@undefineds.co/xpod 0.3.58 → 0.3.62

package/dist/runtime/GatewayAdminProxyAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayAdminProxyAuth.js","sourceRoot":"","sources":["../../src/runtime/GatewayAdminProxyAuth.ts"],"names":[],"mappings":";;;AAgBA,8EAEC;AAiBD,wEAcC;AAED,sEAIC;AAED,0DAUC;AAED,wEA4CC;AAjHD,6CAAuE;AAEvE,uCAAgC;AAEnB,QAAA,mCAAmC,GAAG,6BAA6B,CAAC;AACpE,QAAA,oCAAoC,GAAG,8BAA8B,CAAC;AACtE,QAAA,oCAAoC,GAAG,8BAA8B,CAAC;AAEtE,QAAA,2BAA2B,GAAG;IACzC,2CAAmC;IACnC,4CAAoC;IACpC,4CAAoC;CAC5B,CAAC;AAEX,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,SAAgB,iCAAiC;IAC/C,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAiBD,SAAgB,8BAA8B,CAAC,KAAmC;IAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1D,OAAO;QACL,CAAC,2CAAmC,CAAC,EAAE,QAAQ;QAC/C,CAAC,4CAAoC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;QACxD,CAAC,4CAAoC,CAAC,EAAE,2BAA2B,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ;YACR,QAAQ;SACT,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAAC,OAA4B;IACxE,KAAK,MAAM,MAAM,IAAI,mCAA2B,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAgB,uBAAuB,CAAC,aAAiC;IACvE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QACpD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,aAAa,CAAC;IAElB,IAAI,IAAA,eAAI,EAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,UAAU,KAAK,KAAK,CAAC;AAC9B,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAM9C;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,2CAAmC,CAAC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,4CAAoC,CAAC,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,4CAAoC,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,CAAC;IAC7F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,KAAK,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,KAAK,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,iBAAiB,EAAE,CAAC;QACvE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,KAAK,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC7G,CAAC;IAED,MAAM,QAAQ,GAAG,2BAA2B,CAAC;QAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,KAAK,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC5G,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,KAAK,GAAG,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,2BAA2B,CAAC,KAMpC;IACC,MAAM,OAAO,GAAG;QACd,IAAI;QACJ,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;QACrC,KAAK,CAAC,GAAG,IAAI,GAAG;QAChB,KAAK,CAAC,QAAQ;QACd,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,QAAgB;IACjD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC","sourcesContent":["import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\nimport type { IncomingHttpHeaders, OutgoingHttpHeaders } from 'node:http';\nimport { isIP } from 'node:net';\n\nexport const GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = 'x-xpod-admin-proxy-loopback';\nexport const GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = 'x-xpod-admin-proxy-timestamp';\nexport const GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = 'x-xpod-admin-proxy-signature';\n\nexport const GATEWAY_ADMIN_PROXY_HEADERS = [\n  GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER,\n  GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER,\n  GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER,\n] as const;\n\nconst MAX_CLOCK_SKEW_MS = 60_000;\n\nexport function createGatewayAdminProxyAuthSecret(): string {\n  return randomBytes(32).toString('base64url');\n}\n\nexport interface GatewayAdminProxyMarkerInput {\n  secret: string;\n  method: string | undefined;\n  url: string | undefined;\n  originalClientLoopback: boolean;\n  issuedAt?: number;\n}\n\nexport interface GatewayAdminProxyMarkerVerification {\n  present: boolean;\n  valid: boolean;\n  originalClientLoopback: boolean;\n  reason?: string;\n}\n\nexport function createGatewayAdminProxyHeaders(input: GatewayAdminProxyMarkerInput): OutgoingHttpHeaders {\n  const issuedAt = input.issuedAt ?? Date.now();\n  const loopback = input.originalClientLoopback ? '1' : '0';\n  return {\n    [GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER]: loopback,\n    [GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER]: String(issuedAt),\n    [GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER]: signGatewayAdminProxyMarker({\n      secret: input.secret,\n      method: input.method,\n      url: input.url,\n      loopback,\n      issuedAt,\n    }),\n  };\n}\n\nexport function stripGatewayAdminProxyHeaders(headers: IncomingHttpHeaders): void {\n  for (const header of GATEWAY_ADMIN_PROXY_HEADERS) {\n    delete headers[header];\n  }\n}\n\nexport function isLoopbackRemoteAddress(remoteAddress: string | undefined): boolean {\n  if (!remoteAddress) return false;\n  const normalized = remoteAddress.startsWith('::ffff:')\n    ? remoteAddress.slice('::ffff:'.length)\n    : remoteAddress;\n\n  if (isIP(normalized) === 4) {\n    return normalized.startsWith('127.');\n  }\n  return normalized === '::1';\n}\n\nexport function verifyGatewayAdminProxyHeaders(input: {\n  headers: IncomingHttpHeaders;\n  secret?: string;\n  method: string | undefined;\n  url: string | undefined;\n  now?: number;\n}): GatewayAdminProxyMarkerVerification {\n  const loopback = firstHeader(input.headers[GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER]);\n  const timestamp = firstHeader(input.headers[GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER]);\n  const signature = firstHeader(input.headers[GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER]);\n  const present = loopback !== undefined || timestamp !== undefined || signature !== undefined;\n  if (!present) {\n    return { present: false, valid: false, originalClientLoopback: false };\n  }\n  if (!input.secret) {\n    return { present: true, valid: false, originalClientLoopback: false, reason: 'missing_secret' };\n  }\n  if (loopback !== '0' && loopback !== '1') {\n    return { present: true, valid: false, originalClientLoopback: false, reason: 'invalid_loopback' };\n  }\n  if (!timestamp || !signature) {\n    return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'incomplete_marker' };\n  }\n\n  const issuedAt = Number.parseInt(timestamp, 10);\n  if (!Number.isFinite(issuedAt)) {\n    return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'invalid_timestamp' };\n  }\n  if (Math.abs((input.now ?? Date.now()) - issuedAt) > MAX_CLOCK_SKEW_MS) {\n    return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'expired_marker' };\n  }\n\n  const expected = signGatewayAdminProxyMarker({\n    secret: input.secret,\n    method: input.method,\n    url: input.url,\n    loopback,\n    issuedAt,\n  });\n  if (!safeEqual(signature, expected)) {\n    return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'bad_signature' };\n  }\n\n  return { present: true, valid: true, originalClientLoopback: loopback === '1' };\n}\n\nfunction signGatewayAdminProxyMarker(input: {\n  secret: string;\n  method: string | undefined;\n  url: string | undefined;\n  loopback: '0' | '1';\n  issuedAt: number;\n}): string {\n  const payload = [\n    'v1',\n    (input.method ?? 'GET').toUpperCase(),\n    input.url ?? '/',\n    input.loopback,\n    String(input.issuedAt),\n  ].join('\\n');\n  return createHmac('sha256', input.secret).update(payload).digest('base64url');\n}\n\nfunction safeEqual(actual: string, expected: string): boolean {\n  const actualBuffer = Buffer.from(actual);\n  const expectedBuffer = Buffer.from(expected);\n  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);\n}\n\nfunction firstHeader(value: string | string[] | undefined): string | undefined {\n  return Array.isArray(value) ? value[0] : value;\n}\n"]}

package/dist/runtime/Proxy.d.ts

@@ -1,3 +1,4 @@
+import http from 'http';
 import type { Supervisor } from '../supervisor/Supervisor';
 import type { RuntimeHost, RuntimeListenEndpoint } from './host/types';
 export declare class GatewayProxy {
@@ -11,6 +12,8 @@ export declare class GatewayProxy {
     private readonly exitOnStop;
     private readonly shutdownHandler?;
     private readonly baseUrl?;
+    private readonly internalAdminAuthSecret?;
+    private readonly clientRemoteAddressResolver?;
     constructor(port: number | undefined, supervisor: Supervisor, bindHost?: string, options?: GatewayProxyOptions);
     setTargets(targets: {
         css?: string | GatewayProxyTarget;
@@ -19,8 +22,12 @@ export declare class GatewayProxy {
     start(): Promise<void>;
     stop(): Promise<void>;
     private handleRequest;
+    private isApiWebProductPath;
     private shouldRouteToApi;
+    private applyInternalAdminProxyHeaders;
     private isApiHost;
+    private configuredApiHosts;
+    private hostsFromUrlList;
     private hostFromUrl;
     private normalizeHost;
     private firstHeaderValue;
@@ -30,6 +37,7 @@ export declare class GatewayProxy {
     private normalizeRootMutationProxyResponse;
     private createRootMutationForbiddenBody;
     private sanitizeProxyResponseHeaders;
+    private normalizeProxiedCorsHeaders;
     private handleCorsPreflightRequest;
     /**
      * Add CORS headers matching CSS CorsHandler configuration
@@ -51,4 +59,6 @@ export interface GatewayProxyOptions {
     exitOnStop?: boolean;
     shutdownHandler?: () => Promise<void>;
     baseUrl?: string;
+    internalAdminAuthSecret?: string;
+    clientRemoteAddressResolver?: (req: http.IncomingMessage) => string | undefined;
 }

package/dist/runtime/Proxy.js

@@ -8,6 +8,7 @@ const http_proxy_1 = __importDefault(require("http-proxy"));
 const http_1 = __importDefault(require("http"));
 const global_logger_factory_1 = require("global-logger-factory");
 const NodeRuntimeHost_1 = require("./host/node/NodeRuntimeHost");
+const GatewayAdminProxyAuth_1 = require("./GatewayAdminProxyAuth");
 // CORS configuration matching CSS CorsHandler defaults
 const CORS_CONFIG = {
     methods: ['GET', 'HEAD', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE'],
@@ -36,6 +37,8 @@ class GatewayProxy {
         this.exitOnStop = options.exitOnStop ?? false;
         this.shutdownHandler = options.shutdownHandler;
         this.baseUrl = options.baseUrl;
+        this.internalAdminAuthSecret = options.internalAdminAuthSecret;
+        this.clientRemoteAddressResolver = options.clientRemoteAddressResolver;
         this.proxy = http_proxy_1.default.createProxyServer({
             xfwd: true,
         });
@@ -47,6 +50,7 @@ class GatewayProxy {
             }
         });
         this.proxy.on('proxyRes', (proxyRes, req, res) => {
+            this.normalizeProxiedCorsHeaders(req, proxyRes);
             this.sanitizeProxyResponseHeaders(req, proxyRes);
             const interceptedRequest = req;
             const outgoing = res;
@@ -100,6 +104,9 @@ class GatewayProxy {
     handleRequest(req, res) {
         const url = req.url ?? '/';
         const origin = req.headers.origin;
+        const originalRemoteAddress = this.clientRemoteAddressResolver?.(req) ?? req.socket.remoteAddress;
+        const originalClientLoopback = (0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(originalRemoteAddress);
+        (0, GatewayAdminProxyAuth_1.stripGatewayAdminProxyHeaders)(req.headers);
         // Store public host for routing before any CSS canonical-host rewrites.
