npm - @opendatalabs/personal-server-ts-server - Versions diffs - 1.33.0 → 1.33.2 - Mend

@opendatalabs/personal-server-ts-server 1.33.0 → 1.33.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/dist/api-auth.d.ts.map +1 -1
package/dist/api-auth.js +20 -13
package/dist/api-auth.js.map +1 -1
package/dist/app.d.ts +7 -3
package/dist/app.d.ts.map +1 -1
package/dist/app.js +13 -1
package/dist/app.js.map +1 -1
package/dist/middleware/local-listener.d.ts +12 -1
package/dist/middleware/local-listener.d.ts.map +1 -1
package/dist/middleware/local-listener.js +69 -11
package/dist/middleware/local-listener.js.map +1 -1
package/dist/routes/auth-device.d.ts +8 -0
package/dist/routes/auth-device.d.ts.map +1 -1
package/dist/routes/auth-device.js +63 -44
package/dist/routes/auth-device.js.map +1 -1
package/dist/ui/ps-lite-debug.js +166 -38
package/package.json +3 -3

package/dist/api-auth.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAG1B,MAAM,2CAA2C,CAAC;~~AAEnD~~,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;~~AAMrD~~,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;~~AA6CD~~,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,~~CAiI3B~~"}
1	+ {"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAG1B,MAAM,2CAA2C,CAAC;AAKnD,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAKrD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AAiCD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CAmJ3B"}

package/dist/api-auth.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import { authenticateRequest, } from "@opendatalabs/personal-server-ts-core/auth";
-import { verifyDataReadPolicy } from "@opendatalabs/personal-server-ts-core/policy";
+import { resolveDataListGrantScopes, verifyDataReadPolicy, } from "@opendatalabs/personal-server-ts-core/policy";
 import { createInMemoryWriteProofReplayStore, createWriteSessionAuthorization, } from "@opendatalabs/personal-server-ts-core/write";
-import { NotOwnerError, ProtocolError, UnregisteredBuilderError, } from "@opendatalabs/personal-server-ts-core/errors";
+import { NotOwnerError, ProtocolError, } from "@opendatalabs/personal-server-ts-core/errors";
 function serverNotConfigured() {
     return new ProtocolError(500, "SERVER_NOT_CONFIGURED", "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.");
 }
@@ -18,15 +18,6 @@ async function authenticate(request, deps) {
         serverOwner: deps.serverOwner,
     });
 }
-async function assertRegisteredBuilder(gateway, signer) {
-    // vana-sdk 3.14.0's GatewayClient always exposes isRegisteredBuilder, so the
-    // legacy getBuilder feature-detect fallback is now unreachable (its else
-    // branch narrows the client to `never`). Query registration directly, matching
-    // middleware/builder-check.ts.
-    if (await gateway.isRegisteredBuilder(signer))
-        return;
-    throw new UnregisteredBuilderError();
-}
 export function createServerApiAuth(deps) {
     const writeProofReplayStore = deps.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
     // The write-session half of this port is protocol, not runtime: the browser
@@ -88,13 +79,29 @@ export function createServerApiAuth(deps) {
         authorizeOwner,
         authorizeWrite,
         authorizeWriteSession,
-        async authorizeBuilderList(request) {
+        async authorizeBuilderList(request, options) {
             const result = await authenticate(request, deps);
             if (result.isPolicyBypass ||
                 isOwner(result.auth.signer, deps.serverOwner)) {
                 return;
             }
-            await assertRegisteredBuilder(deps.gateway, result.auth.signer);
+            // A builder lists only what its grants cover, bound to this server's
+            // owner like a read; fail closed when we can't identify the owner.
+            // resolveDataListGrantScopes does the one builder lookup (and throws
+            // UnregisteredBuilderError), so no separate registration check here.
+            if (!deps.serverOwner)
+                throw serverNotConfigured();
+            const grantedScopes = await resolveDataListGrantScopes({
+                signer: result.auth.signer,
+                grantId: result.auth.payload.grantId ?? options?.grantId,
+                serverOwner: deps.serverOwner,
+            }, {
+                authSessionVerifier: deps.gateway,
+                grantVerifier: deps.gateway,
+                grantLister: deps.gateway,
+                runtimeAvailability: deps.runtimeAvailability,
+            });
+            return { grantedScopes };
         },
         async authorizeBuilderRead(input) {
             const result = await authenticate(input.request, deps);

package/dist/api-auth.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAMpD,OAAO,~~EAAE~~,oBAAoB,~~EAAE~~,MAAM,8CAA8C,CAAC;~~AACpF~~,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,~~EACb~~,~~wBAAwB,GACzB,~~MAAM,8CAA8C,CAAC;AAgCtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,~~KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,+BAA+B;IAC/B,IAAI,~~MAAM,~~OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO;IACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,~~UAAU,mBAAmB,CACjC,IAAuB;IAEvB,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,iBAAiB;QACpC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,mBAAmB,EAAE,IAAI,CAAC,OAAO;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,mEAAmE;YACnE,8CAA8C;SAC/C;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAAC,KAAmC;QAC/D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAgB;QACnD,OAAO,aAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QACd,qBAAqB;QAErB,KAAK,CAAC,oBAAoB,CAAC,OAAO;~~YAChC~~,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,~~uBAAuB~~,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,~~MAAM~~,CAAC,CAAC;~~QAClE~~,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,GACd,MAAM,8CAA8C,CAAC;AAgCtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,iBAAiB;QACpC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,mBAAmB,EAAE,IAAI,CAAC,OAAO;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,mEAAmE;YACnE,8CAA8C;SAC/C;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAAC,KAAmC;QAC/D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAgB;QACnD,OAAO,aAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QACd,qBAAqB;QAErB,KAAK,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO;YACzC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACnD,MAAM,aAAa,GAAG,MAAM,0BAA0B,CACpD;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,OAAO;gBACxD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/app.d.ts CHANGED Viewed

@@ -44,11 +44,15 @@ export interface AppDeps {
     cloudMode?: boolean;
     devToken?: string;
     /**
-     * Port of the loopback-only auth listener. The dev UI subtree is served
-     * only to connections that arrived on it (never via the tunnel).
+     * Port of the loopback-only auth listener. The dev UI subtree and the
+     * signature-free device-login approval are served only to connections
+     * that arrived on it (never via the tunnel).
      */
     localApprovalPort?: number;
-    /** Main server port; a loopback-port collision disables the dev UI. */
+    /**
+     * Main server port; a loopback-port collision disables the dev UI and the
+     * signature-free device-login approval.
+     */
     serverPort?: number;
     ownerSignature?: `0x${string}`;
     ownerPrivateKey?: `0x${string}`;

package/dist/app.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAcrD,OAAO,EACL,mBAAmB,EAGnB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACpC,MAAM,2CAA2C,CAAC;AASnD,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACZ,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB~~;;;OAGG~~;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B~~,uEAAuE~~;~~IACvE~~,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,kBAAkB,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,0BAA0B,CAAC,EAAE,8BAA8B,CAAC;IAC5D,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC3E;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,~~CA+W7C~~"}
1	+ {"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAcrD,OAAO,EACL,mBAAmB,EAGnB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACpC,MAAM,2CAA2C,CAAC;AASnD,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACZ,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,kBAAkB,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,0BAA0B,CAAC,EAAE,8BAA8B,CAAC;IAC5D,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC3E;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CA6X7C"}

package/dist/app.js CHANGED Viewed

@@ -43,7 +43,17 @@ export function createApp(deps) {
     });
     app.use("/ui", uiLoopbackOnly);
     app.use("/ui/*", uiLoopbackOnly);
-    app.use("*", corsMiddleware());
+    // The whole /auth/device subtree stays out of the wildcard CORS: no other
+    // origin may read the approval page or the approve/initiate responses
+    // (which carry session ids). That includes /auth/device/token (the
+    // control-plane POST and the CLI logout DELETE). No browser cross-origin
+    // caller of any of these exists: the CLI and control plane use server-side
+    // fetch (unaffected by CORS) and the approval page calls its own origin,
+    // so a cross-origin preflight for them must fail.
+    const cors = corsMiddleware();
+    app.use("*", (c, next) => c.req.path === "/auth/device" || c.req.path.startsWith("/auth/device/")
+        ? next()
+        : cors(c, next));
     // Mount health route
     app.route("/", healthRoute({
         version: deps.version,
@@ -241,6 +251,8 @@ export function createApp(deps) {
             logger: deps.logger,
             serverOrigin: deps.serverOrigin,
             localApprovalOrigin: deps.localApprovalOrigin,
+            localApprovalPort: deps.localApprovalPort,
+            serverPort: deps.serverPort,
             serverOwner: deps.serverOwner,
             tokenStore: deps.tokenStore,
             devToken: deps.devToken,

