factory-factory 0.3.21 → 0.4.0

package/dist/src/backend/routers/websocket/upgrade-utils.js

@@ -1,8 +1,19 @@
+import { toError } from '../../../backend/lib/error-utils.js';
+import { isOriginAllowed, isTrustedLocalAddress } from '../../../backend/lib/request-trust.js';
+import { FORWARDED_CLIENT_ADDRESS_HEADERS } from '../../../shared/proxy-utils.js';
+function getForwardedClientAddressHeaders(request) {
+    return FORWARDED_CLIENT_ADDRESS_HEADERS.filter((header) => request.headers[header] !== undefined);
+}
 export function sendBadRequest(socket, message) {
     const body = message ? `\r\n\r\n${message}` : '\r\n\r\n';
     socket.write(`HTTP/1.1 400 Bad Request${body}`);
     socket.destroy();
 }
+export function sendForbidden(socket, message) {
+    const body = message ? `\r\n\r\n${message}` : '\r\n\r\n';
+    socket.write(`HTTP/1.1 403 Forbidden${body}`);
+    socket.destroy();
+}
 export function validateWebSocketOrigin({ request, socket, configService, logger, connectionName, }) {
     const origin = request.headers?.origin;
     if (!origin) {
@@ -11,24 +22,108 @@ export function validateWebSocketOrigin({ request, socket, configService, logger
         return false;
     }
     const allowedOrigins = configService.getCorsConfig().allowedOrigins;
-    if (!allowedOrigins.includes(origin)) {
+    if (!isOriginAllowed(origin, allowedOrigins)) {
         logger.warn(`Rejected ${connectionName} connection from unauthorized origin`, { origin });
         sendBadRequest(socket, 'Unauthorized origin');
         return false;
     }
     return true;
 }
+export function validateTrustedLocalWebSocketRequest({ request, socket, configService, logger, connectionName, }) {
+    const remoteAddress = request.socket.remoteAddress;
+    const corsConfig = configService.getCorsConfig();
+    if (!isTrustedLocalAddress(remoteAddress, corsConfig.trustedLocalCidrs)) {
+        logger.warn(`Rejected ${connectionName} connection from untrusted remote address`, {
+            remoteAddress,
+        });
+        sendForbidden(socket, 'Untrusted remote address');
+        return false;
+    }
+    const forwardedClientAddressHeaders = getForwardedClientAddressHeaders(request);
+    if (forwardedClientAddressHeaders.length > 0) {
+        logger.warn(`Rejected ${connectionName} connection with forwarded client address headers`, {
+            forwardedClientAddressHeaders,
+            remoteAddress,
+        });
+        sendForbidden(socket, 'Forwarded WebSocket upgrades are not trusted');
+        return false;
+    }
+    return true;
+}
 export function markWebSocketAlive(ws, wsAliveMap) {
     wsAliveMap.set(ws, true);
     ws.on('pong', () => wsAliveMap.set(ws, true));
 }
-export function getOrCreateConnectionSet(map, key) {
-    const existing = map.get(key);
-    if (existing) {
-        return existing;
+function extractRequiredParams(url, requiredParams, socket, logger, connectionName) {
+    const params = {};
+    for (const param of requiredParams) {
+        const value = url.searchParams.get(param);
+        if (!value) {
+            logger.warn(`${connectionName} missing ${param}`);
+            sendBadRequest(socket);
+            return null;
+        }
+        params[param] = value;
     }
-    const created = new Set();
-    map.set(key, created);
-    return created;
+    return params;
+}
+function runAuthorize(authorize, onAuthorized, onError) {
+    const handleResult = (auth) => {
+        if (auth === null) {
+            return;
+        }
+        if (auth === undefined) {
+            onError(new Error('authorize hook returned undefined'));
+            return;
+        }
+        onAuthorized(auth);
+    };
+    try {
+        const result = authorize();
+        if (result instanceof Promise) {
+            result.then(handleResult).catch(onError);
+        }
+        else {
+            handleResult(result);
+        }
+    }
+    catch (error) {
+        onError(error);
+    }
+}
+export function createWebSocketUpgradeHandler(options) {
+    const { connectionName, configService, logger, requiredParams, authorize, onOpen } = options;
+    return function handleUpgrade(request, socket, head, url, wss, wsAliveMap) {
+        if (!validateWebSocketOrigin({ request, socket, configService, logger, connectionName })) {
+            return;
+        }
+        if (!validateTrustedLocalWebSocketRequest({
+            request,
+            socket,
+            configService,
+            logger,
+            connectionName,
+        })) {
+            return;
+        }
+        const params = extractRequiredParams(url, requiredParams ?? [], socket, logger, connectionName);
