@withbuddi/buddi 0.1.0-pre.37 → 0.1.0-pre.39

package/packages/gateway/dist/web/access/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../../src/web/access/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,eAAe,EAAkB,MAAM,aAAa,CAAC;AAErG,OAAO,EAAE,oBAAoB,EAAsB,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,WAAW,GAQZ,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAE7D,uEAAuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,CAAC;AACzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,oDAAoD;AACpD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/D,iEAAiE;AACjE,MAAM,aAAa,GAAG,MAAM,CAAC;AAc7B,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,GAAG,GAAG,KAAK,uBAAuB,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AACD,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACzF,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/F,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACrG,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,OAAsE;IACtG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oBAAoB;AACpB,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA8B;IACpE,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACvG,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iHAAiH,EAAE,CAAC;IACjJ,CAAC;IACD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+GAA+G,EAAE,CAAC;IAC/I,CAAC;IACD,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACzG,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6GAA6G,EAAE,CAAC;IAChK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;AACvG,CAAC;AAyBD,MAAM,UAAU,QAAQ,CAAC,UAAkB;IACzC,OAAO,WAAW,UAAU,uBAAuB,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,OAA8H,EAAE;IACzJ,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuI,CAAC;IAE7J,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;QAC7B,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAChH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAA4B,EAAE;QAC3D,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;QAClC,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,KAAK,IAA8B,EAAE;YAChD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACjJ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;oBACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,qCAAqC,GAAG,CAAC,MAAM,2BAA2B,EAAE,CAAC;gBAC1H,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8B,CAAC;gBAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;gBAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,GAAqE,CAAC;oBAChF,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK;wBAAE,SAAS;oBAC3D,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;wBAAE,SAAS;oBACvD,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK;wBAAE,SAAS;oBACrD,IAAI,CAAC;wBACH,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,GAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;oBACzE,CAAC;oBAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACpB,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;oBACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,oDAAoD,EAAE,CAAC;gBACpG,CAAC;gBACD,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;gBAC9B,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;gBAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC,GAAG,EAAE,CAAC,sDAAsD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,uFAAuF,EAAE,CAAC;YACvI,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,CAAC,QAAQ,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG;YACjB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,GAAG,aAAa,CAAC;YAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,GAAG,IAAI,KAAK;gBAAE,OAAO,GAAG,CAAC;YAC7B,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,GAAG,mBAAmB,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACxD,sEAAsE;gBACtE,mDAAmD;gBACnD,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;gBACpB,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9C,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,YAAY,CAAC;YACpC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;QAClC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI,KAAK;KACrD,CAAC;AACJ,CAAC;AAuBD,MAAM,OAAO,GAAgD;IAC3D,aAAa,EAAE,+EAA+E;IAC9F,wBAAwB,EAAE,iFAAiF;IAC3G,cAAc,EAAE,mFAAmF;IACnG,SAAS,EAAE,6DAA6D;IACxE,iBAAiB,EAAE,0DAA0D;IAC7E,aAAa,EAAE,gFAAgF;IAC/F,eAAe,EAAE,6DAA6D;IAC9E,cAAc,EAAE,4DAA4D;IAC5E,gBAAgB,EAAE,4DAA4D;IAC9E,OAAO,EAAE,6CAA6C;IACtD,eAAe,EAAE,kDAAkD;IACnE,gBAAgB,EAAE,0EAA0E;IAC5F,eAAe,EAAE,kEAAkE;IACnF,mBAAmB,EAAE,qFAAqF;IAC1G,kBAAkB,EAAE,yDAAyD;CAC9E,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,MAAyB;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,MAAyB;IAC1C,OAAO;QACL,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;KACxG,CAAC;AACJ,CAAC;AAQD,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACnF,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,OAAsE,EACtE,IAA+B;IAE/B,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACpH,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAiC,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnE,0EAA0E;IAC1E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5E,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE9H,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,GAAG,KAAK,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC3E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnE,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3G,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEzD,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC,UAAU,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAClG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAElH,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,IAAI,GAAG,GAAG,WAAW,IAAI,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/E,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,WAAW,GAAG,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,QAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/E,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,WAAW,GAAG,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACzF,QAAQ,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,GAAG,0BAA0B,GAAG,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExG,uDAAuD;IACvD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACpH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAClG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AAC/H,CAAC;AAkBD,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,uFAAuF;AACvF,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChE,gEAAgE;IAChE,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAA4B;IAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,IAAI,KAAK,GAAuC,IAAI,CAAC;IACrD,MAAM,QAAQ,GAAG,CAAC,MAAyB,EAAE,GAAS,EAAiC,EAAE;QACvF,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC;YACzC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACtC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAoB,EAAE,OAAgC,EAAE,GAAS,EAAwC,EAAE;QACjI,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,mEAAmE;YACnE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC9D,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7J,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC7C,OAAO,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAChH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/C,OAAO,QAAQ,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpG,CAAC;QACD,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE;gBACR,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;gBACjC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK;gBAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE;gBACpC,MAAM,EAAE,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS;aACxC;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,sBAAsB;QAClC,aAAa,EAAE,0BAA0B;QACzC,YAAY,EAAE,mBAAmB;QACjC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO;QACrC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK;QACnC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;QACtB,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,iEAAiE,EAAE,CAAC;YAC3H,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI,CAAC;YAChD,IAAI,OAAO;gBAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAChE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,qFAAqF,EAAE,CAAC;YAClI,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,+CAA+C,EAAE,CAAC;YACnG,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5F,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,IAAI,SAAS,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,QAAQ,EAAE,GAAkB;YAChC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YAC1D,OAAO;gBACL,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,yGAAyG,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBACxJ,EAAE,IAAI,EAAE,oIAAoI,EAAE;oBAC9I,EAAE,IAAI,EAAE,sJAAsJ,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE;oBACrM,EAAE,IAAI,EAAE,qIAAqI,EAAE;oBAC/I,EAAE,IAAI,EAAE,0DAA0D,EAAE;iBACrE;gBACD,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,+BAA+B,EAAE;oBACzF,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,uBAAuB,EAAE;oBAClF,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,oCAAoC,EAAE,WAAW,EAAE,iBAAiB,EAAE;oBACjH,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,yCAAyC,EAAE,WAAW,EAAE,2BAA2B,EAAE;iBAC5I;aACF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,uCAAuC;QACvC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS;QAC9C,QAAQ;QACR,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG;YACtC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC5H,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,MAAM,EAAE,EAAE,EAAE,CAAC;gBACf,yDAAyD;gBACzD,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAChH,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7F,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACjF,sEAAsE;YACtE,8DAA8D;YAC9D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5E,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,eAAe;KACjC,CAAC;AACJ,CAAC"}