package/dist/app.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAW7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,wCAAwC,GAIzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAiB3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA4G5D,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,iBAAiB,GACrB,IAAI,CAAC,iBAAiB,IAAI,+BAA+B,EAAE,CAAC;IAC9D,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IAEtE,0EAA0E;IAC1E,qEAAqE;IACrE,qDAAqD;IACrD,kEAAkE;IAClE,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,cAAc,GAAG,uBAAuB,CAAC;QAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAEjC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAE/B,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CACH,CAAC;IAEF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CACP,kBAAkB,EAClB,gBAAgB,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yEAAyE;QACzE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,mDAAmD;QACnD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,GAAG;QACxE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB;QACjB,qBAAqB;QACrB,oEAAoE;QACpE,2CAA2C;QAC3C,aAAa,EAAE,IAAI,CAAC,iBAAiB;YACnC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;YACN,CAAC,CAAC,SAAS;QACb,4DAA4D;QAC5D,UAAU,EAAE,IAAI,CAAC,iBAAiB;YAChC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;YACtE,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,sEAAsE;IACtE,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,iBAAiB,CAAC;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,iBAAiB;QACjB,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;QACvC,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,oEAAoE;IACpE,GAAG,CAAC,KAAK,CACP,WAAW,EACX,kBAAkB,CAAC;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,iBAAiB;KAChC,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,YAAY;KACxB,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,2DAA2D;IAC3D,0EAA0E;IAC1E,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,kBAAkB,GACtB,IAAI,CAAC,kBAAkB,IAAI,gCAAgC,EAAE,CAAC;IAChE,MAAM,0BAA0B,GAC9B,IAAI,CAAC,0BAA0B;QAC/B,wCAAwC,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GACvB,IAAI,CAAC,mBAAmB,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,eAAe,EAAE,kBAAkB;QACnC,uBAAuB,EAAE,0BAA0B;QACnD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;QAC1C,uBAAuB,EAAE,IAAI,CAAC,0BAA0B;QACxD,gBAAgB,EAAE,mBAAmB;KACtC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CACP,mBAAmB,EACnB,kBAAkB,CAAC;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxB,IAAI,CAAC,IAAI,CAAC,gBAAgB;oBACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;gBACjC,MAAM,KAAK,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5C,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,EAAE,cAAc;oBAC9B,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;oBACxD,CAAC,CAAC,KAAK,CAAC;gBACZ,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC;SACF,CAAC,CACH,CAAC;QACF,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAC5B,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC/D,CAAC,CAAC;gBACH,OAAO,2BAA2B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YACxE,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS;SACvC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,0EAA0E;QAC1E,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,yBAAyB,EAAE;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,KAAK,EACL,OAAO,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,cAAc;gBAClC,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CACH,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,SAAS,EACT,oBAAoB,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,kBAAkB;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
1	+ {"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAW7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,wCAAwC,GAIzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAiB3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAgH5D,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,iBAAiB,GACrB,IAAI,CAAC,iBAAiB,IAAI,+BAA+B,EAAE,CAAC;IAC9D,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IAEtE,0EAA0E;IAC1E,qEAAqE;IACrE,qDAAqD;IACrD,kEAAkE;IAClE,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,cAAc,GAAG,uBAAuB,CAAC;QAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAEjC,0EAA0E;IAC1E,sEAAsE;IACtE,mEAAmE;IACnE,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACvB,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QACrE,CAAC,CAAC,IAAI,EAAE;QACR,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAClB,CAAC;IAEF,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CACH,CAAC;IAEF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CACP,kBAAkB,EAClB,gBAAgB,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yEAAyE;QACzE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,mDAAmD;QACnD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,GAAG;QACxE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB;QACjB,qBAAqB;QACrB,oEAAoE;QACpE,2CAA2C;QAC3C,aAAa,EAAE,IAAI,CAAC,iBAAiB;YACnC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;YACN,CAAC,CAAC,SAAS;QACb,4DAA4D;QAC5D,UAAU,EAAE,IAAI,CAAC,iBAAiB;YAChC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;YACtE,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,sEAAsE;IACtE,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,iBAAiB,CAAC;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,iBAAiB;QACjB,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;QACvC,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,oEAAoE;IACpE,GAAG,CAAC,KAAK,CACP,WAAW,EACX,kBAAkB,CAAC;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,iBAAiB;KAChC,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,YAAY;KACxB,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,2DAA2D;IAC3D,0EAA0E;IAC1E,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,kBAAkB,GACtB,IAAI,CAAC,kBAAkB,IAAI,gCAAgC,EAAE,CAAC;IAChE,MAAM,0BAA0B,GAC9B,IAAI,CAAC,0BAA0B;QAC/B,wCAAwC,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GACvB,IAAI,CAAC,mBAAmB,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,eAAe,EAAE,kBAAkB;QACnC,uBAAuB,EAAE,0BAA0B;QACnD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;QAC1C,uBAAuB,EAAE,IAAI,CAAC,0BAA0B;QACxD,gBAAgB,EAAE,mBAAmB;KACtC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CACP,mBAAmB,EACnB,kBAAkB,CAAC;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxB,IAAI,CAAC,IAAI,CAAC,gBAAgB;oBACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;gBACjC,MAAM,KAAK,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5C,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,EAAE,cAAc;oBAC9B,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;oBACxD,CAAC,CAAC,KAAK,CAAC;gBACZ,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC;SACF,CAAC,CACH,CAAC;QACF,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAC5B,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC/D,CAAC,CAAC;gBACH,OAAO,2BAA2B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YACxE,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS;SACvC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,0EAA0E;QAC1E,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,yBAAyB,EAAE;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,KAAK,EACL,OAAO,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,cAAc;gBAClC,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CACH,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,SAAS,EACT,oBAAoB,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,kBAAkB;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/local-listener.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { MiddlewareHandler } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 export interface LoopbackListenerDeps {
     /**
      * Port of the loopback-only auth listener (see `index.ts`). The dev UI is
@@ -13,6 +13,17 @@ export interface LoopbackListenerDeps {
      */
     serverPort?: number;
 }
+/** Socket-level check: is this IP address (not a hostname) loopback? */
+export declare function isLoopbackIp(address: string | undefined): boolean;
+export declare function isSameOriginLoopbackRequest(c: Context): boolean;
+/**
+ * Socket-level half of the loopback gate: the connection was accepted by the
+ * loopback auth listener (its port, on a loopback address). This is the one
+ * fact a remote caller cannot influence — the tunnel forwards the main port
+ * only, and `Host` is just a header. Fails closed when the listener is not
+ * configured, collides with the main port, or there is no socket info.
+ */
+export declare function arrivedOnLoopbackListener(c: Context, deps: LoopbackListenerDeps): boolean;
 /**
  * Restrict a route subtree to requests that physically arrived on the
  * loopback auth listener, addressed it by a loopback name, and did not come

package/dist/middleware/local-listener.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"local-listener.d.ts","sourceRoot":"","sources":["../../src/middleware/local-listener.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,~~EAAW~~,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;~~AAkED~~;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,oBAAoB,GACzB,iBAAiB,~~CAgCnB~~"}
1	+ {"version":3,"file":"local-listener.d.ts","sourceRoot":"","sources":["../../src/middleware/local-listener.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOjE;AA2FD,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAa/D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAWT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,oBAAoB,GACzB,iBAAiB,CAmBnB"}

