@aitne/daemon 0.1.0

package/dist/api/server.js

@@ -0,0 +1,558 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { logger as honoLogger } from "hono/logger";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { readRuntimeState, writeRuntimeState, } from "../db/runtime-state.js";
+/** Persistence key for the boot-audit fingerprint (`auditRiskClassifications`). */
+const RISK_AUDIT_STATE_KEY = "risk_audit_unclassified_fingerprint";
+import { getContextDir } from "../config.js";
+import { auditRiskClassifications, classifyRisk, RiskTier, } from "../safety/risk-classifier.js";
+import { createHealthRoutes } from "./routes/health.js";
+import { createContextRoutes } from "./routes/context.js";
+import { createAgentRoutes } from "./routes/agent.js";
+import { createDashboardRoutes } from "./routes/dashboard.js";
+import { createNotionRoutes } from "./routes/notion.js";
+import { createGitHubRoutes } from "./routes/github.js";
+import { createCalendarRoutes } from "./routes/calendar.js";
+import { createAppleCalendarRoutes } from "./routes/apple-calendar.js";
+import { createMetricsRoutes } from "./routes/metrics.js";
+import { createObsidianRoutes } from "./routes/obsidian.js";
+import { createGitRoutes } from "./routes/git.js";
+import { createGitTemplatesRoutes } from "./routes/git-templates.js";
+import { createRepositoriesRoutes } from "./routes/repositories.js";
+import { createMailRoutes } from "./routes/mail.js";
+import { createSSERoutes } from "./routes/sse.js";
+import { createSetupRoutes } from "./routes/setup.js";
+import { createSetupMigrateRoutes } from "./routes/setup-migrate.js";
+import { createSettingsStore } from "../settings/settings-store.js";
+import { createSystemRoutes } from "./routes/system.js";
+import { createBackendRoutes } from "./routes/backends.js";
+import { createSkillsRoutes } from "./routes/skills.js";
+import { createObservationRoutes } from "./routes/observations.js";
+import { createSkillCurationRoutes } from "./routes/skill-curation.js";
+import { createProfileQuestionsRoutes } from "./routes/profile-questions.js";
+import { createRecurringScheduleRoutes } from "./routes/recurring-schedules.js";
+import { createTriggerRoutes } from "./routes/triggers.js";
+import { createTravelBookingRoutes } from "./routes/travel-bookings.js";
+import { createReceiptRoutes } from "./routes/receipts.js";
+import { createTravelTimeRoutes } from "./routes/travel-time.js";
+import { createBookRoutes } from "./routes/books.js";
+import { createDelegatedRunRoutes } from "./routes/delegated.js";
+import { createDelegatedSyncRoutes } from "./routes/delegated-sync.js";
+import { createIntegrationRoutes } from "./routes/integrations.js";
+import { createIntegrationReconcileRoutes } from "./routes/integrations-reconcile.js";
+import { createKnowledgeRoutes } from "./routes/knowledge.js";
+import { createTaskFlowsRoutes } from "./routes/task-flows.js";
+import { createGitAccountsRoutes } from "./routes/git-accounts.js";
+import { createCommandsRoutes } from "./routes/commands.js";
+import { createVoiceRoutes } from "./routes/voice.js";
+import { buildManagedTasksRoutesDepsFromApi, createManagedTasksRoutes, } from "./routes/managed-tasks.js";
+import { buildSotBindingsRoutesDepsFromApi, createSotBindingsRoutes, } from "./routes/sot-bindings.js";
+import { buildEntitiesRoutesDepsFromApi, createEntitiesRoutes, } from "./routes/entities.js";
+import { createActivitySourcesRoutes } from "./routes/activity-sources.js";
+import { createIntegrationRouteGate } from "./integration-route-gate.js";
+import { createMcpRoutes } from "./routes/mcp.js";
+import { createAttachmentRoutes } from "./routes/attachments.js";
+import { InMemoryManagementMdWriteLockManager, } from "../core/management-md-write-lock.js";
+import { queryChatBinding } from "./chat-binding-query.js";
+import { DEFAULT_CLAUDE_HIGH_MODEL, getModelsForBackend, } from "../core/backends/model-registry.js";
+import { createLogger } from "../logging.js";
+const logger = createLogger("api-server");
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/**
+ * Hostnames the daemon will accept in the Host header. Anything else is
+ * rejected before any handler runs — the daemon binds to 127.0.0.1 only,
+ * but Node still accepts requests with arbitrary Host headers, and a DNS
+ * rebinding attack could land here with `Host: pairing.evil.example`.