+        if (!params) {
+            return;
+        }
+        const upgrade = (auth) => {
+            wss.handleUpgrade(request, socket, head, (ws) => {
+                markWebSocketAlive(ws, wsAliveMap);
+                onOpen(ws, { params, url, request, auth });
+            });
+        };
+        if (!authorize) {
+            upgrade(undefined);
+            return;
+        }
+        runAuthorize(() => authorize({ params, url, request, socket }), upgrade, (error) => {
+            logger.error(`Failed to authorize ${connectionName} upgrade`, toError(error));
+            sendBadRequest(socket, 'Authorization failed');
+        });
+    };
 }
 //# sourceMappingURL=upgrade-utils.js.map

package/dist/src/backend/routers/websocket/upgrade-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade-utils.js","sourceRoot":"","sources":["../../../../../src/backend/routers/websocket/upgrade-utils.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAgB;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,aAAa,EACb,MAAM,EACN,cAAc,GAOf;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,YAAY,cAAc,mCAAmC,CAAC,CAAC;QAC3E,cAAc,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC;IACpE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,YAAY,cAAc,sCAAsC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,cAAc,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,UAAuC;IACvF,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,GAA8B,EAC9B,GAAS;IAET,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"upgrade-utils.js","sourceRoot":"","sources":["../../../../../src/backend/routers/websocket/upgrade-utils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAMxE,SAAS,gCAAgC,CAAC,OAAwB;IAChE,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAgB;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,aAAa,EACb,MAAM,EACN,cAAc,GAOf;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,YAAY,cAAc,mCAAmC,CAAC,CAAC;QAC3E,cAAc,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC;IACpE,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,YAAY,cAAc,sCAAsC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,cAAc,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,EACnD,OAAO,EACP,MAAM,EACN,aAAa,EACb,MAAM,EACN,cAAc,GAOf;IACC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC;IACjD,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,YAAY,cAAc,2CAA2C,EAAE;YACjF,aAAa;SACd,CAAC,CAAC;QACH,aAAa,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,6BAA6B,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,6BAA6B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,YAAY,cAAc,mDAAmD,EAAE;YACzF,6BAA6B;YAC7B,aAAa;SACd,CAAC,CAAC;QACH,aAAa,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,UAAuC;IACvF,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AA8BD,SAAS,qBAAqB,CAC5B,GAAQ,EACR,cAAiC,EACjC,MAAc,EACd,MAA8B,EAC9B,cAAsB;IAEtB,MAAM,MAAM,GAAG,EAA4B,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,YAAY,KAAK,EAAE,CAAC,CAAC;YAClD,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD,SAAS,YAAY,CACnB,SAAqD,EACrD,YAAmC,EACnC,OAAiC;IAEjC,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAQ,EAAE;QAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAG3C,OAeD;IACC,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE7F,OAAO,SAAS,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU;QACvE,IAAI,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;QAED,IACE,CAAC,oCAAoC,CAAC;YACpC,OAAO;YACP,MAAM;YACN,aAAa;YACb,MAAM;YACN,cAAc;SACf,CAAC,EACF,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,cAAc,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAW,EAAQ,EAAE;YACpC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC9C,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;gBACnC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,SAAkB,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,YAAY,CACV,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EACjD,OAAO,EACP,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,KAAK,CAAC,uBAAuB,cAAc,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,cAAc,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QACjD,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/backend/routers/websocket/upgrade-utils.test.js

@@ -1,14 +1,14 @@
 import { describe, expect, it, vi } from 'vitest';
-import { validateWebSocketOrigin } from './upgrade-utils.js';
+import { createWebSocketUpgradeHandler, validateTrustedLocalWebSocketRequest, validateWebSocketOrigin, } from './upgrade-utils.js';
 function createSocket() {
     return { write: vi.fn(), destroy: vi.fn() };
 }
 function createLogger() {
