agent-comms 8.3.1 → 8.4.1

package/dist/bridges/user/web/test/web-access.unit.test.js

@@ -3,7 +3,7 @@
  */
 import { describe, expect, it } from "vitest";
 import * as os from "node:os";
-import { accessCookieName, authorise, canonicalAddress, generateAccessToken, isLoopbackAddress, isWildcardHost, localWebUrl, LOOPBACK_HOST, requiresAccessToken, resolveWebBindHost, tokensMatch, WEB_HOST_ENV, } from "../web-access.js";
+import { accessCookieName, accessUrls, authorise, canonicalAddress, generateAccessToken, HOSTED_DASHBOARD_ORIGIN, isLoopbackAddress, isWildcardHost, localWebUrl, LOOPBACK_HOST, requiresAccessToken, resolveWebBindHost, tokensMatch, WEB_HOST_ENV, } from "../web-access.js";
 const HTTP_FOUND = 302;
 const HTTP_UNAUTHORIZED = 401;
 const HTTP_FORBIDDEN = 403;
@@ -206,7 +206,7 @@ describe("authorise", () => {
         expect(decision).toEqual({
             kind: "exchange",
             status: HTTP_FOUND,
-            cookie: `${COOKIE_NAME}=${p.token}; HttpOnly; SameSite=Strict; Path=/`,
+            cookie: `${COOKIE_NAME}=${p.token}; HttpOnly; SameSite=Lax; Path=/`,
             location: "/room?x=1",
         });
     });
@@ -267,5 +267,130 @@ describe("authorise", () => {
         }));
         expect(decision).toEqual({ kind: "allow" });
     });
+    it("rejects a foreign Origin from a loopback client, under a loopback bind and a wildcard bind", () => {
+        for (const bindHost of [LOOPBACK_HOST, "0.0.0.0"]) {
+            const decision = authorise(policy({ token: undefined, bindHost }), request({
+                remoteAddress: "127.0.0.1",
+                headers: {
+                    host: `127.0.0.1:${String(PORT)}`,
+                    origin: "https://evil.example",
+                },
+            }));
+            expect(decision).toMatchObject({ kind: "deny", status: HTTP_FORBIDDEN });
+        }
+    });
+    it("rejects a foreign Origin from a client on this machine's own interface address", () => {
+        const decision = authorise(policy({ localClientAddresses: () => new Set([LAN_CLIENT]) }), request({
+            headers: { host: HOST_HEADER, origin: "https://evil.example" },
+        }));
+        expect(decision).toMatchObject({ kind: "deny", status: HTTP_FORBIDDEN });
+    });
+    it("rejects an https Origin whose host and port match this server", () => {
+        const decision = authorise(policy({ token: undefined, bindHost: LOOPBACK_HOST }), request({
+            remoteAddress: "127.0.0.1",
+            headers: {
+                host: `127.0.0.1:${String(PORT)}`,
+                origin: `https://127.0.0.1:${String(PORT)}`,
+            },
+        }));
+        expect(decision).toMatchObject({ kind: "deny", status: HTTP_FORBIDDEN });
+    });
+    it("allows an http Origin naming a loopback name on the bound port from a loopback client", () => {
+        const decision = authorise(policy({ token: undefined, bindHost: LOOPBACK_HOST }), request({
+            remoteAddress: "127.0.0.1",
+            headers: {
+                host: `127.0.0.1:${String(PORT)}`,
+                origin: `http://localhost:${String(PORT)}`,
+            },
+        }));
+        expect(decision).toEqual({ kind: "allow" });
+    });
+    it("allows the hosted dashboard's Origin from a loopback client only", () => {
+        const loopback = authorise(policy({ token: undefined, bindHost: LOOPBACK_HOST }), request({
+            remoteAddress: "127.0.0.1",
+            headers: {
+                host: `127.0.0.1:${String(PORT)}`,
+                origin: HOSTED_DASHBOARD_ORIGIN,
+            },
+        }));
+        expect(loopback).toEqual({ kind: "allow" });
+        const p = policy();
+        const remote = authorise(p, request({
+            headers: {
+                host: HOST_HEADER,
+                cookie: `${COOKIE_NAME}=${p.token}`,
+                origin: HOSTED_DASHBOARD_ORIGIN,
+            },
+        }));
+        expect(remote).toMatchObject({ kind: "deny", status: HTTP_FORBIDDEN });
+    });
+    it("accepts the Bearer scheme in any letter case and rejects other schemes", () => {
+        const p = policy();
+        for (const scheme of ["Bearer", "bearer", "BEARER"]) {
+            expect(authorise(p, request({
+                headers: {
+                    host: HOST_HEADER,
+                    authorization: `${scheme} ${String(p.token)}`,
+                },
+            }))).toEqual({ kind: "allow" });
+        }
+        expect(authorise(p, request({
+            headers: {
+                host: HOST_HEADER,
+                authorization: `Basic ${String(p.token)}`,
+            },
+        }))).toMatchObject({ kind: "deny", status: HTTP_UNAUTHORIZED });
+    });
+});
+describe("accessUrls", () => {
+    const MAC = "00:00:00:00:00:00";
+    function v4(address, internal) {
+        return {
+            address,
+            family: "IPv4",
+            internal,
+            netmask: "255.255.255.0",
+            mac: MAC,
+            cidr: null,
+        };
+    }
+    function v6(address) {
+        return {
+            address,
+            family: "IPv6",
+            internal: false,
+            netmask: "ffff:ffff:ffff:ffff::",
+            mac: MAC,
+            cidr: null,
+            scopeid: 0,
+        };
+    }
+    const loopback = { lo0: [v4("127.0.0.1", true)] };
+    const lan = {
+        en0: [v4("192.168.1.10", false), v6("fe80::1"), v6("2001:db8::10")],
+        ...loopback,
+    };
+    function listFor(bindHost, interfaces) {
+        return accessUrls({ ...policy({ bindHost }), token: "t" }, () => interfaces);
+    }
+    it("lists external IPv4 and non-link-local IPv6 addresses, bracketed, under the IPv6 wildcard", () => {
+        expect(listFor("::", lan)).toEqual([
+            `http://192.168.1.10:${String(PORT)}/?token=t`,
+            `http://[2001:db8::10]:${String(PORT)}/?token=t`,
+        ]);
+    });
+    it("lists only IPv4 addresses under the IPv4 wildcard, which accepts no IPv6 connection", () => {
+        expect(listFor("0.0.0.0", lan)).toEqual([
+            `http://192.168.1.10:${String(PORT)}/?token=t`,
+        ]);
+    });
+    it("lists nothing when a wildcard bind finds no external address", () => {
+        expect(listFor("0.0.0.0", loopback)).toEqual([]);
+    });
+    it("lists the bound address under a specific bind", () => {
+        expect(listFor(BIND, loopback)).toEqual([
+            `http://${BIND}:${String(PORT)}/?token=t`,
+        ]);
+    });
 });
 //# sourceMappingURL=web-access.unit.test.js.map