package/dist/middleware/local-listener.js CHANGED Viewed

@@ -1,6 +1,6 @@
 const LOOPBACK_V4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
 /** Socket-level check: is this IP address (not a hostname) loopback? */
-function isLoopbackIp(address) {
+export function isLoopbackIp(address) {
     if (!address)
         return false;
     return (address === "::1" ||
@@ -54,6 +54,73 @@ function hasForeignOrigin(c, requestOrigin) {
         return true;
     }
 }
+/**
+ * Fetch Metadata check. Browsers that send `Sec-Fetch-Site` label every
+ * request with its initiator; only the page itself (`same-origin`) and a
+ * user-typed or externally opened URL (`none`) may act on the loopback
+ * listener.
+ */
+function hasCrossSiteFetchMetadata(c) {
+    const site = c.req.header("sec-fetch-site");
+    if (site === undefined)
+        return false;
+    return site !== "same-origin" && site !== "none";
+}
+/**
+ * Request-level half of the loopback gate, for routes that cannot 404 the
+ * whole subtree: the request addressed this server by a loopback name and
+ * was not issued by another browser origin. Socket checks (listener port,
+ * peer address) are the caller's job.
+ */
+/**
+ * The raw Host header names the same host as the request URL. Node builds
+ * `c.req.url` from an absolute-form request line (`POST http://localhost/...`)
+ * and ignores Host, so a forwarder that passes the request line through could
+ * pair a loopback URL with a public Host. Require both to agree. A request
+ * with no Host never reaches a handler on the real server (node-server answers
+ * 400), so an absent header only occurs in-process and has nothing to disagree
+ * with; the socket checks still apply.
+ */
+function hostHeaderMatchesUrl(c, requestUrl) {
+    const host = c.req.header("host");
+    if (!host)
+        return true;
+    try {
+        return new URL(`${requestUrl.protocol}//${host}`).host === requestUrl.host;
+    }
+    catch {
+        return false;
+    }
+}
+export function isSameOriginLoopbackRequest(c) {
+    let requestUrl;
+    try {
+        requestUrl = new URL(c.req.url);
+    }
+    catch {
+        return false;
+    }
+    return (isLoopbackRequestHost(requestUrl.hostname) &&
+        hostHeaderMatchesUrl(c, requestUrl) &&
+        !hasForeignOrigin(c, requestUrl.origin) &&
+        !hasCrossSiteFetchMetadata(c));
+}
+/**
+ * Socket-level half of the loopback gate: the connection was accepted by the
+ * loopback auth listener (its port, on a loopback address). This is the one
+ * fact a remote caller cannot influence — the tunnel forwards the main port
+ * only, and `Host` is just a header. Fails closed when the listener is not
+ * configured, collides with the main port, or there is no socket info.
+ */
+export function arrivedOnLoopbackListener(c, deps) {
+    const port = deps.localApprovalPort;
+    if (port === undefined || port === deps.serverPort)
+        return false;
+    const socket = getSocket(c);
+    return (!!socket &&
+        socket.localPort === port &&
+        isLoopbackIp(typeof socket.localAddress === "string" ? socket.localAddress : undefined));
+}
 /**
  * Restrict a route subtree to requests that physically arrived on the
  * loopback auth listener, addressed it by a loopback name, and did not come
@@ -72,16 +139,7 @@ function hasForeignOrigin(c, requestOrigin) {
  */
 export function requireLoopbackListener(deps) {
     return async (c, next) => {
-        const port = deps.localApprovalPort;
-        if (port === undefined || port === deps.serverPort) {
-            return c.notFound();
-        }
-        const socket = getSocket(c);
-        if (!socket ||
-            socket.localPort !== port ||
-            !isLoopbackIp(typeof socket.localAddress === "string"
-                ? socket.localAddress
-                : undefined)) {
+        if (!arrivedOnLoopbackListener(c, deps)) {
             return c.notFound();
         }
         let requestUrl;

package/dist/middleware/local-listener.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"local-listener.js","sourceRoot":"","sources":["../../src/middleware/local-listener.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,GAAG,kCAAkC,CAAC;AAEvD,wEAAwE;AACxE,~~SAAS~~,YAAY,CAAC,OAA2B;~~IAC/C~~,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CACL,OAAO,KAAK,KAAK;QACjB,OAAO,KAAK,kBAAkB;QAC9B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK;QAClB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,CAAU;IAEV,wEAAwE;IACxE,yDAAyD;IACzD,8DAA8D;IAC9D,OAAQ,CAAC,CAAC,GAAW,EAAE,QAAQ,EAAE,MAAM,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CAAC,CAAU,EAAE,aAAqB;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED~~;;;;;;;;;;;;;;;GAeG~~;AACH,MAAM,~~UAAU~~,~~uBAAuB~~,~~CACrC~~,~~IAA0B~~;~~IAE1B~~,OAAO,KAAK,~~EAAE,~~CAAC,~~EAAE~~,IAAI,EAAE,~~EAAE~~;~~QACvB~~,MAAM,IAAI,GAAG,IAAI,CAAC,~~iBAAiB~~,CAAC;~~QACpC~~,IAAI,IAAI,KAAK,~~SAAS~~,IAAI,IAAI,KAAK,IAAI,CAAC,UAAU,~~EAAE~~,CAAC;~~YACnD~~,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;~~QACtB~~,CAAC;~~QACD~~,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;~~QAC5B~~,~~IACE~~,CAAC,MAAM;~~YACP~~,MAAM,CAAC,SAAS,KAAK,IAAI;~~YACzB~~,~~CAAC,~~YAAY,~~CACX~~,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ~~;gBACrC~~,CAAC,CAAC,MAAM,CAAC,YAAY~~;gBACrB~~,CAAC,CAAC,SAAS,~~CACd~~,~~EACD~~,CAAC;~~YACD~~,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,gBAAgB,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"local-listener.js","sourceRoot":"","sources":["../../src/middleware/local-listener.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,GAAG,kCAAkC,CAAC;AAEvD,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,OAA2B;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CACL,OAAO,KAAK,KAAK;QACjB,OAAO,KAAK,kBAAkB;QAC9B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK;QAClB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,CAAU;IAEV,wEAAwE;IACxE,yDAAyD;IACzD,8DAA8D;IAC9D,OAAQ,CAAC,CAAC,GAAW,EAAE,QAAQ,EAAE,MAAM,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CAAC,CAAU,EAAE,aAAqB;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,CAAU;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,CAAU,EAAE,UAAe;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,CAAU;IACpD,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,qBAAqB,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,oBAAoB,CAAC,CAAC,EAAE,UAAU,CAAC;QACnC,CAAC,gBAAgB,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC;QACvC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,CAAU,EACV,IAA0B;IAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,CACL,CAAC,CAAC,MAAM;QACR,MAAM,CAAC,SAAS,KAAK,IAAI;QACzB,YAAY,CACV,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAC1E,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA0B;IAE1B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,yBAAyB,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,gBAAgB,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/auth-device.d.ts CHANGED Viewed

@@ -15,6 +15,14 @@ export interface LoginV2Deps {
     logger: Logger;
     serverOrigin: string | (() => string);
     localApprovalOrigin?: string | (() => string | undefined);
+    /**
+     * Port of the loopback approval listener (see `index.ts`). The
+     * signature-free approval shortcut is honored only on connections that
+     * this listener accepted; `undefined` disables the shortcut.
+     */
+    localApprovalPort?: number;
+    /** Main server port; a collision with `localApprovalPort` disables the shortcut. */
+    serverPort?: number;
     serverOwner?: `0x${string}`;
     tokenStore: TokenStore;
     devToken?: string;

package/dist/routes/auth-device.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-device.d.ts","sourceRoot":"","sources":["../../src/routes/auth-device.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAKnC,OAAO,EAGL,uBAAuB,EACvB,qBAAqB,EAKrB,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAKzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;~~AAQpD~~,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;CACvD;AAED,KAAK,6BAA6B,GAAG,kBAAkB,GAAG;IACxD,KAAK,IAAI,IAAI,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC,CAAC;AA0CF,wEAAwE;AACxE,QAAA,MAAM,QAAQ,+BAAwC,CAAC;~~AAsIvD~~,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,~~CA2MxD~~;AA8LD,OAAO,EACL,QAAQ,EACR,qBAAqB,IAAI,cAAc,EACvC,uBAAuB,IAAI,gBAAgB,GAC5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,yBAAyB;iCAER,MAAM;;;;;;uBAWhB,MAAM;EAI5B"}
1	+ {"version":3,"file":"auth-device.d.ts","sourceRoot":"","sources":["../../src/routes/auth-device.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAKnC,OAAO,EAGL,uBAAuB,EACvB,qBAAqB,EAKrB,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAKzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAapD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;CACvD;AAED,KAAK,6BAA6B,GAAG,kBAAkB,GAAG;IACxD,KAAK,IAAI,IAAI,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC,CAAC;AA0CF,wEAAwE;AACxE,QAAA,MAAM,QAAQ,+BAAwC,CAAC;AAuIvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAmOxD;AA8LD,OAAO,EACL,QAAQ,EACR,qBAAqB,IAAI,cAAc,EACvC,uBAAuB,IAAI,gBAAgB,GAC5C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,yBAAyB;iCAER,MAAM;;;;;;uBAWhB,MAAM;EAI5B"}