package/packages/gateway/dist/web/access/index.d.ts

@@ -0,0 +1,9 @@
+export * from './arrival.js';
+export * from './provider.js';
+export * from './registry.js';
+export * from './tailscale.js';
+export * from './cloudflare.js';
+export * from './cloudflare-api.js';
+export * from './cloudflare-setup.js';
+export * from './cloudflare-token.js';
+//# sourceMappingURL=index.d.ts.map

package/packages/gateway/dist/web/access/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/web/access/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC"}

package/packages/gateway/dist/web/access/index.js

@@ -0,0 +1,9 @@
+export * from './arrival.js';
+export * from './provider.js';
+export * from './registry.js';
+export * from './tailscale.js';
+export * from './cloudflare.js';
+export * from './cloudflare-api.js';
+export * from './cloudflare-setup.js';
+export * from './cloudflare-token.js';
+//# sourceMappingURL=index.js.map

package/packages/gateway/dist/web/access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/web/access/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC"}

package/packages/gateway/dist/web/access/ingress.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The ingress listener (specs/trusted-access.md §3.3).
+ *
+ * A second loopback listener for a proxy on this machine other than
+ * Tailscale (cloudflared). Every socket it accepts is tagged `ingress`
+ * (`arrival.ts`) before a byte of the request is read, so every request on it
+ * is remote and fails every loopback-only check, whatever it says about
+ * itself. It is bound only while such a provider is on, and closed when the
+ * last one goes off.
+ */
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import type { Duplex } from 'node:stream';
+export interface Ingress {
+    /** Bind or close to match `wanted()`. Serialised: overlapping calls run in turn. */
+    sync(): Promise<void>;
+    /** The bound port, or null while it is not listening. */
+    port(): number | null;
+    /** Why it is not listening although it is wanted, in words; null when fine. */
+    problem(): string | null;
+    close(): Promise<void>;
+}
+export declare function createIngress(opts: {
+    onRequest: (req: IncomingMessage, res: ServerResponse) => void;
+    onUpgrade: (req: IncomingMessage, socket: Duplex, head: Buffer) => void;
+    /** The port to bind: the dashboard's + 2, `BUDDI_INGRESS_PORT`, or 0 in tests. */
+    port: () => number;
+    wanted: () => Promise<boolean>;
+    log: (line: string) => void;
+}): Ingress;
+//# sourceMappingURL=ingress.d.ts.map

package/packages/gateway/dist/web/access/ingress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.d.ts","sourceRoot":"","sources":["../../../src/web/access/ingress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAgB,KAAK,eAAe,EAAe,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACjG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,MAAM,WAAW,OAAO;IACtB,oFAAoF;IACpF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,yDAAyD;IACzD,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC;IACtB,+EAA+E;IAC/E,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,SAAS,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC/D,SAAS,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxE,kFAAkF;IAClF,IAAI,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CA6DV"}

package/packages/gateway/dist/web/access/ingress.js

@@ -0,0 +1,76 @@
+/**
+ * The ingress listener (specs/trusted-access.md §3.3).
+ *
+ * A second loopback listener for a proxy on this machine other than
+ * Tailscale (cloudflared). Every socket it accepts is tagged `ingress`
+ * (`arrival.ts`) before a byte of the request is read, so every request on it
+ * is remote and fails every loopback-only check, whatever it says about
+ * itself. It is bound only while such a provider is on, and closed when the
+ * last one goes off.
+ */
+import { createServer } from 'node:http';
+import { markSocketArrival } from './arrival.js';
+export function createIngress(opts) {
+    let server = null;
+    let bound = null;
+    let problem = null;
+    let chain = Promise.resolve();
+    const open = async () => {
+        const port = opts.port();
+        const next = createServer(opts.onRequest);
+        next.on('connection', (socket) => markSocketArrival(socket, 'ingress'));
+        next.on('upgrade', (req, socket, head) => opts.onUpgrade(req, socket, head));
+        await new Promise((resolve) => {
+            const onError = (err) => {
+                problem = err.code === 'EADDRINUSE'
+                    ? `Port ${port}, where cloudflared should point, is taken by another program. Free it, or set BUDDI_INGRESS_PORT, and restart buddi.`
+                    : `The port for cloudflared (${port}) could not be opened: ${err.message}.`;
+                opts.log(`access: the ingress listener could not bind 127.0.0.1:${port}: ${err.code ?? err.message}`);
+                resolve();
+            };
+            next.once('error', onError);
+            next.listen(port, '127.0.0.1', () => {
+                next.removeListener('error', onError);
+                // A later server-level error (EMFILE on accept) is logged, never an
+                // unhandled 'error' event that would take the whole gateway down.
+                next.on('error', (err) => opts.log(`access: the ingress listener on 127.0.0.1:${port}: ${err.code ?? err.message}`));
+                server = next;
+                bound = next.address()?.port ?? port;
+                problem = null;
+                opts.log(`access: listening for cloudflared on 127.0.0.1:${bound}`);
+                resolve();
+            });
+        });
+    };
+    const shut = async () => {
+        const current = server;
+        server = null;
+        bound = null;
+        if (!current)
+            return;
+        await new Promise((resolve) => {
+            current.close(() => resolve());
+            current.closeAllConnections?.();
+        });
+    };
+    const enqueue = (op) => {
+        const run = chain.then(op, op);
+        chain = run.catch(() => { });
+        return run;
+    };
+    return {
+        sync: () => enqueue(async () => {
+            const want = await opts.wanted().catch(() => false);
+            if (want && !server)
+                await open();
+            else if (!want) {
+                problem = null;
+                await shut();
+            }
+        }),
+        port: () => bound,
+        problem: () => problem,
+        close: () => enqueue(async () => { problem = null; await shut(); }),
+    };
+}
+//# sourceMappingURL=ingress.js.map