package/dist/bridges/user/web/test/web-access.unit.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-access.unit.test.js","sourceRoot":"","sources":["../../../../../src/bridges/user/web/test/web-access.unit.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,GAGb,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,IAAI,GAAG,KAAK,CAAC;AACnB,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,MAAM,IAAI,GAAG,cAAc,CAAC;AAC5B,MAAM,WAAW,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAE9C,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAE3C,yHAAyH;AACzH,SAAS,MAAM,CAAC,YAA6C,EAAE;IAC7D,OAAO;QACL,KAAK,EAAE,mBAAmB,EAAE;QAC5B,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE;QACrC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,SAAiC;IAChD,OAAO;QACL,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,GAAG;QACR,aAAa,EAAE,UAAU;QACzB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC9B,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CACvE,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CACjE,0EAA0E,EAC1E,CAAC,QAAQ,EAAE,EAAE;QACX,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,GAAG,EAAE,CACV,kBAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CACzD,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,KAAK,EAAE,IAAI,CAAC;QACb,CAAC,iBAAiB,EAAE,KAAK,CAAC;QAC1B,CAAC,kBAAkB,EAAE,WAAW,CAAC;QACjC,CAAC,eAAe,EAAE,WAAW,CAAC;QAC9B,CAAC,cAAc,EAAE,cAAc,CAAC;QAChC,CAAC,aAAa,EAAE,aAAa,CAAC;KAC/B,CAAC,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CACpE,0BAA0B,EAC1B,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAC1D,wBAAwB,EACxB,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE;QACvE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC,CACzD,oBAAoB,EACpB,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mGAAmG,EAAE,GAAG,EAAE;QAC3G,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,CACJ,SAAS,CACP,YAAY,EACZ,OAAO,CAAC;gBACN,aAAa,EAAE,WAAW;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;aAC7C,CAAC,CACH,CACF,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,KAAK,MAAM,CAAC,IAAI;YACd,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;YACrD,MAAM,EAAE;SACT,EAAE,CAAC;YACF,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC;gBACN,aAAa,EAAE,WAAW;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;aACpD,CAAC,CACH,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,CACJ,SAAS,CACP,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAC/B,OAAO,CAAC;YACN,aAAa,EAAE,WAAW;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;SAC7C,CAAC,CACH,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,EAAE,EACR,OAAO,CAAC;YACN,aAAa,EAAE,WAAW;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;SAC/C,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACvG,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EACvD,OAAO,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CACjC,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,CACJ,SAAS,CACP,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EACrD,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAC5D,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,KAAK,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5F,MAAM,GAAG,GAAG,CAAC,CAAyB,EAAE,IAAY,EAAE,MAAc,EAAE,EAAE,CACtE,SAAS,CACP,CAAC,EACD,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAClE,CAAC;QACJ,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,MAAM,CACJ,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CACvD,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,MAAM,CACJ,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CACvD,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACrD,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,EAAE,EACR,OAAO,CAAC;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE;SAC9D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;SACnE,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,QAAQ,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE;aACzC;SACF,CAAC,CACH,CACF,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7B,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,WAAW,QAAQ;aAC/B;SACF,CAAC,CACH,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,KAAK,qCAAqC;YACtE,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACpE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;QACH,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACjE,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB,MAAM,CAAC,IAAI,CAAC,EAAE;gBACtC,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE;aACnC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,CACJ,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CACzE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC,IAAI,CAAC,EAAE;gBACxC,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE;aACnC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE;gBACnC,MAAM,EAAE,UAAU,IAAI,OAAO;aAC9B;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE;gBACnC,MAAM,EAAE,UAAU,WAAW,EAAE;aAChC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"web-access.unit.test.js","sourceRoot":"","sources":["../../../../../src/bridges/user/web/test/web-access.unit.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,GAGb,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,IAAI,GAAG,KAAK,CAAC;AACnB,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,MAAM,IAAI,GAAG,cAAc,CAAC;AAC5B,MAAM,WAAW,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAE9C,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAE3C,yHAAyH;AACzH,SAAS,MAAM,CAAC,YAA6C,EAAE;IAC7D,OAAO;QACL,KAAK,EAAE,mBAAmB,EAAE;QAC5B,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE;QACrC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,SAAiC;IAChD,OAAO;QACL,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,GAAG;QACR,aAAa,EAAE,UAAU;QACzB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC9B,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CACvE,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CACjE,0EAA0E,EAC1E,CAAC,QAAQ,EAAE,EAAE;QACX,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,GAAG,EAAE,CACV,kBAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CACzD,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,KAAK,EAAE,IAAI,CAAC;QACb,CAAC,iBAAiB,EAAE,KAAK,CAAC;QAC1B,CAAC,kBAAkB,EAAE,WAAW,CAAC;QACjC,CAAC,eAAe,EAAE,WAAW,CAAC;QAC9B,CAAC,cAAc,EAAE,cAAc,CAAC;QAChC,CAAC,aAAa,EAAE,aAAa,CAAC;KAC/B,CAAC,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CACpE,0BAA0B,EAC1B,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAC1D,wBAAwB,EACxB,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE;QACvE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAC,CACzD,oBAAoB,EACpB,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mGAAmG,EAAE,GAAG,EAAE;QAC3G,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,CACJ,SAAS,CACP,YAAY,EACZ,OAAO,CAAC;gBACN,aAAa,EAAE,WAAW;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;aAC7C,CAAC,CACH,CACF,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,KAAK,MAAM,CAAC,IAAI;YACd,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;YACrD,MAAM,EAAE;SACT,EAAE,CAAC;YACF,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC;gBACN,aAAa,EAAE,WAAW;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;aACpD,CAAC,CACH,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,CACJ,SAAS,CACP,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAC/B,OAAO,CAAC;YACN,aAAa,EAAE,WAAW;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;SAC7C,CAAC,CACH,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,EAAE,EACR,OAAO,CAAC;YACN,aAAa,EAAE,WAAW;