@withbuddi/buddi 0.1.0-pre.26 → 0.1.0-pre.28

package/packages/gateway/dist/web/sessions.d.ts

@@ -90,23 +90,80 @@ export interface Session {
     /** When the browser was last handed this cookie. Drives the refresh rule. */
     cookieIssuedAt: Date;
 }
+/**
+ * What the table stores in place of a session id: sha256, hex.
+ *
+ * A plain hash is enough because the id is 256 random bits — there is nothing
+ * to guess, so nothing a slow hash would slow down.
+ */
+export declare function sessionIdHash(sessionId: string): string;
+/**
+ * The CSRF value for a session, derived from its id.
+ *
+ * Derived rather than random so it never has to be stored: after a restart the
+ * request presents the session id, and the CSRF value it must also echo is
+ * recomputed from it. HMAC keyed by the id is one-way — the page can read the
+ * CSRF cookie, and that reveals nothing about the HttpOnly id — and another
+ * site still cannot read either cookie, which is all double-submit asks of it.
+ */
+export declare function csrfFor(sessionId: string): string;
+/** Just enough of `pg.Pool` for the session table. */
+export interface SessionDb {
+    query: (sql: string, params?: unknown[]) => Promise<{
+        rows: unknown[];
+    }>;
+}
+/**
+ * A session as `forget` offers it: the stored fields, and the id only when this
+ * process has seen the cookie (a row read back from the table has no id to give).
+ */
+export type SessionRecord = Omit<Session, 'id' | 'csrf'> & {
+    id?: string;
+};
+export interface SessionStoreOptions {
+    /** The database the sessions are kept in. Without one they live in memory only. */
+    db?: SessionDb | undefined;
+    log?: ((line: string) => void) | undefined;
+}
+/**
+ * The longest the stored idle edge may lag the live one.
+ *
+ * Sliding the in-memory expiry is free and happens on every request; writing
+ * it back is a database round trip, so it is done at most this often per
+ * session (or a tenth of the idle lifetime, when that is shorter). A restart
+ * can therefore cost a session at most this much of its idle lifetime, never
+ * extend it.
+ */
+export declare const SESSION_WRITE_EVERY_MS: number;
+/** How often expired rows are swept from the table. */
+export declare const SESSION_SWEEP_EVERY_MS: number;
 export declare class SessionStore {
     #private;
-    constructor(ttlMs?: Partial<Record<SessionScope, number>>, tailscaleMaxMs?: number);
+    constructor(ttlMs?: Partial<Record<SessionScope, number>>, tailscaleMaxMs?: number, options?: SessionStoreOptions);
     /** The idle lifetime a session established from `scope` gets. */
     ttlFor(scope: SessionScope): number;
-    create(scope: SessionScope, now?: Date, provenance?: SessionProvenance): Session;
     /**
-     * Forget every session matching this, and say how many went.
+     * A new session. Stored unless `persist` is false — which is how the open
+     * loopback gate mints its silent sessions: one is minted again for free on
+     * the next request, so there is nothing to keep across a restart, and a
+     * cookie-less local poller must not add a row per request.
+     */
+    create(scope: SessionScope, now?: Date, provenance?: SessionProvenance, options?: {
+        persist?: boolean;
+    }): Session;
+    /**
+     * Forget every session matching this — in memory and in the table — and say
+     * how many went.
      *
      * What the setting page uses to revoke the sessions an identity earned the
      * moment that identity stops being allowed one: turning the switch off, or
      * naming a different login, empties the tailnet's access immediately rather
-     * than at the next request that happens to be made.
+     * than at the next request that happens to be made. Rows this process never
+     * saw a cookie for are offered without an `id`.
      */
-    forget(matches: (session: Session) => boolean): number;
+    forget(matches: (session: SessionRecord) => boolean): Promise<number>;
     /**
-     * The live session for this cookie, sliding its expiry.
+     * The live session for this cookie, from memory only, sliding its expiry.
      *
      * `scope` is where *this request* came from, and it must match where the
      * session was established. A cookie minted on loopback is not honoured when
@@ -114,8 +171,19 @@ export declare class SessionStore {
      * this machine rather than a credential that got a longer life by accident.
      * (A browser will not send it across hosts in the first place; this is the
      * belt to that suspenders.)