     return { warn: vi.fn() };
 }
-function createConfigService(allowedOrigins) {
+function createConfigService(allowedOrigins, trustedLocalCidrs = []) {
     return {
-        getCorsConfig: vi.fn(() => ({ allowedOrigins })),
+        getCorsConfig: vi.fn(() => ({ allowedOrigins, trustedLocalCidrs })),
     };
 }
 describe('validateWebSocketOrigin', () => {
@@ -55,5 +55,318 @@ describe('validateWebSocketOrigin', () => {
         expect(socket.write).not.toHaveBeenCalled();
         expect(socket.destroy).not.toHaveBeenCalled();
     });
+    it('allows upgrades from equivalent loopback origins', () => {
+        const socket = createSocket();
+        const isValid = validateWebSocketOrigin({
+            request: { headers: { origin: 'http://127.0.0.1:3000' } },
+            socket,
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createLogger(),
+            connectionName: 'terminal WebSocket',
+        });
+        expect(isValid).toBe(true);
+        expect(socket.write).not.toHaveBeenCalled();
+        expect(socket.destroy).not.toHaveBeenCalled();
+    });
+    it('rejects credentialed loopback origins', () => {
+        const socket = createSocket();
+        const isValid = validateWebSocketOrigin({
+            request: { headers: { origin: 'http://evil@localhost:3000' } },
+            socket,
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createLogger(),
+            connectionName: 'terminal WebSocket',
+        });
+        expect(isValid).toBe(false);
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('Unauthorized origin'));
+        expect(socket.destroy).toHaveBeenCalledTimes(1);
+    });
+});
+describe('validateTrustedLocalWebSocketRequest', () => {
+    it('rejects untrusted remote addresses', () => {
+        const socket = createSocket();
+        const logger = createLogger();
+        const isValid = validateTrustedLocalWebSocketRequest({
+            request: {
+                headers: {},
+                socket: { remoteAddress: '203.0.113.10' },
+            },
+            socket,
+            configService: createConfigService(['http://localhost:3000']),
+            logger,
+            connectionName: 'terminal WebSocket',
+        });
+        expect(isValid).toBe(false);
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('403 Forbidden'));
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('Untrusted remote address'));
+        expect(socket.destroy).toHaveBeenCalledTimes(1);
+        expect(logger.warn).toHaveBeenCalledWith('Rejected terminal WebSocket connection from untrusted remote address', { remoteAddress: '203.0.113.10' });
+    });
+    it('rejects forwarded client address headers from trusted peer addresses', () => {
+        const socket = createSocket();
+        const logger = createLogger();
+        const isValid = validateTrustedLocalWebSocketRequest({
+            request: {
+                headers: { 'x-forwarded-for': '203.0.113.10' },
+                socket: { remoteAddress: '127.0.0.1' },
+            },
+            socket,
+            configService: createConfigService(['http://localhost:3000']),
+            logger,
+            connectionName: 'terminal WebSocket',
+        });
+        expect(isValid).toBe(false);
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('403 Forbidden'));
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('Forwarded WebSocket upgrades are not trusted'));
+        expect(socket.destroy).toHaveBeenCalledTimes(1);
+        expect(logger.warn).toHaveBeenCalledWith('Rejected terminal WebSocket connection with forwarded client address headers', {
+            forwardedClientAddressHeaders: ['x-forwarded-for'],
+            remoteAddress: '127.0.0.1',
+        });
+    });
+    it('allows trusted local requests without forwarded client address headers', () => {
+        const socket = createSocket();
+        const isValid = validateTrustedLocalWebSocketRequest({
+            request: {
+                headers: {},
+                socket: { remoteAddress: '172.17.0.1' },
+            },
+            socket,
+            configService: createConfigService(['http://localhost:3000'], ['172.17.0.1/32']),
+            logger: createLogger(),
+            connectionName: 'terminal WebSocket',
+        });
+        expect(isValid).toBe(true);
+        expect(socket.write).not.toHaveBeenCalled();
+        expect(socket.destroy).not.toHaveBeenCalled();
+    });
+});
+describe('createWebSocketUpgradeHandler', () => {
+    function createFullLogger() {
+        return { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+    }
+    function createWss(ws = {}) {
+        return {