         // External gateways pass the original domain through X-Forwarded-Host;
         // direct/local requests use Host.
@@ -151,12 +158,14 @@ class GatewayProxy {
         // Public API is selected by host (`api.<domain>`), not by adding an `/api`
         // path prefix to the IdP/Pod host. Path-based routing remains for local/dev
         // single-origin clients and existing legacy endpoints.
-        // 2a. Dashboard UI is served by API server under /dashboard/*
-        if ((url === '/dashboard' || url.startsWith('/dashboard/')) && this.targets.api) {
+        // 2a. Xpod web products are served by the API server.
+        if (this.isApiWebProductPath(url) && this.targets.api) {
+            this.applyInternalAdminProxyHeaders(req, originalClientLoopback);
             this.proxy.web(req, res, { target: this.toProxyTarget(this.targets.api) });
             return;
         }
         if ((apiHost || this.shouldRouteToApi(url)) && this.targets.api) {
+            this.applyInternalAdminProxyHeaders(req, originalClientLoopback);
             this.proxy.web(req, res, { target: this.toProxyTarget(this.targets.api) });
             return;
         }
@@ -178,6 +187,12 @@ class GatewayProxy {
             res.end('CSS Service Not Available');
         }
     }
+    isApiWebProductPath(url) {
+        return url === '/dashboard'
+            || url.startsWith('/dashboard/')
+            || url === '/settings'
+            || url.startsWith('/settings/');
+    }
     shouldRouteToApi(url) {
         return url.startsWith('/v1/')
             || url.startsWith('/api/')
@@ -185,17 +200,43 @@ class GatewayProxy {
             || url === '/.well-known/matrix/client'
             || url.startsWith('/_matrix/');
     }
+    applyInternalAdminProxyHeaders(req, originalClientLoopback) {
+        if (!this.internalAdminAuthSecret) {
+            req.headers[GatewayAdminProxyAuth_1.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER] = originalClientLoopback ? '1' : '0';
+            return;
+        }
+        Object.assign(req.headers, (0, GatewayAdminProxyAuth_1.createGatewayAdminProxyHeaders)({
+            secret: this.internalAdminAuthSecret,
+            method: req.method,
+            url: req.url,
+            originalClientLoopback,
+        }));
+    }
     isApiHost(hostHeader) {
         const host = this.normalizeHost(hostHeader);
         if (!host) {
             return false;
         }
-        if (host.startsWith('api.')) {
+        if (host.startsWith('api.') || host.startsWith('registry.')) {
             return true;
         }
-        const configuredHost = this.hostFromUrl(process.env.XPOD_CLOUD_API_ENDPOINT)
-            ?? this.hostFromUrl(process.env.XPOD_PUBLIC_API_URL);
-        return Boolean(configuredHost && host === configuredHost);
+        const configuredHosts = this.configuredApiHosts();
+        return configuredHosts.includes(host);
+    }
+    configuredApiHosts() {
+        return [
+            process.env.XPOD_CLOUD_API_ENDPOINT,
+            process.env.XPOD_PUBLIC_API_URL,
+            process.env.XPOD_PUBLIC_REGISTRY_URL,
+        ]
+            .flatMap((value) => this.hostsFromUrlList(value))
+            .filter((host) => Boolean(host));
+    }
+    hostsFromUrlList(value) {
+        if (!value) {
+            return [];
+        }
+        return value.split(',').map((entry) => this.hostFromUrl(entry.trim()));
     }
     hostFromUrl(value) {
         if (!value) {
@@ -297,6 +338,23 @@ class GatewayProxy {
             }
         }
     }
+    normalizeProxiedCorsHeaders(req, proxyRes) {
+        const origin = req.headers.origin;
+        if (!origin) {
+            return;
+        }
+        proxyRes.headers['access-control-allow-origin'] = origin;
+        proxyRes.headers['access-control-allow-credentials'] = 'true';
+        const vary = proxyRes.headers.vary;
+        const varyValues = (Array.isArray(vary) ? vary : [vary])
+            .flatMap((value) => value?.split(',') ?? [])
+            .map((value) => value.trim())
+            .filter(Boolean);
+        if (!varyValues.some((value) => value.toLowerCase() === 'origin')) {
+            varyValues.push('Origin');
+        }
+        proxyRes.headers.vary = varyValues.join(', ');
+    }
     handleCorsPreflightRequest(res, origin) {
         this.addCorsHeaders(res, origin);
         res.writeHead(204);

package/dist/runtime/Proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"Proxy.js","sourceRoot":"","sources":["../../src/runtime/Proxy.ts"],"names":[],"mappings":";;;;;;AAAA,4DAAmC;AACnC,gDAAwB;AACxB,iEAAqD;AAErD,iEAA8D;AAa9D,uDAAuD;AACvD,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;IACrE,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE;QACd,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;QAC3D,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM;KAChE;IACD,cAAc,EAAE;QACd,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe;QACrE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa;QAC1D,WAAW,EAAE,kBAAkB,EAAE,cAAc;KAChD;CACF,CAAC;AAEF,MAAa,YAAY;IAWvB,YACE,IAAwB,EAChB,UAAsB,EAC9B,QAAQ,GAAG,SAAS,EACpB,UAA+B,EAAE;QAFzB,eAAU,GAAV,UAAU,CAAY;QAZf,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAGrC,YAAO,GAA2D,EAAE,CAAC;QAa3E,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iCAAe,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC;YACpF,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;QAC9C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,oBAAS,CAAC,iBAAiB,CAAC;YACvC,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACvC,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACjD,MAAM,kBAAkB,GAAG,GAAyB,CAAC;YACrD,MAAM,QAAQ,GAAG,GAA0B,CAAC;YAC5C,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACvF,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,kCAAkC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;gBAClF,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5D,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,cAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAE3B,kDAAkD;YAClD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ,EAAE,CAAC,CAAC;YAC5F,CAAC;iBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ,EAAE,CAAC,CAAC;YAC5F,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAC,OAAiF;QACjG,IAAI,CAAC,OAAO,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC;YACtC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC;SACvC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAEM,IAAI;QACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjE,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,GAAyB,EAAE,GAAwB;QACvE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAElC,wEAAwE;QACxE,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE7C,8CAA8C;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/D,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC;QAC7C,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,4BAA4B;QAC5B,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,YAAY,EAAE,CAAC;gBACjB,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;gBAChC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;YACjD,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACrC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,sBAAsB,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAC1J,CAAC;QAEF,gCAAgC;QAChC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnC,CAAC;YACD,KAAK,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,2EAA2E;QAC3E,4EAA4E;QAC5E,uDAAuD;QAEvD,8DAA8D;QAC9D,IAAI,CAAC,GAAG,KAAK,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAChF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YAED,MAAM,kBAAkB,GAAG,GAAyB,CAAC;YACrD,kBAAkB,CAAC,yBAAyB,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;YACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;gBACvB,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ;gBACnD,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;eACxB,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;eACvB,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;eAC7B,GAAG,KAAK,4BAA4B;eACpC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAEO,SAAS,CAAC,UAA8B;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;eACvE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC,cAAc,IAAI,IAAI,KAAK,cAAc,CAAC,CAAC;IAC5D,CAAC;IAEO,WAAW,CAAC,KAAyB;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,UAA8B;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAEO,gBAAgB,CAAC,KAAoC;QAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjD,CAAC;IAEO,yBAAyB,CAAC,GAAyB;QACzD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,CAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAEO,gCAAgC,CAAC,GAAyB;QAChE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,CAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAEO,0BAA0B,CAAC,GAAwB;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;SAC1C,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAEO,kCAAkC,CACxC,QAA8B,EAC9B,IAAY;QAEZ,MAAM,OAAO,GAA6B,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;QAC9C,MAAM,WAAW,GAAG,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ;YACtE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBAC/C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvF,IACE,UAAU,KAAK,GAAG;YAClB,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YAChD,QAAQ,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EACnD,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;YAC3F,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YAC9D,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAEO,+BAA+B;QACrC,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,sCAAsC;YAC/C,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;SAC3C,CAAC;IACJ,CAAC;IAEO,4BAA4B,CAAC,GAAyB,EAAE,QAA8B;QAC5F,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;QAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAwD,CAAC;QAClF,MAAM,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACzD,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3E,CAAC,CAAC,OAAO,gBAAgB,KAAK,QAAQ;gBACpC,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACpD,CAAC,CAAC,KAAK,CAAC;QAEZ,IAAI,MAAM,KAAK,MAAM,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7G,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,0BAA0B,CAChC,GAAwB,EACxB,MAA0B;QAE1B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAwB,EAAE,MAA0B;QACzE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QAC5D,GAAG,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;QACjF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEjC,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAClC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC5D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;gBAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;gBAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEhE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;oBACnC,KAAK;oBACL,MAAM;oBACN,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;iBAC5D,CAAC,CAAC;gBAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,YAAY,CAAC,GAAG,EAAE;oBAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3E,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;wBACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;4BACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBAClB,CAAC;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAEO,eAAe,CAAC,MAAoC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,MAA0B;QAC9C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,OAAO;aAClB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,GAAI,CAAC;IACrB,CAAC;CACF;AA9aD,oCA8aC","sourcesContent":["import