+ */
+const ALLOWED_DAEMON_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
+function normalizeHostname(rawHostname) {
+    // WHATWG URL parsing keeps IPv6 brackets in `hostname` (e.g. "[::1]");
+    // strip them so the allowlist can hold just "::1".
+    const lower = rawHostname.toLowerCase();
+    return lower.startsWith("[") && lower.endsWith("]")
+        ? lower.slice(1, -1)
+        : lower;
+}
+/**
+ * Resolve the request's effective hostname for the loopback check.
+ * Falls back to the URL's parsed hostname when the Host header is
+ * absent — this is the path Hono's synthetic test requests
+ * (`app.request("/api/...")`) take, since they construct a Request
+ * with a URL but no explicit Host header. In production every real
+ * HTTP/1.1 request carries a Host header, and the URL Hono constructs
+ * is itself derived from that header, so the fallback never widens
+ * the security boundary.
+ */
+function getRequestHostname(c) {
+    const headerValue = c.req.header("host");
+    if (headerValue) {
+        try {
+            return normalizeHostname(new URL(`http://${headerValue}`).hostname);
+        }
+        catch {
+            return null;
+        }
+    }
+    try {
+        return normalizeHostname(new URL(c.req.url).hostname);
+    }
+    catch {
+        return null;
+    }
+}
+function buildAllowedDaemonOrigins(apiPort) {
+    return new Set([
+        `http://localhost:${apiPort}`,
+        `http://127.0.0.1:${apiPort}`,
+        `http://[::1]:${apiPort}`,
+    ]);
+}
+function evaluateLoopbackBrowserGate(input) {
+    if (SAFE_METHODS.has(input.method)) {
+        return { allowed: true };
+    }
+    if (input.secFetchSite) {
+        if (input.secFetchSite === "same-origin") {
+            return { allowed: true };
+        }
+        return {
+            allowed: false,
+            reason: `sec_fetch_site_${input.secFetchSite.replace(/-/g, "_")}`,
+        };
+    }
+    if (input.origin) {
+        return input.allowedOrigins.has(input.origin)
+            ? { allowed: true }
+            : { allowed: false, reason: "origin_mismatch" };
+    }
+    return { allowed: true };
+}
+function getBearerToken(c) {
+    const authHeader = c.req.header("authorization");
+    return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+}
+function safeTokenEquals(actual, expected) {
+    return actual !== null
+        && expected !== null
+        && actual.length === expected.length
+        && timingSafeEqual(Buffer.from(actual), Buffer.from(expected));
+}
+async function isBearerAuthenticated(c, deps) {
+    return safeTokenEquals(getBearerToken(c), await deps.secretBroker.getApiToken());
+}
+/**
+ * Check if a request to a ReadSensitive endpoint carries a valid token.
+ *
+ * Two valid credentials:
+ *  1. `Authorization: Bearer <apiToken>` — dashboard proxy path
+ *  2. `X-Read-Token: <readToken>` — agent backend path
+ *
+ * Both are verified with timing-safe comparison.
+ */
+async function isReadSensitiveAuthenticated(c, deps) {
+    // Path 1: Bearer token (dashboard proxy)
+    if (await isBearerAuthenticated(c, deps)) {
+        return true;
+    }
+    // Path 2: X-Read-Token (agent backend)
+    const readTokenHeader = c.req.header("x-read-token");
+    if (readTokenHeader !== undefined) {
+        if (deps.readTokenValidator?.(readTokenHeader) === true) {
+            return true;
+        }
+        if (typeof deps.readToken === "string"
+            && readTokenHeader.length === deps.readToken.length
+            && timingSafeEqual(Buffer.from(readTokenHeader), Buffer.from(deps.readToken))) {
+            return true;
+        }
+    }
+    return false;
+}
+export function createApp(deps) {
+    const app = new Hono();
+    const allowedDaemonOrigins = buildAllowedDaemonOrigins(deps.config.apiPort);
+    // Middleware
+    // Defense-in-depth Host header validation. The dashboard proxy already
+    // does this check, but the daemon should not trust an upstream gate —
+    // an attacker reaching port 8321 directly (or via a future proxy bypass)
+    // must still be denied if their Host header isn't a loopback hostname.
+    // This closes the DNS rebinding attack against the daemon itself.
