botmux 3.18.3 → 3.18.4

package/dist/core/daemon-ipc-auth.d.ts

@@ -15,6 +15,14 @@ export declare function daemonIpcAuthHeaders(input: {
 /** Read the host-only daemon IPC secret. Sandboxed callers fail closed because
  * ~/.botmux is masked by the bwrap plan. */
 export declare function loadDaemonIpcSecret(secretPath?: string): string;
-/** Trusted-host fetch wrapper for daemon IPC. */
+/** Trusted-host fetch wrapper for daemon IPC.
+ *
+ * ⚠️ Uses {@link loopbackFetch}, never the global `fetch`: under Bun the global
+ * one routes 127.0.0.1 through `$http_proxy` whenever `no_proxy` does not name
+ * that literal address (CIDR and `localhost` do not count), and the corporate
+ * proxy answers an nginx HTML 403. Verified against this wrapper with a real Bun
+ * process and a stand-in proxy: global fetch → 403 from the proxy;
+ * `loopbackFetch` → straight to the daemon. See src/core/loopback-fetch.ts.
+ */
 export declare function fetchDaemonIpc(port: number, path: string, init?: RequestInit, secret?: string): Promise<Response>;
 //# sourceMappingURL=daemon-ipc-auth.d.ts.map

package/dist/core/daemon-ipc-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-ipc-auth.d.ts","sourceRoot":"","sources":["../../src/core/daemon-ipc-auth.ts"],"names":[],"mappings":"AAUA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB,GAAG,OAAO,CAWV;AAED;4CAC4C;AAC5C,wBAAgB,mBAAmB,CAAC,UAAU,SAAsB,GAAG,MAAM,CAI5E;AAED,iDAAiD;AACjD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,WAAgB,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CAanB"}
+{"version":3,"file":"daemon-ipc-auth.d.ts","sourceRoot":"","sources":["../../src/core/daemon-ipc-auth.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB,GAAG,OAAO,CAWV;AAED;4CAC4C;AAC5C,wBAAgB,mBAAmB,CAAC,UAAU,SAAsB,GAAG,MAAM,CAI5E;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,WAAgB,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CAenB"}

package/dist/core/daemon-ipc-auth.js

@@ -1,6 +1,7 @@
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { cliAuthBind, loadDashboardSecret, signCliAuth, } from '../dashboard/auth.js';
+import { loopbackFetch } from './loopback-fetch.js';
 const DEFAULT_SECRET_PATH = join(homedir(), '.botmux', '.dashboard-secret');
 /**
  * Build a route- and port-bound authorization header for the daemon's
@@ -26,12 +27,22 @@ export function loadDaemonIpcSecret(secretPath = DEFAULT_SECRET_PATH) {
         throw new Error(`daemon IPC secret is missing or empty: ${secretPath}`);
     return secret;
 }
-/** Trusted-host fetch wrapper for daemon IPC. */
+/** Trusted-host fetch wrapper for daemon IPC.
+ *
+ * ⚠️ Uses {@link loopbackFetch}, never the global `fetch`: under Bun the global
+ * one routes 127.0.0.1 through `$http_proxy` whenever `no_proxy` does not name
+ * that literal address (CIDR and `localhost` do not count), and the corporate
+ * proxy answers an nginx HTML 403. Verified against this wrapper with a real Bun
+ * process and a stand-in proxy: global fetch → 403 from the proxy;
+ * `loopbackFetch` → straight to the daemon. See src/core/loopback-fetch.ts.