httpProxy from 'http-proxy';\nimport http from 'http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Supervisor } from '../supervisor/Supervisor';\nimport { nodeRuntimeHost } from './host/node/NodeRuntimeHost';\nimport type { RuntimeHost, RuntimeListenEndpoint } from './host/types';\n\ntype InterceptedRequest = http.IncomingMessage & { __xpodInspectRootMutation?: boolean };\n\ninterface RootMutationForbiddenBody {\n  name: 'ForbiddenHttpError';\n  message: string;\n  statusCode: 403;\n  errorCode: 'H403';\n  details: { cause: 'root-container-write' };\n}\n\n// CORS configuration matching CSS CorsHandler defaults\nconst CORS_CONFIG = {\n  methods: ['GET', 'HEAD', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE'],\n  credentials: true,\n  allowedHeaders: [\n    'Authorization', 'Content-Type', 'Accept', 'DPoP', 'Origin',\n    'X-Requested-With', 'If-Match', 'If-None-Match', 'Slug', 'Link',\n  ],\n  exposedHeaders: [\n    'Accept-Patch', 'Accept-Post', 'Accept-Put', 'Allow', 'Content-Range',\n    'ETag', 'Last-Modified', 'Link', 'Location', 'Updates-Via',\n    'WAC-Allow', 'Www-Authenticate', 'X-Request-Id',\n  ],\n};\n\nexport class GatewayProxy {\n  private readonly logger = getLoggerFor(this);\n  private proxy: httpProxy;\n  private server: http.Server;\n  private targets: { css?: GatewayProxyTarget; api?: GatewayProxyTarget } = {};\n  private readonly runtimeHost: RuntimeHost;\n  private readonly listenEndpoint: RuntimeListenEndpoint;\n  private readonly exitOnStop: boolean;\n  private readonly shutdownHandler?: () => Promise<void>;\n  private readonly baseUrl?: string;\n\n  constructor(\n    port: number | undefined,\n    private supervisor: Supervisor,\n    bindHost = '0.0.0.0',\n    options: GatewayProxyOptions = {},\n  ) {\n    this.runtimeHost = options.runtimeHost ?? nodeRuntimeHost;\n    this.listenEndpoint = options.listenEndpoint ?? this.runtimeHost.createListenEndpoint({\n      port,\n      host: bindHost,\n      socketPath: options.socketPath,\n    });\n    this.exitOnStop = options.exitOnStop ?? false;\n    this.shutdownHandler = options.shutdownHandler;\n    this.baseUrl = options.baseUrl;\n    this.proxy = httpProxy.createProxyServer({\n      xfwd: true,\n    });\n\n    this.proxy.on('error', (err, _req, res) => {\n      this.logger.error('Proxy error:', err);\n      if (res && 'writeHead' in res && !res.headersSent) {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Service Unavailable', details: err.message }));\n      }\n    });\n\n    this.proxy.on('proxyRes', (proxyRes, req, res) => {\n      this.sanitizeProxyResponseHeaders(req, proxyRes);\n      const interceptedRequest = req as InterceptedRequest;\n      const outgoing = res as http.ServerResponse;\n      if (!interceptedRequest.__xpodInspectRootMutation || !outgoing || outgoing.headersSent) {\n        return;\n      }\n\n      const chunks: Buffer[] = [];\n      proxyRes.on('data', (chunk) => {\n        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n      });\n      proxyRes.on('end', () => {\n        const originalBody = Buffer.concat(chunks);\n        const rewritten = this.normalizeRootMutationProxyResponse(proxyRes, originalBody);\n        outgoing.writeHead(rewritten.statusCode, rewritten.headers);\n        outgoing.end(rewritten.body);\n      });\n    });\n\n    this.server = http.createServer(this.handleRequest.bind(this));\n\n    this.server.on('upgrade', (req, socket, head) => {\n      const url = req.url ?? '/';\n\n      // Route /ws/* WebSocket connections to API server\n      if (url.startsWith('/ws/') && this.targets.api) {\n        this.proxy.ws(req, socket, head, { target: this.toProxyTarget(this.targets.api) as any });\n      } else if (this.targets.css) {\n        this.proxy.ws(req, socket, head, { target: this.toProxyTarget(this.targets.css) as any });\n      } else {\n        socket.destroy();\n      }\n    });\n  }\n\n  public setTargets(targets: { css?: string | GatewayProxyTarget; api?: string | GatewayProxyTarget }): void {\n    this.targets = {\n      css: this.normalizeTarget(targets.css),\n      api: this.normalizeTarget(targets.api),\n    };\n  }\n\n  public async start(): Promise<void> {\n    await this.runtimeHost.listen(this.server, this.listenEndpoint);\n    this.logger.info(`Listening on ${this.runtimeHost.formatListenEndpoint(this.listenEndpoint)}`);\n  }\n\n  public stop(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      this.proxy.close();\n      this.runtimeHost.close(this.server, this.listenEndpoint).then(() => {\n        resolve();\n      }, reject);\n    });\n  }\n\n  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void {\n    const url = req.url ?? '/';\n    const origin = req.headers.origin;\n\n    // Store public host for routing before any CSS canonical-host rewrites.\n    // External gateways pass the original domain through X-Forwarded-Host;\n    // direct/local requests use Host.\n    const originalHost = this.firstHeaderValue(req.headers['x-forwarded-host']) ?? req.headers.host;\n    const apiHost = this.isApiHost(originalHost);\n\n    // Set x-forwarded-proto based on CSS_BASE_URL\n    const baseUrl = this.baseUrl ?? process.env.CSS_BASE_URL ?? '';\n    if (baseUrl.startsWith('https')) {\n      req.headers['x-forwarded-proto'] = 'https';\n    }\n\n    // API subdomains are the public API boundary. Preserve the API host for API\n    // handlers (for example Matrix discovery) instead of rewriting it to the\n    // canonical CSS/WebID host.\n    if (apiHost) {\n      if (originalHost) {\n        req.headers.host = originalHost;\n        req.headers['x-forwarded-host'] = originalHost;\n      }\n    } else if (baseUrl) {\n      try {\n        const parsedBaseUrl = new URL(baseUrl);\n        req.headers.host = parsedBaseUrl.host;\n        req.headers['x-forwarded-host'] = parsedBaseUrl.host;\n      } catch {\n        if (!req.headers['x-forwarded-host']) {\n          req.headers['x-forwarded-host'] = originalHost;\n        }\n      }\n    } else if (!req.headers['x-forwarded-host']) {\n      req.headers['x-forwarded-host'] = originalHost;\n    }\n\n    this.logger.debug(\n      `${req.method} ${url} x-forwarded-proto=${req.headers['x-forwarded-proto']} x-forwarded-host=${req.headers['x-forwarded-host']} host=${req.headers.host}`,\n    );\n\n    // 1. Internal service endpoints\n    if (url.startsWith('/service/')) {\n      if (req.method === 'OPTIONS') {\n        this.handleCorsPreflightRequest(res, origin);\n        return;\n      }\n      if (origin) {\n        this.addCorsHeaders(res, origin);\n      }\n      void this.handleInternalApi(req, res);\n      return;\n    }\n\n    // 2. API Server Routing.\n    // Public API is selected by host (`api.<domain>`), not by adding an `/api`\n    // path prefix to the IdP/Pod host. Path-based routing remains for local/dev\n    // single-origin clients and existing legacy endpoints.\n\n    // 2a. Dashboard UI is served by API server under /dashboard/*\n    if ((url === '/dashboard' || url.startsWith('/dashboard/')) && this.targets.api) {\n      this.proxy.web(req, res, { target: this.toProxyTarget(this.targets.api) as any });\n      return;\n    }\n\n    if ((apiHost || this.shouldRouteToApi(url)) && this.targets.api) {\n      this.proxy.web(req, res, { target: this.toProxyTarget(this.targets.api) as any });\n      return;\n    }\n\n    // 3. CSS Routing (Default)\n    if (this.targets.css) {\n      if (this.shouldRejectRootResourceMutation(req)) {\n        this.writeRootMutationForbidden(res);\n        return;\n      }\n\n      const interceptedRequest = req as InterceptedRequest;\n      interceptedRequest.__xpodInspectRootMutation = this.shouldInspectRootMutation(req);\n      this.proxy.web(req, res, {\n        target: this.toProxyTarget(this.targets.css) as any,\n        ...(interceptedRequest.__xpodInspectRootMutation ? { selfHandleResponse: true } : {}),\n      } as any);\n    } else {\n      res.writeHead(503);\n      res.end('CSS Service Not Available');\n    }\n  }\n\n  private shouldRouteToApi(url: string): boolean {\n    return url.startsWith('/v1/')\n      || url.startsWith('/api/')\n      || url.startsWith('/provision/')\n      || url === '/.well-known/matrix/client'\n      || url.startsWith('/_matrix/');\n  }\n\n  private isApiHost(hostHeader: string | undefined): boolean {\n    const host = this.normalizeHost(hostHeader);\n    if (!host) {\n      return false;\n    }\n    if (host.startsWith('api.')) {\n      return true;\n    }\n\n    const configuredHost = this.hostFromUrl(process.env.XPOD_CLOUD_API_ENDPOINT)\n      ?? this.hostFromUrl(process.env.XPOD_PUBLIC_API_URL);\n    return Boolean(configuredHost && host === configuredHost);\n  }\n\n  private hostFromUrl(value: string | undefined): string | undefined {\n    if (!value) {\n      return undefined;\n    }\n    try {\n      return new URL(value).hostname.toLowerCase();\n    } catch {\n      return undefined;\n    }\n  }\n\n  private normalizeHost(hostHeader: string | undefined): string | undefined {\n    const host = this.firstHeaderValue(hostHeader)?.split(',')[0]?.trim();\n    if (!host) {\n      return undefined;\n    }\n    return host.replace(/:\\d+$/, '').toLowerCase();\n  }\n\n  private firstHeaderValue(value: string | string[] | undefined): string | undefined {\n    return Array.isArray(value) ? value[0] : value;\n  }\n\n  private shouldInspectRootMutation(req: http.IncomingMessage): boolean {\n    const method = (req.method ?? 