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;SAC/C,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACvG,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EACvD,OAAO,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CACjC,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,CACJ,SAAS,CACP,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EACrD,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAC5D,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,KAAK,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5F,MAAM,GAAG,GAAG,CAAC,CAAyB,EAAE,IAAY,EAAE,MAAc,EAAE,EAAE,CACtE,SAAS,CACP,CAAC,EACD,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAClE,CAAC;QACJ,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,MAAM,CACJ,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CACvD,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,MAAM,CACJ,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CACvD,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACrD,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,EAAE,EACR,OAAO,CAAC;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE;SAC9D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE;SACnE,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,QAAQ,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE;aACzC;SACF,CAAC,CACH,CACF,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7B,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,WAAW,QAAQ;aAC/B;SACF,CAAC,CACH,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,KAAK,kCAAkC;YACnE,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACpE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;QACH,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACjE,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB,MAAM,CAAC,IAAI,CAAC,EAAE;gBACtC,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE;aACnC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,CACJ,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CACzE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC,IAAI,CAAC,EAAE;gBACxC,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE;aACnC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE;gBACnC,MAAM,EAAE,UAAU,IAAI,OAAO;aAC9B;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE;gBACnC,MAAM,EAAE,UAAU,WAAW,EAAE;aAChC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,KAAK,MAAM,QAAQ,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EACtC,OAAO,CAAC;gBACN,aAAa,EAAE,WAAW;gBAC1B,OAAO,EAAE;oBACP,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE;oBACjC,MAAM,EAAE,sBAAsB;iBAC/B;aACF,CAAC,CACH,CAAC;YACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAC7D,OAAO,CAAC;YACN,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,sBAAsB,EAAE;SAC/D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EACrD,OAAO,CAAC;YACN,aAAa,EAAE,WAAW;YAC1B,OAAO,EAAE;gBACP,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE;gBACjC,MAAM,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,EAAE;aAC5C;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EACrD,OAAO,CAAC;YACN,aAAa,EAAE,WAAW;YAC1B,OAAO,EAAE;gBACP,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE;gBACjC,MAAM,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,EAAE;aAC3C;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EACrD,OAAO,CAAC;YACN,aAAa,EAAE,WAAW;YAC1B,OAAO,EAAE;gBACP,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE;gBACjC,MAAM,EAAE,uBAAuB;aAChC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,SAAS,CACtB,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE;gBACnC,MAAM,EAAE,uBAAuB;aAChC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC;gBACN,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW;oBACjB,aAAa,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;iBAC9C;aACF,CAAC,CACH,CACF,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,CACJ,SAAS,CACP,CAAC,EACD,OAAO,CAAC;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,aAAa,EAAE,SAAS,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;aAC1C;SACF,CAAC,CACH,CACF,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,MAAM,GAAG,GAAG,mBAAmB,CAAC;IAEhC,SAAS,EAAE,CAAC,OAAe,EAAE,QAAiB;QAC5C,OAAO;YACL,OAAO;YACP,MAAM,EAAE,MAAM;YACd,QAAQ;YACR,OAAO,EAAE,eAAe;YACxB,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,SAAS,EAAE,CAAC,OAAe;QACzB,OAAO;YACL,OAAO;YACP,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,uBAAuB;YAChC,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,CAAC;SACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG;QACV,GAAG,EAAE,CAAC,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;QACnE,GAAG,QAAQ;KACZ,CAAC;IAEF,SAAS,OAAO,CACd,QAAgB,EAChB,UAAkD;QAElD,OAAO,UAAU,CACf,EAAE,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EACvC,GAAG,EAAE,CAAC,UAAU,CACjB,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YACjC,uBAAuB,MAAM,CAAC,IAAI,CAAC,WAAW;YAC9C,yBAAyB,MAAM,CAAC,IAAI,CAAC,WAAW;SACjD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YACtC,uBAAuB,MAAM,CAAC,IAAI,CAAC,WAAW;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YACtC,UAAU,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/bridges/user/web/web-access.d.ts

@@ -1,8 +1,9 @@
 /**
  * Network exposure policy for the bridge web server (agent-comms#346).
  *
- * The default is loopback only, with no token. Setting AGENT_COMMS_WEB_HOST to a non-loopback address is the explicit opt-in to LAN reachability. Because the server exposes every mutating action (POST /api/action and the /ws/mesh oRPC socket), a non-loopback bind always comes with a per-process secret token. Every request, from any client, must carry a Host header naming this server (the DNS rebinding defence: a rebound name resolves here but arrives with the attacker's name in Host). A client on this machine (loopback, or one of this machine's own interface addresses) needs nothing more. Any other client must also present the token (as a bearer token, or as the cookie a one-time `?token=` URL exchange sets) and, when it carries an Origin, carry one that names the same host.
+ * The default is loopback only, with no token. Setting AGENT_COMMS_WEB_HOST to a non-loopback address is the explicit opt-in to LAN reachability. Because the server exposes every mutating action (POST /api/action and the /ws/mesh oRPC socket), a non-loopback bind always comes with a per-process secret token. Every request, from any client, must carry a Host header naming this server (the DNS rebinding defence: a rebound name resolves here but arrives with the attacker's name in Host), and any Origin it carries must be this server over http (the cross-site defence: a page open in the operator's own browser reaches loopback as readily as a LAN page does, so the check cannot be limited to remote clients). The one other origin admitted, and only from a client on this machine, is the hosted dashboard (see HOSTED_DASHBOARD_ORIGIN). A client on this machine (loopback, or one of this machine's own interface addresses) needs nothing more. Any other client must also present the token, as a bearer token or as the cookie a one-time `?token=` URL exchange sets.