+    app.use("*", async (c, next) => {
+        const hostname = getRequestHostname(c);
+        if (!hostname || !ALLOWED_DAEMON_HOSTS.has(hostname)) {
+            return c.json({ error: "forbidden_host", message: "Daemon only accepts loopback Host headers." }, 403);
+        }
+        await next();
+    });
+    app.use("*", cors({ origin: "http://localhost:3000" }));
+    app.use("*", honoLogger());
+    // Risk-based auth middleware — Approve-tier endpoints require Bearer token;
+    // ReadSensitive-tier endpoints require Bearer or X-Read-Token when
+    // `enforceReadToken=true`; Autonomous-tier endpoints pass through
+    // (deniedTools is the safety control per DELEGATED-MODE-V2 §4.5).
+    app.use("*", async (c, next) => {
+        const path = new URL(c.req.url).pathname;
+        const method = c.req.method;
+        const tier = classifyRisk(method, path);
+        const browserGate = evaluateLoopbackBrowserGate({
+            method,
+            origin: c.req.header("origin") ?? null,
+            secFetchSite: c.req.header("sec-fetch-site") ?? null,
+            allowedOrigins: allowedDaemonOrigins,
+        });
+        if (tier === RiskTier.Approve) {
+            const expected = await deps.secretBroker.getApiToken();
+            if (!expected) {
+                return c.json({ error: "server_misconfigured", message: "Protected endpoints require a configured daemon API token" }, 503);
+            }
+            const token = getBearerToken(c);
+            // Timing-safe comparison to prevent side-channel leakage
+            const valid = safeTokenEquals(token, expected);
+            if (!valid) {
+                return c.json({ error: "unauthorized", message: "This endpoint requires authentication" }, 401);
+            }
+        }
+        else if (!browserGate.allowed && !(await isBearerAuthenticated(c, deps))) {
+            logger.warn({ method, path, tier, reason: browserGate.reason }, "browser-originated unsafe request rejected");
+            return c.json({
+                error: "forbidden_origin",
+                reason: browserGate.reason,
+                message: "Browser-originated unsafe requests must go through the authenticated dashboard proxy.",
+            }, 403);
+        }
+        else if (tier === RiskTier.ReadSensitive) {
+            // Accept either Bearer (dashboard proxy) or X-Read-Token (agent backend).
+            const authenticated = await isReadSensitiveAuthenticated(c, deps);
+            if (!authenticated) {
+                if (deps.enforceReadToken) {
+                    // Phase D: hard enforcement — reject unauthenticated requests.
+                    logger.warn({ method, path, tier: "read_sensitive" }, "read-sensitive-access REJECTED — no valid token");
+                    return c.json({ error: "unauthorized", message: "This endpoint requires X-Read-Token or Bearer authentication" }, 401);
+                }
+                // Phase C: soft enforcement — warn but allow through.
+                logger.warn({ method, path, tier: "read_sensitive" }, "read-sensitive-access WITHOUT valid token");
+            }
+            else {
+                logger.debug({ method, path, tier: "read_sensitive" }, "read-sensitive-access");
+            }
+        }
+        await next();
+    });
+    // Integration delegation framework — registry-driven 410 gate (§4.5.2).
+    // Mounted AFTER auth so unauthenticated requests still get 401 (not 410,
+    // which would leak the integration's mode to anonymous callers). Gating
+    // is path-prefix only; multi-provider routes (Gmail under /api/mail/*)
+    // do per-account 410s inside their handlers.
+    app.use("*", createIntegrationRouteGate({ db: deps.db }));
+    // Error handling — do not leak internal details to clients
+    app.onError((err, c) => {
+        logger.error({ err, path: c.req.path, method: c.req.method }, "API error");
+        return c.json({ error: "internal_error" }, 500);
+    });
+    // Routes
+    const healthRoutes = createHealthRoutes(deps);
+    const contextRoutes = createContextRoutes(deps);
+    const agentRoutes = createAgentRoutes(deps);
+    const dashboardRoutes = createDashboardRoutes(deps);
+    const notionRoutes = createNotionRoutes({
+        notionService: deps.services.notion,
+        writeTracker: deps.writeTracker,
+    });
+    const metricsRoutes = createMetricsRoutes(deps);
+    const setupRoutes = createSetupRoutes(deps);
+    // Management Mode Phase 2 — migration endpoint. Mounted only when
+    // the orchestrator primitives are wired (normal boot); tests that
+    // skip the primitives gracefully omit the route. Uses a shared
+    // settings store so the settings update inside the route hits the
+    // same DB rows env-writer would.