+     *
+     * The server asks `resolve`, which reads through to the table on a miss.
      */
     get(sessionId: string | undefined, scope: SessionScope, now?: Date): Session | undefined;
+    /**
+     * `get`, reading through to the table when this process has not seen the
+     * cookie yet — after a restart, every session starts here.
+     *
+     * A row is honoured on exactly the terms a cached session is: past its idle
+     * edge or its absolute one it is deleted and refused, and its scope must
+     * match. A database that cannot be read is a miss, never an error page.
+     */
+    resolve(sessionId: string | undefined, scope: SessionScope, now?: Date): Promise<Session | undefined>;
     /**
      * Should this response carry a fresh cookie? Mutating: a `true` answer marks
      * the cookie as issued now, so the caller must actually send it.
@@ -125,7 +193,13 @@ export declare class SessionStore {
     static maxAgeSeconds(session: Session): number;
     /** Constant-time double-submit check. */
     static csrfMatches(session: Session, presented: string | undefined): boolean;
-    destroy(sessionId: string | undefined): void;
+    /**
+     * End this session, in memory at once and in the table before the returned
+     * promise settles. Callers that revoke for a reason await it.
+     */
+    destroy(sessionId: string | undefined): Promise<void>;
+    /** Every table operation queued so far has settled. A test seam. */
+    flush(): Promise<void>;
     get size(): number;
 }
 /**

package/packages/gateway/dist/web/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/web/sessions.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,QAAwB,CAAC;AAC1D,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAuB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE1D,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,UAAU,CAAC;IAChB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAGjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,EAAE,YAAY,CAAC;IACpB,yEAAyE;IACzE,GAAG,EAAE,UAAU,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACzB,6EAA6E;IAC7E,cAAc,EAAE,IAAI,CAAC;CACtB;AAYD,qBAAa,YAAY;;gBAKX,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAM,EAAE,cAAc,GAAE,MAAiC;IAKhH,iEAAiE;IACjE,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM;IAInC,MAAM,CACJ,KAAK,EAAE,YAAY,EACnB,GAAG,GAAE,IAAiB,EACtB,UAAU,GAAE,iBAAmE,GAC9E,OAAO;IAqBV;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,MAAM;IAWtD;;;;;;;;;OASG;IACH,GAAG,CACD,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,YAAY,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,GAAG,SAAS;IAatB;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO;IAO9D,8DAA8D;IAC9D,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM;IAI9C,yCAAyC;IACzC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAI5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAI5C,IAAI,IAAI,IAAI,MAAM,CAEjB;CAaF;AAED;;;;GAIG;AACH,qBAAa,WAAW;;gBAKV,GAAG,GAAE,MAA0B,EAAE,QAAQ,GAAE,MAAuB;IAK9E,4EAA4E;IAC5E,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO;IAMrD,2EAA2E;IAC3E,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,IAAI;IAS/C,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQxB;;;;;;OAMG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,IAAI;CAW9E"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/web/sessions.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,QAAwB,CAAC;AAC1D,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAuB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE1D,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,UAAU,CAAC;IAChB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAGjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,KAAK,EAAE,YAAY,CAAC;IACpB,yEAAyE;IACzE,GAAG,EAAE,UAAU,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACzB,6EAA6E;IAC7E,cAAc,EAAE,IAAI,CAAC;CACtB;AAYD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3E,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAa,CAAC;AAEjD,uDAAuD;AACvD,eAAO,MAAM,sBAAsB,QAAc,CAAC;AA2BlD,qBAAa,YAAY;;gBAgBrB,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAM,EACjD,cAAc,GAAE,MAAiC,EACjD,OAAO,GAAE,mBAAwB;IAQnC,iEAAiE;IACjE,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM;IAInC;;;;;OAKG;IACH,MAAM,CACJ,KAAK,EAAE,YAAY,EACnB,GAAG,GAAE,IAAiB,EACtB,UAAU,GAAE,iBAAmE,EAC/E,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO;IAmCV;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA0B3E;;;;;;;;;;;OAWG;IACH,GAAG,CACD,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,YAAY,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,GAAG,SAAS;IAgBtB;;;;;;;OAOG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,YAAY,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAmB/B;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO;IAO9D,8DAA8D;IAC9D,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM;IAI9C,yCAAyC;IACzC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAI5E;;;OAGG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAc3D,oEAAoE;IAC9D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,IAAI,IAAI,IAAI,MAAM,CAEjB;CAwFF;AAED;;;;GAIG;AACH,qBAAa,WAAW;;gBAKV,GAAG,GAAE,MAA0B,EAAE,QAAQ,GAAE,MAAuB;IAK9E,4EAA4E;IAC5E,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO;IAMrD,2EAA2E;IAC3E,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,IAAI;IAS/C,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQxB;;;;;;OAMG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,IAAI;CAW9E"}

package/packages/gateway/dist/web/sessions.js

@@ -1,12 +1,14 @@
 /**
  * Sessions, CSRF tokens, spent tickets and the auth rate limit.