package/dist/routes/auth-device.js CHANGED Viewed

@@ -16,6 +16,7 @@ import { approveDeviceSessionContract, createMemoryDeviceSessionStore, DEVICE_PO
 import { NotOwnerError, ProtocolError, } from "@opendatalabs/personal-server-ts-core/errors";
 import { createWeb3AuthMiddleware, mapSdkAuthError, } from "../middleware/web3-auth.js";
 import { createOwnerCheckMiddleware } from "../middleware/owner-check.js";
+import { arrivedOnLoopbackListener, isLoopbackIp, isSameOriginLoopbackRequest, } from "../middleware/local-listener.js";
 import { escapeHtml, renderAccountPage } from "../ui/account-page.js";
 function createInspectableDeviceSessionStore() {
     const store = createMemoryDeviceSessionStore();
@@ -68,48 +69,49 @@ function getRequestPath(c) {
 function resolveOrigin(origin) {
     return typeof origin === "function" ? origin() : origin;
 }
-function isLocalhostRequest(remoteAddr) {
-    if (!remoteAddr)
-        return false;
-    return (remoteAddr === "127.0.0.1" ||
-        remoteAddr === "::1" ||
-        remoteAddr === "localhost" ||
-        remoteAddr.startsWith("127.") ||
-        remoteAddr === "::ffff:127.0.0.1");
-}
-function isLoopbackHost(hostname) {
-    return (hostname === "localhost" ||
-        hostname === "::1" ||
-        hostname === "127.0.0.1" ||
-        hostname.startsWith("127."));
-}
-function isLocalhostOrigin(origin) {
-    try {
-        return isLoopbackHost(new URL(origin).hostname);
-    }
-    catch {
-        return false;
-    }
-}
 function getSocketRemoteAddress(c) {
     // Access Node.js socket via Hono's env bindings when running on the real server.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     return c.env?.incoming?.socket?.remoteAddress;
 }
+/**
+ * The request comes from this machine and not from another site open in the
+ * user's browser: a loopback TCP peer (never X-Forwarded-For / X-Real-IP,
+ * which are trivially spoofable), a loopback Host (DNS rebinding), and no
+ * foreign `Origin` / cross-site `Sec-Fetch-Site`. The tunnel client also
+ * connects from loopback but keeps the public Host, so tunneled requests
+ * never qualify.
+ */
+function isLocalRequest(c, deps) {
+    const remoteAddr = deps.getRemoteAddress?.(c) ?? getSocketRemoteAddress(c);
+    return isLoopbackIp(remoteAddr) && isSameOriginLoopbackRequest(c);
+}
+/**
+ * The request is on the loopback approval channel: the TCP connection was
+ * accepted by the loopback approval listener (socket port + loopback local
+ * address, the same check that gates the dev UI), and it addressed that
+ * listener by its own origin. `Host` alone proves nothing — a request to the
+ * main port can carry `Host: 127.0.0.1:<approvalPort>`. Fails closed when the
+ * socket is unavailable.
+ */
 function usesLocalApprovalChannel(c, deps) {
     const localApprovalOrigin = resolveOrigin(deps.localApprovalOrigin);
     if (!localApprovalOrigin) {
         return false;
     }
-    return getRequestOrigin(c) === localApprovalOrigin;
+    return (arrivedOnLoopbackListener(c, {
+        localApprovalPort: deps.localApprovalPort,
+        serverPort: deps.serverPort,
+    }) && getRequestOrigin(c) === localApprovalOrigin);
 }
-function getApprovalOrigin(c, deps) {
-    const requestOrigin = getRequestOrigin(c);
-    const localApprovalOrigin = resolveOrigin(deps.localApprovalOrigin);
-    if (localApprovalOrigin && isLocalhostOrigin(requestOrigin)) {
-        return localApprovalOrigin;
-    }
-    return requestOrigin;
+/**
+ * Approval pages must never render inside another site's frame (clickjacking
+ * the Approve button).
+ */
+function noFrameHtml(c, html, status = 200) {
+    c.header("Content-Security-Policy", "frame-ancestors 'none'");
+    c.header("X-Frame-Options", "DENY");
+    return c.html(html, status);
 }
 async function verifyRemoteOwnerApproval(c, serverOwner) {
     if (!serverOwner) {
@@ -176,16 +178,30 @@ export function authDeviceRoutes(deps) {
         app.post("/", (c) => {
             const sessionId = randomBytes(32).toString("hex");
             const pollToken = randomBytes(32).toString("hex");
+            const requestOrigin = getRequestOrigin(c);
+            const localApprovalOrigin = resolveOrigin(deps.localApprovalOrigin);
+            // Bind the session to where it was started: only a login initiated
+            // locally (the CLI on this machine) may later be approved through the
+            // signature-free loopback channel. Anything else, e.g. via the public
+            // tunnel URL, needs the owner wallet.
+            //
+            // Caveat: "local" is judged from the loopback peer plus a loopback
+            // Host. A reverse proxy on this machine that rewrites Host to
+            // localhost would make remote sessions look local here. Such a session
+            // still needs the owner to click Approve on the loopback approval
+            // listener, which only this machine can reach.
+            const localApprovalAllowed = localApprovalOrigin !== undefined && isLocalRequest(c, deps);
             const result = initiateDeviceSessionContract({
                 sessionStore: sessions,
                 serverOwner: deps.serverOwner,
-                requestOrigin: getRequestOrigin(c),
-                approvalOrigin: getApprovalOrigin(c, deps),
+                requestOrigin,
+                approvalOrigin: (localApprovalAllowed && localApprovalOrigin) || requestOrigin,
+                localApprovalAllowed,
                 sessionId,
                 pollToken,
                 now: Date.now(),
             });
-            deps.logger.info({ sessionId }, "Login flow initiated");
+            deps.logger.info({ sessionId, localApprovalAllowed }, "Login flow initiated");
             return c.json(result.body, result.status);
         });
         // GET /poll  — Poll for completion
@@ -207,18 +223,19 @@ export function authDeviceRoutes(deps) {
             sessions.purgeExpired(Date.now());
             const sessionId = c.req.query("session");
             if (!sessionId) {
-                return c.html(errorPage("Missing session parameter"), 400);
+                return noFrameHtml(c, errorPage("Missing session parameter"), 400);
             }
             const session = sessions.get(sessionId);
             if (!session) {
-                return c.html(errorPage("Session expired or invalid"), 404);
+                return noFrameHtml(c, errorPage("Session expired or invalid"), 404);
             }
             if (session.status === "approved") {
-                return c.html(successPage());
+                return noFrameHtml(c, successPage());
             }
             const owner = deps.serverOwner ?? "unknown";
-            const localApprovalShortcutEnabled = usesLocalApprovalChannel(c, deps);
-            return c.html(approvePage(session.requestedServerOrigin, owner, sessionId, localApprovalShortcutEnabled));
+            const localApprovalShortcutEnabled = session.localApprovalAllowed === true &&
+                usesLocalApprovalChannel(c, deps);
+            return noFrameHtml(c, approvePage(session.requestedServerOrigin, owner, sessionId, localApprovalShortcutEnabled));
         });
         // POST /approve  — Approve the session
         app.post("/approve", async (c) => {
@@ -235,15 +252,17 @@ export function authDeviceRoutes(deps) {
                 return c.json({ status: "already_approved" });
             }
             // v1: localhost auto-approve — user is physically at the server.
-            // SECURITY: Use the direct TCP peer address, NOT X-Forwarded-For
-            // or X-Real-IP headers which are trivially spoofable by remote attackers.
+            // Only for sessions initiated locally, on the loopback channel, from
+            // the approval page itself (not another site in the same browser).
+            // Anything else falls through to the owner-wallet check.
             const remoteAddr = deps.getRemoteAddress?.(c) ?? getSocketRemoteAddress(c);
-            const allowLocalShortcut = usesLocalApprovalChannel(c, deps) &&
-                isLocalhostRequest(remoteAddr);
+            const allowLocalShortcut = session.localApprovalAllowed === true &&
+                usesLocalApprovalChannel(c, deps) &&
+                isLocalRequest(c, deps);
             if (!allowLocalShortcut) {
                 const approvalAuth = await verifyRemoteOwnerApproval(c, deps.serverOwner);
                 if (approvalAuth instanceof Response) {
-                    deps.logger.warn({ remoteAddr, sessionId }, "Remote approval rejected");
+                    deps.logger.warn({ remoteAddr, sessionId, origin: c.req.header("origin") }, "Remote approval rejected");
                     return approvalAuth;
                 }
                 deps.logger.info({ remoteAddr, sessionId, signer: approvalAuth.signer }, "Remote approval authenticated with owner wallet");