+    const setupMigrateRoutes = deps.migrationLock && deps.contextWriteGate
+        ? createSetupMigrateRoutes({
+            db: deps.db,
+            config: deps.config,
+            settingsStore: createSettingsStore(deps.db),
+            migrationLock: deps.migrationLock,
+            contextWriteGate: deps.contextWriteGate,
+            observerManager: deps.observerManager,
+            eventBus: deps.eventBus,
+            eventBroadcaster: deps.eventBroadcaster ?? undefined,
+            getInFlightExecutions: deps.getInFlightExecutions,
+            onPrimaryVaultPathChange: deps.onPrimaryVaultPathChange,
+        })
+        : null;
+    const systemRoutes = createSystemRoutes(deps);
+    const backendRoutes = createBackendRoutes(deps);
+    const skillsRoutes = createSkillsRoutes({ config: deps.config });
+    const observationRoutes = createObservationRoutes(deps);
+    const skillCurationRoutes = createSkillCurationRoutes(deps);
+    const profileQuestionsRoutes = createProfileQuestionsRoutes(deps);
+    const recurringScheduleRoutes = createRecurringScheduleRoutes(deps);
+    const triggerRoutes = createTriggerRoutes(deps);
+    const travelBookingRoutes = createTravelBookingRoutes(deps);
+    const receiptRoutes = createReceiptRoutes(deps);
+    const travelTimeRoutes = createTravelTimeRoutes({ services: deps.services });
+    const bookRoutes = createBookRoutes(deps);
+    const integrationRoutes = createIntegrationRoutes(deps);
+    const integrationReconcileRoutes = createIntegrationReconcileRoutes(deps);
+    const delegatedRunRoutes = createDelegatedRunRoutes(deps);
+    const delegatedSyncRoutes = createDelegatedSyncRoutes(deps);
+    const knowledgeRoutes = createKnowledgeRoutes(deps);
+    const taskFlowsRoutes = createTaskFlowsRoutes();
+    const gitAccountsRoutes = createGitAccountsRoutes(deps);
+    const commandsRoutes = createCommandsRoutes(deps);
+    const voiceRoutes = createVoiceRoutes(deps);
+    // Management Registry & Entities (docs/design/21-management-registry-
+    // and-entities.md). The managed-tasks and sot-bindings routes MUST
+    // share one lock manager — separate instances would let back-to-back
+    // POSTs stomp each other's render. Honor the externally-supplied
+    // manager when present (production boot wires it into the boot
+    // reconciler + chokidar watcher), otherwise materialize a single
+    // shared instance for this server's lifetime.
+    const sharedManagementMdLockManager = deps.managementMdWriteLockManager ?? new InMemoryManagementMdWriteLockManager();
+    const managedTasksRoutes = createManagedTasksRoutes(buildManagedTasksRoutesDepsFromApi(deps, sharedManagementMdLockManager));
+    const sotBindingsRoutes = createSotBindingsRoutes(buildSotBindingsRoutesDepsFromApi(deps, sharedManagementMdLockManager));
+    const entitiesRoutes = createEntitiesRoutes(buildEntitiesRoutesDepsFromApi(deps));
+    const activitySourcesRoutes = createActivitySourcesRoutes({ db: deps.db });
+    app.route("/api", healthRoutes);
+    app.route("/api", contextRoutes);
+    app.route("/api", agentRoutes);
+    app.route("/api", dashboardRoutes);
+    app.route("/api", notionRoutes);
+    app.route("/api", metricsRoutes);
+    app.route("/api", setupRoutes);
+    if (setupMigrateRoutes) {
+        app.route("/api", setupMigrateRoutes);
+    }
+    app.route("/api", systemRoutes);
+    app.route("/api", backendRoutes);
+    app.route("/api", skillsRoutes);
+    app.route("/api", observationRoutes);
+    app.route("/api", skillCurationRoutes);
+    app.route("/api", profileQuestionsRoutes);
+    app.route("/api", recurringScheduleRoutes);
+    app.route("/api", managedTasksRoutes);
+    app.route("/api", sotBindingsRoutes);
+    app.route("/api", entitiesRoutes);
+    app.route("/api", activitySourcesRoutes);
+    app.route("/api", triggerRoutes);
+    app.route("/api", travelBookingRoutes);
+    app.route("/api", receiptRoutes);
+    app.route("/api", travelTimeRoutes);
+    app.route("/api", bookRoutes);
+    app.route("/api", integrationRoutes);
+    app.route("/api", integrationReconcileRoutes);
+    app.route("/api", delegatedRunRoutes);
+    app.route("/api", delegatedSyncRoutes);
+    app.route("/api", knowledgeRoutes);
+    app.route("/api", taskFlowsRoutes);
+    app.route("/api", gitAccountsRoutes);
+    app.route("/api", commandsRoutes);
+    app.route("/api", voiceRoutes);
+    // ── Chat file attachments (Phase 1) ──
+    if (deps.attachmentStore) {
+        const attachmentRoutes = createAttachmentRoutes({
+            db: deps.db,
+            config: deps.config,
+            store: deps.attachmentStore,
+            validateTurnToken: deps.validateAttachmentTurnToken
+                ?? (() => null),
+            ...(deps.auditLogger ? { audit: deps.auditLogger } : {}),
+        });
+        app.route("/api", attachmentRoutes);
+    }
+    // ── MCP server CRUD + probe (B-003 Phase 2) ──
+    // Per-server secrets live in the shared blob store under `mcp:<id>:<key>`.