'GET').toUpperCase();\n    if (![ 'POST', 'PUT', 'PATCH', 'DELETE' ].includes(method)) {\n      return false;\n    }\n\n    const pathname = new URL(req.url ?? '/', 'http://localhost').pathname;\n    const segments = pathname.split('/').filter(Boolean);\n    return segments.length === 1 && !segments[0].startsWith('.');\n  }\n\n  private shouldRejectRootResourceMutation(req: http.IncomingMessage): boolean {\n    const method = (req.method ?? 'GET').toUpperCase();\n    if (![ 'POST', 'PUT', 'PATCH', 'DELETE' ].includes(method)) {\n      return false;\n    }\n\n    const pathname = new URL(req.url ?? '/', 'http://localhost').pathname;\n    const segments = pathname.split('/').filter(Boolean);\n    return segments.length === 1 && !segments[0].startsWith('.') && !pathname.endsWith('/');\n  }\n\n  private writeRootMutationForbidden(res: http.ServerResponse): void {\n    const body = Buffer.from(JSON.stringify(this.createRootMutationForbiddenBody()));\n    res.writeHead(403, {\n      'Content-Type': 'application/json',\n      'Content-Length': String(body.byteLength),\n    });\n    res.end(body);\n  }\n\n  private normalizeRootMutationProxyResponse(\n    proxyRes: http.IncomingMessage,\n    body: Buffer,\n  ): { statusCode: number; headers: http.OutgoingHttpHeaders; body: Buffer } {\n    const headers: http.OutgoingHttpHeaders = { ...proxyRes.headers };\n    const statusCode = proxyRes.statusCode ?? 500;\n    const contentType = typeof proxyRes.headers['content-type'] === 'string'\n      ? proxyRes.headers['content-type']\n      : Array.isArray(proxyRes.headers['content-type'])\n        ? proxyRes.headers['content-type'][0] ?? ''\n        : '';\n    const bodyText = contentType.includes('application/json') ? body.toString('utf8') : '';\n\n    if (\n      statusCode === 500 &&\n      bodyText.includes('Cannot obtain the parent of') &&\n      bodyText.includes('because it is a root container')\n    ) {\n      const normalizedBody = Buffer.from(JSON.stringify(this.createRootMutationForbiddenBody()));\n      delete headers['content-length'];\n      delete headers['transfer-encoding'];\n      headers['content-type'] = 'application/json';\n      headers['content-length'] = String(normalizedBody.byteLength);\n      return { statusCode: 403, headers, body: normalizedBody };\n    }\n\n    delete headers['transfer-encoding'];\n    headers['content-length'] = String(body.byteLength);\n    return { statusCode, headers, body };\n  }\n\n  private createRootMutationForbiddenBody(): RootMutationForbiddenBody {\n    return {\n      name: 'ForbiddenHttpError',\n      message: 'Write to server root is not allowed.',\n      statusCode: 403,\n      errorCode: 'H403',\n      details: { cause: 'root-container-write' },\n    };\n  }\n\n  private sanitizeProxyResponseHeaders(req: http.IncomingMessage, proxyRes: http.IncomingMessage): void {\n    const method = (req.method ?? 'GET').toUpperCase();\n    const statusCode = proxyRes.statusCode ?? 200;\n    const headers = proxyRes.headers as Record<string, string | string[] | undefined>;\n    const transferEncoding = headers['transfer-encoding'];\n    const hasTransferEncoding = Array.isArray(transferEncoding)\n      ? transferEncoding.some((value) => value.toLowerCase().includes('chunked'))\n      : typeof transferEncoding === 'string'\n        ? transferEncoding.toLowerCase().includes('chunked')\n        : false;\n\n    if (method === 'HEAD' || statusCode === 204 || statusCode === 304 || (statusCode >= 100 && statusCode < 200)) {\n      delete headers['transfer-encoding'];\n      return;\n    }\n\n    if (hasTransferEncoding) {\n      delete headers['transfer-encoding'];\n      if (headers['content-length'] !== undefined) {\n        delete headers['content-length'];\n      }\n    }\n  }\n\n  private handleCorsPreflightRequest(\n    res: http.ServerResponse,\n    origin: string | undefined,\n  ): void {\n    this.addCorsHeaders(res, origin);\n    res.writeHead(204);\n    res.end();\n  }\n\n  /**\n   * Add CORS headers matching CSS CorsHandler configuration\n   */\n  private addCorsHeaders(res: http.ServerResponse, origin: string | undefined): void {\n    res.setHeader('Access-Control-Allow-Origin', origin || '*');\n    res.setHeader('Access-Control-Allow-Credentials', String(CORS_CONFIG.credentials));\n    res.setHeader('Access-Control-Allow-Methods', CORS_CONFIG.methods.join(', '));\n    res.setHeader('Access-Control-Allow-Headers', CORS_CONFIG.allowedHeaders.join(', '));\n    res.setHeader('Access-Control-Expose-Headers', CORS_CONFIG.exposedHeaders.join(', '));\n  }\n\n  private async handleInternalApi(req: http.IncomingMessage, res: http.ServerResponse): Promise<void> {\n    try {\n      const reqUrl = req.url ?? '/';\n      const parsed = new URL(reqUrl, 'http://localhost');\n      const pathname = parsed.pathname;\n\n      if (pathname === '/service/status') {\n        const status = this.supervisor.getAllStatus();\n        const cssReady = await this.isCssReady();\n        const code = cssReady ? 200 : 503;\n        res.writeHead(code, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify(status));\n        return;\n      }\n\n      if (pathname === '/service/logs') {\n        const level = parsed.searchParams.get('level') ?? undefined;\n        const source = parsed.searchParams.get('source') ?? undefined;\n        const limitValue = parsed.searchParams.get('limit');\n        const limit = limitValue ? parseInt(limitValue, 10) : undefined;\n\n        const logs = this.supervisor.getLogs({\n          level,\n          source,\n          limit: Number.isFinite(limit as number) ? limit : undefined,\n        });\n\n        res.writeHead(200, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify(logs));\n        return;\n      }\n\n      if (pathname === '/service/stop' && req.method === 'POST') {\n        res.writeHead(200, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ ok: true }));\n        setImmediate(() => {\n          const shutdown = this.shutdownHandler ?? (() => this.supervisor.stopAll());\n          void shutdown().then(() => {\n            if (this.exitOnStop) {\n              process.exit(0);\n            }\n          });\n        });\n        return;\n      }\n\n      res.writeHead(404);\n      res.end('Not Found');\n    } catch (error) {\n      this.logger.error('Internal service endpoint failed:', error);\n      if (!res.headersSent) {\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n      }\n      res.end(JSON.stringify({ error: 'Internal Server Error' }));\n    }\n  }\n\n  private async isCssReady(): Promise<boolean> {\n    if (!this.targets.css) {\n      return true;\n    }\n\n    return this.runtimeHost.isConnectionTargetReady(this.targets.css, 1_500);\n  }\n\n  private normalizeTarget(target?: string | GatewayProxyTarget): GatewayProxyTarget | undefined {\n    if (!target) {\n      return undefined;\n    }\n    if (typeof target === 'string') {\n      return { url: target };\n    }\n    return target;\n  }\n\n  private toProxyTarget(target: GatewayProxyTarget): string | { socketPath: string; protocol: string } {\n    if (target.socketPath) {\n      return {\n        socketPath: target.socketPath,\n        protocol: 'http:',\n      };\n    }\n    return target.url!;\n  }\n}\n\nexport interface GatewayProxyTarget {\n  url?: string;\n  socketPath?: string;\n}\n\nexport interface GatewayProxyOptions {\n  socketPath?: string;\n  listenEndpoint?: RuntimeListenEndpoint;\n  runtimeHost?: RuntimeHost;\n  exitOnStop?: boolean;\n  shutdownHandler?: () => Promise<void>;\n  baseUrl?: string;\n}\n"]}
+{"version":3,"file":"Proxy.js","sourceRoot":"","sources":["../../src/runtime/Proxy.ts"],"names":[],"mappings":";;;;;;AAAA,4DAAmC;AACnC,gDAAwB;AACxB,iEAAqD;AAErD,iEAA8D;AAE9D,mEAKiC;AAYjC,uDAAuD;AACvD,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC;IACrE,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE;QACd,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;QAC3D,kBAAkB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM;KAChE;IACD,cAAc,EAAE;QACd,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe;QACrE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa;QAC1D,WAAW,EAAE,kBAAkB,EAAE,cAAc;KAChD;CACF,CAAC;AAEF,MAAa,YAAY;IAavB,YACE,IAAwB,EAChB,UAAsB,EAC9B,QAAQ,GAAG,SAAS,EACpB,UAA+B,EAAE;QAFzB,eAAU,GAAV,UAAU,CAAY;QAdf,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAGrC,YAAO,GAA2D,EAAE,CAAC;QAe3E,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iCAAe,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC;YACpF,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;QAC9C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;QAC/D,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,oBAAS,CAAC,iBAAiB,CAAC;YACvC,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACvC,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,4BAA4B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACjD,MAAM,kBAAkB,GAAG,GAAyB,CAAC;YACrD,MAAM,QAAQ,GAAG,GAA0B,CAAC;YAC5C,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACvF,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,kCAAkC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;gBAClF,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5D,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,cAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAE3B,kDAAkD;YAClD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ,EAAE,CAAC,CAAC;YAC5F,CAAC;iBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ,EAAE,CAAC,CAAC;YAC5F,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAC,OAAiF;QACjG,IAAI,CAAC,OAAO,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC;YACtC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC;SACvC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAEM,IAAI;QACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjE,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,GAAyB,EAAE,GAAwB;QACvE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,MAAM,qBAAqB,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAClG,MAAM,sBAAsB,GAAG,IAAA,+CAAuB,EAAC,qBAAqB,CAAC,CAAC;QAC9E,IAAA,qDAA6B,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3C,wEAAwE;QACxE,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE7C,8CAA8C;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/D,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC;QAC7C,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,4BAA4B;QAC5B,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,YAAY,EAAE,CAAC;gBACjB,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;gBAChC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;YACjD,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACrC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