package/dist/routes/auth-device.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-device.js","sourceRoot":"","sources":["../../src/routes/auth-device.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6EAA6E;AAC7E,+DAA+D;AAC/D,OAAO,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,aAAa,EACb,aAAa,GACd,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,wBAAwB,EACxB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAoBtE,SAAS,mCAAmC;IAC1C,MAAM,KAAK,GAAG,8BAA8B,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,OAAO;QACL,MAAM,CAAC,KAAK;YACV,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,SAAS;YACX,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QACD,eAAe,CAAC,SAAS;YACvB,OAAO,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,SAAS;YACd,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,YAAY,CAAC,GAAG;YACd,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACxB,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK;YACH,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YACD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,IAAI;YACN,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QACD,GAAG,CAAC,SAAiB;YACnB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAAG,mCAAmC,EAAE,CAAC;AAEvD,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CACpB,MAAuD;IAEvD,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,UAA8B;IACxD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,CACL,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,UAAU,KAAK,kBAAkB,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAU;IACxC,iFAAiF;IACjF,8DAA8D;IAC9D,OAAQ,CAAC,CAAC,GAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC;AACzD,CAAC;AAED,SAAS,wBAAwB,CAAC,CAAU,EAAE,IAAiB;IAC7D,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU,EAAE,IAAiB;IACtD,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAEpE,IAAI,mBAAmB,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5D,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,CAAU,EACV,WAAsC;IAEtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EACL,0FAA0F;aAC7F;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,OAAO,EACL,wDAAwD;oBACxD,gDAAgD;aACnD;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,WAAW,EAAE,UAAU;YACvB,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACnC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YAC5B,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;YAC/B,SAAS,EACP,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAC/C,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,IAAW,CAAC,CAAC;QACxE,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAiB,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC;IACnE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEhE,IAAI,qBAAqB,EAAE,CAAC;QAC1B,mDAAmD;QACnD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;YAClB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,6BAA6B,CAAC;gBAC3C,YAAY,EAAE,QAAQ;gBACtB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAClC,cAAc,EAAE,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC;gBAC1C,SAAS;gBACT,SAAS;gBACT,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,sBAAsB,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAmB,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,mCAAmC;QACnC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,yBAAyB,CAAC;gBACvC,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI;gBACvC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAA2B,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACvB,wCAAwC,CACzC,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAqC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;YACxB,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAElC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC;YAC5C,MAAM,4BAA4B,GAAG,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAEvE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,OAAO,CAAC,qBAAqB,EAC7B,KAAK,EACL,SAAS,EACT,4BAA4B,CAC7B,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC/B,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAElC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAC/D,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,iEAAiE;YACjE,iEAAiE;YACjE,0EAA0E;YAC1E,MAAM,UAAU,GACd,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,kBAAkB,GACtB,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC;gBACjC,kBAAkB,CAAC,UAAgC,CAAC,CAAC;YAEvD,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,CAAC,EACD,IAAI,CAAC,WAAW,CACjB,CAAC;gBACF,IAAI,YAAY,YAAY,QAAQ,EAAE,CAAC;oBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,UAAU,EAAE,SAAS,EAAE,EACzB,0BAA0B,CAC3B,CAAC;oBACF,OAAO,YAAY,CAAC;gBACtB,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EACtD,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACzE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAA+B,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,qBAAqB,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG;oBACT,OAAO,EACL,wEAAwE;iBAC3E;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EACpE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,+DAA+D;IAE/D,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;gBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,yEAAyE;AACzE,oDAAoD;AAEpD,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,SAAS,WAAW,CAClB,MAAc,EACd,KAAa,EACb,SAAiB,EACjB,4BAAqC;IAErC,OAAO,iBAAiB,CAAC;QACvB,KAAK,EAAE,iCAAiC;QACxC,aAAa,EAAE,WAAW;QAC1B,OAAO,EAAE,eAAe;QACxB,WAAW,EACT,6GAA6G;QAC/G,QAAQ,EAAE;;;gBAGE,UAAU,CAAC,MAAM,CAAC;;mCAEC,UAAU,CAAC,KAAK,CAAC;;;;;;eAMrC;QACX,MAAM,EAAE;yBACa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;4BACtB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;8CACH,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDA2FvC,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqC3D;KACA,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,iBAAiB,CAAC;QACvB,KAAK,EAAE,8BAA8B;QACrC,aAAa,EAAE,WAAW;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,iBAAiB,CAAC;QACvB,KAAK,EAAE,yBAAyB;QAChC,aAAa,EAAE,WAAW;QAC1B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE;kGACoF;QAC9F,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AAED,qBAAqB;AACrB,OAAO,EACL,QAAQ,EACR,qBAAqB,IAAI,cAAc,EACvC,uBAAuB,IAAI,gBAAgB,GAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,gBAAgB,CAAC,UAAkB;YACjC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAClD,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,SAAiB;YACvB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"auth-device.js","sourceRoot":"","sources":["../../src/routes/auth-device.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6EAA6E;AAC7E,+DAA+D;AAC/D,OAAO,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,aAAa,EACb,aAAa,GACd,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,wBAAwB,EACxB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AA4BtE,SAAS,mCAAmC;IAC1C,MAAM,KAAK,GAAG,8BAA8B,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,OAAO;QACL,MAAM,CAAC,KAAK;YACV,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,SAAS;YACX,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QACD,eAAe,CAAC,SAAS;YACvB,OAAO,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,SAAS;YACd,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,YAAY,CAAC,GAAG;YACd,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACxB,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK;YACH,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YACD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,IAAI;YACN,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QACD,GAAG,CAAC,SAAiB;YACnB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAAG,mCAAmC,EAAE,CAAC;AAEvD,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CACpB,MAAuD;IAEvD,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAU;IACxC,iFAAiF;IACjF,8DAA8D;IAC9D,OAAQ,CAAC,CAAC,GAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,IAAiB;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,YAAY,CAAC,UAAU,CAAC,IAAI,2BAA2B,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,CAAU,EAAE,IAAiB;IAC7D,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,yBAAyB,CAAC,CAAC,EAAE;QAC3B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,CAAU,EACV,IAAY,EACZ,SAA0B,GAAG;IAE7B,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;IAC9D,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,CAAU,EACV,WAAsC;IAEtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EACL,0FAA0F;aAC7F;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,OAAO,EACL,wDAAwD;oBACxD,gDAAgD;aACnD;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,WAAW,EAAE,UAAU;YACvB,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACnC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YAC5B,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;YAC/B,SAAS,EACP,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAC/C,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,IAAW,CAAC,CAAC;QACxE,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAiB,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC;IACnE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEhE,IAAI,qBAAqB,EAAE,CAAC;QAC1B,mDAAmD;QACnD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;YAClB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACpE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,sCAAsC;YACtC,EAAE;YACF,mEAAmE;YACnE,8DAA8D;YAC9D,uEAAuE;YACvE,kEAAkE;YAClE,+CAA+C;YAC/C,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,SAAS,IAAI,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,6BAA6B,CAAC;gBAC3C,YAAY,EAAE,QAAQ;gBACtB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa;gBACb,cAAc,EACZ,CAAC,oBAAoB,IAAI,mBAAmB,CAAC,IAAI,aAAa;gBAChE,oBAAoB;gBACpB,SAAS;gBACT,SAAS;gBACT,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,oBAAoB,EAAE,EACnC,sBAAsB,CACvB,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAmB,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,mCAAmC;QACnC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,yBAAyB,CAAC;gBACvC,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI;gBACvC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAA2B,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACvB,wCAAwC,CACzC,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAqC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;YACxB,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAElC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,2BAA2B,CAAC,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC;YAC5C,MAAM,4BAA4B,GAChC,OAAO,CAAC,oBAAoB,KAAK,IAAI;gBACrC,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAEpC,OAAO,WAAW,CAChB,CAAC,EACD,WAAW,CACT,OAAO,CAAC,qBAAqB,EAC7B,KAAK,EACL,SAAS,EACT,4BAA4B,CAC7B,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC/B,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAElC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAC/D,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,iEAAiE;YACjE,qEAAqE;YACrE,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,UAAU,GACd,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,kBAAkB,GACtB,OAAO,CAAC,oBAAoB,KAAK,IAAI;gBACrC,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC;gBACjC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAE1B,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,CAAC,EACD,IAAI,CAAC,WAAW,CACjB,CAAC;gBACF,IAAI,YAAY,YAAY,QAAQ,EAAE,CAAC;oBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EACzD,0BAA0B,CAC3B,CAAC;oBACF,OAAO,YAAY,CAAC;gBACtB,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EACtD,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACzE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAA+B,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,qBAAqB,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG;oBACT,OAAO,EACL,wEAAwE;iBAC3E;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EACpE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,+DAA+D;IAE/D,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;gBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,yEAAyE;AACzE,oDAAoD;AAEpD,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,SAAS,WAAW,CAClB,MAAc,EACd,KAAa,EACb,SAAiB,EACjB,4BAAqC;IAErC,OAAO,iBAAiB,CAAC;QACvB,KAAK,EAAE,iCAAiC;QACxC,aAAa,EAAE,WAAW;QAC1B,OAAO,EAAE,eAAe;QACxB,WAAW,EACT,6GAA6G;QAC/G,QAAQ,EAAE;;;gBAGE,UAAU,CAAC,MAAM,CAAC;;mCAEC,UAAU,CAAC,KAAK,CAAC;;;;;;eAMrC;QACX,MAAM,EAAE;yBACa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;4BACtB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;8CACH,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDA2FvC,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqC3D;KACA,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,iBAAiB,CAAC;QACvB,KAAK,EAAE,8BAA8B;QACrC,aAAa,EAAE,WAAW;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,iBAAiB,CAAC;QACvB,KAAK,EAAE,yBAAyB;QAChC,aAAa,EAAE,WAAW;QAC1B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE;kGACoF;QAC9F,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AAED,qBAAqB;AACrB,OAAO,EACL,QAAQ,EACR,qBAAqB,IAAI,cAAc,EACvC,uBAAuB,IAAI,gBAAgB,GAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,gBAAgB,CAAC,UAAkB;YACjC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAClD,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,SAAiB;YACvB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ui/ps-lite-debug.js CHANGED Viewed