+    // If no blob store is wired (unit-test harnesses that omit it), the MCP
+    // route is skipped rather than silently writing secrets with a different
+    // key.
+    if (deps.blobStore) {
+        const mcpRoutes = createMcpRoutes({
+            db: deps.db,
+            blobStore: deps.blobStore,
+            dataDir: deps.config.dataDir,
+        });
+        app.route("/api", mcpRoutes);
+    }
+    // Calendar routes (reads from services registry dynamically). Direct
+    // mode only — delegated requests are 410-gated by the integration
+    // route gate before reaching this handler (DELEGATED-MODE-V2-DESIGN.md
+    // §6.3); cross-backend delegated work flows through
+    // POST /api/integrations/google_calendar/invoke.
+    const calendarRoutes = createCalendarRoutes({
+        services: deps.services,
+        agentWriteTracker: deps.writeTracker,
+        db: deps.db,
+    });
+    app.route("/api", calendarRoutes);
+    // Apple Calendar (iCloud CalDAV) routes — sibling provider to
+    // /api/calendar. The skill body routes the agent here when
+    // rules/management.md says Schedule = Apple Calendar.
+    const appleCalendarRoutes = createAppleCalendarRoutes({
+        services: deps.services,
+        secretBroker: deps.secretBroker,
+        agentWriteTracker: deps.writeTracker,
+    });
+    app.route("/api", appleCalendarRoutes);
+    // Multi-mail provider routes — /api/mail/* + /api/config/mail/*. Gmail
+    // accounts return 410 from the per-account gate inside the route
+    // handler when `gmail.mode === "delegated"` (DELEGATED-MODE-V2-DESIGN.md
+    // §6.3 defense-in-depth); cross-backend delegated work flows through
+    // POST /api/integrations/gmail/invoke.
+    const mailRoutes = createMailRoutes({
+        db: deps.db,
+        config: deps.config,
+        services: deps.services,
+        blobStore: deps.blobStore,
+        writeTracker: deps.writeTracker,
+        onMailScopeChanged: deps.onMailScopeChanged,
+    });
+    app.route("/api", mailRoutes);
+    // Obsidian routes — share the writeTracker so agent-originated vault
+    // writes (create / append / daily:append) are attributed correctly by
+    // the obsidian-watcher observer instead of appearing as user edits.
+    const obsidianRoutes = createObsidianRoutes({
+        obsidianService: deps.services.obsidian,
+        writeTracker: deps.writeTracker,
+    });
+    app.route("/api", obsidianRoutes);
+    // Git routes — registered unconditionally; the read-only proxy
+    // resolves `?repo=` against the unified `repositories` table on every
+    // request and 400s when the row is missing or has no local clone.
+    const gitRoutes = createGitRoutes({ db: deps.db });
+    app.route("/api", gitRoutes);
+    // Unified Repositories API — registration + behavioural surface
+    // (CRUD, run, triggers, daily management). See
+    // docs/design/appendices/unified-repositories.md.
+    const repositoriesRoutes = createRepositoriesRoutes({
+        db: deps.db,
+        eventBus: deps.eventBus,
+        config: deps.config,
+        writeTracker: deps.writeTracker,
+        onIndexableContextChange: deps.onIndexableContextChange,
+    });
+    app.route("/api", repositoriesRoutes);
+    // Git template editor + retemplate. Registered unconditionally — the
+    // dashboard's Templates editor is reachable even when no repos are
+    // currently watched (the user may be staging a template change before
+    // adding repos), and the retemplate path's own enumeration handles
+    // the empty-targets case.