package/packages/gateway/dist/web/access/ingress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.js","sourceRoot":"","sources":["../../../src/web/access/ingress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAYjD,MAAM,UAAU,aAAa,CAAC,IAO7B;IACC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAsB,EAAE,MAAM,EAAE,IAAc,CAAC,CAAC,CAAC;QAC1G,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,OAAO,GAAG,CAAC,GAA0B,EAAQ,EAAE;gBACnD,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,YAAY;oBACjC,CAAC,CAAC,QAAQ,IAAI,uHAAuH;oBACrI,CAAC,CAAC,6BAA6B,IAAI,0BAA0B,GAAG,CAAC,OAAO,GAAG,CAAC;gBAC9E,IAAI,CAAC,GAAG,CAAC,yDAAyD,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtG,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBAClC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtC,oEAAoE;gBACpE,kEAAkE;gBAClE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,6CAA6C,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC5I,MAAM,GAAG,IAAI,CAAC;gBACd,KAAK,GAAI,IAAI,CAAC,OAAO,EAAyB,EAAE,IAAI,IAAI,IAAI,CAAC;gBAC7D,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;gBACpE,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC;QACvB,MAAM,GAAG,IAAI,CAAC;QACd,KAAK,GAAG,IAAI,CAAC;QACb,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/B,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,EAAuB,EAAiB,EAAE;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,EAAE,CAAC;iBAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM,IAAI,EAAE,CAAC;YAAC,CAAC;QACnD,CAAC,CAAC;QACF,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK;QACjB,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO;QACtB,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC"}

