAO,EAAE,CAAC;oBAC9C,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;oBACxB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;wBAAE,MAAM;oBACrC,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAAC,OAAO,EAAE,CAAC;oBAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACrF,CAAC;gBACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;oBAAC,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wEAAwE;gBACxE,uEAAuE;gBACvE,6DAA6D;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,IAAI,GAAG,EAAC,KAAK,EAAC,CAAC;gBAC1C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IACvG,IAAI,KAAK,GAAwD,IAAI,CAAC;IACtE,6EAA6E;IAC7E,mFAAmF;IACnF,MAAM,IAAI,GAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QAC5F,KAAK,CAAC,KAAK,CAAC,OAAO;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;YAChF,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAC3F,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;KACjJ,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,EAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC;IACjI,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC;YAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;QACxF,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE;YAAE,MAAM,IAAI,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QAC3F,iEAAiE;QACjE,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QACzE,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAA+B,CAAC;QAC9C,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC,KAAK,CAAC;QAC7B,OAAO,EAAE,CAAC;QACV,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM;YAAE,MAAM,IAAI,wBAAwB,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE,OAAO,IAAI,YAAY,CAAC,CAAC;QAC1J,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,KAAK,OAAO;YAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxG,MAAM,EAAE,KAAK,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qEAAqE;QACrE,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI;YAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC5I,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI;YAAE,MAAM,KAAK,CAAC;QAChE,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,sEAAsE;QACtE,IAAI,CAAC;YAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IAC7D,CAAC;AACH,CAAC"}

package/dist/app-host/app-environment.d.ts

@@ -8,18 +8,17 @@ export interface AppEnvironmentSelection {
     readonly cpOrigin: string;
     readonly logOrigin: string;
     readonly assetSha256: string;
+    /** mdbase's own origins (CP, log) may be loopback HTTP: LAB and local builds only. */
     readonly allowLoopbackHttp: boolean;
-    /** Native app-origin storage only; never CP/log HTTP or test trust. */
-    readonly allowNativeLoopbackHttp: boolean;
 }
 /** No environment or app-origin default. CP/log origins come only from the
  * preauthenticated build release, whose environment must match exactly.
- * LAB app loopback is explicit; production loopback requires a native manifest.
+ * A loopback app origin is an application under development (or a native one);
+ * it never relaxes HTTPS for the CP or log outside LAB.
  * Same-origin storage preservation is an app gate, not a runtime fallback. */
 export declare function selectAppEnvironment(input: {
     environment: "lab" | "staging" | "production" | "local";
     appOrigin: string;
-    platform?: "native";
     release: AppBundledReleaseTrust;
 }): AppEnvironmentSelection;
 /** Only a previously validated immutable selection, not a copied/redirect object.

package/dist/app-host/app-environment.js

@@ -1,19 +1,20 @@
 import { isAppOrigin } from "./app-origin.js";
-import { applicationEnvironmentAllowed, applicationLoopbackAllowed, labLoopbackHttpOrigin, localApplicationEnvironment, localApplicationOrigin } from "../application/local-build.js";
+import { applicationEnvironmentAllowed, serviceLoopbackAllowed, loopbackHttpOrigin, localApplicationEnvironment, localApplicationOrigin } from "../application/local-build.js";
 const selections = new WeakSet();
 const invalid = () => new Error("app environment: explicit authenticated build context required");
 function origin(value, loopbackAllowed) {
     if (typeof value !== "string" || !value.length)
         throw invalid();
     const u = new URL(value);
-    const loopback = loopbackAllowed && labLoopbackHttpOrigin(value);
+    const loopback = loopbackAllowed && loopbackHttpOrigin(value);
     if (u.origin !== value || u.username || u.password || (u.protocol !== "https:" && !loopback))
         throw invalid();
     return value;
 }
 /** No environment or app-origin default. CP/log origins come only from the
  * preauthenticated build release, whose environment must match exactly.
- * LAB app loopback is explicit; production loopback requires a native manifest.
+ * A loopback app origin is an application under development (or a native one);
+ * it never relaxes HTTPS for the CP or log outside LAB.
  * Same-origin storage preservation is an app gate, not a runtime fallback. */
 export function selectAppEnvironment(input) {
     const { environment, release } = input;
@@ -32,11 +33,10 @@ export function selectAppEnvironment(input) {
     const appOrigin = input.appOrigin;
     if (local && ![cpOrigin, logOrigin, appOrigin].every(localApplicationOrigin))
         throw invalid();
-    if (!isAppOrigin(appOrigin, applicationLoopbackAllowed(environment), input.platform))
+    if (!isAppOrigin(appOrigin))
         throw invalid();
     const selected = Object.freeze({ environment, appOrigin, cpOrigin, logOrigin, assetSha256: release.assetSha256,
-        allowLoopbackHttp: applicationLoopbackAllowed(environment) && new URL(appOrigin).protocol === "http:",
-        allowNativeLoopbackHttp: input.platform === "native" && isAppOrigin(appOrigin, false, "native") && new URL(appOrigin).protocol === "http:" });
+        allowLoopbackHttp: serviceLoopbackAllowed(environment) && new URL(appOrigin).protocol === "http:" });
     selections.add(selected);
     return selected;
 }