,sBAAsB,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAC1J,CAAC;QAEF,gCAAgC;QAChC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnC,CAAC;YACD,KAAK,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,2EAA2E;QAC3E,4EAA4E;QAC5E,uDAAuD;QAEvD,sDAAsD;QACtD,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACtD,IAAI,CAAC,8BAA8B,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAChE,IAAI,CAAC,8BAA8B,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YAED,MAAM,kBAAkB,GAAG,GAAyB,CAAC;YACrD,kBAAkB,CAAC,yBAAyB,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;YACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;gBACvB,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAQ;gBACnD,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,GAAW;QACrC,OAAO,GAAG,KAAK,YAAY;eACtB,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;eAC7B,GAAG,KAAK,WAAW;eACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;eACxB,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;eACvB,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;eAC7B,GAAG,KAAK,4BAA4B;eACpC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAEO,8BAA8B,CAAC,GAAyB,EAAE,sBAA+B;QAC/F,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClC,GAAG,CAAC,OAAO,CAAC,2DAAmC,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAA,sDAA8B,EAAC;YACxD,MAAM,EAAE,IAAI,CAAC,uBAAuB;YACpC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,sBAAsB;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,SAAS,CAAC,UAA8B;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAClD,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAEO,kBAAkB;QACxB,OAAO;YACL,OAAO,CAAC,GAAG,CAAC,uBAAuB;YACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,OAAO,CAAC,GAAG,CAAC,wBAAwB;SACrC;aACE,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAEO,gBAAgB,CAAC,KAAyB;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAEO,WAAW,CAAC,KAAyB;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,UAA8B;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAEO,gBAAgB,CAAC,KAAoC;QAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjD,CAAC;IAEO,yBAAyB,CAAC,GAAyB;QACzD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,CAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAEO,gCAAgC,CAAC,GAAyB;QAChE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,CAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAEO,0BAA0B,CAAC,GAAwB;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;SAC1C,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAEO,kCAAkC,CACxC,QAA8B,EAC9B,IAAY;QAEZ,MAAM,OAAO,GAA6B,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;QAC9C,MAAM,WAAW,GAAG,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ;YACtE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBAC/C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvF,IACE,UAAU,KAAK,GAAG;YAClB,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YAChD,QAAQ,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EACnD,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;YAC3F,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YAC9D,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAEO,+BAA+B;QACrC,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,sCAAsC;YAC/C,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;SAC3C,CAAC;IACJ,CAAC;IAEO,4BAA4B,CAAC,GAAyB,EAAE,QAA8B;QAC5F,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;QAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAwD,CAAC;QAClF,MAAM,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACzD,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3E,CAAC,CAAC,OAAO,gBAAgB,KAAK,QAAQ;gBACpC,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACpD,CAAC,CAAC,KAAK,CAAC;QAEZ,IAAI,MAAM,KAAK,MAAM,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7G,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,2BAA2B,CACjC,GAAyB,EACzB,QAA8B;QAE9B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAC;QACzD,QAAQ,CAAC,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM,CAAC;QAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACrD,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;YAClE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAEO,0BAA0B,CAChC,GAAwB,EACxB,MAA0B;QAE1B,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAwB,EAAE,MAA0B;QACzE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QAC5D,GAAG,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;QACjF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEjC,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAClC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC5D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;gBAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;gBAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEhE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;oBACnC,KAAK;oBACL,MAAM;oBACN,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;iBAC5D,CAAC,CAAC;gBAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,YAAY,CAAC,GAAG,EAAE;oBAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3E,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;wBACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;4BACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBAClB,CAAC;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAEO,eAAe,CAAC,MAAoC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,MAA0B;QAC9C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,OAAO;aAClB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,GAAI,CAAC;IACrB,CAAC;CACF;AAjfD,oCAifC","sourcesContent":["import httpProxy from 'http-proxy';\nimport http from 'http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Supervisor } from '../supervisor/Supervisor';\nimport { nodeRuntimeHost } from './host/node/NodeRuntimeHost';\nimport type { RuntimeHost, RuntimeListenEndpoint } from './host/types';\nimport {\n  createGatewayAdminProxyHeaders,\n  GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER,\n  isLoopbackRemoteAddress,\n  stripGatewayAdminProxyHeaders,\n} from './GatewayAdminProxyAuth';\n\ntype InterceptedRequest = http.IncomingMessage & { __xpodInspectRootMutation?: boolean };\n\ninterface RootMutationForbiddenBody {\n  name: 'ForbiddenHttpError';\n  message: string;\n  statusCode: 403;\n  errorCode: 'H403';\n  details: { cause: 'root-container-write' };\n}\n\n// CORS configuration matching CSS CorsHandler defaults\nconst CORS_CONFIG = {\n  methods: ['GET', 'HEAD', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE'],\n  credentials: true,\n  allowedHeaders: [\n    'Authorization', 'Content-Type', 'Accept', 'DPoP', 'Origin',\n    'X-Requested-With', 'If-Match', 'If-None-Match', 'Slug', 'Link',\n  ],\n  exposedHeaders: [\n    'Accept-Patch', 'Accept-Post', 'Accept-Put', 'Allow', 'Content-Range',\n    'ETag', 'Last-Modified', 'Link', 'Location', 'Updates-Via',\n    'WAC-Allow', 'Www-Authenticate', 'X-Request-Id',\n  ],\n};\n\nexport class GatewayProxy {\n  private readonly logger = getLoggerFor(this);\n  private proxy: httpProxy;\n  private server: http.Server;\n  private targets: { css?: GatewayProxyTarget; api?: GatewayProxyTarget } = {};\n  private readonly runtimeHost: RuntimeHost;\n  private readonly listenEndpoint: RuntimeListenEndpoint;\n  private readonly exitOnStop: boolean;\n  private readonly shutdownHandler?: () => Promise<void>;\n  private readonly baseUrl?: string;\n  private readonly internalAdminAuthSecret?: string;\n  private readonly clientRemoteAddressResolver?: (req: http.IncomingMessage) => string | undefined;\n\n  constructor(\n    port: number | undefined,\n    private supervisor: Supervisor,\n    bindHost = '0.0.0.0',\n    options: GatewayProxyOptions = {},\n  ) {\n    this.runtimeHost = options.runtimeHost ?? nodeRuntimeHost;\n    this.listenEndpoint = options.listenEndpoint ?? this.runtimeHost.createListenEndpoint({\n      port,\n      host: bindHost,\n      socketPath: options.socketPath,\n    });\n    this.exitOnStop = options.exitOnStop ?? false;\n    this.shutdownHandler = options.shutdownHandler;\n    this.baseUrl = options.baseUrl;\n    this.internalAdminAuthSecret = options.internalAdminAuthSecret;\n    this.clientRemoteAddressResolver = options.clientRemoteAddressResolver;\n    this.proxy = httpProxy.createProxyServer({\n      xfwd: true,\n    });\n\n    this.proxy.on('error', (err, _req, res) => {\n      this.logger.error('Proxy error:', err);\n      if (res && 'writeHead' in res && !res.headersSent) {\n        res.writeHead(502, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Service Unavailable', details: err.message }));\n      }\n    });\n\n    this.proxy.on('proxyRes', (proxyRes, req, res) => {\n      this.normalizeProxiedCorsHeaders(req, proxyRes);\n      this.sanitizeProxyResponseHeaders(req, proxyRes);\n      const interceptedRequest = req as InterceptedRequest;\n      const outgoing = res as http.ServerResponse;\n      if (!interceptedRequest.__xpodInspectRootMutation || !outgoing || outgoing.headersSent) {\n        return;\n      }\n\n      const chunks: Buffer[] = [];\n      proxyRes.on('data', (chunk) => {\n        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n      });\n      proxyRes.on('end', () => {\n        const originalBody = Buffer.concat(chunks);\n        const rewritten = this.normalizeRootMutationProxyResponse(proxyRes, originalBody);\n        outgoing.writeHead(rewritten.statusCode, rewritten.headers);\n        outgoing.end(rewritten.body);\n      });\n    });\n\n    this.server = http.createServer(this.handleRequest.bind(this));\n\n    this.server.on('upgrade', (req, socket, head) => {\n      const url = req.url ?? '/';\n\n      // Route /ws/* WebSocket connections to API server\n      if (url.startsWith('/ws/') && this.targets.api) {\n        this.proxy.ws(req, socket, head, { target: this.toProxyTarget(this.targets.api) as any });\n      } else if (this.targets.css) {\n        this.proxy.ws(req, socket, head, { target: this.toProxyTarget(this.targets.css) as any });\n      } else {\n        socket.destroy();\n      }\n    });\n  }\n\n  public setTargets(targets: { css?: string | GatewayProxyTarget; api?: string | GatewayProxyTarget }): void {\n    this.targets = {\n      css: this.normalizeTarget(targets.css),\n      api: this.normalizeTarget(targets.api),\n    };\n  }\n\n  public async start(): Promise<void> {\n    await this.runtimeHost.listen(this.server, this.listenEndpoint);\n    this.logger.info(`Listening on ${this.runtimeHost.formatListenEndpoint(this.listenEndpoint)}`);\n  }\n\n  public stop(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      this.proxy.close();\n      this.runtimeHost.close(this.server, this.listenEndpoint).then(() => {\n        resolve();\n      }, reject);\n    });\n  }\n\n  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void {\n    const url = req.url ?? '/';\n    const origin = req.headers.origin;\n    const originalRemoteAddress = this.clientRemoteAddressResolver?.