  */
+import * as os from "node:os";
 /** The environment variable that opts the web server into binding beyond loopback. Its value is an IP address literal to bind: `0.0.0.0` or `::` for every interface, or one interface's own address. */
 export declare const WEB_HOST_ENV = "AGENT_COMMS_WEB_HOST";
 /** The default bind address, reachable from this machine only. */
@@ -13,6 +14,8 @@ export declare const ACCESS_COOKIE_PREFIX = "agent_comms_web_token";
 export declare function accessCookieName(port: number): string;
 /** The query parameter a one-time URL exchange carries the token in. */
 export declare const ACCESS_QUERY_PARAM = "token";
+/** The origin of the dashboard deployed to GitHub Pages. It discovers a bridge's server by probing loopback ports and then opens its `/ws/mesh` socket cross-origin, so its Origin is admitted from a client on this machine; every other foreign origin is refused. */
+export declare const HOSTED_DASHBOARD_ORIGIN = "https://exadev.github.io";
 /** True for any address in 127.0.0.0/8, for ::1, and for an IPv4-mapped form of either (what a dual-stack socket reports for an IPv4 client). */
 export declare function isLoopbackAddress(address: string): boolean;
 /**
@@ -36,8 +39,8 @@ export declare function generateAccessToken(): string;
  * Constant-time token comparison. Both sides are hashed to a fixed length first, because crypto.timingSafeEqual requires equal-length inputs and comparing lengths directly would leak the expected token's length.
  */
 export declare function tokensMatch(presented: string, expected: string): boolean;
-/** The addresses of this machine's own network interfaces. */
-export declare function ownInterfaceAddresses(): ReadonlySet<string>;
+/** The addresses of this machine's own network interfaces, as of at most INTERFACE_CACHE_MS ago. */
+export declare const ownInterfaceAddresses: () => ReadonlySet<string>;
 /** The exposure a running server is under. */
 export interface AccessPolicy {
     /** The token every client not on this machine must present. Undefined for a loopback bind, which no such client can reach. */
@@ -69,11 +72,11 @@ export type AccessDecision = {
     readonly location: string;
 };
 /**
- * Decides whether a request may proceed. The Host header must name this server, for every client. A client on this machine is then allowed. Any other client needs the token (a bearer token or the cookie), and any Origin it sends must be this server; a GET carrying the right `?token=` instead exchanges it for the cookie.
+ * Decides whether a request may proceed. The Host header must name this server and any Origin must be this server, for every client. A client on this machine is then allowed. Any other client needs the token (a bearer token or the cookie); a GET carrying the right `?token=` instead exchanges it for the cookie.
  */
 export declare function authorise(policy: Readonly<AccessPolicy>, request: AccessRequest): AccessDecision;
-/** The URLs an operator can open on the LAN, each carrying the token for the one-time exchange. A wildcard bind lists every external IPv4 address of this machine; a specific bind lists that address. */
+/** The URLs an operator can open on the LAN, each carrying the token for the one-time exchange. A wildcard bind lists every external, non-link-local address of this machine that the bind family can reach (IPv6 bracketed, and only under `::`, since `0.0.0.0` accepts IPv4 alone); a specific bind lists that address. The list is empty when a wildcard bind finds no such address. */
 export declare function accessUrls(policy: Readonly<AccessPolicy> & {
     readonly token: string;
-}): string[];
+}, interfaces?: () => NodeJS.Dict<os.NetworkInterfaceInfo[]>): string[];
 //# sourceMappingURL=web-access.d.ts.map

package/dist/bridges/user/web/web-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-access.d.ts","sourceRoot":"","sources":["../../../../src/bridges/user/web/web-access.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,yMAAyM;AACzM,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD,kEAAkE;AAClE,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC,+TAA+T;AAC/T,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,UAAU,CAAC;AA4B1C,iJAAiJ;AACjJ,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAaxD;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,uJAAuJ;AACvJ,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,MAAM,CASR;AAED,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIxE;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,IAAI,WAAW,CAAC,MAAM,CAAC,CAQ3D;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,8HAA8H;IAC9H,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,mWAAmW;IACnW,QAAQ,CAAC,oBAAoB,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;CAC1D;AAED,0IAA0I;AAC1I,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;CAC3E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5E;IACE,4IAA4I;IAC5I,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AA0HN;;GAEG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC9B,OAAO,EAAE,aAAa,GACrB,cAAc,CA4BhB;AAED,0MAA0M;AAC1M,wBAAgB,UAAU,CACxB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1D,MAAM,EAAE,CAgBV"}
+{"version":3,"file":"web-access.d.ts","sourceRoot":"","sources":["../../../../src/bridges/user/web/web-access.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,yMAAyM;AACzM,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD,kEAAkE;AAClE,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC,+TAA+T;AAC/T,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,UAAU,CAAC;AAe1C,wQAAwQ;AACxQ,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAqBlE,iJAAiJ;AACjJ,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAaxD;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,uJAAuJ;AACvJ,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,MAAM,CASR;AAED,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIxE;AAwBD,oGAAoG;AACpG,eAAO,MAAM,qBAAqB,EAAE,MAAM,WAAW,CAAC,MAAM,CAE3D,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,8HAA8H;IAC9H,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,mWAAmW;IACnW,QAAQ,CAAC,oBAAoB,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;CAC1D;AAED,0IAA0I;AAC1I,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;CAC3E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5E;IACE,4IAA4I;IAC5I,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AA8IN;;GAEG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC9B,OAAO,EAAE,aAAa,GACrB,cAAc,CAkChB;AAED,4XAA4X;AAC5X,wBAAgB,UAAU,CACxB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAC3D,UAAU,GAAE,MAAM,MAAM,CAAC,IAAI,CAC3B,EAAE,CAAC,oBAAoB,EAAE,CACH,GACvB,MAAM,EAAE,CAkBV"}

package/dist/bridges/user/web/web-access.js

@@ -1,7 +1,7 @@
 /**
  * Network exposure policy for the bridge web server (agent-comms#346).
  *
- * The default is loopback only, with no token. Setting AGENT_COMMS_WEB_HOST to a non-loopback address is the explicit opt-in to LAN reachability. Because the server exposes every mutating action (POST /api/action and the /ws/mesh oRPC socket), a non-loopback bind always comes with a per-process secret token. Every request, from any client, must carry a Host header naming this server (the DNS rebinding defence: a rebound name resolves here but arrives with the attacker's name in Host). A client on this machine (loopback, or one of this machine's own interface addresses) needs nothing more. Any other client must also present the token (as a bearer token, or as the cookie a one-time `?token=` URL exchange sets) and, when it carries an Origin, carry one that names the same host.