+ */
 export async function fetchDaemonIpc(port, path, init = {}, secret) {
     const resolvedSecret = secret ?? loadDaemonIpcSecret();
     const method = init.method ?? 'GET';
-    return fetch(`http://127.0.0.1:${port}${path}`, {
-        ...init,
+    return loopbackFetch(`http://127.0.0.1:${port}${path}`, {
+        method,
+        body: init.body,
+        signal: init.signal ?? undefined,
         headers: daemonIpcAuthHeaders({
             secret: resolvedSecret,
             port,

package/dist/core/daemon-ipc-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-ipc-auth.js","sourceRoot":"","sources":["../../src/core/daemon-ipc-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAMpC;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IAChF,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,CAAC,MAAM,EACZ,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAChD,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4CAC4C;AAC5C,MAAM,UAAU,mBAAmB,CAAC,UAAU,GAAG,mBAAmB;IAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,IAAY,EACZ,OAAoB,EAAE,EACtB,MAAe;IAEf,MAAM,cAAc,GAAG,MAAM,IAAI,mBAAmB,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IACpC,OAAO,KAAK,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE;QAC9C,GAAG,IAAI;QACP,OAAO,EAAE,oBAAoB,CAAC;YAC5B,MAAM,EAAE,cAAc;YACtB,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"daemon-ipc-auth.js","sourceRoot":"","sources":["../../src/core/daemon-ipc-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAA0B,MAAM,qBAAqB,CAAC;AAE5E,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAMpC;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IAChF,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,CAAC,MAAM,EACZ,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAChD,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4CAC4C;AAC5C,MAAM,UAAU,mBAAmB,CAAC,UAAU,GAAG,mBAAmB;IAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,IAAY,EACZ,OAAoB,EAAE,EACtB,MAAe;IAEf,MAAM,cAAc,GAAG,MAAM,IAAI,mBAAmB,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IACpC,OAAO,aAAa,CAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE;QACtD,MAAM;QACN,IAAI,EAAE,IAAI,CAAC,IAAiC;QAC5C,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;QAChC,OAAO,EAAE,oBAAoB,CAAC;YAC5B,MAAM,EAAE,cAAc;YACtB,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/core/loopback-fetch.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `fetch`-shaped client for **loopback-only** HTTP, built on `node:http`.
+ *
+ * ⚠️ WHY THIS EXISTS — DO NOT "SIMPLIFY" ANY CALLER BACK TO THE GLOBAL `fetch`.
+ *
+ * Bun's `fetch` automatically routes through `$http_proxy`, and its `no_proxy`
+ * handling is **literal-match only**: it does not parse CIDR notation and does
+ * not treat `localhost` as covering `127.0.0.1`. Corporate dev machines commonly
+ * export exactly that shape (`http_proxy=…` plus `no_proxy=…,127.0.0.0/8,…`), so
+ * a request to our OWN loopback port gets handed to the corporate proxy, which
+ * refuses to forward an internal address and answers with an nginx HTML
+ * `403 Forbidden`. The user sees a failure naming a service that is running
+ * perfectly well two ports away.
+ *
+ * Measured on Bun 1.4.0 (source AND `bun build --compile`), one fresh process per
+ * row because Bun snapshots proxy configuration at startup:
+ *
+ *   no_proxy unset / ""        → proxied
+ *   no_proxy=127.0.0.0/8       → proxied      ← the common corporate shape
+ *   no_proxy=localhost         → proxied      ← does NOT cover 127.0.0.1
+ *   no_proxy=127.0.0.1         → direct
+ *   no_proxy=*                 → direct
+ *
+ * And the obvious escapes do not work:
+ *
+ *   fetch(…, {proxy: ''|undefined|null})  → still proxied (option exists ≠ works)
+ *   delete process.env.http_proxy at run  → still proxied (startup snapshot)
+ *   setting  process.env.http_proxy later → still direct  (same reason)
+ *
+ * `node:http` ignores proxy environment variables entirely, in both Node and Bun,
+ * which is the only reliable way to guarantee a loopback dial stays loopback.
+ * Related precedent: `platform/platform-http.ts` (deliberately avoids undici) and
+ * `dashboard/hd2d-assets.ts` (the reverse case — it WANTS the proxy).
+ */
+/** The subset of RequestInit our loopback callers use. */
+export interface LoopbackFetchInit {
+    method?: string;
+    headers?: HeadersInit;
+    /** Accepts what `fetch` accepts; streams are the one thing we cannot forward. */
+    body?: BodyInit | null;
+    signal?: AbortSignal | null;
+}
+/** Install (or clear, with `undefined`) the test transport. Returns the previous one. */
+export declare function __setLoopbackTransportForTests(next: ((url: string, init: LoopbackFetchInit) => Promise<Response>) | undefined): ((url: string, init: LoopbackFetchInit) => Promise<Response>) | undefined;
+export declare function loopbackFetch(url: string, init?: LoopbackFetchInit): Promise<Response>;
+/** `typeof fetch`-compatible view, for defaulting an injectable `fetchImpl`. */
+export declare const loopbackFetchImpl: typeof fetch;
+/**
+ * Is this URL a literal loopback target, i.e. safe (and necessary) to send through
+ * {@link loopbackFetch}? For call sites whose base URL is configurable and may
+ * legitimately point at a remote host — those must keep using the global fetch,
+ * which handles TLS, redirects and real proxying.