package/packages/gateway/dist/web/access/provider.d.ts

@@ -0,0 +1,173 @@
+/**
+ * Trusted access providers (specs/trusted-access.md §3).
+ *
+ * Something in front of buddi proves who is knocking — Tailscale's daemon,
+ * Cloudflare Access's signed JWT, later the withbuddi relay's signed pass —
+ * buddi checks that proof itself, and then buddi's own `remote` session rules
+ * apply: 12 hours idle, CSRF, exact Origin, approvals, the lock screen.
+ *
+ * A provider is a core module, one file per provider, never a plugin: sign-in
+ * is the one thing a plugin must never be able to widen. This file is the
+ * shape every provider has; `registry.ts` holds the ones this gateway runs.
+ *
+ * The rules every provider keeps:
+ *
+ * - `identify` never throws, and never trusts a header alone. "Could not ask"
+ *   (a daemon, a JWKS endpoint, a relay that did not answer) is its own
+ *   answer, `unanswered`, which never ends a session and never counts as a
+ *   failed sign-in.
+ * - `matches` decides by how a request arrived (`arrival.ts`), never by a
+ *   header alone.
+ * - Neither a header nor a provider identity ever yields a `local` session.
+ */
+import type { IncomingMessage } from 'node:http';
+import type { Arrival } from './arrival.js';
+/** The providers there are. `withbuddi` is the relay (provider 3), not built yet. */
+export type AccessProviderId = 'tailscale' | 'cloudflare-access' | 'withbuddi';
+export declare const ACCESS_PROVIDER_IDS: readonly AccessProviderId[];
+export declare function isAccessProviderId(value: unknown): value is AccessProviderId;
+/** A verified identity, as a provider hands it to the session it mints. */
+export interface AccessIdentity {
+    provider: AccessProviderId;
+    /**
+     * Who it is: the login (Tailscale), the email (Cloudflare Access), or the
+     * account id (the relay's device identity). What `confirm` checks again.
+     */
+    subject: string;
+    /** A name to greet, when the provider has one. Never a credential. */
+    name?: string | undefined;
+    /**
+     * Whatever else the provider keeps on the session row, as strings: a
+     * tailnet address, an issuer, a device label. Shown, never trusted.
+     */
+    detail?: Record<string, string> | undefined;
+    /**
+     * The rate-limit bucket this request belongs to, now that it verified
+     * (Cloudflare's `Cf-Connecting-Ip`, the relay's client address).
+     */
+    bucket?: string | undefined;
+    /** This identity's own end, when it has one shorter than the provider's cap (a JWT's `exp`). */
+    expiresAt?: Date | undefined;
+}
+/**
+ * Why a request earned no identity: a fixed name the provider logs and the
+ * signed-out page may say in words. Never a supplied value.
+ */
+export interface AccessRefusal {
+    refusal: string;
+    /** The sentence the log and the page say. Never holds a supplied login or address. */
+    sentence: string;
+    /**
+     * `unanswered`: the provider could not be asked (keep the session, 503).
+     * `login`: set up, and this person is not the one it allows.
+     * `other`: anything else; the request is simply unauthenticated.
+     */
+    kind: 'unanswered' | 'login' | 'other';
+    /**
+     * A credential was presented and failed (a Cloudflare Access assertion that
+     * does not verify): the rate-limit bucket it counts against, and a digest
+     * of it so the same one counts once. Absent for a credential-free probe and
+     * for "could not ask", which are never failed sign-ins.
+     */
+    attempt?: {
+        bucket: string;
+        credential: string;
+    } | undefined;
+}
+export type AccessIdentifyResult = {
+    ok: true;
+    identity: AccessIdentity;
+} | ({
+    ok: false;
+} & AccessRefusal);
+/**
+ * What a provider says on every request of a session it minted:
+ * `keep` it; `end` it (the identity changed or was withdrawn); `refuse` this