@@ -113359,7 +113359,7 @@ var LedgerFold = class {
   through = null;
   retry;
   skipped;
-  partial = false;
+  truncated = false;
   // A Map keeps arbitrary keys (including "__proto__") out of the prototype
   // chain; Object.fromEntries defines each one as an own property again.
   records = /* @__PURE__ */ new Map();
@@ -113376,7 +113376,7 @@ var LedgerFold = class {
       attemptedAt: ledger.retry.attemptedAt
     } : void 0;
     this.skipped = ledger.skipped;
-    this.partial = ledger.partial === true;
+    this.truncated = ledger.truncated === true;
     for (const [key, pair] of Object.entries(ledger.records)) {
       this.records.set(key, [pair[0], pair[1]]);
     }
@@ -113403,7 +113403,7 @@ var LedgerFold = class {
       return;
     if (this.baseline === null) {
       this.baseline = version4.collectedAt;
-    } else if (isEarlier(version4.collectedAt, this.baseline) && !this.partial) {
+    } else if (isEarlier(version4.collectedAt, this.baseline) && !this.truncated) {
       this.baseline = version4.collectedAt;
     }
     if (isNewer(version4.collectedAt, this.current)) {
@@ -113453,8 +113453,8 @@ var LedgerFold = class {
   /**
    * Make room for `need` records by dropping some that are absent: not in the
    * newest tracked version, not in the version being folded, and not
-   * pre-tracking (first seen at or before the baseline). Pre-tracking records
-   * are never dropped. Dated records that are absent CAN be dropped (and are
+   * baseline records (first seen at or before the baseline). Baseline records
+   * are never dropped. Other absent records CAN be dropped (and are
    * dated as new if they return): that needs a scope near the cap, and
    * whoever can write the scope can provoke it. Among the evictable ones the
    * most recently first seen go first. Returns how many were dropped.
@@ -113502,17 +113502,17 @@ var LedgerFold = class {
   }
   /**
    * Prune and return the ledger, or null when nothing was ever folded.
-   * `partial` marks a ledger rebuilt from only the newest retained versions;
+   * `truncated` marks a ledger rebuilt from only the newest retained versions;
    * `through` overrides the completeness marker (see `ScopeFirstSeenLedger`).
    */
   async finish(options = {}) {
     if (this.scope === null || this.latest === null)
       return null;
     await this.prune();
-    const partial2 = this.partial || options.partial === true;
+    const truncated = this.truncated || options.truncated === true;
     const retry = options.retry === void 0 ? this.retry : options.retry;
     return {
-      version: 3,
+      version: 4,
       scope: this.scope,
       baseline: this.baseline,
       current: this.current,
@@ -113520,7 +113520,7 @@ var LedgerFold = class {
       through: options.through ?? this.through ?? this.latest.collectedAt,
       ...retry ? { retry } : {},
       ...this.skipped ? { skipped: this.skipped } : {},
-      ...partial2 ? { partial: true } : {},
+      ...truncated ? { truncated: true } : {},
       records: Object.fromEntries(this.records)
     };
   }
@@ -113535,7 +113535,7 @@ function listAddedTimestamps(ledger) {
   for (const [first, last2] of Object.values(ledger.records)) {
     if (Date.parse(last2) !== currentMs)
       continue;
-    if (Date.parse(first) <= baselineMs)
+    if (ledger.partial === true && Date.parse(first) <= baselineMs)
       continue;
     added.push(first);
   }
@@ -113554,9 +113554,9 @@ function nullableParseable(value) {
 var SKIP_REASONS = /* @__PURE__ */ new Set(["too_large", "unreadable"]);
 function readScopeFirstSeenLedger(value) {
   try {
-    if (!isRecord3(value) || value.version !== 3)
+    if (!isRecord3(value) || value.version !== 4)
       return null;
-    const { scope, baseline, current, latest, through, records, skipped, partial: partial2 } = value;
+    const { scope, baseline, current, latest, through, records, skipped, truncated } = value;
     if (typeof scope !== "string" || scope.length === 0)
       return null;
     if (!nullableParseable(baseline) || !nullableParseable(current)) {
@@ -113586,7 +113586,7 @@ function readScopeFirstSeenLedger(value) {
     }
     if (skipped !== void 0 && !SKIP_REASONS.has(skipped))
       return null;
-    if (partial2 !== void 0 && partial2 !== true)
+    if (truncated !== void 0 && truncated !== true)
       return null;
     if (!isRecord3(records))
       return null;
@@ -113602,7 +113602,7 @@ function readScopeFirstSeenLedger(value) {
       copied.set(key, [pair[0], pair[1]]);
     }
     return {
-      version: 3,
+      version: 4,
       scope,
       baseline,
       current,
@@ -113610,7 +113610,7 @@ function readScopeFirstSeenLedger(value) {
       through,
       ...retryValue ? { retry: retryValue } : {},
       ...skipped ? { skipped } : {},
-      ...partial2 ? { partial: true } : {},
+      ...truncated ? { truncated: true } : {},
       records: Object.fromEntries(copied)
     };
   } catch {
@@ -113639,6 +113639,7 @@ async function withScopeLock(scope, fn3) {
 }
 // ../core/dist/additions/ledger-store.js
+var OLDEST_PAGE = 20;
 var REBUILD_VERSION_LIMIT = 200;
 var REBUILD_BYTE_BUDGET = 256 * 1024 * 1024;
 function isRecord4(value) {
@@ -113694,6 +113695,11 @@ async function dropIfScopeEmpty(storage, scope) {
 function latestStillStored(storage, ledger) {
   return storage.findEntry({ scope: ledger.scope, at: ledger.latest.collectedAt })?.collectedAt === ledger.latest.collectedAt;
 }
+function baselineStillStored(storage, ledger) {
+  if (ledger.baseline === null)
+    return true;
+  return storage.findEntry({ scope: ledger.scope, at: ledger.baseline })?.collectedAt === ledger.baseline;
+}
 function isMarker(ledger) {
   return ledger.skipped === "too_large" || ledger.skipped === "unreadable";
 }
@@ -113716,6 +113722,32 @@ async function foldEntries(storage, scope, entries, fold) {
   }
   return { folded, failed };
 }
+function oldestStartsAtFirst(oldestInstant) {
+  const lowest = oldestInstant.reduce((a10, b10) => b10.version < a10.version ? b10 : a10);
+  return lowest.version <= 1 || (lowest.afterTombstoneVersion ?? null) !== null;
+}
+function baselineIsKnown(storage, ledger) {
+  if (ledger.baseline === null || ledger.skipped !== void 0)
+    return true;
+  if (ledger.truncated === true)
+    return false;
+  const count = storage.countVersions(ledger.scope);
+  const tail = storage.listVersions(ledger.scope, {
+    limit: OLDEST_PAGE,
+    offset: Math.max(0, count - OLDEST_PAGE)
+  }).filter((entry) => !Number.isNaN(Date.parse(entry.collectedAt)));
+  if (tail.length === 0)
+    return false;
+  const oldestMs = Math.min(...tail.map((e10) => Date.parse(e10.collectedAt)));
+  if (Date.parse(ledger.baseline) !== oldestMs)
+    return false;
+  return oldestStartsAtFirst(tail.filter((entry) => Date.parse(entry.collectedAt) === oldestMs));
+}
+function withDerivedPartial(storage, ledger) {
+  if (baselineIsKnown(storage, ledger))
+    return ledger;
+  return { ...ledger, partial: true };