+ *
+ * Literal only, deliberately: a DNS name that currently resolves to 127.0.0.1
+ * is not a loopback guarantee (it can be re-pointed), and `loopbackFetch`'s own
+ * guard would reject it anyway.
+ */
+export declare function isLoopbackUrl(url: string): boolean;
+//# sourceMappingURL=loopback-fetch.d.ts.map

package/dist/core/loopback-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-fetch.d.ts","sourceRoot":"","sources":["../../src/core/loopback-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iFAAiF;IACjF,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AA4FD,yFAAyF;AACzF,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,GAC9E,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,CAI3E;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAyJnB;AAED,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,EAA+B,OAAO,KAAK,CAAC;AAE1E;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWlD"}

package/dist/core/loopback-fetch.js

@@ -0,0 +1,347 @@
+/**
+ * `fetch`-shaped client for **loopback-only** HTTP, built on `node:http`.
+ *
+ * ⚠️ WHY THIS EXISTS — DO NOT "SIMPLIFY" ANY CALLER BACK TO THE GLOBAL `fetch`.
+ *
+ * Bun's `fetch` automatically routes through `$http_proxy`, and its `no_proxy`
+ * handling is **literal-match only**: it does not parse CIDR notation and does
+ * not treat `localhost` as covering `127.0.0.1`. Corporate dev machines commonly
+ * export exactly that shape (`http_proxy=…` plus `no_proxy=…,127.0.0.0/8,…`), so
+ * a request to our OWN loopback port gets handed to the corporate proxy, which
+ * refuses to forward an internal address and answers with an nginx HTML
+ * `403 Forbidden`. The user sees a failure naming a service that is running
+ * perfectly well two ports away.
+ *
+ * Measured on Bun 1.4.0 (source AND `bun build --compile`), one fresh process per
+ * row because Bun snapshots proxy configuration at startup:
+ *
+ *   no_proxy unset / ""        → proxied
+ *   no_proxy=127.0.0.0/8       → proxied      ← the common corporate shape
+ *   no_proxy=localhost         → proxied      ← does NOT cover 127.0.0.1
+ *   no_proxy=127.0.0.1         → direct
+ *   no_proxy=*                 → direct
+ *
+ * And the obvious escapes do not work:
+ *
+ *   fetch(…, {proxy: ''|undefined|null})  → still proxied (option exists ≠ works)
+ *   delete process.env.http_proxy at run  → still proxied (startup snapshot)
+ *   setting  process.env.http_proxy later → still direct  (same reason)
+ *
+ * `node:http` ignores proxy environment variables entirely, in both Node and Bun,
+ * which is the only reliable way to guarantee a loopback dial stays loopback.
+ * Related precedent: `platform/platform-http.ts` (deliberately avoids undici) and
+ * `dashboard/hd2d-assets.ts` (the reverse case — it WANTS the proxy).
+ */
+import { Buffer } from 'node:buffer';
+import { requestLiteralLoopback } from './loopback-target.js';
+/** Normalise a fetch-style body to bytes. Streams are rejected loudly rather
+ *  than silently sent as "[object ReadableStream]". */
+function bodyToBuffer(body) {
+    if (body == null)
+        return undefined;
+    if (typeof body === 'string')
+        return Buffer.from(body);
+    if (Buffer.isBuffer(body))
+        return body;
+    if (body instanceof URLSearchParams)
+        return Buffer.from(body.toString());
+    if (body instanceof ArrayBuffer)
+        return Buffer.from(new Uint8Array(body));
+    if (ArrayBuffer.isView(body)) {
+        return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+    }
+    throw new TypeError('loopbackFetch: unsupported body type (streams/FormData are not forwarded)');
+}
+function headerEntries(headers) {
+    if (!headers)
+        return {};
+    // `Headers` (and anything iterable of pairs) normalises casing for us; a plain
+    // object is passed through as written.
+    const out = {};
+    if (headers instanceof Headers) {
+        headers.forEach((value, key) => { out[key] = value; });
+        return out;
+    }
+    if (Array.isArray(headers)) {
+        for (const [k, v] of headers)
+            out[k] = String(v);
+        return out;
+    }
+    for (const [k, v] of Object.entries(headers))
+        out[k] = String(v);
+    return out;
+}
+/**
+ * The error an aborted request must fail with.
+ *
+ * ⚠️ Callers branch on `err.name === 'AbortError'` to tell "timed out" from
+ * "nothing listening" — e.g. daemon.ts returns 504 `wait_timeout` vs 503
+ * `daemon_offline`, and command-handler.ts reports `busy` vs `failed`. A plain
+ * `new Error('aborted')` (or node:http's own ECONNRESET) silently sends every
+ * timeout down the wrong branch. Measured against the global fetch these replace:
+ * it rejects with `name=AbortError`, while the first version of this module gave
+ * `name=Error, code=ECONNRESET`.