+    const gitTemplatesRoutes = createGitTemplatesRoutes({
+        db: deps.db,
+        config: deps.config,
+        getContextDir: () => getContextDir(deps.config, deps.db),
+    });
+    app.route("/api", gitTemplatesRoutes);
+    // SSE routes for real-time dashboard communication
+    if (deps.eventBroadcaster) {
+        const sseRoutes = createSSERoutes({
+            dashboardAdapter: deps.dashboardAdapter ?? null,
+            eventBroadcaster: deps.eventBroadcaster,
+            getChatBinding: () => {
+                const result = queryChatBinding(deps.db, {
+                    backend: "claude",
+                    highModel: DEFAULT_CLAUDE_HIGH_MODEL,
+                });
+                if (!result)
+                    return null;
+                return {
+                    backend: result.activeBackend,
+                    model: result.activeModel,
+                    modelLabel: result.activeModelLabel,
+                };
+            },
+            isSessionActive: (sessionId) => {
+                const row = deps.db
+                    .prepare("SELECT 1 FROM conversation_sessions WHERE id = ? AND status = 'active' LIMIT 1")
+                    .get(sessionId);
+                return row != null;
+            },
+            findActiveDashboardSessionId: () => {
+                const row = deps.db
+                    .prepare(`SELECT id FROM conversation_sessions
+             WHERE scope = 'dashboard_chat'
+               AND scope_key = 'dashboard'
+               AND status = 'active'
+             ORDER BY last_message_at DESC
+             LIMIT 1`)
+                    .get();
+                return row?.id ?? null;
+            },
+            rebindSessionChannel: (sessionId, newChannelId) => {
+                deps.db
+                    .prepare("UPDATE conversation_sessions SET channel_id = ? WHERE id = ? AND status = 'active'")
+                    .run(newChannelId, sessionId);
+            },
+            endSession: (channelId) => deps.endDashboardSession?.(channelId) ?? Promise.resolve(null),
+            continueSession: (sessionId) => deps.continueDashboardSession?.(sessionId)
+                ?? Promise.resolve({ ok: false, status: 503, message: "continue unavailable" }),
+            attachmentStore: deps.attachmentStore,
+            validateChatModelOverride: (backendId, modelId) => {
+                try {
+                    const row = deps.db
+                        .prepare("SELECT enabled FROM backends WHERE id = ? LIMIT 1")
+                        .get(backendId);
+                    if (!row || row.enabled !== 1) {
+                        return false;
+                    }
+                    return getModelsForBackend(backendId).some((model) => model.modelId === modelId);
+                }
+                catch (err) {
+                    // Fail closed — the override is a best-effort feature, not
+                    // load-bearing for basic chat dispatch. But log so we notice if
+                    // the query starts failing in production (e.g. schema drift,
+                    // corruption) rather than swallowing it silently. In tests the
+                    // `backends` table may not exist yet (migrations haven't run),
+                    // which is benign and expected.
+                    logger.warn({ err, backendId, modelId }, "validateChatModelOverride query failed — rejecting override");
+                    return false;
+                }
+            },
+        });
+        app.route("/api", sseRoutes);
+    }
+    // GitHub routes — webhook at root, API proxy under /api
+    if (deps.eventBus) {
+        const { webhookApp, apiApp } = createGitHubRoutes({
+            db: deps.db,
+            config: deps.config,
+            secretBroker: deps.secretBroker,
+            eventBus: deps.eventBus,
+        });
+        app.route("/", webhookApp); // POST /webhook/github
+        app.route("/api", apiApp); // GET /api/github/repos, etc.
+    }
+    // Boot-time risk-classification audit. Surfaces /api routes that
+    // rely on the default-Approve fallback. Most are intentional admin
+    // surfaces (secrets, pairing, restore-snapshot, dashboard-only
+    // controls) for which fail-closed is correct — but the same fallback
+    // historically masked the `POST /api/context/roadmap/id` regression
+    // that 7×401'd inside roadmap_refresh on 2026-04-28.
+    //
+    // Gating: log only when the unclassified set CHANGES from the last
+    // boot. A warning that fires identically on every restart turns into
+    // wallpaper within a week and a real regression (one new entry) gets
+    // lost in the noise. Hash + persist + diff via `runtime_state`.