package/dist/app-host/app-environment.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-environment.js","sourceRoot":"","sources":["../../src/app-host/app-environment.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAWtL,MAAM,UAAU,GAAG,IAAI,OAAO,EAAU,CAAC;AACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;AAClG,SAAS,MAAM,CAAC,KAAc,EAAE,eAAwB;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,OAAO,EAAE,CAAC;IAChE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,eAAe,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9G,OAAO,KAAK,CAAC;AACf,CAAC;AACD;;;8EAG8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,EAAC,WAAW,EAAE,OAAO,EAAC,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO;QACvD,OAAO,CAAC,MAAM,KAAK,0BAA0B,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;QACpF,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAC3C,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,2BAA2B;QAC5E,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7C,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;QACxG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClH,CAAC,CAAC,OAAO,CAAC,UAAU,YAAY,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,OAAO,EAAE,CAAC;IACpI,MAAM,KAAK,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9F,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,0BAA0B,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;QAC3G,iBAAiB,EAAE,0BAA0B,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,OAAO;QACrG,uBAAuB,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAC,CAAC,CAAC;IAC/I,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,QAAQ,CAAC;AAC5C,CAAC;AACD;2EAC2E;AAC3E,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"app-environment.js","sourceRoot":"","sources":["../../src/app-host/app-environment.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAU/K,MAAM,UAAU,GAAG,IAAI,OAAO,EAAU,CAAC;AACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;AAClG,SAAS,MAAM,CAAC,KAAc,EAAE,eAAwB;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,OAAO,EAAE,CAAC;IAChE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,eAAe,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9G,OAAO,KAAK,CAAC;AACf,CAAC;AACD;;;;8EAI8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,EAAC,WAAW,EAAE,OAAO,EAAC,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO;QACvD,OAAO,CAAC,MAAM,KAAK,0BAA0B,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;QACpF,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAC3C,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,2BAA2B;QAC5E,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7C,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;QACxG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClH,CAAC,CAAC,OAAO,CAAC,UAAU,YAAY,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,OAAO,EAAE,CAAC;IACpI,MAAM,KAAK,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9F,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;QAC3G,iBAAiB,EAAE,sBAAsB,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAC,CAAC,CAAC;IACtG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAAC,OAAO,QAAQ,CAAC;AAC5C,CAAC;AACD;2EAC2E;AAC3E,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC"}

package/dist/app-host/app-origin.d.ts

@@ -1,7 +1,10 @@
 export type AppOriginPlatform = "web" | "mobile" | "extension" | "native";
 /** Origin of a URL, including app schemes whose WHATWG origin is opaque. */
 export declare function urlOrigin(url: URL): string;
-export declare function appOriginPlatform(value: unknown, loopbackHttp?: boolean, platform?: "native"): AppOriginPlatform | null;
-export declare const isAppOrigin: (value: unknown, loopbackHttp?: boolean, platform?: "native") => boolean;
+/** The platform an app origin runs on, or null when it is not an app origin.
+ * A manifest that declares `platform: "native"` is held to the canonical IPv4
+ * loopback origin its manifest rule requires. */
+export declare function appOriginPlatform(value: unknown, declared?: "native"): AppOriginPlatform | null;
+export declare const isAppOrigin: (value: unknown) => boolean;
 /** This document's or Worker's own app origin, or null outside a browser. */
 export declare function currentAppOrigin(): string | null;