+ *
+ * `signal.reason` is what the platform puts there (a DOMException named
+ * AbortError, or whatever the caller passed to `abort(reason)`); we only
+ * synthesise an equivalent when it is somehow absent.
+ */
+function abortError(signal) {
+    const reason = signal?.reason;
+    if (reason !== undefined && reason !== null)
+        return reason;
+    // Node and browsers both expose DOMException; fall back to a shaped Error.
+    if (typeof DOMException === 'function') {
+        return new DOMException('The operation was aborted.', 'AbortError');
+    }
+    const err = new Error('The operation was aborted.');
+    err.name = 'AbortError';
+    return err;
+}
+/**
+ * Issue one request to a literal loopback host and resolve a real `Response`, so
+ * call sites keep using `.ok` / `.status` / `.json()` / `.text()` unchanged.
+ *
+ * ⚠️ Resolves as soon as the response HEADERS arrive, with the body exposed as a
+ * `ReadableStream` — it must NOT buffer to completion first. `dashboard/aggregator.ts`
+ * subscribes to a never-ending SSE stream (`/api/events`) and reads frames off
+ * `res.body`; a buffer-all implementation never resolves for those callers and the
+ * whole session/event aggregation silently stops. Measured: a server that writes
+ * one frame and holds the connection open produced no Response at all until this
+ * was made streaming. `.text()`/`.json()` still work, because `Response` drains
+ * the stream for them.
+ *
+ * Rejects the way `fetch` does (a transport failure) rather than resolving a
+ * synthetic error status, because callers distinguish "no server there" from
+ * "server said no".
+ */
+/**
+ * Test-only transport override.
+ *
+ * ⚠️ Why this seam exists: several suites drive loopback code paths by replacing
+ * `globalThis.fetch`. Moving those call sites onto node:http silently bypassed
+ * that stub, so the tests began making REAL connections to ports like 4310/39003
+ * — `fetchMock` recorded 0 calls and the assertions failed for a reason unrelated
+ * to what they test. Rather than push every caller back onto the global fetch (the
+ * whole defect), the transport itself is injectable: production keeps node:http,
+ * tests install a mock here.
+ *
+ * Not for production use — `__setLoopbackTransportForTests(undefined)` restores the default.
+ */
+let transportOverride;
+/** Install (or clear, with `undefined`) the test transport. Returns the previous one. */
+export function __setLoopbackTransportForTests(next) {
+    const previous = transportOverride;
+    transportOverride = next;
+    return previous;
+}
+export function loopbackFetch(url, init = {}) {
+    if (transportOverride)
+        return transportOverride(url, init);
+    const target = new URL(url);
+    // ⚠️ FAIL CLOSED on the scheme. This transport IS node:http, so an `https:` URL
+    // would be dialled as PLAINTEXT — measured: `loopbackFetch('https://127.0.0.1:P')`
+    // against a plain HTTP server returned `200 PLAIN`, i.e. a caller that believed it
+    // was using TLS would have sent its credentials in the clear. `isLoopbackUrl`
+    // already refuses https, but a public helper must not depend on callers routing
+    // through a predicate first.
+    if (target.protocol !== 'http:') {
+        return Promise.reject(new TypeError(`loopbackFetch: only http: is supported (got ${target.protocol})`));
+    }
+    // `URL.hostname` keeps IPv6 in brackets (`[::1]`), but node:http — and
+    // requestLiteralLoopback's allow-list — want the bare address. Passing the
+    // bracketed form through was rejected as `remote_host_forbidden`, i.e. a legal
+    // IPv6 loopback URL could never be dialled (measured against a `::1` server).
+    const host = normaliseLoopbackHost(target.hostname);
+    // `URL` normalises away a scheme's DEFAULT port, so both `http://127.0.0.1/x` and
+    // an explicit `http://127.0.0.1:80/x` yield `port === ''` — `Number('')` is 0 and
+    // was rejected as `invalid_port` (measured against a local server on :80, which the
+    // native fetch reaches fine). Fill in the scheme default.
+    const port = target.port ? Number(target.port) : 80;
+    const method = (init.method ?? 'GET').toUpperCase();
+    const headers = headerEntries(init.headers);
+    const body = bodyToBuffer(init.body);
+    // A body without a length makes some servers wait for more; be explicit.