  *
- * All four are in-process and deliberately so: a dashboard session is not a
- * durable fact about the installation, and a restart logging the owner out is
- * the correct behaviour for a page that can approve an effect. Nothing here
- * reaches the database, and nothing here is ever written to a log.
+ * Sessions are kept in `core.dashboard_sessions` with a small cache in front,
+ * so a restart or an upgrade no longer signs the owner out (docs/web.md,
+ * "Sessions"). What is stored is a hash of the session id, never the id: a
+ * copy of the table cannot be replayed as a cookie. The CSRF value is derived
+ * from the id rather than stored at all. The rate limit stays in memory.
+ * Nothing here is ever written to a log.
  */
-import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 /**
  * How long a session is honoured **without any activity**, by where it was
  * established. Both are idle lifetimes, not absolute ones: a session in use
@@ -66,24 +68,86 @@ function equal(a, b) {
     const bb = Buffer.from(b ?? '', 'utf8');
     return ab.length > 0 && ab.length === bb.length && timingSafeEqual(ab, bb);
 }
+/**
+ * What the table stores in place of a session id: sha256, hex.
+ *
+ * A plain hash is enough because the id is 256 random bits — there is nothing
+ * to guess, so nothing a slow hash would slow down.
+ */
+export function sessionIdHash(sessionId) {
+    return createHash('sha256').update(sessionId, 'utf8').digest('hex');
+}
+/**
+ * The CSRF value for a session, derived from its id.
+ *
+ * Derived rather than random so it never has to be stored: after a restart the
+ * request presents the session id, and the CSRF value it must also echo is
+ * recomputed from it. HMAC keyed by the id is one-way — the page can read the
+ * CSRF cookie, and that reveals nothing about the HttpOnly id — and another
+ * site still cannot read either cookie, which is all double-submit asks of it.
+ */
+export function csrfFor(sessionId) {
+    return createHmac('sha256', sessionId).update('buddi-csrf-v1').digest('base64url').slice(0, 32);
+}
+/**
+ * The longest the stored idle edge may lag the live one.
+ *
+ * Sliding the in-memory expiry is free and happens on every request; writing
+ * it back is a database round trip, so it is done at most this often per
+ * session (or a tenth of the idle lifetime, when that is shorter). A restart
+ * can therefore cost a session at most this much of its idle lifetime, never
+ * extend it.