+ * request alone (401, the session stays — a stray request without
+ * Cloudflare's header must not sign the owner out); `unanswered` (503, the
+ * session stays).
+ */
+export type AccessConfirmation = {
+    answer: 'keep';
+    refusal?: undefined;
+} | {
+    answer: 'end' | 'refuse' | 'unanswered';
+    refusal?: AccessRefusal | undefined;
+};
+export type AccessState = 'off' | 'needs-setup' | 'waiting' | 'ready' | 'unanswered';
+export interface AccessStatus {
+    state: AccessState;
+    /** One sentence for the panel's row and for `buddi doctor`. */
+    sentence: string;
+}
+/** One line of the panel's setup copy; a Copy button sits beside `command`. */
+export interface AccessSetupStep {
+    text: string;
+    command?: string | undefined;
+}
+/** A field the provider stores, as the shared panel draws it. */
+export interface AccessField {
+    key: string;
+    label: string;
+    hint?: string | undefined;
+    placeholder?: string | undefined;
+}
+/** The panel's copy and fields. Text, never React: one shared panel draws every provider. */
+export interface AccessSetup {
+    steps: AccessSetupStep[];
+    fields: AccessField[];
+}
+/** What a provider may ask of the gateway it runs in. */
+export interface AccessContext {
+    /** The port the dashboard is bound to. */
+    dashboardPort: () => number;
+    /** The ingress listener's port, or null while it is not listening. */
+    ingressPort: () => number | null;
+    /** The configured public origin, if any. */
+    publicOrigin: () => string | undefined;
+}
+/** The session fields a provider re-checks. */
+export interface AccessSessionView {
+    provider?: AccessProviderId | undefined;
+    providerSubject?: string | undefined;
+    providerDetail?: Record<string, string> | undefined;
+}
+export interface AccessProvider<S = unknown> {
+    readonly id: AccessProviderId;
+    /** What the panel's row says. */
+    readonly title: string;
+    /** `login` names a person; `device` names a browser that finished a sign-in (§3.2). */
+    readonly identity: 'login' | 'device';
+    /** Whether the proxy runs on this machine (`tailscale serve`, cloudflared) or elsewhere (the relay). */
+    readonly proxy: 'this-machine' | 'elsewhere';
+    /** The listener its requests arrive on. */
+    readonly arrival: Arrival;
+    /** The key its settings are stored under in `core.web_settings`. */
+    readonly settingKey: string;
+    /** The hard cap on a session, on top of the 12-hour idle rule. */
+    readonly absoluteCapMs: number;
+    /** What is stored, made safe: anything unexpected reads as off. */
+    parseSetting(raw: unknown): S;
+    enabled(setting: S): boolean;
+    /** The subject this setting allows, for "is this the same person" checks. */
+    allowed(setting: S): string;
+    status(setting: S, ctx: AccessContext): Promise<AccessStatus>;
+    setup(setting: S, ctx: AccessContext): AccessSetup;
+    /**
+     * Did this request come through me? By arrival first; a provider on the
+     * main listener (Tailscale) may then look for its own headers, which only
+     * ever narrows.
+     */
+    matches(req: IncomingMessage): boolean;
+    /** Who this request is, verified, or why not. Null: the request makes no claim at all. */
+    identify(req: IncomingMessage, setting: S, now: Date): Promise<AccessIdentifyResult | null>;
+    confirm(session: AccessSessionView, req: IncomingMessage, setting: S, now: Date): Promise<AccessConfirmation>;
+    /**
+     * The rate-limit bucket for a request that arrived its way (§7.5), before
+     * anything verified; a verified identity names its own (`bucket`).
+     */
+    clientKey(req: IncomingMessage): string;
+}
+/** Two subjects are the same person when they differ only in case. */
+export declare function sameSubject(a: string | undefined, b: string | undefined): boolean;
+//# sourceMappingURL=provider.d.ts.map