package/dist/app-host/app-origin.js

@@ -1,15 +1,19 @@
 import { isNativeLoopbackOrigin } from "@mdbase-dev/connect-protocol/manifest";
-/** App origins the SDK can run under: https (and LAB loopback http) web
- * origins, declared native IPv4 loopback HTTP on any port, Capacitor's iOS `capacitor://<host>` and browser-extension pages.
+/** App origins the SDK can run under: https web origins, loopback http (an
+ * application under development, or a native one), Capacitor's iOS
+ * `capacitor://<host>` and browser-extension pages.
  * Browsers may report custom app schemes as an opaque "null" origin, so the
  * canonical form is always `<scheme>//<host>`. Exact match, no wildcards. */
-import { labLoopbackHttpOrigin } from "../application/local-build.js";
+import { loopbackHttpOrigin } from "../application/local-build.js";
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 /** Origin of a URL, including app schemes whose WHATWG origin is opaque. */
 export function urlOrigin(url) {
     return url.protocol === "https:" || url.protocol === "http:" ? url.origin : `${url.protocol}//${url.host}`;
 }
-export function appOriginPlatform(value, loopbackHttp = false, platform) {
+/** The platform an app origin runs on, or null when it is not an app origin.
+ * A manifest that declares `platform: "native"` is held to the canonical IPv4
+ * loopback origin its manifest rule requires. */
+export function appOriginPlatform(value, declared) {
     if (typeof value !== "string" || value.length > 512)
         return null;
     let u;
@@ -23,14 +27,14 @@ export function appOriginPlatform(value, loopbackHttp = false, platform) {
         return null;
     switch (u.protocol) {
         case "https:": return "web";
-        case "http:": return platform === "native" && isNativeLoopbackOrigin(value) ? "native" : loopbackHttp && labLoopbackHttpOrigin(value) ? "web" : null;
+        case "http:": return declared === "native" ? (isNativeLoopbackOrigin(value) ? "native" : null) : loopbackHttpOrigin(value) ? "web" : null;
         case "capacitor:": return !u.port && /^[a-z0-9.-]{1,253}$/.test(u.hostname) ? "mobile" : null;
         case "chrome-extension:": return /^[a-p]{32}$/.test(u.host) ? "extension" : null;
         case "moz-extension:": return UUID.test(u.host) ? "extension" : null;
         default: return null;
     }
 }
-export const isAppOrigin = (value, loopbackHttp = false, platform) => appOriginPlatform(value, loopbackHttp, platform) !== null;
+export const isAppOrigin = (value) => appOriginPlatform(value) !== null;
 /** This document's or Worker's own app origin, or null outside a browser. */
 export function currentAppOrigin() {
     const location = globalThis.location;

package/dist/app-host/app-origin.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-origin.js","sourceRoot":"","sources":["../../src/app-host/app-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,sBAAsB,EAAC,MAAM,uCAAuC,CAAC;AAC7E;;;6EAG6E;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,MAAM,IAAI,GAAG,gEAAgE,CAAC;AAG9E,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,YAAY,GAAG,KAAK,EAAE,QAAmB;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAM,CAAC;IAAC,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7H,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC;QAC5B,KAAK,OAAO,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACrJ,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,KAAK,mBAAmB,CAAC,CAAC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,KAAK,gBAAgB,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,YAAY,GAAG,KAAK,EAAE,QAAmB,EAAW,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;AAE7J,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAgC,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IAC9F,IAAI,CAAC;QAAC,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"app-origin.js","sourceRoot":"","sources":["../../src/app-host/app-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,sBAAsB,EAAC,MAAM,uCAAuC,CAAC;AAC7E;;;;6EAI6E;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,MAAM,IAAI,GAAG,gEAAgE,CAAC;AAG9E,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;AAC7G,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,QAAmB;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAM,CAAC;IAAC,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7H,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC;QAC5B,KAAK,OAAO,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1I,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,KAAK,mBAAmB,CAAC,CAAC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,KAAK,gBAAgB,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAE1F,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAgC,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IAC9F,IAAI,CAAC;QAAC,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1E,CAAC"}