+    if (body && headers['content-length'] === undefined && headers['Content-Length'] === undefined) {
+        headers['content-length'] = String(body.byteLength);
+    }
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (fn) => { if (!settled) {
+            settled = true;
+            fn();
+        } };
+        // Set once the signal fires, so the body stream can fail with the SAME
+        // AbortError instead of the socket's ECONNRESET.
+        let aborted;
+        // ⚠️ The abort listener MUST be removed once this request can no longer be
+        // aborted. `{ once: true }` only fires-and-forgets on a real abort; a request
+        // that simply COMPLETED left its listener attached, and `dashboard/aggregator.ts`
+        // reuses one AbortController across an unbounded SSE reconnect loop — measured,
+        // 12 completed requests left 12 listeners, each pinning a finished req/res and
+        // its closure, and a later abort would destroy every stale request in turn.
+        let detachAbort = () => { };
+        let req;
+        try {
+            req = requestLiteralLoopback(
+            // Dial the parsed host/port explicitly (and validated as loopback) rather
+            // than handing over the URL, so nothing can re-target the request.
+            { host, port }, {
+                path: `${target.pathname}${target.search}`,
+                method,
+                headers,
+            }, res => {
+                const status = res.statusCode ?? 0;
+                // Fetch's null-body statuses that can actually ARRIVE HERE are 204/205/304,
+                // plus any HEAD response. 101 is deliberately absent: node:http never calls
+                // this callback for it (it emits `upgrade` instead — handled below), so a
+                // `status === 101` branch here would be dead code that reads as covered. `new Response(stream, {status:205})` THROWS,
+                // and it throws inside this async callback — on Node that escaped as an
+                // uncaught exception and killed the process, while Bun happens to tolerate
+                // 205, which is exactly why it went unnoticed.
+                const bodyless = status === 204 || status === 205
+                    || status === 304 || method === 'HEAD';
+                const stream = bodyless ? null : new ReadableStream({
+                    start(controller) {
+                        res.on('data', (chunk) => {
+                            try {
+                                controller.enqueue(new Uint8Array(Buffer.from(chunk)));
+                            }
+                            catch { /* already closed by a cancel() */ }
+                        });
+                        res.on('end', () => {
+                            detachAbort();
+                            try {
+                                controller.close();
+                            }
+                            catch { /* already closed */ }
+                        });
+                        res.on('error', err => {
+                            detachAbort();
+                            // An abort must surface as AbortError, not the ECONNRESET that
+                            // destroying the socket produces.
+                            try {
+                                controller.error(aborted ?? err);
+                            }
+                            catch { /* already errored */ }
+                        });
+                    },
+                    // A consumer that stops reading (or aborts) must tear the socket down,
+                    // otherwise a never-ending SSE keeps the connection and the process alive.
+                    cancel() { detachAbort(); res.destroy(); req.destroy(); },
+                });
+                if (bodyless)
+                    detachAbort();
+                // Wrapped: any status the Response constructor refuses (an upstream
+                // sending something illegal) must reject this promise, never escape as an
+                // uncaught exception out of an HTTP event callback.
+                let response;
+                try {
+                    response = new Response(stream, {
+                        status,
+                        statusText: res.statusMessage ?? '',
+                        headers: Object.fromEntries(Object.entries(res.headers)
+                            .filter((entry) => typeof entry[1] === 'string')),
+                    });
+                }
+                catch (err) {
+                    detachAbort();
+                    res.destroy();
+                    finish(() => reject(err));
+                    return;
+                }
+                finish(() => resolve(response));
+            });
+        }
+        catch (err) {
+            // Invalid host/port (the loopback guard) — surface it, do not hang.
+            detachAbort();
+            finish(() => reject(err));
+            return;
+        }
+        // ⚠️ A 101 arrives as `upgrade`, NOT as a response. Without this listener the
+        // promise never settles: measured against a server answering 101, the call only
+        // ended when an external AbortSignal fired at 800ms (and `requestDashboardAt`
+        // passes no signal at all, so it would hang forever if the recorded port happened
+        // to be a WebSocket service). The native fetch rejects such a response in ~1ms;
+        // do the same, since a fetch-shaped client cannot express a protocol switch.
+        req.on('upgrade', (_res, socket) => {
+            socket.destroy();
+            req.destroy();
+            detachAbort();
+            finish(() => reject(new TypeError('loopbackFetch: server switched protocols (101); this client does not support upgrades')));
+        });
+        // Only a failure BEFORE the response headers can reject the promise; once the
+        // Response exists, later socket errors surface through the stream instead.