+            ws,
+            wss: {
+                handleUpgrade: vi.fn((_request, _socket, _head, callback) => callback(ws)),
+            },
+        };
+    }
+    const trustedRequest = {
+        headers: { origin: 'http://localhost:3000' },
+        socket: { remoteAddress: '127.0.0.1' },
+    };
+    function invoke(handler, { request = trustedRequest, socket = createSocket(), url = new URL('http://localhost/ws'), wss = createWss().wss, wsAliveMap = new WeakMap(), } = {}) {
+        handler(request, socket, Buffer.alloc(0), url, wss, wsAliveMap);
+    }
+    it('rejects unauthorized origins before upgrading', () => {
+        const socket = createSocket();
+        const onOpen = vi.fn();
+        const { wss } = createWss();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createFullLogger(),
+            onOpen,
+        });
+        invoke(handler, {
+            request: { headers: { origin: 'https://attacker.example' } },
+            socket,
+            wss,
+        });
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('Unauthorized origin'));
+        expect(wss.handleUpgrade).not.toHaveBeenCalled();
+        expect(onOpen).not.toHaveBeenCalled();
+    });
+    it('rejects untrusted remote addresses before upgrading', () => {
+        const socket = createSocket();
+        const onOpen = vi.fn();
+        const { wss } = createWss();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createFullLogger(),
+            onOpen,
+        });
+        invoke(handler, {
+            request: {
+                headers: { origin: 'http://localhost:3000' },
+                socket: { remoteAddress: '203.0.113.10' },
+            },
+            socket,
+            wss,
+        });
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('403 Forbidden'));
+        expect(wss.handleUpgrade).not.toHaveBeenCalled();
+        expect(onOpen).not.toHaveBeenCalled();
+    });
+    it('rejects upgrades missing a required query param', () => {
+        const socket = createSocket();
+        const logger = createFullLogger();
+        const onOpen = vi.fn();
+        const { wss } = createWss();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger,
+            requiredParams: ['workspaceId'],
+            onOpen,
+        });
+        invoke(handler, { socket, wss });
+        expect(logger.warn).toHaveBeenCalledWith('test WebSocket missing workspaceId');
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('400 Bad Request'));
+        expect(wss.handleUpgrade).not.toHaveBeenCalled();
+        expect(onOpen).not.toHaveBeenCalled();
+    });
+    it('upgrades, marks the socket alive, and passes params to onOpen', () => {
+        const onOpen = vi.fn();
+        const ws = { on: vi.fn() };
+        const { wss } = createWss(ws);
+        const wsAliveMap = new WeakMap();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createFullLogger(),
+            requiredParams: ['workspaceId'],
+            onOpen,
+        });
+        invoke(handler, {
+            url: new URL('http://localhost/ws?workspaceId=workspace-1'),
+            wss,
+            wsAliveMap,
+        });
+        expect(wsAliveMap.get(ws)).toBe(true);
+        expect(onOpen).toHaveBeenCalledWith(ws, expect.objectContaining({ params: { workspaceId: 'workspace-1' }, auth: undefined }));
+    });
+    it('does not upgrade when authorize resolves null', async () => {
+        const onOpen = vi.fn();
+        const { wss } = createWss();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createFullLogger(),
+            authorize: () => Promise.resolve(null),
+            onOpen,
+        });
+        invoke(handler, { wss });
+        await vi.waitFor(() => {
+            expect(onOpen).not.toHaveBeenCalled();
+        });
+        expect(wss.handleUpgrade).not.toHaveBeenCalled();
+    });
+    it('passes the resolved authorize value to onOpen', async () => {
+        const onOpen = vi.fn();
+        const ws = { on: vi.fn() };
+        const { wss } = createWss(ws);
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createFullLogger(),
+            authorize: async () => ({ workingDir: '/tmp/worktree' }),
+            onOpen,
+        });
+        invoke(handler, { wss });
+        await vi.waitFor(() => {
+            expect(onOpen).toHaveBeenCalledWith(ws, expect.objectContaining({ auth: { workingDir: '/tmp/worktree' } }));
+        });
+    });
+    it('upgrades synchronously when authorize returns a plain value', () => {
+        const onOpen = vi.fn();
+        const ws = { on: vi.fn() };
+        const { wss } = createWss(ws);
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createFullLogger(),