+ * The default is loopback only, with no token. Setting AGENT_COMMS_WEB_HOST to a non-loopback address is the explicit opt-in to LAN reachability. Because the server exposes every mutating action (POST /api/action and the /ws/mesh oRPC socket), a non-loopback bind always comes with a per-process secret token. Every request, from any client, must carry a Host header naming this server (the DNS rebinding defence: a rebound name resolves here but arrives with the attacker's name in Host), and any Origin it carries must be this server over http (the cross-site defence: a page open in the operator's own browser reaches loopback as readily as a LAN page does, so the check cannot be limited to remote clients). The one other origin admitted, and only from a client on this machine, is the hosted dashboard (see HOSTED_DASHBOARD_ORIGIN). A client on this machine (loopback, or one of this machine's own interface addresses) needs nothing more. Any other client must also present the token, as a bearer token or as the cookie a one-time `?token=` URL exchange sets.
  */
 import * as crypto from "node:crypto";
 import * as net from "node:net";
@@ -25,7 +25,13 @@ const HTTP_DEFAULT_PORT = 80;
 const HTTP_UNAUTHORIZED = 401;
 const HTTP_FORBIDDEN = 403;
 const HTTP_FOUND = 302;
-const BEARER_PREFIX = "Bearer ";
+/** The authentication scheme of an `Authorization` header carrying the token. Scheme names are case-insensitive (RFC 9110 section 11.1). */
+const BEARER_SCHEME = "bearer";
+/** The origin of the dashboard deployed to GitHub Pages. It discovers a bridge's server by probing loopback ports and then opens its `/ws/mesh` socket cross-origin, so its Origin is admitted from a client on this machine; every other foreign origin is refused. */
+export const HOSTED_DASHBOARD_ORIGIN = "https://exadev.github.io";
+/** How long the address sets derived from the machine's interfaces and hostname are reused. Reading them costs a system call per interface, which every request would otherwise pay; this bounds how long a newly attached interface waits to be recognised. */
+const INTERFACE_CACHE_MS = 5000;
+const LINK_LOCAL_V6 = /^fe[89ab]/i;
 const LOOPBACK_V4_PREFIX = "127.";
 const IPV4_MAPPED_PREFIX = "::ffff:";
 const LOOPBACK_V6 = "::1";
@@ -104,8 +110,18 @@ export function tokensMatch(presented, expected) {
     const digest = (value) => crypto.createHash("sha256").update(value).digest();
     return crypto.timingSafeEqual(digest(presented), digest(expected));
 }
-/** The addresses of this machine's own network interfaces. */
-export function ownInterfaceAddresses() {
+/** Returns `compute()`, reusing the previous result for INTERFACE_CACHE_MS. */
+function cachedFor(compute) {
+    let cached;
+    return () => {
+        const now = Date.now();
+        if (cached === undefined || now >= cached.expires) {
+            cached = { value: compute(), expires: now + INTERFACE_CACHE_MS };
+        }
+        return cached.value;
+    };
+}
+function readInterfaceAddresses() {
     const addresses = new Set();
     for (const entries of Object.values(os.networkInterfaces())) {
         for (const entry of entries ?? []) {
@@ -114,12 +130,13 @@ export function ownInterfaceAddresses() {
     }
     return addresses;
 }
+/** The addresses of this machine's own network interfaces, as of at most INTERFACE_CACHE_MS ago. */
+export const ownInterfaceAddresses = cachedFor(readInterfaceAddresses);
 function headerValue(headers, name) {
     const value = headers[name];
     return Array.isArray(value) ? value[0] : value;
 }
-/** Every hostname a client may legitimately use to reach this server: loopback names, the addresses it is bound to and this machine's own name (plus its `.local` mDNS form). Never a name an outside party could make resolve here, which is what DNS rebinding relies on, and never the wildcard address itself, which a page in a local browser can also reach. */
-function allowedHostnames(bindHost) {
+function readAllowedHostnames(bindHost) {
     const names = new Set(LOOPBACK_HOSTNAMES);
     if (isWildcardHost(bindHost)) {
         for (const address of ownInterfaceAddresses())
@@ -136,6 +153,16 @@ function allowedHostnames(bindHost) {
     names.add(`${machine}.local`);
     return names;
 }
+const hostnameSets = new Map();
+/** Every hostname a client may legitimately use to reach this server: loopback names, the addresses it is bound to and this machine's own name (plus its `.local` mDNS form). Never a name an outside party could make resolve here, which is what DNS rebinding relies on, and never the wildcard address itself, which a page in a local browser can also reach. Reused for INTERFACE_CACHE_MS per bind address. */
+function allowedHostnames(bindHost) {
+    let read = hostnameSets.get(bindHost);
+    if (read === undefined) {
+        read = cachedFor(() => readAllowedHostnames(bindHost));
+        hostnameSets.set(bindHost, read);
+    }
+    return read();
+}
 /** A Host header names either an IP literal (compared in canonical form) or a DNS name (compared as is). */
 function canonicalAddressOrName(hostname) {
     return net.isIP(hostname) === 0 ? hostname : canonicalAddress(hostname);
@@ -163,8 +190,8 @@ function hostHeaderAllowed(policy, headers) {
         return false;
     return allowedHostnames(policy.bindHost).has(authority.hostname);
 }
-/** An Origin, when the browser sends one, must be this very server: otherwise a page from elsewhere on the LAN could drive it with the operator's cookie. */
-function originAllowed(headers) {
+/** An Origin, when the browser sends one, must be this very server over http: otherwise a page from anywhere (on the LAN, or open in the operator's own browser) could drive it. The hosted dashboard is the one other origin, and only for a client on this machine. */
+function originAllowed(policy, headers, ownClient) {
     const origin = headerValue(headers, "origin");
     if (origin === undefined)
         return true;
@@ -175,7 +202,14 @@ function originAllowed(headers) {
     catch {
         return false;
     }
-    return (parsed.host.toLowerCase() === headerValue(headers, "host")?.toLowerCase());
+    if (ownClient && parsed.origin === HOSTED_DASHBOARD_ORIGIN)
+        return true;
+    if (parsed.protocol !== "http:")
+        return false;
+    const authority = parseAuthority(parsed.host);
+    if (authority?.port !== policy.port)
+        return false;
+    return allowedHostnames(policy.bindHost).has(authority.hostname);
 }
 function cookieToken(headers, cookieName) {
     const cookies = headerValue(headers, "cookie");
@@ -192,8 +226,12 @@ function bearerToken(headers) {
     const authorization = headerValue(headers, "authorization");
     if (authorization === undefined)
         return undefined;
-    return authorization.startsWith(BEARER_PREFIX)
-        ? authorization.slice(BEARER_PREFIX.length)
+    const separator = authorization.indexOf(" ");
+    if (separator === -1)
+        return undefined;
+    const scheme = authorization.slice(0, separator).toLowerCase();
+    return scheme === BEARER_SCHEME
+        ? authorization.slice(separator + 1).trim()
         : undefined;
 }
 function presentedCredential(policy, token, headers) {
@@ -211,22 +249,28 @@ function isOwnClient(policy, remoteAddress) {
         policy.localClientAddresses().has(canonicalAddress(remoteAddress)));
 }
 /**
- * Decides whether a request may proceed. The Host header must name this server, for every client. A client on this machine is then allowed. Any other client needs the token (a bearer token or the cookie), and any Origin it sends must be this server; a GET carrying the right `?token=` instead exchanges it for the cookie.