+}
 function retryOf(failed, now) {
   if (failed.length === 0)
     return null;
@@ -113732,7 +113764,7 @@ async function rebuild(storage, scope, retained, budget, now) {
   const { folded, failed } = await foldEntries(storage, scope, selected, fold);
   if (folded === 0) {
     return {
-      version: 3,
+      version: 4,
       scope,
       baseline: null,
       current: null,
@@ -113744,7 +113776,10 @@ async function rebuild(storage, scope, retained, budget, now) {
   }
   const total = storage.countVersions(scope);
   return fold.finish({
-    partial: folded < total,
+    // Truncated only when the window or the byte budget left versions out. A
+    // version that could not be read is not a truncation: it is retried (see
+    // `retry`), and the ledger converges once it is read or deleted.
+    truncated: selected.length < retained.length || retained.length < total,
     through: retained[0].collectedAt,
     retry: retryOf(failed, now)
   });
@@ -113778,7 +113813,7 @@ async function catchUp(storage, ledger, retained, budget, now) {
   })[0];
   const windowCut = beyond !== void 0 && Date.parse(beyond.collectedAt) > Date.parse(ledger.through);
   return await fold.finish({
-    partial: windowCut || selected.length < newer.length,
+    truncated: windowCut || selected.length < newer.length,
     through: selected.length > 0 ? retained[0].collectedAt : ledger.through,
     retry
   }) ?? ledger;
@@ -113827,7 +113862,7 @@ async function ensureScopeLedger(storage, scope, options = {}) {
         return null;
       }
       let existing = await readStoredLedger(storage, scope);
-      if (existing && (!latestStillStored(storage, existing) || isMarker(existing) && newerThan(retained, existing).length > 0)) {
+      if (existing && (!latestStillStored(storage, existing) || !baselineStillStored(storage, existing) || isMarker(existing) && newerThan(retained, existing).length > 0)) {
         existing = null;
       }
       const ledger = existing ? await catchUp(storage, existing, retained, budget, now) : await rebuild(storage, scope, retained, budget, now);
@@ -113839,7 +113874,7 @@ async function ensureScopeLedger(storage, scope, options = {}) {
         } catch {
         }
       }
-      return ledger;
+      return ledger ? withDerivedPartial(storage, ledger) : ledger;
     } catch {
       return null;
     }
@@ -113902,6 +113937,7 @@ async function summarizeAdditions(input) {
   let total = 0;
   let trackedSince = null;
   let trackedSinceAt = Infinity;
+  let anyPartial = false;
   for await (const ledger of input.ledgers) {
     for (const firstSeen of listAddedTimestamps(ledger)) {
       const date5 = localDate(formatter, new Date(Date.parse(firstSeen)));
@@ -113918,14 +113954,24 @@ async function summarizeAdditions(input) {
         trackedSince = scopeTrackedSince;
       }
     }
+    const partial2 = scopeTrackedSince !== null && ledger.partial === true;
+    anyPartial ||= partial2;
     scopes.push({
       scope: ledger.scope,
       total: ledger.latest.total,
-      trackedSince: scopeTrackedSince
+      trackedSince: scopeTrackedSince,
+      partial: partial2
     });
   }
   scopes.sort((a10, b10) => a10.scope.localeCompare(b10.scope));
-  return { timezone, total, days: dayRows, trackedSince, scopes };
+  return {
+    timezone,
+    total,
+    days: dayRows,
+    trackedSince,
+    partial: anyPartial,
+    scopes
+  };
 }
 // ../core/dist/contracts/data.js
@@ -113973,7 +114019,7 @@ function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 var VISIBILITY_PAGE_SIZE = 200;
-async function collectScopes(storage, scopePrefix, isVisible) {
+async function collectScopes(storage, scopePrefix, isVisible, isListable) {
   const scopes = [];
   for (let scan = 0; ; scan += VISIBILITY_PAGE_SIZE) {
     const batch = storage.listScopes({
@@ -113982,6 +114028,8 @@ async function collectScopes(storage, scopePrefix, isVisible) {
       offset: scan
     });
     for (const summary of batch.scopes) {
+      if (isListable && !isListable(summary.scope))
+        continue;
       if (!isVisible) {
         scopes.push(summary);
         continue;
@@ -114004,8 +114052,8 @@ async function listDataScopesContract(input) {
   const offset = normalizeOffset(input.offset);
   let page;
   let total;
-  if (input.isVisible) {
-    const visible = await collectScopes(input.storage, input.scopePrefix, input.isVisible);
+  if (input.isVisible || input.isListable) {
+    const visible = await collectScopes(input.storage, input.scopePrefix, input.isVisible, input.isListable);
     total = visible.length;
     page = visible.slice(offset, offset + limit);
   } else {
@@ -114543,6 +114591,7 @@ function createMemoryDeviceSessionStore() {
         sessionId: input.sessionId,
         pollToken: input.pollToken,
         requestedServerOrigin: input.requestedServerOrigin,
+        localApprovalAllowed: input.localApprovalAllowed === true,
         status: "pending",
         createdAt: input.now,
         lastPollAt: 0
@@ -114596,6 +114645,7 @@ function initiateDeviceSessionContract(input) {
   input.sessionStore.purgeExpired(input.now);
   input.sessionStore.create({
     requestedServerOrigin: input.requestOrigin,
+    localApprovalAllowed: input.localApprovalAllowed,
     sessionId: input.sessionId,
     pollToken: input.pollToken,
     now: input.now
@@ -115892,6 +115942,10 @@ async function verifyDataReadPolicy(input, ports) {
       grantId: input.grantId
     });
   }
+  assertGrantAuthorizesBuilder(grant, builder, input);
+  return grant;
+}
+function assertGrantAuthorizesBuilder(grant, builder, input) {
   if (SENTINEL_GRANT_IDS.has(grant.id)) {
     throw new GrantRequiredError({
       reason: "Grant resolved to a reserved id",
@@ -115924,7 +115978,7 @@ async function verifyDataReadPolicy(input, ports) {
       }
     }
   }
-  if (!scopeCoveredByGrant(input.requestedScope, grant.scopes)) {
+  if (input.requestedScope !== void 0 && !scopeCoveredByGrant(input.requestedScope, grant.scopes)) {
     throw new ScopeMismatchError({
       requestedScope: input.requestedScope,
       grantedScopes: grant.scopes
@@ -115949,7 +116003,62 @@ async function verifyDataReadPolicy(input, ports) {
       actual: grant.grantorAddress ?? null
     });
   }
-  return grant;
+}
+function isWellFormedGrantRow(grant) {
+  if (typeof grant !== "object" || grant === null)
+    return false;
+  const row = grant;
+  return typeof row.id === "string" && typeof row.granteeId === "string" && Array.isArray(row.scopes) && row.scopes.every((scope) => typeof scope === "string") && (row.grantorAddress === void 0 || row.grantorAddress === null || typeof row.grantorAddress === "string");
+}
+async function resolveDataListGrantScopes(input, ports) {
+  const available = await ports.runtimeAvailability?.isAvailable();
+  if (available === false) {
+    throw new PsUnavailableError();
+  }
+  if (!input.serverOwner) {
+    throw new ServerNotConfiguredError({