package/packages/gateway/dist/web/access/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/web/access/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,qFAAqF;AACrF,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,mBAAmB,GAAG,WAAW,CAAC;AAE/E,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAAoD,CAAC;AAEhH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,gGAAgG;IAChG,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,EAAE,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;IACvC;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC9D;AAED,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GAAG,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC;AAE5G;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAC;IAAC,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;CAAE,CAAC;AAErF,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;AAErF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,WAAW,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,6FAA6F;AAC7F,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,sEAAsE;IACtE,WAAW,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACjC,4CAA4C;IAC5C,YAAY,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,wGAAwG;IACxG,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAAC;IAC7C,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,mEAAmE;IACnE,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,WAAW,CAAC;IACnD;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;IACvC,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC5F,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9G;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;CACzC;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGjF"}

package/packages/gateway/dist/web/access/provider.js

@@ -0,0 +1,11 @@
+export const ACCESS_PROVIDER_IDS = ['tailscale', 'cloudflare-access', 'withbuddi'];
+export function isAccessProviderId(value) {
+    return typeof value === 'string' && ACCESS_PROVIDER_IDS.includes(value);
+}
+/** Two subjects are the same person when they differ only in case. */
+export function sameSubject(a, b) {
+    if (!a || !b)
+        return false;
+    return a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+//# sourceMappingURL=provider.js.map

package/packages/gateway/dist/web/access/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/web/access/provider.ts"],"names":[],"mappings":"AA4BA,MAAM,CAAC,MAAM,mBAAmB,GAAgC,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;AAEhH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC;AAiJD,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,CAAqB,EAAE,CAAqB;IACtE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC"}