+ * Decides whether a request may proceed. The Host header must name this server and any Origin must be this server, for every client. A client on this machine is then allowed. Any other client needs the token (a bearer token or the cookie); a GET carrying the right `?token=` instead exchanges it for the cookie.
  */
 export function authorise(policy, request) {
     if (!hostHeaderAllowed(policy, request.headers)) {
         return { kind: "deny", status: HTTP_FORBIDDEN, message: "Forbidden host" };
     }
-    if (isOwnClient(policy, request.remoteAddress))
+    const ownClient = isOwnClient(policy, request.remoteAddress);
+    if (!originAllowed(policy, request.headers, ownClient)) {
+        return {
+            kind: "deny",
+            status: HTTP_FORBIDDEN,
+            message: "Forbidden origin",
+        };
+    }
+    if (ownClient)
         return { kind: "allow" };
     const { token } = policy;
     if (token === undefined) {
         return { kind: "deny", status: HTTP_UNAUTHORIZED, message: "Unauthorized" };
     }
     if (presentedCredential(policy, token, request.headers)) {
-        return originAllowed(request.headers)
-            ? { kind: "allow" }
-            : { kind: "deny", status: HTTP_FORBIDDEN, message: "Forbidden origin" };
+        return { kind: "allow" };
     }
     if (request.method === "GET") {
         const url = new URL(request.url, "http://placeholder");
@@ -236,21 +280,25 @@ export function authorise(policy, request) {
             return {
                 kind: "exchange",
                 status: HTTP_FOUND,
-                cookie: `${accessCookieName(policy.port)}=${token}; HttpOnly; SameSite=Strict; Path=/`,
+                cookie: `${accessCookieName(policy.port)}=${token}; HttpOnly; SameSite=Lax; Path=/`,
                 location: `${url.pathname}${url.search}`,
             };
         }
     }
     return { kind: "deny", status: HTTP_UNAUTHORIZED, message: "Unauthorized" };
 }
-/** The URLs an operator can open on the LAN, each carrying the token for the one-time exchange. A wildcard bind lists every external IPv4 address of this machine; a specific bind lists that address. */
-export function accessUrls(policy) {
+/** The URLs an operator can open on the LAN, each carrying the token for the one-time exchange. A wildcard bind lists every external, non-link-local address of this machine that the bind family can reach (IPv6 bracketed, and only under `::`, since `0.0.0.0` accepts IPv4 alone); a specific bind lists that address. The list is empty when a wildcard bind finds no such address. */
+export function accessUrls(policy, interfaces = os.networkInterfaces) {
     const hosts = [];
     if (isWildcardHost(policy.bindHost)) {
-        for (const addresses of Object.values(os.networkInterfaces())) {
+        const ipv4Only = canonicalAddress(policy.bindHost) === IPV4_WILDCARD;
+        for (const addresses of Object.values(interfaces())) {
             for (const entry of addresses ?? []) {
-                if (!entry.internal && entry.family === "IPv4")
-                    hosts.push(entry.address);
+                if (entry.internal || LINK_LOCAL_V6.test(entry.address))
+                    continue;
+                if (ipv4Only && entry.family !== "IPv4")
+                    continue;
+                hosts.push(urlHost(entry.address));
             }
         }
     }

package/dist/bridges/user/web/web-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-access.js","sourceRoot":"","sources":["../../../../src/bridges/user/web/web-access.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,yMAAyM;AACzM,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAEnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AAEzC,+TAA+T;AAC/T,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,GAAG,oBAAoB,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C,uHAAuH;AACvH,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,uGAAuG;AACvG,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAErE,8HAA8H;AAC9H,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB,iJAAiJ;AACjJ,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC;IACZ,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,UAAU,CAAC;IAClE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,IAAI,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,aAAa,CAAC;AACpE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACxD,CAAC;AAED,uJAAuJ;AACvJ,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAY;IACxD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,GAAsB;IAEtB,MAAM,SAAS,GAAG,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,aAAa,CAAC;IACtE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,2DAA2D,SAAS,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,QAAgB;IAC7D,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CACvC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IACrD,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAClC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAgCD,SAAS,WAAW,CAClB,OAAiC,EACjC,IAAY;IAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,sWAAsW;AACtW,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAClD,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,OAAO,GAAG,EAAE;SACf,QAAQ,EAAE;SACV,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,QAAQ,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4GAA4G;AAC5G,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CACrB,SAAiB;IAEjB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CACrC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CACtD,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA8B,EAC9B,OAAiC;IAEjC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,6JAA6J;AAC7J,SAAS,aAAa,CAAC,OAAiC;IACtD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,OAAiC,EACjC,UAAkB;IAElB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,OAAiC;IACpD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC;QAC5C,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA8B,EAC9B,KAAa,EACb,OAAiC;IAEjC,MAAM,SAAS,GAAG;QAChB,WAAW,CAAC,OAAO,CAAC;QACpB,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;KACpD,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,CACnB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAClB,MAA8B,EAC9B,aAAiC;IAEjC,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,CACL,iBAAiB,CAAC,aAAa,CAAC;QAChC,MAAM,CAAC,oBAAoB,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,MAA8B,EAC9B,OAAsB;IAEtB,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;YACnC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACnB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5C,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,qCAAqC;gBACtF,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC9E,CAAC;AAED,0MAA0M;AAC1M,MAAM,UAAU,UAAU,CACxB,MAA2D;IAE3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;YAC9D,KAAK,MAAM,KAAK,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;oBAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,IAAI,EAAE,EAAE,CACP,UAAU,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,EAAE,CACjF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"web-access.js","sourceRoot":"","sources":["../../../../src/bridges/user/web/web-access.