(req) ?? req.socket.remoteAddress;\n    const originalClientLoopback = isLoopbackRemoteAddress(originalRemoteAddress);\n    stripGatewayAdminProxyHeaders(req.headers);\n\n    // Store public host for routing before any CSS canonical-host rewrites.\n    // External gateways pass the original domain through X-Forwarded-Host;\n    // direct/local requests use Host.\n    const originalHost = this.firstHeaderValue(req.headers['x-forwarded-host']) ?? req.headers.host;\n    const apiHost = this.isApiHost(originalHost);\n\n    // Set x-forwarded-proto based on CSS_BASE_URL\n    const baseUrl = this.baseUrl ?? process.env.CSS_BASE_URL ?? '';\n    if (baseUrl.startsWith('https')) {\n      req.headers['x-forwarded-proto'] = 'https';\n    }\n\n    // API subdomains are the public API boundary. Preserve the API host for API\n    // handlers (for example Matrix discovery) instead of rewriting it to the\n    // canonical CSS/WebID host.\n    if (apiHost) {\n      if (originalHost) {\n        req.headers.host = originalHost;\n        req.headers['x-forwarded-host'] = originalHost;\n      }\n    } else if (baseUrl) {\n      try {\n        const parsedBaseUrl = new URL(baseUrl);\n        req.headers.host = parsedBaseUrl.host;\n        req.headers['x-forwarded-host'] = parsedBaseUrl.host;\n      } catch {\n        if (!req.headers['x-forwarded-host']) {\n          req.headers['x-forwarded-host'] = originalHost;\n        }\n      }\n    } else if (!req.headers['x-forwarded-host']) {\n      req.headers['x-forwarded-host'] = originalHost;\n    }\n\n    this.logger.debug(\n      `${req.method} ${url} x-forwarded-proto=${req.headers['x-forwarded-proto']} x-forwarded-host=${req.headers['x-forwarded-host']} host=${req.headers.host}`,\n    );\n\n    // 1. Internal service endpoints\n    if (url.startsWith('/service/')) {\n      if (req.method === 'OPTIONS') {\n        this.handleCorsPreflightRequest(res, origin);\n        return;\n      }\n      if (origin) {\n        this.addCorsHeaders(res, origin);\n      }\n      void this.handleInternalApi(req, res);\n      return;\n    }\n\n    // 2. API Server Routing.\n    // Public API is selected by host (`api.<domain>`), not by adding an `/api`\n    // path prefix to the IdP/Pod host. Path-based routing remains for local/dev\n    // single-origin clients and existing legacy endpoints.\n\n    // 2a. Xpod web products are served by the API server.\n    if (this.isApiWebProductPath(url) && this.targets.api) {\n      this.applyInternalAdminProxyHeaders(req, originalClientLoopback);\n      this.proxy.web(req, res, { target: this.toProxyTarget(this.targets.api) as any });\n      return;\n    }\n\n    if ((apiHost || this.shouldRouteToApi(url)) && this.targets.api) {\n      this.applyInternalAdminProxyHeaders(req, originalClientLoopback);\n      this.proxy.web(req, res, { target: this.toProxyTarget(this.targets.api) as any });\n      return;\n    }\n\n    // 3. CSS Routing (Default)\n    if (this.targets.css) {\n      if (this.shouldRejectRootResourceMutation(req)) {\n        this.writeRootMutationForbidden(res);\n        return;\n      }\n\n      const interceptedRequest = req as InterceptedRequest;\n      interceptedRequest.__xpodInspectRootMutation = this.shouldInspectRootMutation(req);\n      this.proxy.web(req, res, {\n        target: this.toProxyTarget(this.targets.css) as any,\n        ...(interceptedRequest.__xpodInspectRootMutation ? { selfHandleResponse: true } : {}),\n      } as any);\n    } else {\n      res.writeHead(503);\n      res.end('CSS Service Not Available');\n    }\n  }\n\n  private isApiWebProductPath(url: string): boolean {\n    return url === '/dashboard'\n      || url.startsWith('/dashboard/')\n      || url === '/settings'\n      || url.startsWith('/settings/');\n  }\n\n  private shouldRouteToApi(url: string): boolean {\n    return url.startsWith('/v1/')\n      || url.startsWith('/api/')\n      || url.startsWith('/provision/')\n      || url === '/.well-known/matrix/client'\n      || url.startsWith('/_matrix/');\n  }\n\n  private applyInternalAdminProxyHeaders(req: http.IncomingMessage, originalClientLoopback: boolean): void {\n    if (!this.internalAdminAuthSecret) {\n      req.headers[GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER] = originalClientLoopback ? '1' : '0';\n      return;\n    }\n    Object.assign(req.headers, createGatewayAdminProxyHeaders({\n      secret: this.internalAdminAuthSecret,\n      method: req.method,\n      url: req.url,\n      originalClientLoopback,\n    }));\n  }\n\n  private isApiHost(hostHeader: string | undefined): boolean {\n    const host = this.normalizeHost(hostHeader);\n    if (!host) {\n      return false;\n    }\n    if (host.startsWith('api.') || host.startsWith('registry.')) {\n      return true;\n    }\n\n    const configuredHosts = this.configuredApiHosts();\n    return configuredHosts.includes(host);\n  }\n\n  private configuredApiHosts(): string[] {\n    return [\n      process.env.XPOD_CLOUD_API_ENDPOINT,\n      process.env.XPOD_PUBLIC_API_URL,\n      process.env.XPOD_PUBLIC_REGISTRY_URL,\n    ]\n      .flatMap((value) => this.hostsFromUrlList(value))\n      .filter((host): host is string => Boolean(host));\n  }\n\n  private hostsFromUrlList(value: string | undefined): Array<string | undefined> {\n    if (!value) {\n      return [];\n    }\n    return value.split(',').map((entry) => this.hostFromUrl(entry.trim()));\n  }\n\n  private hostFromUrl(value: string | undefined): string | undefined {\n    if (!value) {\n      return undefined;\n    }\n    try {\n      return new URL(value).hostname.toLowerCase();\n    } catch {\n      return undefined;\n    }\n  }\n\n  private normalizeHost(hostHeader: string | undefined): string | undefined {\n    const host = this.firstHeaderValue(hostHeader)?.split(',')[0]?.trim();\n    if (!host) {\n      return undefined;\n    }\n    return host.replace(/:\\d+$/, '').toLowerCase();\n  }\n\n  private firstHeaderValue(value: string | string[] | undefined): string | undefined {\n    return Array.isArray(value) ? value[0] : value;\n  }\n\n  private shouldInspectRootMutation(req: http.IncomingMessage): boolean {\n    const method = (req.method ?? 'GET').toUpperCase();\n    if (![ 'POST', 'PUT', 'PATCH', 'DELETE' ].includes(method)) {\n      return false;\n    }\n\n    const pathname = new URL(req.url ?? '/', 'http://localhost').pathname;\n    const segments = pathname.split('/').filter(Boolean);\n    return segments.length === 1 && !segments[0].startsWith('.');\n  }\n\n  private shouldRejectRootResourceMutation(req: http.IncomingMessage): boolean {\n    const method = (req.method ?? 'GET').toUpperCase();\n    if (![ 'POST', 'PUT', 'PATCH', 'DELETE' ].includes(method)) {\n      return false;\n    }\n\n    const pathname = new URL(req.url ?? '/', 'http://localhost').pathname;\n    const segments = pathname.split('/').filter(Boolean);\n    return segments.length === 1 && !segments[0].startsWith('.') && !pathname.endsWith('/');\n  }\n\n  private writeRootMutationForbidden(res: http.ServerResponse): void {\n    const body = Buffer.from(JSON.stringify(this.createRootMutationForbiddenBody()));\n    res.writeHead(403, {\n      'Content-Type': 'application/json',\n      'Content-Length': String(body.byteLength),\n    });\n    res.end(body);\n  }\n\n  private normalizeRootMutationProxyResponse(\n    proxyRes: http.IncomingMessage,\n    body: Buffer,\n  ): { statusCode: number; headers: http.OutgoingHttpHeaders; body: Buffer } {\n    const headers: http.OutgoingHttpHeaders = { ...proxyRes.headers };\n    const statusCode = proxyRes.statusCode ?? 500;\n    const contentType = typeof proxyRes.headers['content-type'] === 'string'\n      ? proxyRes.headers['content-type']\n      : Array.isArray(proxyRes.headers['content-type'])\n        ? proxyRes.headers['content-type'][0] ?? ''\n        : '';\n    const bodyText = contentType.includes('application/json') ? body.toString('utf8') : '';\n\n    if (\n      statusCode === 500 &&\n      bodyText.includes('Cannot obtain the parent of') &&\n      bodyText.includes('because it is a root container')\n    ) {\n      const normalizedBody = Buffer.from(JSON.stringify(this.createRootMutationForbiddenBody()));\n      delete headers['content-length'];\n      delete headers['transfer-encoding'];\n      headers['content-type'] = 'application/json';\n      headers['content-length'] = String(normalizedBody.byteLength);\n      return { statusCode: 403, headers, body: normalizedBody };\n    }\n\n    delete headers['transfer-encoding'];\n    headers['content-length'] = String(body.byteLength);\n    return { statusCode, headers, body };\n  }\n\n  private createRootMutationForbiddenBody(): RootMutationForbiddenBody {\n    return {\n      name: 'ForbiddenHttpError',\n      message: 'Write to server root is not allowed.',\n      statusCode: 403,\n      errorCode: 'H403',\n      details: { cause: 'root-container-write' },\n    };\n  }\n\n  private sanitizeProxyResponseHeaders(req: http.IncomingMessage, proxyRes: http.IncomingMessage): void {\n    const method = (req.method ?? 'GET').toUpperCase();\n    const statusCode = proxyRes.statusCode ?? 200;\n    const headers = proxyRes.headers as Record<string, string | string[] | undefined>;\n    const transferEncoding = headers['transfer-encoding'];\n    const hasTransferEncoding = Array.isArray(transferEncoding)\n      ? transferEncoding.some((value) => value.toLowerCase().includes('chunked'))\n      : typeof transferEncoding === 'string'\n        ? transferEncoding.toLowerCase().includes('chunked')\n        : false;\n\n    if (method === 'HEAD' || statusCode === 204 || statusCode === 304 || (statusCode >= 100 && statusCode < 200)) {\n      delete headers['transfer-encoding'];\n      return;\n    }\n\n    if (hasTransferEncoding) {\n      delete headers['transfer-encoding'];\n      if (headers['content-length'] !