+            authorize: () => ({ connectionId: 'conn-1' }),
+            onOpen,
+        });
+        invoke(handler, { wss });
+        expect(onOpen).toHaveBeenCalledWith(ws, expect.objectContaining({ auth: { connectionId: 'conn-1' } }));
+    });
+    it('rejects synchronously when authorize returns a plain null', () => {
+        const onOpen = vi.fn();
+        const { wss } = createWss();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createFullLogger(),
+            authorize: () => null,
+            onOpen,
+        });
+        invoke(handler, { wss });
+        expect(wss.handleUpgrade).not.toHaveBeenCalled();
+        expect(onOpen).not.toHaveBeenCalled();
+    });
+    it('fails closed when authorize returns undefined', async () => {
+        const socket = createSocket();
+        const logger = createFullLogger();
+        const onOpen = vi.fn();
+        const { wss } = createWss();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger,
+            authorize: async () => undefined,
+            onOpen,
+        });
+        invoke(handler, { socket, wss });
+        await vi.waitFor(() => {
+            expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('Authorization failed'));
+        });
+        expect(logger.error).toHaveBeenCalledWith('Failed to authorize test WebSocket upgrade', expect.objectContaining({ message: 'authorize hook returned undefined' }));
+        expect(wss.handleUpgrade).not.toHaveBeenCalled();
+        expect(onOpen).not.toHaveBeenCalled();
+    });
+    it('rejects hooks that can return undefined at the type level', () => {
+        const defineHandler = () => createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger: createFullLogger(),
+            authorize: async () => (Math.random() > 0.5 ? { id: 'a' } : undefined),
+            onOpen: vi.fn(),
+        });
+        expect(defineHandler).toBeDefined();
+    });
+    it('rejects with 400 when a synchronous authorize throws', () => {
+        const socket = createSocket();
+        const logger = createFullLogger();
+        const onOpen = vi.fn();
+        const { wss } = createWss();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger,
+            authorize: () => {
+                throw new Error('bad state');
+            },
+            onOpen,
+        });
+        invoke(handler, { socket, wss });
+        expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('Authorization failed'));
+        expect(wss.handleUpgrade).not.toHaveBeenCalled();
+        expect(onOpen).not.toHaveBeenCalled();
+    });
+    it('rejects with 400 when authorize throws', async () => {
+        const socket = createSocket();
+        const logger = createFullLogger();
+        const onOpen = vi.fn();
+        const { wss } = createWss();
+        const handler = createWebSocketUpgradeHandler({
+            connectionName: 'test WebSocket',
+            configService: createConfigService(['http://localhost:3000']),
+            logger,
+            authorize: () => Promise.reject(new Error('db down')),
+            onOpen,
+        });
+        invoke(handler, { socket, wss });
+        await vi.waitFor(() => {
+            expect(socket.write).toHaveBeenCalledWith(expect.stringContaining('Authorization failed'));
+        });
+        expect(logger.error).toHaveBeenCalledWith('Failed to authorize test WebSocket upgrade', expect.any(Error));
+        expect(wss.handleUpgrade).not.toHaveBeenCalled();
+        expect(onOpen).not.toHaveBeenCalled();
+    });
 });
 //# sourceMappingURL=upgrade-utils.test.js.map

package/dist/src/backend/routers/websocket/upgrade-utils.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade-utils.test.js","sourceRoot":"","sources":["../../../../../src/backend/routers/websocket/upgrade-utils.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,YAAY;IACnB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAuB,CAAC;AACnE,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAwB;IACnD,OAAO;QACL,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAqB;YAC3C,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAqB;YAC/E,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,6DAA6D,EAC7D,EAAE,MAAM,EAAE,0BAA0B,EAAE,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAqB;YAC5E,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,YAAY,EAAE;YACtB,cAAc,EAAE,qBAAqB;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"upgrade-utils.test.js","sourceRoot":"","sources":["../../../../../src/backend/routers/websocket/upgrade-utils.