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,yMAAyM;AACzM,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAEnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AAEzC,+TAA+T;AAC/T,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,GAAG,oBAAoB,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C,uHAAuH;AACvH,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,4IAA4I;AAC5I,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,wQAAwQ;AACxQ,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,gQAAgQ;AAChQ,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,aAAa,GAAG,YAAY,CAAC;AAEnC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,uGAAuG;AACvG,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAErE,8HAA8H;AAC9H,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB,iJAAiJ;AACjJ,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC;IACZ,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,UAAU,CAAC;IAClE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,IAAI,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,aAAa,CAAC;AACpE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACxD,CAAC;AAED,uJAAuJ;AACvJ,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAY;IACxD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,GAAsB;IAEtB,MAAM,SAAS,GAAG,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,aAAa,CAAC;IACtE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,2DAA2D,SAAS,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,QAAgB;IAC7D,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CACvC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IACrD,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAI,OAAgB;IACpC,IAAI,MAAmE,CAAC;IACxE,OAAO,GAAG,EAAE;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClD,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,GAAG,kBAAkB,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAClC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,qBAAqB,GAA8B,SAAS,CACvE,sBAAsB,CACvB,CAAC;AAgCF,SAAS,WAAW,CAClB,OAAiC,EACjC,IAAY;IAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAClD,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,OAAO,GAAG,EAAE;SACf,QAAQ,EAAE;SACV,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,QAAQ,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAqC,CAAC;AAElE,sZAAsZ;AACtZ,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,4GAA4G;AAC5G,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CACrB,SAAiB;IAEjB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CACrC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CACtD,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA8B,EAC9B,OAAiC;IAEjC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,yQAAyQ;AACzQ,SAAS,aAAa,CACpB,MAA8B,EAC9B,OAAiC,EACjC,SAAkB;IAElB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,SAAS,EAAE,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAClB,OAAiC,EACjC,UAAkB;IAElB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,OAAiC;IACpD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,MAAM,KAAK,aAAa;QAC7B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA8B,EAC9B,KAAa,EACb,OAAiC;IAEjC,MAAM,SAAS,GAAG;QAChB,WAAW,CAAC,OAAO,CAAC;QACpB,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;KACpD,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,CACnB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAClB,MAA8B,EAC9B,aAAiC;IAEjC,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,CACL,iBAAiB,CAAC,aAAa,CAAC;QAChC,MAAM,CAAC,oBAAoB,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,MAA8B,EAC9B,OAAsB;IAEtB,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,kBAAkB;SAC5B,CAAC;IACJ,CAAC;IACD,IAAI,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5C,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,kCAAkC;gBACnF,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC9E,CAAC;AAED,4XAA4X;AAC5X,MAAM,UAAU,UAAU,CACxB,MAA2D,EAC3D,aAEI,EAAE,CAAC,iBAAiB;IAExB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC;QACrE,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;YACpD,KAAK,MAAM,KAAK,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;gBACpC,IAAI,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,SAAS;gBAClE,IAAI,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;oBAAE,SAAS;gBAClD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,IAAI,EAAE,EAAE,CACP,UAAU,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,EAAE,CACjF,CAAC;AACJ,CAAC"}

package/dist/core/coordinator-role.d.ts

@@ -0,0 +1,68 @@
+/**
+ * CoordinatorRole: the elected holder of this machine's coordinator duties (agent-comms#341), the stale-agent PID probe, single-authority departure announcements, and the default cc-peer front. Held by gossiped, term-based claim (wire-mesh-core's CoordinatorElection over the spec's coordinator-frame) rather than by whoever binds the well-known port: a higher term always supersedes a lower one, an equal term breaks by lowest device-id, and any live peer can take the role over by raising the term, so a peer that never bound the port can hold it and the port stays only a compatibility first-contact address.
+ *
+ * Claims travel as wire-mesh session frames (MeshTransport.broadcastCoordinatorClaim/sendCoordinatorClaim), and only over sessions to peers on this machine, because both duties the role assigns are facts about one machine: a PID probe can only see local processes and the cc-peer front can only reach local Claude Code sessions.
+ *
+ * When a claim is made: a store claims only when it knows of no incumbent and is the first on the machine as far as it can tell. A store that bound the well-known port with no first-contact presence configured can meet other stores only through that port, so it claims at once; one that may be reachable through first contact (it bound the port, or could neither join nor bind it) first waits one claim wait for an incumbent's announcement, so a store arriving at an existing mesh never takes the role at an equal term before the holder's claim reaches it. Both ends of every machine-local session announce the incumbent they know as the session is enrolled. When the incumbent departs, the lowest device-id among the peers this side has a machine-local session to claims at once at a raised term, and every other survivor claims too if, one claim wait later, the claim it accepts still names a holder it has no session to, which covers a lowest-id peer that is itself gone or was never reachable. The same wait follows accepting a claim whose holder this side has no session to, so a claim naming a device that never joined cannot pin the role vacant.