== undefined) {\n        delete headers['content-length'];\n      }\n    }\n  }\n\n  private normalizeProxiedCorsHeaders(\n    req: http.IncomingMessage,\n    proxyRes: http.IncomingMessage,\n  ): void {\n    const origin = req.headers.origin;\n    if (!origin) {\n      return;\n    }\n    proxyRes.headers['access-control-allow-origin'] = origin;\n    proxyRes.headers['access-control-allow-credentials'] = 'true';\n    const vary = proxyRes.headers.vary;\n    const varyValues = (Array.isArray(vary) ? vary : [vary])\n      .flatMap((value) => value?.split(',') ?? [])\n      .map((value) => value.trim())\n      .filter(Boolean);\n    if (!varyValues.some((value) => value.toLowerCase() === 'origin')) {\n      varyValues.push('Origin');\n    }\n    proxyRes.headers.vary = varyValues.join(', ');\n  }\n\n  private handleCorsPreflightRequest(\n    res: http.ServerResponse,\n    origin: string | undefined,\n  ): void {\n    this.addCorsHeaders(res, origin);\n    res.writeHead(204);\n    res.end();\n  }\n\n  /**\n   * Add CORS headers matching CSS CorsHandler configuration\n   */\n  private addCorsHeaders(res: http.ServerResponse, origin: string | undefined): void {\n    res.setHeader('Access-Control-Allow-Origin', origin || '*');\n    res.setHeader('Access-Control-Allow-Credentials', String(CORS_CONFIG.credentials));\n    res.setHeader('Access-Control-Allow-Methods', CORS_CONFIG.methods.join(', '));\n    res.setHeader('Access-Control-Allow-Headers', CORS_CONFIG.allowedHeaders.join(', '));\n    res.setHeader('Access-Control-Expose-Headers', CORS_CONFIG.exposedHeaders.join(', '));\n  }\n\n  private async handleInternalApi(req: http.IncomingMessage, res: http.ServerResponse): Promise<void> {\n    try {\n      const reqUrl = req.url ?? '/';\n      const parsed = new URL(reqUrl, 'http://localhost');\n      const pathname = parsed.pathname;\n\n      if (pathname === '/service/status') {\n        const status = this.supervisor.getAllStatus();\n        const cssReady = await this.isCssReady();\n        const code = cssReady ? 200 : 503;\n        res.writeHead(code, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify(status));\n        return;\n      }\n\n      if (pathname === '/service/logs') {\n        const level = parsed.searchParams.get('level') ?? undefined;\n        const source = parsed.searchParams.get('source') ?? undefined;\n        const limitValue = parsed.searchParams.get('limit');\n        const limit = limitValue ? parseInt(limitValue, 10) : undefined;\n\n        const logs = this.supervisor.getLogs({\n          level,\n          source,\n          limit: Number.isFinite(limit as number) ? limit : undefined,\n        });\n\n        res.writeHead(200, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify(logs));\n        return;\n      }\n\n      if (pathname === '/service/stop' && req.method === 'POST') {\n        res.writeHead(200, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ ok: true }));\n        setImmediate(() => {\n          const shutdown = this.shutdownHandler ?? (() => this.supervisor.stopAll());\n          void shutdown().then(() => {\n            if (this.exitOnStop) {\n              process.exit(0);\n            }\n          });\n        });\n        return;\n      }\n\n      res.writeHead(404);\n      res.end('Not Found');\n    } catch (error) {\n      this.logger.error('Internal service endpoint failed:', error);\n      if (!res.headersSent) {\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n      }\n      res.end(JSON.stringify({ error: 'Internal Server Error' }));\n    }\n  }\n\n  private async isCssReady(): Promise<boolean> {\n    if (!this.targets.css) {\n      return true;\n    }\n\n    return this.runtimeHost.isConnectionTargetReady(this.targets.css, 1_500);\n  }\n\n  private normalizeTarget(target?: string | GatewayProxyTarget): GatewayProxyTarget | undefined {\n    if (!target) {\n      return undefined;\n    }\n    if (typeof target === 'string') {\n      return { url: target };\n    }\n    return target;\n  }\n\n  private toProxyTarget(target: GatewayProxyTarget): string | { socketPath: string; protocol: string } {\n    if (target.socketPath) {\n      return {\n        socketPath: target.socketPath,\n        protocol: 'http:',\n      };\n    }\n    return target.url!;\n  }\n}\n\nexport interface GatewayProxyTarget {\n  url?: string;\n  socketPath?: string;\n}\n\nexport interface GatewayProxyOptions {\n  socketPath?: string;\n  listenEndpoint?: RuntimeListenEndpoint;\n  runtimeHost?: RuntimeHost;\n  exitOnStop?: boolean;\n  shutdownHandler?: () => Promise<void>;\n  baseUrl?: string;\n  internalAdminAuthSecret?: string;\n  clientRemoteAddressResolver?: (req: http.IncomingMessage) => string | undefined;\n}\n"]}

package/dist/runtime/XpodRuntime.js

@@ -72,6 +72,7 @@ async function startXpodRuntime(options = {}) {
             supervisor,
             shutdownHandler: stop,
             gatewayRunner,
+            clientRemoteAddressResolver: options.gatewayClientRemoteAddressResolver,
         });
         environment.restore();
         return {

package/dist/runtime/XpodRuntime.js.map

@@ -1 +1 @@
-{"version":3,"file":"XpodRuntime.js","sourceRoot":"","sources":["../../src/runtime/XpodRuntime.ts"],"names":[],"mappings":";;AAoBA,4CAmGC;AAvHD,iEAAqD;AACrD,+CAAqE;AACrE,yDAAsD;AACtD,2CAIqB;AACrB,uEAAoE;AACpE,+CAAgE;AAChE,2CAOqB;AAGd,KAAK,UAAU,gBAAgB,CAAC,UAA8B,EAAE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,qCAAiB,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;IACxD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;IACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAA,mCAAuB,EAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEzE,IAAA,6BAAiB,EAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,oCAAY,EAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAA,6CAA+B,EAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE9E,MAAM,uBAAuB,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ;QAC1D,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAQ,CAAC;QACnE,CAAC,CAAC,KAAK,IAAkB,EAAE,CAAC,SAAS,CAAC;IAExC,MAAM,UAAU,GAAG,IAAI,uBAAU,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAsC,CAAC;IAE3C,MAAM,IAAI,GAAG,KAAK,IAAkB,EAAE;QACpC,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,WAAW,GAAG,CAAC,KAAK,IAAG,EAAE;YACvB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YAEf,MAAM,IAAA,+BAAmB,EAAC;gBACxB,QAAQ;gBACR,UAAU;gBACV,MAAM;gBACN,IAAI;gBACJ,KAAK;gBACL,uBAAuB;gBACvB,wBAAwB,EAAE,gCAA2B;gBACrD,iBAAiB,EAAE,WAAW,CAAC,OAAO;aACvC,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,IAAA,0CAA8B,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,QAAQ,CAAC,MAAM,GAAG,MAAM,IAAA,2BAAe,EAAC;YACtC,KAAK;YACL,IAAI;YACJ,gBAAgB,EAAE,WAAW,CAAC,SAAS;YACvC,UAAU;YACV,sBAAsB,EAAtB,kCAAsB;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,QAAQ,CAAC,UAAU,GAAG,MAAM,IAAA,2BAAe,EAAC;YAC1C,KAAK;YACL,IAAI;YACJ,UAAU;YACV,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS;SACV,CAAC,CAAC;QAEH,QAAQ,CAAC,OAAO,GAAG,MAAM,IAAA,+BAAmB,EAAC;YAC3C,KAAK;YACL,IAAI;YACJ,UAAU;YACV,eAAe,EAAE,IAAI;YACrB,aAAa;SACd,CAAC,CAAC;QACH,WAAW,CAAC,OAAO,EAAE,CAAC;QAEtB,OAAO;YACL,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,EAAC,KAA6B,EAAE,IAAkB,EAAqB,EAAE;gBACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;oBACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC;gBACD,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,IAAI;SACL,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport { closeAllIdentityConnections } from '../identity/drizzle/db';\nimport { Supervisor } from '../supervisor/Supervisor';\nimport {\n  createCssRuntimeConfig,\n  initRuntimeLogger,\n  resolveRuntimeBootstrap,\n} from './bootstrap';\nimport { nodeRuntimeDriver } from './driver/node/NodeRuntimeDriver';\nimport { createRuntimeEnvironmentSession } from './environment';\nimport {\n  registerManagedRuntimeServices,\n  startApiRuntime,\n  startCssRuntime,\n  startGatewayRuntime,\n  stopRuntimeServices,\n  type RuntimeServices,\n} from './lifecycle';\nimport type { XpodRuntimeHandle, XpodRuntimeOptions } from './runtime-types';\n\nexport async function startXpodRuntime(options: XpodRuntimeOptions = {}): Promise<XpodRuntimeHandle> {\n  const driver = options.driver ?? nodeRuntimeDriver;\n  const host = options.host ?? driver.host;\n  const platform = options.platform ?? driver.platform;\n  const cssRunner = options.cssRunner ?? driver.cssRunner;\n  const apiRunner = options.apiRunner ?? driver.apiRunner;\n  const gatewayRunner = options.gatewayRunner ?? driver.gatewayRunner;\n  const id = platform.createRuntimeId();\n  const state = await resolveRuntimeBootstrap(id, options, host, platform);\n\n  initRuntimeLogger(state.logLevel, platform);\n  const logger = getLoggerFor('XpodRuntime');\n  const environment = createRuntimeEnvironmentSession(state, options, platform);\n\n  const unregisterSocketOrigins = state.transport === 'socket'\n    ? host.registerSocketOrigins(state.baseUrl, state.sockets.gateway!)\n    : async(): Promise<void> => undefined;\n\n  const supervisor = new Supervisor({ handleProcessSignals: false });\n  const services: RuntimeServices = {};\n  let stopped = false;\n  let stopPromise: Promise<void> | undefined;\n\n  const stop = async(): Promise<void> => {\n    if (stopPromise) {\n      return stopPromise;\n    }\n\n    stopPromise = (async() => {\n      if (stopped) {\n        return;\n      }\n      stopped = true;\n\n      await stopRuntimeServices({\n        services,\n        supervisor,\n        logger,\n        host,\n        state,\n        unregisterSocketOrigins,\n        closeIdentityConnections: closeAllIdentityConnections,\n        restoreRuntimeEnv: environment.restore,\n      });\n    })();\n\n    return stopPromise;\n  };\n\n  registerManagedRuntimeServices(supervisor, services);\n\n  try {\n    services.cssApp = await startCssRuntime({\n      state,\n      host,\n      runtimeShorthand: environment.shorthand,\n      supervisor,\n      createCssRuntimeConfig,\n      cssRunner,\n    });\n\n    services.apiService = await startApiRuntime({\n      state,\n      host,\n      supervisor,\n      authContext: options.authContext,\n      apiRunner,\n    });\n\n    services.gateway = await startGatewayRuntime({\n      state,\n      host,\n      supervisor,\n      shutdownHandler: stop,\n      gatewayRunner,\n    });\n    environment.restore();\n\n    return {\n      id,\n      mode: state.mode,\n      transport: state.transport,\n      baseUrl: state.baseUrl,\n      supervisor,\n      ports: state.ports,\n      sockets: state.sockets,\n      fetch: async(input: string | URL | Request, init?: RequestInit): Promise<Response> => {\n        if (typeof input === 'string' || input instanceof URL) {\n          return platform.fetch(new URL(String(input), state.baseUrl), init);\n        }\n        return platform.fetch(input, init);\n      },\n      stop,\n    };\n  } catch (error) {\n    environment.restore();\n    await stop();\n    throw error;\n  }\n}\n\nexport type { XpodRuntimeHandle, XpodRuntimeOptions } from './runtime-types';\n"]}