+      reason: "serverOwner is required to verify grant ownership"
+    });
+  }
+  const builder = await ports.authSessionVerifier.getBuilder(input.signer);
+  if (!builder) {
+    throw new UnregisteredBuilderError();
+  }
+  if (input.grantId) {
+    if (SENTINEL_GRANT_IDS.has(input.grantId)) {
+      throw new GrantRequiredError({
+        reason: "Reserved grantId",
+        grantId: input.grantId
+      });
+    }
+    const grant = await ports.grantVerifier.getGrant(input.grantId);
+    if (!grant) {
+      throw new GrantRequiredError({
+        reason: "Grant not found",
+        grantId: input.grantId
+      });
+    }
+    assertGrantAuthorizesBuilder(grant, builder, input);
+    return [...grant.scopes];
+  }
+  if (!ports.grantLister)
+    return [];
+  const grants = await ports.grantLister.listGrantsByUser(input.serverOwner);
+  const scopes = /* @__PURE__ */ new Set();
+  for (const grant of grants) {
+    if (!isWellFormedGrantRow(grant))
+      continue;
+    try {
+      assertGrantAuthorizesBuilder(grant, builder, input);
+    } catch (err2) {
+      if (err2 instanceof ProtocolError)
+        continue;
+      throw err2;
+    }
+    for (const scope of grant.scopes)
+      scopes.add(scope);
+  }
+  return [...scopes];
 }
 // ../core/dist/sync/tombstone.js
@@ -116882,6 +116991,9 @@ function decodePathPart(value) {
 function selectedGrantId(request2, url2) {
   return url2.searchParams.get("grantId") ?? request2.headers.get("x-ps-grant-id") ?? void 0;
 }
+function listAuthCovers(listAuth, scope) {
+  return scopeCoveredByGrant(scope, [...listAuth.grantedScopes]);
+}
 async function handleX402Cycle(input) {
   const { deps, gateway, gatewayConfig, gatewayUrl, builder, scope } = input;
   const opIdLower = input.grantId.toLowerCase();
@@ -117188,13 +117300,16 @@ async function handlePersonalServerDataRequest(request2, deps, options = {}) {
     if (pathname === "/" || pathname === "") {
       if (request2.method !== "GET")
         return methodNotAllowed();
-      await deps.auth.authorizeBuilderList(request2);
+      const listAuth = await deps.auth.authorizeBuilderList(request2, {
+        grantId: selectedGrantId(request2, url2)
+      });
       const result = await listDataScopesContract({
         storage: deps.storage,
         scopePrefix: url2.searchParams.get("scopePrefix") ?? void 0,
         limit: normalizeLimit2(url2.searchParams.get("limit"), 20),
         offset: normalizeLimit2(url2.searchParams.get("offset"), 0),
-        isVisible: discoveryVisibility(deps)
+        isVisible: discoveryVisibility(deps),
+        isListable: listAuth ? (scope) => listAuthCovers(listAuth, scope) : void 0
       });
       return jsonResponse(result.response);
     }
@@ -117219,7 +117334,16 @@ async function handlePersonalServerDataRequest(request2, deps, options = {}) {
     if (parts.length === 2 && parts[1] === "versions") {
       if (request2.method !== "GET")
         return methodNotAllowed();
-      await deps.auth.authorizeBuilderList(request2);
+      const listAuth = await deps.auth.authorizeBuilderList(request2, {
+        grantId: selectedGrantId(request2, url2)
+      });
+      const scopeResult = parseDataScopeContract(decodePathPart(parts[0]));
+      if (scopeResult.ok && listAuth && !listAuthCovers(listAuth, scopeResult.scope)) {
+        throw new GrantRequiredError({
+          reason: "No grant covers this scope",
+          requestedScope: scopeResult.scope
+        });
+      }
       const result = await listDataVersionsContract({
         storage: deps.storage,
         scopeParam: decodePathPart(parts[0]),
@@ -121947,7 +122071,7 @@ function createMcpDataReadClient(options) {
   }
   return {
     enforcesPayment: options.enforcesPayment ?? false,
-    async listScopes({ scopePrefix, limit, offset } = {}) {
+    async listScopes({ scopePrefix, limit, offset, grantId } = {}) {
       const params = new URLSearchParams();
       if (scopePrefix)
         params.set("scopePrefix", scopePrefix);
@@ -121962,7 +122086,7 @@ function createMcpDataReadClient(options) {
         aud: options.serverOrigin,
         method: "GET",
         uri: basePath,
-        grantId: "mcp-list"
+        grantId
       });
       const url2 = new URL(pathWithQuery, options.serverOrigin).toString();
       const request2 = new Request(url2, {
@@ -124615,7 +124739,8 @@ async function resolveSearchScopes({ connection, maxScopes, discoveryTimeoutMs,
     try {
       const listed = await withTimeout(readClient.listScopes({
         scopePrefix: prefix,
-        limit: LIST_SCOPES_LIMIT
+        limit: LIST_SCOPES_LIMIT,
+        grantId: grant.grantId
       }), discoveryTimeoutMs, `list scopes for ${requested}`);
       for (const summary of listed.scopes) {
         if (resolveGrantForScope(connection, summary.scope)) {
@@ -136603,7 +136728,7 @@ function createWeb3SignedPsLiteAuth(options) {
       serverOrigin: options.origin,
       serverOwner: options.ownerAddress
     }, authorizeOwner) : {},
-    async authorizeBuilderList(request2) {
+    async authorizeBuilderList(request2, listOptions) {
       const auth = await authenticatePsLiteRequest(request2, options);
       if (auth.isPolicyBypass || isOwnerSigner(auth, options.ownerAddress)) {
         return;
@@ -136611,10 +136736,12 @@ function createWeb3SignedPsLiteAuth(options) {
       if (!options.dataReadPolicyPorts) {
         throw dataReadPolicyPortsRequired();
       }
-      const builder = await options.dataReadPolicyPorts.authSessionVerifier.getBuilder(auth.auth.signer);
-      if (!builder) {
-        throw new UnregisteredBuilderError();
-      }
+      const grantedScopes = await resolveDataListGrantScopes({
+        signer: auth.auth.signer,
+        grantId: auth.auth.payload.grantId ?? listOptions?.grantId,
+        serverOwner: options.ownerAddress
+      }, options.dataReadPolicyPorts);
+      return { grantedScopes };
     },
     async authorizeBuilderRead(input) {
       const auth = await authenticatePsLiteRequest(input.request, options);
@@ -139692,6 +139819,7 @@ async function createIndexedDbPsLiteRuntime(options) {
     dataReadPolicyPorts: {
       authSessionVerifier: gateway,
       grantVerifier: gateway,
+      grantLister: gateway,
       runtimeAvailability
     },
     ...writeSessionStore ? {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@opendatalabs/personal-server-ts-server",
-  "version": "1.33.0",
+  "version": "1.33.2",
   "description": "Hono HTTP server for the Vana Personal Server — routes, middleware, composition root",
   "license": "MIT",
   "repository": {
@@ -51,8 +51,8 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.19.17",
-    "@opendatalabs/personal-server-ts-core": "1.33.0",
-    "@opendatalabs/personal-server-ts-lite": "1.33.0",
+    "@opendatalabs/personal-server-ts-core": "1.33.2",
+    "@opendatalabs/personal-server-ts-lite": "1.33.2",
     "@opendatalabs/vana-sdk": "3.23.0-pr.211.36da1d8",
     "better-sqlite3": "^12.11.1",
     "hono": "^4.13.12",