+ */
+import type { CoordinatorFrame } from "wire-mesh-core/generated/protocol";
+import type { ConnectionHandle, MeshTransport } from "./transport.js";
+/** The claim this side currently accepts, in the hex form the rest of agent-comms addresses peers by. */
+export interface CoordinatorClaimView {
+    term: number;
+    holder: string;
+}
+/** What CoordinatorRole needs from MeshStore. The transport's electionPeerIds, not MeshStore's peer list, decides which peers count as survivors and as reachable holders, because only a peer with a machine-local session can ever claim the role or hear this side's claims. */
+export interface CoordinatorRoleDeps {
+    getPeerId: () => string;
+    requireTransport: () => Pick<MeshTransport, "broadcastCoordinatorClaim" | "sendCoordinatorClaim" | "electionPeerIds">;
+    /** How long this side waits for an incumbent's claim to reach it before claiming the role itself: after the incumbent departs, after accepting a claim whose holder it has no session to, and before a store that may not be alone claims a vacant role. MeshStore passes ROOM_REQUEST_TIMEOUT_MS, the ordinary bound on a frame reaching a connected peer, unless a test shortens it. */
+    claimWaitMs: number;
+    /** Starts the duties the role carries. Never runs concurrently with onLost. */
+    onGained: () => Promise<void>;
+    /** Stops the duties the role carries. Never runs concurrently with onGained. */
+    onLost: () => Promise<void>;
+    onError: (error: unknown) => void;
+}
+export declare class CoordinatorRole {
+    private readonly deps;
+    /** Built on first use rather than at construction, because MeshStore's peerId is assigned after its constructor runs (every bridge sets it to the identity's device-id). */
+    private electionInstance;
+    /** Whether the duties are running here, or are being started; set as each transition begins, so onGained and onLost each fire exactly once per change of holder. */
+    private holding;
+    /** Every onGained and onLost, chained so each starts only once the previous one has finished: a role lost and regained in quick succession must not start the duties while they are still being stopped. */
+    private transitions;
+    /** Set while this side waits out claimWaitMs for an incumbent it can reach. */
+    private claimWait;
+    private stopped;
+    constructor(deps: Readonly<CoordinatorRoleDeps>);
+    private get election();
+    /** Whether this side holds the role now. */
+    isHolder(): boolean;
+    /** The claim this side currently accepts, or undefined when it has neither made nor heard one. */
+    current(): CoordinatorClaimView | undefined;
+    /** Claims the role at once when this side knows of no incumbent at all. Called by a store that can meet no other store except through the well-known port it just bound; a no-op once any claim has been made or heard. */
+    claimIfVacant(): Promise<void>;
+    /** Claims the role one claim wait from now, unless by then this side has accepted a claim naming a holder it can reach. Called by a store that is alone as far as the well-known port tells it but may yet meet an incumbent through first contact, which gets that long to announce itself. */
+    claimIfVacantAfterWait(): void;
+    /** Tells a peer whose machine-local session was just enrolled which claim this side accepts, so a joiner learns the incumbent instead of claiming over it. A no-op while this side knows of none. */
+    announceTo(handle: Readonly<ConnectionHandle>): Promise<void>;
+    /** Evaluates a claim a peer gossiped. An accepted claim is gossiped on to every peer so the supersession reaches peers the sender is not connected to, and when it names a holder this side has no session to, this side waits one claim wait for that holder to appear before claiming over it; a stale or tiebreak-losing claim is answered with the incumbent so its sender converges. Receiving the incumbent itself is neither, and is dropped without a reply, which is what stops two peers that agree from echoing it forever. */
+    handleClaim(handle: Readonly<ConnectionHandle>, frame: Readonly<CoordinatorFrame>): Promise<void>;
+    /** Recovers the role when the departed peer held it. The lowest device-id among the peers this side has a machine-local session to claims at once at a raised term; every other survivor waits one claim wait and claims itself if the claim it then accepts still names a holder it has no session to, then runs onDelayedTakeover (the caller's single-authority announcement of the departed holder, which a delayed successor makes too). */
+    handleDeparture(peerId: string, onDelayedTakeover: () => Promise<void>): Promise<void>;
+    /** Stops taking part and gives the duties up if this side held them, once any transition still running has finished. Idempotent. */
+    stop(): Promise<void>;
+    private isLowestSurvivor;
+    /** Whether the claim this side accepts leaves the role without a holder it can reach: there is no claim at all, or it names a device that is neither this side nor a peer this side has a machine-local session to. */
+    private incumbentUnreachable;
+    /** Waits one claim wait, then claims at a raised term and runs onTakeover (when given) if the incumbent is still unreachable. Replaces any wait already running, since only the latest accepted claim decides whether a takeover is due. */
+    private startClaimWait;
+    private claim;
+    private cancelClaimWait;
+    /** Queues a transition to whatever holding should now be. Resolves once that transition has run, and rejects with its failure; the chain itself carries on past a failure, which reaches this call's caller instead. */
+    private syncHolding;
+    /** Starts or stops the duties when the incumbent changed to or from this side since the previous transition. Reads the election afresh when the transition actually runs, not when it was queued, so a claim evaluated while an earlier transition was still running is reflected exactly once. */
+    private applyHolding;
+}
+//# sourceMappingURL=coordinator-role.d.ts.map

package/dist/core/coordinator-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator-role.d.ts","sourceRoot":"","sources":["../../src/core/coordinator-role.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEtE,yGAAyG;AACzG,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mRAAmR;AACnR,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,IAAI,CAC1B,aAAa,EACb,2BAA2B,GAAG,sBAAsB,GAAG,iBAAiB,CACzE,CAAC;IACF,0XAA0X;IAC1X,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,gFAAgF;IAChF,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACnC;AAYD,qBAAa,eAAe;IAWd,OAAO,CAAC,QAAQ,CAAC,IAAI;IAVjC,4KAA4K;IAC5K,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,oKAAoK;IACpK,OAAO,CAAC,OAAO,CAAS;IACxB,4MAA4M;IAC5M,OAAO,CAAC,WAAW,CAAoC;IACvD,+EAA+E;IAC/E,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,OAAO,CAAS;gBAEK,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC;IAEhE,OAAO,KAAK,QAAQ,GAKnB;IAED,4CAA4C;IAC5C,QAAQ,IAAI,OAAO;IAInB,kGAAkG;IAClG,OAAO,IAAI,oBAAoB,GAAG,SAAS;IAM3C,2NAA2N;IACrN,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAKpC,gSAAgS;IAChS,sBAAsB,IAAI,IAAI;IAK9B,qMAAqM;IAC/L,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnE,0gBAA0gB;IACpgB,WAAW,CACf,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAClC,KAAK,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC;IAkBhB,ibAAib;IAC3a,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC;IAShB,oIAAoI;IAC9H,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAM3B,OAAO,CAAC,gBAAgB;IAUxB,uNAAuN;IACvN,OAAO,CAAC,oBAAoB;IAO5B,4OAA4O;IAC5O,OAAO,CAAC,cAAc;YAaR,KAAK;IAMnB,OAAO,CAAC,eAAe;IAMvB,wNAAwN;YAC1M,WAAW;IAMzB,mSAAmS;YACrR,YAAY;CAM3B"}