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,SAAS,YAAY;IACnB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAuB,CAAC;AACnE,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAwB,EAAE,oBAA8B,EAAE;IACrF,OAAO;QACL,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAqB;YAC3C,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAqB;YAC/E,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,6DAA6D,EAC7D,EAAE,MAAM,EAAE,0BAA0B,EAAE,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAqB;YAC5E,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,YAAY,EAAE;YACtB,cAAc,EAAE,qBAAqB;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAqB;YAC5E,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,YAAY,EAAE;YACtB,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAqB;YACjF,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,YAAY,EAAE;YACtB,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,oCAAoC,CAAC;YACnD,OAAO,EAAE;gBACP,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;aACvB;YACpB,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,sEAAsE,EACtE,EAAE,aAAa,EAAE,cAAc,EAAE,CAClC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,oCAAoC,CAAC;YACnD,OAAO,EAAE;gBACP,OAAO,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE;gBAC9C,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE;aACT;YAC/B,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACvC,MAAM,CAAC,gBAAgB,CAAC,8CAA8C,CAAC,CACxE,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,8EAA8E,EAC9E;YACE,6BAA6B,EAAE,CAAC,iBAAiB,CAAC;YAClD,aAAa,EAAE,WAAW;SAC3B,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,GAAG,oCAAoC,CAAC;YACnD,OAAO,EAAE;gBACP,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;aACrB;YACpB,MAAM;YACN,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAChF,MAAM,EAAE,YAAY,EAAE;YACtB,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,SAAS,gBAAgB;QACvB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;IAC1E,CAAC;IAED,SAAS,SAAS,CAAC,KAAgB,EAAe;QAChD,OAAO;YACL,EAAE;YACF,GAAG,EAAE;gBACH,aAAa,EAAE,EAAE,CAAC,EAAE,CAClB,CACE,QAAyB,EACzB,OAAe,EACf,KAAa,EACb,QAAqC,EACrC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAClB;aAC4B;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE;QAC5C,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE;KACT,CAAC;IAEhC,SAAS,MAAM,CACb,OAAyD,EACzD,EACE,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,YAAY,EAAE,EACvB,GAAG,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,EACpC,GAAG,GAAG,SAAS,EAAE,CAAC,GAAG,EACrB,UAAU,GAAG,IAAI,OAAO,EAAsB,MAO5C,EAAE;QAEN,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAClE,CAAC;IAED,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,gBAAgB,EAAE;YAC1B,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE;YACd,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAqB;YAC/E,MAAM;YACN,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,gBAAgB,EAAE;YAC1B,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE;YACd,OAAO,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE;gBAC5C,MAAM,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;aACZ;YAC/B,MAAM;YACN,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAA0B,CAAC;QACnD,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,EAAsB,CAAC;QAErD,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,gBAAgB,EAAE;YAC1B,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE;YACd,GAAG,EAAE,IAAI,GAAG,CAAC,6CAA6C,CAAC;YAC3D,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACjC,EAAE,EACF,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CACrF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,gBAAgB,EAAE;YAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACtC,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAA0B,CAAC;QACnD,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,gBAAgB,EAAE;YAC1B,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;YACxD,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAEzB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACjC,EAAE,EACF,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAA0B,CAAC;QACnD,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,gBAAgB,EAAE;YAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;YAC7C,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAEzB,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACjC,EAAE,EACF,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,gBAAgB,EAAE;YAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;YACrB,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAEzB,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,SAA4B;YACnD,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAEjC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACvC,4CAA4C,EAC5C,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAC1E,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QAGnE,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,6BAA6B,CAAC;YAC5B,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM,EAAE,gBAAgB,EAAE;YAE1B,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;SAChB,CAAC,CAAC;QAEL,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,SAAS,EAAE,GAAG,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAEjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,aAAa,EAAE,mBAAmB,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7D,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAEjC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACvC,4CAA4C,EAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/backend/routers/websocket/websocket.integration.test.js

@@ -18,6 +18,7 @@ let createSnapshotsUpgradeHandler;
 let createChatUpgradeHandler;
 let terminalConnections;
 let snapshotConnections;
+let chatConnectionRegistry;
 let workspaceSnapshotStore;
 let counter = 0;
 const allowedOrigin = 'http://localhost:3000';
@@ -37,8 +38,9 @@ beforeAll(async () => {
         await vi.importActual('./snapshots.handler'));
     ({ createChatUpgradeHandler } =
         await vi.importActual('./chat.handler'));
+    ({ chatConnectionRegistry } = await vi.importActual('./chat-connection-registry'));
     ({ workspaceSnapshotStore } = await vi.importActual('@/backend/services/workspace-snapshot-store.service'));
-});
+}, 30_000);
 afterEach(async () => {
     for (const ws of openSockets) {
         await closeWebSocket(ws);
@@ -50,6 +52,7 @@ afterEach(async () => {
     }
     terminalConnections.clear();
     snapshotConnections.clear();
+    chatConnectionRegistry.clear();
     workspaceSnapshotStore.clear();
     await clearIntegrationDatabase(prisma);
     vi.restoreAllMocks();
@@ -88,6 +91,7 @@ class FakeTerminalService {
     exitListeners = new Map();
     createTerminal = vi.fn(({ workspaceId }) => Promise.resolve({ terminalId: `${workspaceId}-term-1`, pid: 4321 }));
     destroyTerminal = vi.fn();
+    getTerminal = vi.fn(() => null);
     getTerminalsForWorkspace = vi.fn(() => []);
     resizeTerminal = vi.fn();
     setActiveTerminal = vi.fn();
@@ -143,19 +147,8 @@ function createConfigService() {
     };
 }
 function createChatAppContext(worktreeBaseDir) {
-    const connections = new Map();
     const appContext = unsafeCoerce({
         services: {
-            chatConnectionService: {
-                values: () => connections.values(),
-                get: (connectionId) => connections.get(connectionId),
-                register: (connectionId, connectionInfo) => {
-                    connections.set(connectionId, connectionInfo);
-                },
-                unregister: (connectionId) => {
-                    connections.delete(connectionId);
-                },
-            },
             chatEventForwarderService: {
                 setupClientEvents: vi.fn(),
                 setupWorkspaceNotifications: vi.fn(),
@@ -399,11 +392,11 @@ describe('websocket integration', () => {
         const { ws, messages } = await connectAndCaptureMessages(`ws://127.0.0.1:${server.port}/snapshots?projectId=${projectId}`);
         openSockets.add(ws);
         await vi.waitFor(() => {
-            expect(messages).toContainEqual({
+            expect(messages).toContainEqual(expect.objectContaining({
                 type: 'snapshot_full',
                 projectId,
                 entries: expect.arrayContaining([expect.objectContaining({ workspaceId })]),
-            });
+            }));
         });
         workspaceSnapshotStore.upsert(workspaceId, {
             projectId,
@@ -411,17 +404,17 @@ describe('websocket integration', () => {
             prState: PRState.OPEN,
         }, 'integration-test:update', Date.now() + 1000);
         await vi.waitFor(() => {
-            expect(messages).toContainEqual({
+            expect(messages).toContainEqual(expect.objectContaining({
                 type: 'snapshot_changed',
                 workspaceId,
                 entry: expect.objectContaining({
                     prUrl: 'https://github.com/acme/repo/pull/123',
                 }),
-            });
+            }));
         });
         workspaceSnapshotStore.remove(workspaceId);
         await vi.waitFor(() => {
-            expect(messages).toContainEqual({ type: 'snapshot_removed', workspaceId });
+            expect(messages).toContainEqual(expect.objectContaining({ type: 'snapshot_removed', workspaceId }));
         });
     });
     it('chat handler rejects invalid websocket payloads with error message', async () => {