+    const unclassified = auditRiskClassifications(app.routes);
+    if (unclassified.length > 0) {
+        const auditFingerprint = createHash("sha256")
+            .update(unclassified
+            .map((r) => `${r.method} ${r.path}`)
+            .sort()
+            .join("\n"))
+            .digest("hex");
+        const previous = readRuntimeState(deps.db, RISK_AUDIT_STATE_KEY);
+        if (previous?.fingerprint !== auditFingerprint) {
+            logger.warn({ count: unclassified.length, routes: unclassified }, "Boot audit: /api routes relying on the default-Approve fallback (changed since last boot). Each WILL require Bearer auth. Add explicit RiskTier.Approve / Autonomous entries in risk-classifier.ts to silence this and surface future regressions cleanly.");
+            writeRuntimeState(deps.db, RISK_AUDIT_STATE_KEY, {
+                fingerprint: auditFingerprint,
+            });
+        }
+    }
+    else {
+        // Set was previously non-empty and is now empty — clear the
+        // stored fingerprint so a regression resurrects the warning.
+        writeRuntimeState(deps.db, RISK_AUDIT_STATE_KEY, { fingerprint: "" });
+    }
+    return app;
+}
+//# sourceMappingURL=server.js.map

package/dist/api/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/api/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AAGnE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,QAAQ,GACT,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAoB,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAiBjE,OAAO,EACL,oCAAoC,GAErC,MAAM,qCAAqC,CAAC;AAM7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AA2azD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAExE,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,CAE3B;IACC,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,IAAI,GAAG,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,SAAS,yBAAyB,CAAC,OAAe;IAChD,OAAO,IAAI,GAAG,CAAC;QACb,oBAAoB,OAAO,EAAE;QAC7B,oBAAoB,OAAO,EAAE;QAC7B,gBAAgB,OAAO,EAAE;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAClC,KAA+B;IAE/B,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;YACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,kBAAkB,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,CAEvB;IACC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,OAAO,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,MAAqB,EAAE,QAAuB;IACrE,OAAO,MAAM,KAAK,IAAI;WACjB,QAAQ,KAAK,IAAI;WACjB,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;WACjC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,CAAyD,EACzD,IAA2C;IAE3C,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,4BAA4B,CACzC,CAAyD,EACzD,IAAgF;IAEhF,yCAAyC;IACzC,IAAI,MAAM,qBAAqB,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;eAC/B,eAAe,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM;eAChD,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAC7E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5E,aAAa;IAEb,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAClF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3B,4EAA4E;IAC5E,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,2BAA2B,CAAC;YAC9C,MAAM;YACN,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI;YACtC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACpD,cAAc,EAAE,oBAAoB;SACrC,CAAC,CAAC;QAEH,IAAI,IAAI,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,2DAA2D,EAAE,EACvG,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAChC,yDAAyD;YACzD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,uCAAuC,EAAE,EAC3E,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EAClD,4CAA4C,CAC7C,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,kBAAkB;gBACzB,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,OAAO,EACL,uFAAuF;aAC1F,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC3C,0EAA0E;YAC1E,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAC1B,+DAA+D;oBAC/D,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,EACxC,iDAAiD,CAClD,CAAC;oBACF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,8DAA8D,EAAE,EAClG,GAAG,CACJ,CAAC;gBACJ,CAAC;gBACD,sDAAsD;gBACtD,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,EACxC,2CAA2C,CAC5C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,EACxC,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,6CAA6C;IAC7C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAE1D,2DAA2D;IAC3D,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,SAAS;IACT,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACtC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QACnC,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,kEAAkE;IAClE,iCAAiC;IACjC,MAAM,kBAAkB,GACtB,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB;QACzC,CAAC,CAAC,wBAAwB,CAAC;YACvB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,SAAS;YACpD,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;SACxD,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,uBAAuB,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,0BAA0B,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;IAChD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,sEAAsE;IACtE,mEAAmE;IACnE,qEAAqE;IACrE,iEAAiE;IACjE,+DAA+D;IAC/D,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