+ */
+export const SESSION_WRITE_EVERY_MS = 5 * 60_000;
+/** How often expired rows are swept from the table. */
+export const SESSION_SWEEP_EVERY_MS = 10 * 60_000;
+const COLUMNS = `id_hash, scope, via, tailscale_login, tailscale_address, tailscale_name, ttl_ms,
+  created_at, expires_at, absolute_expires_at`;
+/** Is this a row the table could have produced? Anything else is a miss. */
+function isRow(value) {
+    const row = value;
+    return !!row && typeof row.id_hash === 'string'
+        && (row.scope === 'local' || row.scope === 'remote')
+        && (row.via === 'local' || row.via === 'ticket' || row.via === 'tailscale')
+        && row.created_at !== undefined && row.expires_at !== undefined && row.ttl_ms !== undefined;
+}
 export class SessionStore {
+    /** Keyed by the id's hash, so the cache and the table speak the same key. */
     #sessions = new Map();
+    /** When each cached session's idle edge was last written back. */
+    #persistedAt = new Map();
+    /** Destroyed while a read of the table may still be in flight. */
+    #revoked = new Set();
     #ttl;
     #tailscaleMaxMs;
-    constructor(ttlMs = {}, tailscaleMaxMs = TAILSCALE_SESSION_MAX_MS) {
+    #db;
+    #log;
+    /** Every table operation, in order: a revoke can never be overtaken by a read. */
+    #chain = Promise.resolve();
+    #sweptAt = Number.NEGATIVE_INFINITY;
+    constructor(ttlMs = {}, tailscaleMaxMs = TAILSCALE_SESSION_MAX_MS, options = {}) {
         this.#ttl = { ...SESSION_TTL_MS, ...ttlMs };
         this.#tailscaleMaxMs = tailscaleMaxMs;
+        this.#db = options.db;
+        this.#log = options.log ?? ((line) => console.error(line));
     }
     /** The idle lifetime a session established from `scope` gets. */
     ttlFor(scope) {
         return this.#ttl[scope];
     }
-    create(scope, now = new Date(), provenance = { via: scope === 'local' ? 'local' : 'ticket' }) {
+    /**
+     * A new session. Stored unless `persist` is false — which is how the open
+     * loopback gate mints its silent sessions: one is minted again for free on
+     * the next request, so there is nothing to keep across a restart, and a
+     * cookie-less local poller must not add a row per request.
+     */
+    create(scope, now = new Date(), provenance = { via: scope === 'local' ? 'local' : 'ticket' }, options = {}) {
         this.#prune(now);
         const ttlMs = this.#ttl[scope];
+        const sessionId = id();
         const session = {
-            id: id(),
-            csrf: id(24),
+            id: sessionId,
+            csrf: csrfFor(sessionId),
             scope,
             via: provenance.via,
             ...(provenance.tailscaleLogin !== undefined ? { tailscaleLogin: provenance.tailscaleLogin } : {}),
@@ -95,29 +159,62 @@ export class SessionStore {
             ...(provenance.via === 'tailscale' ? { absoluteExpiresAt: new Date(now.getTime() + this.#tailscaleMaxMs) } : {}),
             cookieIssuedAt: now,
         };
-        this.#sessions.set(session.id, session);
+        const key = sessionIdHash(sessionId);
+        this.#sessions.set(key, session);
+        if (options.persist !== false && this.#db) {
+            this.#persistedAt.set(key, now.getTime());
+            const db = this.#db;
+            void this.#enqueue('storing a session', () => db.query(`insert into core.dashboard_sessions (${COLUMNS}, last_seen_at)
+         values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $8)
+         on conflict (id_hash) do nothing`, [key, session.scope, session.via, session.tailscaleLogin ?? null, session.tailscaleAddress ?? null,
+                session.tailscaleName ?? null, ttlMs, session.createdAt, session.expiresAt, session.absoluteExpiresAt ?? null]));
+            this.#maybeSweep(now);
+        }
         return session;
     }
     /**
-     * Forget every session matching this, and say how many went.
+     * Forget every session matching this — in memory and in the table — and say
+     * how many went.
      *
      * What the setting page uses to revoke the sessions an identity earned the
      * moment that identity stops being allowed one: turning the switch off, or
      * naming a different login, empties the tailnet's access immediately rather
-     * than at the next request that happens to be made.
+     * than at the next request that happens to be made. Rows this process never
+     * saw a cookie for are offered without an `id`.
      */
-    forget(matches) {
-        let gone = 0;
+    async forget(matches) {
+        const gone = new Set();
         for (const [key, session] of this.#sessions) {
             if (matches(session)) {
-                this.#sessions.delete(key);
-                gone += 1;
+                this.#drop(key);
+                gone.add(key);
             }
         }
-        return gone;
+        const db = this.#db;
+        if (db) {
+            await this.#enqueue('revoking sessions', async () => {
+                const { rows } = await db.query(`select ${COLUMNS} from core.dashboard_sessions`);
+                const drop = [...gone];
+                for (const row of rows) {
+                    if (!isRow(row) || gone.has(row.id_hash))
+                        continue;
+                    const { id: _id, csrf: _csrf, ...record } = this.#fromRow(row, undefined);
+                    if (matches(record)) {
+                        drop.push(row.id_hash);
+                        gone.add(row.id_hash);
+                    }
+                }
+                // A read queued before this one may have cached a row it is dropping.