package/packages/gateway/dist/web/access/registry.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The trusted access providers this gateway runs, and the questions the
+ * request handler asks of them (specs/trusted-access.md §3).
+ *
+ * Order matters only for `matching`: a request is asked of the first provider
+ * whose arrival it came by. Today that is Tailscale on the main listener (and
+ * only when Serve's header is there) and Cloudflare Access on the ingress
+ * listener. The relay (provider 3) slots in with `arrival: 'relay'`.
+ */
+import type { IncomingMessage } from 'node:http';
+import type { AccessConfirmation, AccessIdentifyResult, AccessProvider, AccessProviderId, AccessSessionView } from './provider.js';
+export interface AccessRegistry {
+    readonly providers: readonly AccessProvider<any>[];
+    get(id: AccessProviderId | undefined): AccessProvider<any> | undefined;
+    /** The provider's stored setting, parsed. A setting that cannot be read is off. */
+    settingOf<S>(provider: AccessProvider<S>): Promise<S>;
+    /** The provider this request arrived through, if any. */
+    matching(req: IncomingMessage): AccessProvider<any> | undefined;
+    /** Who this request is, through whichever provider it arrived by. Null: no provider, or no claim. */
+    identify(req: IncomingMessage, now: Date): Promise<{
+        provider: AccessProvider<any>;
+        result: AccessIdentifyResult;
+    } | null>;
+    /** Re-check a provider session on this request. A provider that is gone ends it. */
+    confirm(session: AccessSessionView, req: IncomingMessage, now: Date): Promise<AccessConfirmation>;
+    /** The rate-limit bucket before anything verified, for a request that did not arrive on the main listener. */
+    bucketOf(req: IncomingMessage): string | null;
+}
+export declare function createAccessRegistry(opts: {
+    providers: AccessProvider<any>[];
+    readSetting: (key: string) => Promise<unknown>;
+}): AccessRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/packages/gateway/dist/web/access/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/web/access/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEnI,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;IACnD,GAAG,CAAC,EAAE,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACvE,mFAAmF;IACnF,SAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAChE,qGAAqG;IACrG,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3H,oFAAoF;IACpF,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClG,8GAA8G;IAC9G,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;IACjC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAChD,GAAG,cAAc,CA2BjB"}

package/packages/gateway/dist/web/access/registry.js

@@ -0,0 +1,32 @@
+import { arrivalOf } from './arrival.js';
+export function createAccessRegistry(opts) {
+    const providers = opts.providers;
+    const settingOf = async (provider) => provider.parseSetting(await opts.readSetting(provider.settingKey).catch(() => null));
+    const matching = (req) => providers.find((p) => p.matches(req));
+    return {
+        providers,
+        get: (id) => providers.find((p) => p.id === id),
+        settingOf,
+        matching,
+        async identify(req, now) {
+            const provider = matching(req);
+            if (!provider)
+                return null;
+            const result = await provider.identify(req, await settingOf(provider), now);
+            return result ? { provider, result } : null;
+        },
+        async confirm(session, req, now) {
+            const provider = providers.find((p) => p.id === session.provider);
+            if (!provider)
+                return { answer: 'end' };
+            return provider.confirm(session, req, await settingOf(provider), now);
+        },
+        bucketOf(req) {
+            const arrival = arrivalOf(req);
+            if (arrival === 'main')
+                return null;
+            return providers.find((p) => p.arrival === arrival)?.clientKey(req) ?? `${arrival}:unverified`;
+        },
+    };
+}
+//# sourceMappingURL=registry.js.map

package/packages/gateway/dist/web/access/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/web/access/registry.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAkBzC,MAAM,UAAU,oBAAoB,CAAC,IAGpC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,EAAK,QAA2B,EAAc,EAAE,CACrE,QAAQ,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAmC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAClH,OAAO;QACL,SAAS;QACT,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QAC/C,SAAS;QACT,QAAQ;QACR,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG;YACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG;YAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,QAAQ,CAAC,GAAG;YACV,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,OAAO,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,aAAa,CAAC;QACjG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/packages/gateway/dist/web/{tailscale.d.ts → access/tailscale.d.ts}