+{"version":3,"file":"XpodRuntime.js","sourceRoot":"","sources":["../../src/runtime/XpodRuntime.ts"],"names":[],"mappings":";;AAoBA,4CAoGC;AAxHD,iEAAqD;AACrD,+CAAqE;AACrE,yDAAsD;AACtD,2CAIqB;AACrB,uEAAoE;AACpE,+CAAgE;AAChE,2CAOqB;AAGd,KAAK,UAAU,gBAAgB,CAAC,UAA8B,EAAE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,qCAAiB,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;IACxD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;IACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAA,mCAAuB,EAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEzE,IAAA,6BAAiB,EAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,oCAAY,EAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAA,6CAA+B,EAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE9E,MAAM,uBAAuB,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ;QAC1D,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAQ,CAAC;QACnE,CAAC,CAAC,KAAK,IAAkB,EAAE,CAAC,SAAS,CAAC;IAExC,MAAM,UAAU,GAAG,IAAI,uBAAU,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAsC,CAAC;IAE3C,MAAM,IAAI,GAAG,KAAK,IAAkB,EAAE;QACpC,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,WAAW,GAAG,CAAC,KAAK,IAAG,EAAE;YACvB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YAEf,MAAM,IAAA,+BAAmB,EAAC;gBACxB,QAAQ;gBACR,UAAU;gBACV,MAAM;gBACN,IAAI;gBACJ,KAAK;gBACL,uBAAuB;gBACvB,wBAAwB,EAAE,gCAA2B;gBACrD,iBAAiB,EAAE,WAAW,CAAC,OAAO;aACvC,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,IAAA,0CAA8B,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,QAAQ,CAAC,MAAM,GAAG,MAAM,IAAA,2BAAe,EAAC;YACtC,KAAK;YACL,IAAI;YACJ,gBAAgB,EAAE,WAAW,CAAC,SAAS;YACvC,UAAU;YACV,sBAAsB,EAAtB,kCAAsB;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,QAAQ,CAAC,UAAU,GAAG,MAAM,IAAA,2BAAe,EAAC;YAC1C,KAAK;YACL,IAAI;YACJ,UAAU;YACV,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS;SACV,CAAC,CAAC;QAEH,QAAQ,CAAC,OAAO,GAAG,MAAM,IAAA,+BAAmB,EAAC;YAC3C,KAAK;YACL,IAAI;YACJ,UAAU;YACV,eAAe,EAAE,IAAI;YACrB,aAAa;YACb,2BAA2B,EAAE,OAAO,CAAC,kCAAkC;SACxE,CAAC,CAAC;QACH,WAAW,CAAC,OAAO,EAAE,CAAC;QAEtB,OAAO;YACL,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,EAAC,KAA6B,EAAE,IAAkB,EAAqB,EAAE;gBACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;oBACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC;gBACD,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,IAAI;SACL,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport { closeAllIdentityConnections } from '../identity/drizzle/db';\nimport { Supervisor } from '../supervisor/Supervisor';\nimport {\n  createCssRuntimeConfig,\n  initRuntimeLogger,\n  resolveRuntimeBootstrap,\n} from './bootstrap';\nimport { nodeRuntimeDriver } from './driver/node/NodeRuntimeDriver';\nimport { createRuntimeEnvironmentSession } from './environment';\nimport {\n  registerManagedRuntimeServices,\n  startApiRuntime,\n  startCssRuntime,\n  startGatewayRuntime,\n  stopRuntimeServices,\n  type RuntimeServices,\n} from './lifecycle';\nimport type { XpodRuntimeHandle, XpodRuntimeOptions } from './runtime-types';\n\nexport async function startXpodRuntime(options: XpodRuntimeOptions = {}): Promise<XpodRuntimeHandle> {\n  const driver = options.driver ?? nodeRuntimeDriver;\n  const host = options.host ?? driver.host;\n  const platform = options.platform ?? driver.platform;\n  const cssRunner = options.cssRunner ?? driver.cssRunner;\n  const apiRunner = options.apiRunner ?? driver.apiRunner;\n  const gatewayRunner = options.gatewayRunner ?? driver.gatewayRunner;\n  const id = platform.createRuntimeId();\n  const state = await resolveRuntimeBootstrap(id, options, host, platform);\n\n  initRuntimeLogger(state.logLevel, platform);\n  const logger = getLoggerFor('XpodRuntime');\n  const environment = createRuntimeEnvironmentSession(state, options, platform);\n\n  const unregisterSocketOrigins = state.transport === 'socket'\n    ? host.registerSocketOrigins(state.baseUrl, state.sockets.gateway!)\n    : async(): Promise<void> => undefined;\n\n  const supervisor = new Supervisor({ handleProcessSignals: false });\n  const services: RuntimeServices = {};\n  let stopped = false;\n  let stopPromise: Promise<void> | undefined;\n\n  const stop = async(): Promise<void> => {\n    if (stopPromise) {\n      return stopPromise;\n    }\n\n    stopPromise = (async() => {\n      if (stopped) {\n        return;\n      }\n      stopped = true;\n\n      await stopRuntimeServices({\n        services,\n        supervisor,\n        logger,\n        host,\n        state,\n        unregisterSocketOrigins,\n        closeIdentityConnections: closeAllIdentityConnections,\n        restoreRuntimeEnv: environment.restore,\n      });\n    })();\n\n    return stopPromise;\n  };\n\n  registerManagedRuntimeServices(supervisor, services);\n\n  try {\n    services.cssApp = await startCssRuntime({\n      state,\n      host,\n      runtimeShorthand: environment.shorthand,\n      supervisor,\n      createCssRuntimeConfig,\n      cssRunner,\n    });\n\n    services.apiService = await startApiRuntime({\n      state,\n      host,\n      supervisor,\n      authContext: options.authContext,\n      apiRunner,\n    });\n\n    services.gateway = await startGatewayRuntime({\n      state,\n      host,\n      supervisor,\n      shutdownHandler: stop,\n      gatewayRunner,\n      clientRemoteAddressResolver: options.gatewayClientRemoteAddressResolver,\n    });\n    environment.restore();\n\n    return {\n      id,\n      mode: state.mode,\n      transport: state.transport,\n      baseUrl: state.baseUrl,\n      supervisor,\n      ports: state.ports,\n      sockets: state.sockets,\n      fetch: async(input: string | URL | Request, init?: RequestInit): Promise<Response> => {\n        if (typeof input === 'string' || input instanceof URL) {\n          return platform.fetch(new URL(String(input), state.baseUrl), init);\n        }\n        return platform.fetch(input, init);\n      },\n      stop,\n    };\n  } catch (error) {\n    environment.restore();\n    await stop();\n    throw error;\n  }\n}\n\nexport type { XpodRuntimeHandle, XpodRuntimeOptions } from './runtime-types';\n"]}

package/dist/runtime/bootstrap.d.ts

@@ -16,6 +16,7 @@ export interface RuntimeBootstrapState {
     usageDbUrl: string;
     cssAuthMode: AuthMode;
     apiOpen: boolean;
+    gatewayAdminProxyAuthSecret: string;
     logLevel: string;
     baseUrl: string;
     envFilePath?: string;

package/dist/runtime/bootstrap.js

@@ -20,6 +20,7 @@ const env_utils_1 = require("./env-utils");
 const AuthMode_1 = require("../authorization/AuthMode");
 const component_parameter_keys_1 = require("./component-parameter-keys");
 const config_asset_paths_1 = require("./config-asset-paths");
+const GatewayAdminProxyAuth_1 = require("./GatewayAdminProxyAuth");
 const CSS_CONFIG_BASE = 'https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/config/';
 const XPOD_CONFIG_BASE = 'https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/config/';
 const CSS_COMPONENTS_CONTEXT = 'https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld';
@@ -127,6 +128,7 @@ async function resolveRuntimeBootstrap(id, options, host, platform = NodeRuntime
     };
     const cssAuthMode = options.open ? 'allow-all' : (0, AuthMode_1.resolveAuthModeInput)(options.authMode, authModeEnv);
     const apiOpen = options.apiOpen ?? options.open ?? false;
+    const gatewayAdminProxyAuthSecret = (0, GatewayAdminProxyAuth_1.createGatewayAdminProxyAuthSecret)();
     const logLevel = options.logLevel ?? platform.getEnv('CSS_LOGGING_LEVEL') ?? 'warn';
     platform.ensureDir(runtimeRoot);
     platform.ensureDir(rootFilePath);
@@ -165,6 +167,7 @@ async function resolveRuntimeBootstrap(id, options, host, platform = NodeRuntime
         usageDbUrl,
         cssAuthMode,
         apiOpen,
+        gatewayAdminProxyAuthSecret,
         logLevel,
         baseUrl,
         envFilePath,
@@ -197,6 +200,21 @@ function buildRuntimeEnv(state, options, envFromFile = {}) {
         API_HOST: state.bindHost,
         API_SOCKET_PATH: state.sockets.api,
         XPOD_MAIN_PORT: state.ports.gateway !== undefined ? String(state.ports.gateway) : undefined,
+        XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET: state.gatewayAdminProxyAuthSecret,
+        // Auto-provision may write these during API startup. Include them even when
+        // undefined so RuntimeEnvironmentSession can restore/clear them afterwards.
+        XPOD_NODE_ID: mergedEnv.XPOD_NODE_ID,
+        XPOD_NODE_TOKEN: mergedEnv.XPOD_NODE_TOKEN,
+        XPOD_SERVICE_TOKEN: mergedEnv.XPOD_SERVICE_TOKEN,
+        XPOD_PROVISION_CODE: mergedEnv.XPOD_PROVISION_CODE,
+        XPOD_PROVISION_URL: mergedEnv.XPOD_PROVISION_URL,
+        XPOD_SP_DOMAIN: mergedEnv.XPOD_SP_DOMAIN,
+        XPOD_PUBLIC_URL: mergedEnv.XPOD_PUBLIC_URL,
+        XPOD_LOCAL_SETUP_PATH: mergedEnv.XPOD_LOCAL_SETUP_PATH,
+        XPOD_PROVIDER_ID: mergedEnv.XPOD_PROVIDER_ID,
+        XPOD_CLOUD_API_ENDPOINT: mergedEnv.XPOD_CLOUD_API_ENDPOINT,
+        XPOD_LOCAL_AUTO_PROVISION: mergedEnv.XPOD_LOCAL_AUTO_PROVISION,
+        XPOD_LOCAL_AUTO_PROVISION_TIMEOUT_MS: mergedEnv.XPOD_LOCAL_AUTO_PROVISION_TIMEOUT_MS,
         CORS_ORIGINS: new URL(state.baseUrl).origin,
         CSS_LOGGING_LEVEL: state.logLevel,
     };
@@ -233,6 +251,17 @@ function buildRuntimeShorthand(runtimeEnv, options, state, baseEnv = NodeRuntime
             ['p2pAcceptIntervalMs', envValue('XPOD_P2P_ACCEPT_INTERVAL_MS')],
             ['p2pConnectTimeoutMs', envValue('XPOD_P2P_CONNECT_TIMEOUT_MS')],
             ['p2pWinnerSelectionWindowMs', envValue('XPOD_P2P_WINNER_SELECTION_WINDOW_MS')],
+            ['acmeMode', envValue('XPOD_ACME_MODE')],
+            ['acmeEmail', envValue('XPOD_ACME_EMAIL')],
+            ['acmeDomains', envValue('XPOD_ACME_DOMAINS')],
+            ['acmeDirectoryUrl', envValue('XPOD_ACME_DIRECTORY_URL')],
+            ['acmeAccountKeyPath', envValue('XPOD_ACME_ACCOUNT_KEY_PATH')],
+            ['acmeCertificateKeyPath', envValue('XPOD_ACME_CERTIFICATE_KEY_PATH')],
+            ['acmeCertificatePath', envValue('XPOD_ACME_CERTIFICATE_PATH')],
+            ['acmeFullChainPath', envValue('XPOD_ACME_FULL_CHAIN_PATH')],
+            ['acmeRenewBeforeDays', envValue('XPOD_ACME_RENEW_BEFORE_DAYS')],
+            ['acmePropagationDelayMs', envValue('XPOD_ACME_DNS_PROPAGATION_DELAY_MS')],
+            ['acmePostDeployCommand', envValue('XPOD_ACME_POST_DEPLOY_COMMAND')],
             ['serviceToken', envValue('XPOD_SERVICE_TOKEN')],
         ]),
         baseUrl: state.baseUrl,