+                for (const key of drop)
+                    this.#drop(key);
+                if (drop.length > 0)
+                    await db.query(`delete from core.dashboard_sessions where id_hash = any($1)`, [drop]);
+            }, true);
+        }
+        return gone.size;
     }
     /**
-     * The live session for this cookie, sliding its expiry.
+     * The live session for this cookie, from memory only, sliding its expiry.
      *
      * `scope` is where *this request* came from, and it must match where the
      * session was established. A cookie minted on loopback is not honoured when
@@ -125,22 +222,57 @@ export class SessionStore {
      * this machine rather than a credential that got a longer life by accident.
      * (A browser will not send it across hosts in the first place; this is the
      * belt to that suspenders.)
+     *
+     * The server asks `resolve`, which reads through to the table on a miss.
      */
     get(sessionId, scope, now = new Date()) {
         if (!sessionId)
             return undefined;
-        const session = this.#sessions.get(sessionId);
+        const key = sessionIdHash(sessionId);
+        const session = this.#sessions.get(key);
         if (!session)
             return undefined;
         if (this.#dead(session, now)) {
-            this.#sessions.delete(sessionId);
+            this.#drop(key);
+            if (this.#db)
+                void this.#deleteRows([key]);
             return undefined;
         }
         if (session.scope !== scope)
             return undefined;
         session.expiresAt = new Date(now.getTime() + session.ttlMs);
+        this.#writeBack(key, session, now);
         return session;
     }
+    /**
+     * `get`, reading through to the table when this process has not seen the
+     * cookie yet — after a restart, every session starts here.
+     *
+     * A row is honoured on exactly the terms a cached session is: past its idle
+     * edge or its absolute one it is deleted and refused, and its scope must
+     * match. A database that cannot be read is a miss, never an error page.
+     */
+    async resolve(sessionId, scope, now = new Date()) {
+        if (!sessionId)
+            return undefined;
+        const key = sessionIdHash(sessionId);
+        if (!this.#sessions.has(key) && this.#db && !this.#revoked.has(key)) {
+            const db = this.#db;
+            await this.#enqueue('reading a session', async () => {
+                // Another request with the same cookie may have loaded it meanwhile.
+                if (this.#sessions.has(key) || this.#revoked.has(key))
+                    return;
+                const { rows } = await db.query(`select ${COLUMNS} from core.dashboard_sessions where id_hash = $1`, [key]);
+                const row = rows[0];
+                if (!isRow(row) || row.id_hash !== key || this.#revoked.has(key))
+                    return;
+                this.#sessions.set(key, this.#fromRow(row, sessionId));
+                this.#persistedAt.set(key, now.getTime());
+            });
+            this.#maybeSweep(now);
+        }
+        return this.get(sessionId, scope, now);
+    }
     /**
      * Should this response carry a fresh cookie? Mutating: a `true` answer marks
      * the cookie as issued now, so the caller must actually send it.
@@ -160,17 +292,103 @@ export class SessionStore {
     static csrfMatches(session, presented) {
         return presented !== undefined && equal(session.csrf, presented);
     }
-    destroy(sessionId) {
-        if (sessionId)
-            this.#sessions.delete(sessionId);
+    /**
+     * End this session, in memory at once and in the table before the returned
+     * promise settles. Callers that revoke for a reason await it.
+     */
+    async destroy(sessionId) {
+        if (!sessionId)
+            return;
+        const key = sessionIdHash(sessionId);
+        this.#drop(key);
+        if (this.#db) {
+            this.#revoked.add(key);
+            try {
+                await this.#deleteRows([key], true);
+            }
+            finally {
+                this.#revoked.delete(key);
+            }
+        }
+    }
+    /** Every table operation queued so far has settled. A test seam. */
+    async flush() {
+        await this.#chain;
     }
     get size() {
         return this.#sessions.size;
     }
+    #drop(key) {
+        this.#sessions.delete(key);
+        this.#persistedAt.delete(key);
+    }
+    #deleteRows(keys, rethrow = false) {
+        const db = this.#db;
+        if (!db)
+            return Promise.resolve();
+        return this.#enqueue('revoking a session', () => db.query(`delete from core.dashboard_sessions where id_hash = any($1)`, [keys]), rethrow);
+    }
+    /**
+     * Write the sliding edge back, sparingly: at most once per
+     * `SESSION_WRITE_EVERY_MS` (or a tenth of the idle lifetime) per session.