+        req.on('error', err => { detachAbort(); finish(() => reject(aborted ?? err)); });
+        if (init.signal) {
+            const signal = init.signal;
+            const onAbort = () => {
+                aborted = abortError(signal);
+                req.destroy();
+                finish(() => reject(aborted));
+            };
+            if (signal.aborted) {
+                onAbort();
+                return;
+            }
+            signal.addEventListener('abort', onAbort, { once: true });
+            detachAbort = () => {
+                signal.removeEventListener('abort', onAbort);
+                detachAbort = () => { };
+            };
+        }
+        if (body)
+            req.end(body);
+        else
+            req.end();
+    });
+}
+/** `typeof fetch`-compatible view, for defaulting an injectable `fetchImpl`. */
+export const loopbackFetchImpl = loopbackFetch;
+/**
+ * Is this URL a literal loopback target, i.e. safe (and necessary) to send through
+ * {@link loopbackFetch}? For call sites whose base URL is configurable and may
+ * legitimately point at a remote host — those must keep using the global fetch,
+ * which handles TLS, redirects and real proxying.
+ *
+ * Literal only, deliberately: a DNS name that currently resolves to 127.0.0.1
+ * is not a loopback guarantee (it can be re-pointed), and `loopbackFetch`'s own
+ * guard would reject it anyway.
+ */
+export function isLoopbackUrl(url) {
+    try {
+        const parsed = new URL(url);
+        // `http:` only — this transport IS node:http, so reporting an `https:` URL as
+        // loopback-safe would steer a caller onto a transport that cannot serve it.
+        if (parsed.protocol !== 'http:')
+            return false;
+        const host = normaliseLoopbackHost(parsed.hostname);
+        return host === '127.0.0.1' || host === '::1';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Canonicalise a hostname for the loopback allow-list.
+ *
+ *  · Strips the brackets `URL.hostname` keeps around IPv6 literals.
+ *  · Maps `localhost` to `127.0.0.1`.
+ *
+ * ⚠️ `localhost` USED to be rejected here, on the reasoning that "a DNS name is
+ * not a loopback guarantee". That was backwards: refusing it did not avoid a
+ * lookup, it pushed the request onto the GLOBAL fetch, which then proxied it —
+ * measured with a self-hosted TTS endpoint, the `Authorization: Bearer …` header
+ * arrived at the stand-in proxy. `localhost` is reserved for loopback by RFC 6761,
+ * and mapping it here means we dial the literal address and never resolve DNS at
+ * all, which is strictly safer than the alternative. Every OTHER hostname stays
+ * rejected — that is where the rebinding concern actually applies.
+ */
+function normaliseLoopbackHost(hostname) {
+    const bare = hostname.startsWith('[') && hostname.endsWith(']')
+        ? hostname.slice(1, -1)
+        : hostname;
+    return bare === 'localhost' ? '127.0.0.1' : bare;
+}
+//# sourceMappingURL=loopback-fetch.js.map

package/dist/core/loopback-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-fetch.js","sourceRoot":"","sources":["../../src/core/loopback-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAA4B,MAAM,sBAAsB,CAAC;AAWxF;uDACuD;AACvD,SAAS,YAAY,CAAC,IAAiC;IACrD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,YAAY,eAAe;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,2EAA2E,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,OAAgC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,+EAA+E;IAC/E,uCAAuC;IACvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,UAAU,CAAC,MAAsC;IACxD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC3D,2EAA2E;IAC3E,IAAI,OAAO,YAAY,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACpD,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;GAYG;AACH,IAAI,iBAA4F,CAAC;AAEjG,yFAAyF;AACzF,MAAM,UAAU,8BAA8B,CAC5C,IAA+E;IAE/E,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IACnC,iBAAiB,GAAG,IAAI,CAAC;IACzB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,OAA0B,EAAE;IAE5B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,gFAAgF;IAChF,mFAAmF;IACnF,mFAAmF;IACnF,8EAA8E;IAC9E,gFAAgF;IAChF,6BAA6B;IAC7B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CACjC,+CAA+C,MAAM,CAAC,QAAQ,GAAG,CAClE,CAAC,CAAC;IACL,CAAC;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAwB,CAAC;IAC3E,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,0DAA0D;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,yEAAyE;IACzE,IAAI,IAAI,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/F,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,EAAE,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,uEAAuE;QACvE,iDAAiD;QACjD,IAAI,OAAgB,CAAC;QACrB,2EAA2E;QAC3E,8EAA8E;QAC9E,kFAAkF;QAClF,gFAAgF;QAChF,+EAA+E;QAC/E,4EAA4E;QAC5E,IAAI,WAAW,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QAE3B,IAAI,GAA8C,CAAC;QACnD,IAAI,CAAC;YACH,GAAG,GAAG,sBAAsB;YAC1B,0EAA0E;YAC1E,mEAAmE;YACnE,EAAE,IAAI,EAAE,IAAI,EAAE,EACd;gBACE,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;gBAC1C,MAAM;gBACN,OAAO;aACR,EACD,GAAG,CAAC,EAAE;gBACJ,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACnC,4EAA4E;gBAC5E,4EAA4E;gBAC5E,0EAA0E;gBAC1E,sHAAsH;gBACtH,wEAAwE;gBACxE,2EAA2E;gBAC3E,+CAA+C;gBAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;uBAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,MAAM,CAAC;gBACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,cAAc,CAAa;oBAC9D,KAAK,CAAC,UAAU;wBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;4BACxC,IAAI,CAAC;gCAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;4BAAC,CAAC;4BAC/D,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;wBAC9C,CAAC,CAAC,CAAC;wBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;4BACjB,WAAW,EAAE,CAAC;4BACd,IAAI,CAAC;gCAAC,UAAU,CAAC,KAAK,EAAE,CAAC;4BAAC,CAAC;4BAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;wBAC5D,CAAC,CAAC,CAAC;wBACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;4BACpB,WAAW,EAAE,CAAC;4BACd,+DAA+D;4BAC/D,kCAAkC;4BAClC,IAAI,CAAC;gCAAC,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;4BAAC,CAAC;4BAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;wBAC3E,CAAC,CAAC,CAAC;oBACL,CAAC;oBACD,uEAAuE;oBACvE,2EAA2E;oBAC3E,MAAM,KAAK,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;iBAC1D,CAAC,CAAC;gBACH,IAAI,QAAQ;oBAAE,WAAW,EAAE,CAAC;gBAC5B,oEAAoE;gBACpE,0EAA0E;gBAC1E,oDAAoD;gBACpD,IAAI,QAAkB,CAAC;gBACvB,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE;wBAC9B,MAAM;wBACN,UAAU,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;wBACnC,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;6BACxB,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAC9E;qBACF,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,WAAW,EAAE,CAAC;oBACd,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1B,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClC,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,gFAAgF;QAChF,8EAA8E;QAC9E,kFAAkF;QAClF,gFAAgF;QAChF,6EAA6E;QAC7E,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,SAAS,CAC/B,uFAAuF,CACxF,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,8EAA8E;QAC9E,2EAA2E;QAC3E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC7B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC1C,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,WAAW,GAAG,GAAG,EAAE;gBACjB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,WAAW,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YACzB,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;YAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAwC,CAAC;AAE1E;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,8EAA8E;QAC9E,4EAA4E;QAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IACb,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC"}

package/dist/core/managed-origin-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-origin-attestation.d.ts","sourceRoot":"","sources":["../../src/core/managed-origin-attestation.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,2BAA2B,yCAAyC,CAAC;AAClF,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAGjD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC7E,MAAM,EAAE,OAAO,2BAA2B,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED;;4EAE4E;AAC5E,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,6BAA6B,CAAC;CACtC,GAAG,MAAM,CAkDT;AAqED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,+BAA+B,CAAC;IACzC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACvE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA4EpC"}
+{"version":3,"file":"managed-origin-attestation.d.ts","sourceRoot":"","sources":["../../src/core/managed-origin-attestation.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,2BAA2B,yCAAyC,CAAC;AAClF,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAGjD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC7E,MAAM,EAAE,OAAO,2BAA2B,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED;;4EAE4E;AAC5E,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,6BAA6B,CAAC;CACtC,GAAG,MAAM,CAkDT;AAqED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,+BAA+B,CAAC;IACzC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACvE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA4EpC"}

package/dist/core/managed-origin-attestation.js

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto';
+import { loopbackFetchImpl } from './loopback-fetch.js';
 import { closeSync, constants as fsConstants, fstatSync, openSync, readSync, unlinkSync, writeSync, } from 'node:fs';
 import { ensureManagedOriginAttestationDirectory, managedOriginAttestationProofPath, } from './managed-origin-capability.js';
 export const MANAGED_ORIGIN_ATTEST_ROUTE = '/api/session-origin/attest';
@@ -156,7 +157,7 @@ export async function attestManagedOrigin(input) {
     timer.unref?.();
     let response;
     try {
-        response = await (input.fetchImpl ?? fetch)(`http://127.0.0.1:${port}${MANAGED_ORIGIN_ATTEST_ROUTE}`, {
+        response = await (input.fetchImpl ?? loopbackFetchImpl)(`http://127.0.0.1:${port}${MANAGED_ORIGIN_ATTEST_ROUTE}`, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify({

package/dist/core/managed-origin-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"managed-origin-attestation.js","sourceRoot":"","sources":["../../src/core/managed-origin-attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uCAAuC,EACvC,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,sCAAsC,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC;AA2BjC,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;4EAE4E;AAC5E,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,MAAM,GAAG,GAAG,uCAAuC,CACjD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,SAAS,CACtB,CAAC;IACF,MAAM,IAAI,GAAG,iCAAiC,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,KAAK,CAClB,CAAC;IACF,IAAI,EAAsB,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM;cAC3D,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,EACjC,KAAK,CACN,CAAC;QACF,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;eAC1D,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACxE,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjF,MAAM,IAAI,OAAO,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iCAAiC,CAAC,IAAY;IACrD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,CAC9E,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;eAC1D,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;eACvD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,IAAI,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAKtB;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAgC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,2BAA2B,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;WAClE,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WAC3B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;WAC3C,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;WAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;WAC1F,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;WAC1E,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK;WACtC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,GAAG,2BAA2B;WAC5D,OAAO,KAAK,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS;QACzD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;eACtC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC;eAC3C,KAAK,CAAC,eAAe,GAAG,CAAC;YAC5B,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,UAAU,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,6BAA6B,CACrC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,6BAA6B,CAAC,mCAAmC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,iCAAiC,CACjD,KAAK,CAAC,OAAO,CAAC,OAAO,EACrB,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,KAAK,CACN,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CACzC,oBAAoB,IAAI,GAAG,2BAA2B,EAAE,EACxD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;gBAC1C,KAAK;aACN,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,6BAA6B,CACrC,UAAU,CAAC,MAAM,CAAC,OAAO;YACvB,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC/F,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;QAClF,MAAM,IAAI,6BAA6B,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACtF,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,aAAa,CAAC;YAC1B,KAAK,EAAE,iCAAiC,CAAC,SAAS,CAAC;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,6BAA6B,CAAC,yCAAyC,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"managed-origin-attestation.js","sourceRoot":"","sources":["../../src/core/managed-origin-attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uCAAuC,EACvC,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,sCAAsC,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC;AA2BjC,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;4EAE4E;AAC5E,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,MAAM,GAAG,GAAG,uCAAuC,CACjD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,SAAS,CACtB,CAAC;IACF,MAAM,IAAI,GAAG,iCAAiC,CAC5C,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,KAAK,CAAC,KAAK,CAClB,CAAC;IACF,IAAI,EAAsB,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM;cAC3D,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,EACjC,KAAK,CACN,CAAC;QACF,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;eAC1D,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACxE,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjF,MAAM,IAAI,OAAO,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iCAAiC,CAAC,IAAY;IACrD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,CAC9E,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;eAC1D,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;eACvD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,IAAI,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAKtB;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAgC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,2BAA2B,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;WAClE,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WAC3B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;WAC3C,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;WAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;WAC1F,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;WAC1E,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK;WACtC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,GAAG,2BAA2B;WAC5D,OAAO,KAAK,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS;QACzD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;eACtC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC;eAC3C,KAAK,CAAC,eAAe,GAAG,CAAC;YAC5B,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,UAAU,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,6BAA6B,CACrC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,6BAA6B,CAAC,mCAAmC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,iCAAiC,CACjD,KAAK,CAAC,OAAO,CAAC,OAAO,EACrB,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,KAAK,CACN,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,iBAAiB,CAAC,CACrD,oBAAoB,IAAI,GAAG,2BAA2B,EAAE,EACxD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;gBAC1C,KAAK;aACN,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,6BAA6B,CACrC,UAAU,CAAC,MAAM,CAAC,OAAO;YACvB,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC/F,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC;YAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;QAClF,MAAM,IAAI,6BAA6B,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACtF,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,aAAa,CAAC;YAC1B,KAAK,EAAE,iCAAiC,CAAC,SAAS,CAAC;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,6BAA6B,CAAC,yCAAyC,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}