@@ -1,4 +1,5 @@
 import type { IncomingMessage } from 'node:http';
+import type { AccessProvider } from './provider.js';
 /** The key this setting is stored under in `core.web_settings`. */
 export declare const TAILSCALE_SETTING_KEY = "tailscale";
 /**
@@ -239,4 +240,30 @@ export declare function tailscaleSelf(deps?: TailscaleDaemonDeps): Promise<{
 }>;
 /** What is stored, made safe: anything unexpected in the row reads as "off". */
 export declare function toTailscaleSetting(value: unknown): TailscaleSetting;
+/**
+ * How long a session established through Tailscale may live however much it
+ * is used: seven days, as before the provider interface.
+ */
+export declare const TAILSCALE_ABSOLUTE_CAP_MS: number;
+export interface TailscaleProviderDeps {
+    whois: TailscaleWhois;
+    self: () => Promise<{
+        available: boolean;
+        self: TailscaleProfile | null;
+    }>;
+    log?: ((line: string) => void) | undefined;
+}
+/**
+ * The command that publishes this dashboard on the tailnet, with this
+ * installation's own numbers in it: the HTTPS port of the configured public
+ * origin, and the port the gateway is actually listening on.
+ */
+export declare function tailscaleServeCommand(dashboardPort: number, publicOrigin: string | undefined): string;
+/**
+ * Tailscale behind the provider interface. A move, not a change: the five
+ * checks of `tailscaleIdentity` are its `identify`, the per-request whois is
+ * its `confirm`, and its requests arrive on the main listener, where
+ * `tailscale serve` has always pointed.
+ */
+export declare function tailscaleProvider(deps: TailscaleProviderDeps): AccessProvider<TailscaleSetting>;
 //# sourceMappingURL=tailscale.d.ts.map

package/packages/gateway/dist/web/access/tailscale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale.d.ts","sourceRoot":"","sources":["../../../src/web/access/tailscale.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAIjD,OAAO,KAAK,EAAuC,cAAc,EAA6B,MAAM,eAAe,CAAC;AAEpH,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AAKtE,8FAA8F;AAC9F,eAAO,MAAM,cAAc,QAAS,CAAC;AAKrC,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;AAEnF,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAChD,KAAK,EAAE,cAAc,CAAC;IACtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC9D;AAMD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUrE;AAWD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAOzE;AAQD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAOrE;AAED,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG/E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMrD;AAMD;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,kBAAkB,GAClB,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,oBAAoB,GACpB,sBAAsB,GACtB,4BAA4B,CAAC;AAsBjC;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAEjF;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAE5E;AAYD,mFAAmF;AACnF,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAoDnC;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAGxD,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAK1C,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,YAAiB,GAAG,MAAM,GAAG,IAAI,CAY7E;AAWD,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3H;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,aAexB,CAAC;AAEL;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAepD;AAgCD,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAElE;AAED,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAcpH;AAID;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAAoB,EAAE,SAAS,SAAQ,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAgBxI;AAED,qEAAqE;AACrE,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3C,IAAI,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IACvD,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACtG,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CAChC;AAYD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAsBjH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,IAAI,GAAE,mBAAmB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,cAAc,CAyBvG;AAKD,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,0FAA0F;AAC1F,qBAAa,kBAAmB,SAAQ,KAAK;;CAK5C;AAED,uEAAuE;AACvE,wBAAsB,aAAa,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,CAAC,CAuBlI;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAInE;AAMD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,QAAuB,CAAC;AAE9D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3E,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CASrG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CAAC,gBAAgB,CAAC,CA2E/F"}