,6BAA6B,GACjC,IAAI,CAAC,4BAA4B,IAAI,IAAI,oCAAoC,EAAE,CAAC;IAClF,MAAM,kBAAkB,GAAG,wBAAwB,CACjD,kCAAkC,CAAC,IAAI,EAAE,6BAA6B,CAAC,CACxE,CAAC;IACF,MAAM,iBAAiB,GAAG,uBAAuB,CAC/C,iCAAiC,CAAC,IAAI,EAAE,6BAA6B,CAAC,CACvE,CAAC;IACF,MAAM,cAAc,GAAG,oBAAoB,CACzC,8BAA8B,CAAC,IAAI,CAAC,CACrC,CAAC;IACF,MAAM,qBAAqB,GAAG,2BAA2B,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3E,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,IAAI,kBAAkB,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACxC,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC3C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAClC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE/B,wCAAwC;IACxC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;YAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,eAAe;YAC3B,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;mBAC9C,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtC,CAAC;IAED,gDAAgD;IAChD,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,OAAO;IACP,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,eAAe,CAAC;YAChC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC7B,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,uEAAuE;IACvE,oDAAoD;IACpD,iDAAiD;IACjD,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,iBAAiB,EAAE,IAAI,CAAC,YAAY;QACpC,EAAE,EAAE,IAAI,CAAC,EAAE;KACZ,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAElC,8DAA8D;IAC9D,2DAA2D;IAC3D,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;QACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,iBAAiB,EAAE,IAAI,CAAC,YAAY;KACrC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAEvC,uEAAuE;IACvE,iEAAiE;IACjE,yEAAyE;IACzE,qEAAqE;IACrE,uCAAuC;IACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE9B,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QACvC,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAElC,+DAA+D;IAC/D,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE7B,gEAAgE;IAChE,+CAA+C;IAC/C,kDAAkD;IAClD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;QAClD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtC,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,0BAA0B;IAC1B,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;QAClD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAEtC,mDAAmD;IACnD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,eAAe,CAAC;YAChC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;YAC/C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,cAAc,EAAE,GAAG,EAAE;gBACnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE;oBACvC,OAAO,EAAE,QAAQ;oBACjB,SAAS,EAAE,yBAAyB;iBACrC,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,MAAM,CAAC,aAAa;oBAC7B,KAAK,EAAE,MAAM,CAAC,WAAW;oBACzB,UAAU,EAAE,MAAM,CAAC,gBAAgB;iBACpC,CAAC;YACJ,CAAC;YACD,eAAe,EAAE,CAAC,SAAS,EAAE,EAAE;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;qBAChB,OAAO,CACN,gFAAgF,CACjF;qBACA,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClB,OAAO,GAAG,IAAI,IAAI,CAAC;YACrB,CAAC;YACD,4BAA4B,EAAE,GAAG,EAAE;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;qBAChB,OAAO,CACN;;;;;qBAKS,CACV;qBACA,GAAG,EAAgC,CAAC;gBACvC,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;YACzB,CAAC;YACD,oBAAoB,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE;gBAChD,IAAI,CAAC,EAAE;qBACJ,OAAO,CACN,oFAAoF,CACrF;qBACA,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAClC,CAAC;YACD,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACzF,eAAe,EAAE,CAAC,SAAS,EAAE,EAAE,CAC7B,IAAI,CAAC,wBAAwB,EAAE,CAAC,SAAS,CAAC;mBACrC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;YAC5F,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,yBAAyB,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;gBAChD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;yBAChB,OAAO,CAAC,mDAAmD,CAAC;yBAC5D,GAAG,CAAC,SAAS,CAAoC,CAAC;oBACrD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;wBAC9B,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,CACxC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CACrC,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,2DAA2D;oBAC3D,gEAAgE;oBAChE,6DAA6D;oBAC7D,+DAA+D;oBAC/D,+DAA+D;oBAC/D,gCAAgC;oBAChC,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAC3B,6DAA6D,CAC9D,CAAC;oBACF,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,wDAAwD;IACxD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC;YAChD,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAG,uBAAuB;QACrD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAI,8BAA8B;IAC9D,CAAC;IAED,iEAAiE;IACjE,mEAAmE;IACnE,+DAA+D;IAC/D,qEAAqE;IACrE,oEAAoE;IACpE,qDAAqD;IACrD,EAAE;IACF,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC1C,MAAM,CACL,YAAY;aACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;aACnC,IAAI,EAAE;aACN,IAAI,CAAC,IAAI,CAAC,CACd;aACA,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,EAAE,EACP,oBAAoB,CACrB,CAAC;QACF,IAAI,QAAQ,EAAE,WAAW,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EACpD,4PAA4P,CAC7P,CAAC;YACF,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,EAAE;gBAC/C,WAAW,EAAE,gBAAgB;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,4DAA4D;QAC5D,6DAA6D;QAC7D,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}