+     */
+    #writeBack(key, session, now) {
+        const db = this.#db;
+        const last = this.#persistedAt.get(key);
+        if (!db || last === undefined)
+            return;
+        const every = Math.min(SESSION_WRITE_EVERY_MS, session.ttlMs / 10);
+        if (now.getTime() - last < every)
+            return;
+        this.#persistedAt.set(key, now.getTime());
+        const expiresAt = session.expiresAt;
+        void this.#enqueue('renewing a session', () => db.query(`update core.dashboard_sessions set expires_at = greatest(expires_at, $2), last_seen_at = $3 where id_hash = $1`, [key, expiresAt, now]));
+    }
+    #maybeSweep(now) {
+        const db = this.#db;
+        if (!db || now.getTime() - this.#sweptAt < SESSION_SWEEP_EVERY_MS)
+            return;
+        this.#sweptAt = now.getTime();
+        void this.#enqueue('sweeping expired sessions', () => db.query(`delete from core.dashboard_sessions where expires_at <= $1 or absolute_expires_at <= $1`, [now]));
+    }
+    /** A stored row as a session. Its cookie is re-issued on the first response. */
+    #fromRow(row, sessionId) {
+        const createdAt = new Date(row.created_at);
+        return {
+            id: sessionId ?? '',
+            csrf: sessionId ? csrfFor(sessionId) : '',
+            scope: row.scope,
+            via: row.via,
+            ...(row.tailscale_login !== null ? { tailscaleLogin: row.tailscale_login } : {}),
+            ...(row.tailscale_address !== null ? { tailscaleAddress: row.tailscale_address } : {}),
+            ...(row.tailscale_name !== null ? { tailscaleName: row.tailscale_name } : {}),
+            ttlMs: Number(row.ttl_ms),
+            createdAt,
+            expiresAt: new Date(row.expires_at),
+            ...(row.absolute_expires_at !== null ? { absoluteExpiresAt: new Date(row.absolute_expires_at) } : {}),
+            // Unknown after a restart, so treated as old: the browser's copy is
+            // refreshed on the first response rather than trusted to outlive it.
+            cookieIssuedAt: createdAt,
+        };
+    }
+    /**
+     * Run one table operation after every earlier one. A failure is logged by a
+     * fixed sentence (never a value) and, unless `rethrow`, swallowed: the
+     * dashboard keeps working from memory when the database hiccups.
+     */
+    #enqueue(what, op, rethrow = false) {
+        const run = this.#chain.then(async () => { await op(); });
+        this.#chain = run.catch(() => { });
+        return run.catch((err) => {
+            this.#log(`web: ${what} failed: ${err instanceof Error ? err.message : String(err)}`);
+            if (rethrow)
+                throw err;
+        });
+    }
     #prune(now) {
         for (const [key, session] of this.#sessions) {
             if (this.#dead(session, now))
-                this.#sessions.delete(key);
+                this.#drop(key);
         }
     }
     /** Idle too long, or past the absolute edge no use extends. */

package/packages/gateway/dist/web/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/web/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AA6B7D,MAAM,CAAC,MAAM,cAAc,GAA2C;IACpE,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,qBAAqB;CAC9B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAuBrC,SAAS,EAAE,CAAC,KAAK,GAAG,EAAE;IACpB,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,OAAO,YAAY;IACd,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,IAAI,CAA+B;IACnC,eAAe,CAAS;IAEjC,YAAY,QAA+C,EAAE,EAAE,iBAAyB,wBAAwB;QAC9G,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,KAAK,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;IACxC,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,KAAmB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,CACJ,KAAmB,EACnB,MAAY,IAAI,IAAI,EAAE,EACtB,aAAgC,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;QAE/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,EAAE,EAAE;YACR,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;YACZ,KAAK;YACL,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,GAAG,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,KAAK;YACL,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC;YAC1C,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,cAAc,EAAE,GAAG;SACpB,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,OAAsC;QAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,GAAG,CACD,SAA6B,EAC7B,KAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;QAEtB,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,OAAgB,EAAE,MAAY,IAAI,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC7D,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,oBAAoB;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,aAAa,CAAC,OAAgB;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,yCAAyC;IACzC,MAAM,CAAC,WAAW,CAAC,OAAgB,EAAE,SAA6B;QAChE,OAAO,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,CAAC,SAA6B;QACnC,IAAI,SAAS;YAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,GAAS;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,OAAgB,EAAE,GAAS;QAC/B,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IACzG,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACb,KAAK,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC9D,IAAI,CAAS;IACb,SAAS,CAAS;IAE3B,YAAY,MAAc,iBAAiB,EAAE,WAAmB,cAAc;QAC5E,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,4EAA4E;IAC5E,OAAO,CAAC,GAAW,EAAE,MAAY,IAAI,IAAI,EAAE;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;QAC3D,OAAO,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,GAAW,EAAE,MAAY,IAAI,IAAI,EAAE;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,+EAA+E;IACtE,KAAK,GAAG,IAAI,GAAG,EAAoD,CAAC;IAE7E;;;;;;OAMG;IACH,cAAc,CAAC,GAAW,EAAE,UAAkB,EAAE,MAAY,IAAI,IAAI,EAAE;QACpE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;CACF"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/web/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AA6B7D,MAAM,CAAC,MAAM,cAAc,GAA2C;IACpE,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,qBAAqB;CAC9B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAuBrC,SAAS,EAAE,CAAC,KAAK,GAAG,EAAE;IACpB,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEjD,uDAAuD;AACvD,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,MAAM,CAAC;AAelD,MAAM,OAAO,GAAG;8CAC8B,CAAC;AAE/C,4EAA4E;AAC5E,SAAS,KAAK,CAAC,KAAc;IAC3B,MAAM,GAAG,GAAG,KAA4B,CAAC;IACzC,OAAO,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;WAC1C,CAAC,GAAG,CAAC,KAAK,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC;WACjD,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,CAAC;WACxE,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;AAChG,CAAC;AAED,MAAM,OAAO,YAAY;IACvB,6EAA6E;IACpE,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAChD,kEAAkE;IACzD,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,kEAAkE;IACzD,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,IAAI,CAA+B;IACnC,eAAe,CAAS;IACxB,GAAG,CAAwB;IAC3B,IAAI,CAAyB;IACtC,kFAAkF;IAClF,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1C,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAEpC,YACE,QAA+C,EAAE,EACjD,iBAAyB,wBAAwB,EACjD,UAA+B,EAAE;QAEjC,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,KAAK,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,KAAmB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CACJ,KAAmB,EACnB,MAAY,IAAI,IAAI,EAAE,EACtB,aAAgC,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAC/E,UAAiC,EAAE;QAEnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;YACxB,KAAK;YACL,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,GAAG,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,KAAK;YACL,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC;YAC1C,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,cAAc,EAAE,GAAG;SACpB,CAAC;QACF,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;YACpB,KAAK,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CACpD,wCAAwC,OAAO;;0CAEb,EAClC,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;gBAChG,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CACjH,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,OAA4C;QACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,OAAO,+BAA+B,CAAC,CAAC;gBAClF,MAAM,IAAI,GAAa,CAAC,GAAG,IAAI,CAAC,CAAC;gBACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;wBAAE,SAAS;oBACnD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAC1E,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAAC,CAAC;gBACzE,CAAC;gBACD,sEAAsE;gBACtE,KAAK,MAAM,GAAG,IAAI,IAAI;oBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7G,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,GAAG,CACD,SAA6B,EAC7B,KAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;QAEtB,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,IAAI,CAAC,GAAG;gBAAE,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,SAA6B,EAC7B,KAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;QAEtB,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;YACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;gBAClD,qEAAqE;gBACrE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO;gBAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,OAAO,kDAAkD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5G,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO;gBACzE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,OAAgB,EAAE,MAAY,IAAI,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC7D,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,oBAAoB;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,aAAa,CAAC,OAAgB;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,yCAAyC;IACzC,MAAM,CAAC,WAAW,CAAC,OAAgB,EAAE,SAA6B;QAChE,OAAO,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,SAA6B;QACzC,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,WAAW,CAAC,IAAc,EAAE,OAAO,GAAG,KAAK;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CACvD,6DAA6D,EAAE,CAAC,IAAI,CAAC,CACtE,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,GAAW,EAAE,OAAgB,EAAE,GAAS;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACnE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,KAAK;YAAE,OAAO;QACzC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,KAAK,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CACrD,gHAAgH,EAChH,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CACtB,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,GAAS;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,sBAAsB;YAAE,OAAO;QAC1E,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAC5D,yFAAyF,EAAE,CAAC,GAAG,CAAC,CACjG,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,QAAQ,CAAC,GAAQ,EAAE,SAA6B;QAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,SAAS,IAAI,EAAE;YACnB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;YACzC,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YACzB,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,oEAAoE;YACpE,qEAAqE;YACrE,cAAc,EAAE,SAAS;SAC1B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAY,EAAE,EAA0B,EAAE,OAAO,GAAG,KAAK;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtF,IAAI,OAAO;gBAAE,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,GAAS;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,OAAgB,EAAE,GAAS;QAC/B,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IACzG,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACb,KAAK,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC9D,IAAI,CAAS;IACb,SAAS,CAAS;IAE3B,YAAY,MAAc,iBAAiB,EAAE,WAAmB,cAAc;QAC5E,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,4EAA4E;IAC5E,OAAO,CAAC,GAAW,EAAE,MAAY,IAAI,IAAI,EAAE;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;QAC3D,OAAO,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,GAAW,EAAE,MAAY,IAAI,IAAI,EAAE;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,+EAA+E;IACtE,KAAK,GAAG,IAAI,GAAG,EAAoD,CAAC;IAE7E;;;;;;OAMG;IACH,cAAc,CAAC,GAAW,EAAE,UAAkB,EAAE,MAAY,IAAI,IAAI,EAAE;QACpE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;CACF"}

package/packages/gateway/dist/web/signed-out.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The page a signed-out browser gets instead of an empty 401.
+ *
+ * An empty 401 on a page load is shown by the browser (and by the installed
+ * app) as its own error page — "This site can't be reached" — with nothing
+ * saying what to do. A *navigation* that the gate refuses gets this instead:
+ * still a 401, still nothing about why beyond the one sentence a person
+ * needs, and the way back in. API calls, event streams and anything a script
+ * fetched keep the empty 401 (`http.ts`, `sendEmpty`): a caller that is not a
+ * person learns exactly one bit, as before.
+ *
+ * Self-contained on purpose: inline styles carrying the dashboard's tokens
+ * (`packages/web/src/tokens.css`), no script, no font, no image, and a
+ * Content-Security-Policy that would refuse anything else. It holds no token,
+ * no CSRF value and no path on this machine.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/**
+ * Is this request a person opening a page, rather than a script asking?
+ *
+ * `Sec-Fetch-Mode: navigate` is the browser's own word for it. A client that
+ * sends no fetch metadata at all (an old browser, an embedded view) is taken
+ * at its `Accept`: a page load asks for HTML first. Never under `/api/` or
+ * `/stream`, never anything but a GET.
+ */
+export declare function wantsSignedOutPage(req: IncomingMessage, method: string, pathname: string): boolean;
+/**
+ * Where "Try again" points: this same page, as a path on this origin. Never
+ * `//host` (which a browser reads as another site), never anything but a path.
+ */
+export declare function retryHref(pathname: string, search: string): string;
+export interface SignedOutOptions {
+    /** Where "Try again" goes, from `retryHref`. */
+    retry: string;
+    /**
+     * Set when the request came through Tailscale Serve, sign-in through
+     * Tailscale is on, and this login is not the one it allows: the refusal's
+     * own sentence (`tailscaleRefusalReason`), which never names a login.
+     */
+    tailscaleRefusal?: string | undefined;
+}
+/** The page itself. Exported for tests; the server calls `sendSignedOut`. */
+export declare function signedOutPage(options: SignedOutOptions): string;
+/** Answer a refused page load with the signed-out page: 401, HTML, nothing loadable. */
+export declare function sendSignedOut(res: ServerResponse, options: SignedOutOptions, headers?: Record<string, string | string[]>): void;
+//# sourceMappingURL=signed-out.d.ts.map

package/packages/gateway/dist/web/signed-out.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-out.d.ts","sourceRoot":"","sources":["../../src/web/signed-out.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMlG;AAMD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAsD/D;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAM,GAAG,IAAI,CAUnI"}