@elizaos/shared 2.0.0-beta.1 → 2.0.3-beta.3

package/local-inference-gpu/gpu-tier-profiles.js

@@ -0,0 +1,235 @@
+/**
+ * Simplified per-GPU configuration profiles for the Eliza-1 model family.
+ *
+ * These profiles describe hardware capabilities and llama-server flag
+ * recommendations for four supported NVIDIA cards. They are intentionally
+ * separate from the richer YAML-backed `GpuYamlProfile` system in
+ * `gpu-profile-loader.ts` — the JSON-style data here is bundled inline
+ * (no fs reads, no YAML parser) so it is safe in every environment:
+ * mobile runtimes, edge bundles, and server contexts.
+ *
+ * Selection: use `selectBestProfile(vramGb, cudaCompute)` to pick the
+ * most capable profile the detected GPU qualifies for. The result feeds
+ * `buildLlamaCppArgs()` to produce a ready-to-use argv array for
+ * llama-server. Caller must fill in `--model <path>` separately — this
+ * module never references model files.
+ *
+ * Override: set `ELIZA_GPU_PROFILE=<id>` (e.g. `rtx-4090`) to bypass
+ * auto-detection and force a specific profile. `autoSelectProfile()` in
+ * `detect.ts` respects this variable.
+ *
+ * Supported ids: `rtx-3090`, `rtx-4090`, `rtx-5090`, `h200`.
+ */
+// ---------------------------------------------------------------------------
+// Inline profile data — no fs reads at runtime
+// ---------------------------------------------------------------------------
+const RTX_3090 = {
+    id: "rtx-3090",
+    display_name: "NVIDIA RTX 3090",
+    vram_gb: 24,
+    cuda_compute: "8.6",
+    features: ["fp16", "bf16", "int8", "int4"],
+    recommended_tiers: {
+        primary: "eliza-1-9b",
+        secondary: "eliza-1-4b",
+        heavy: null,
+    },
+    llama_cpp_flags: {
+        n_gpu_layers: 99,
+        tensor_split: null,
+        flash_attn: true,
+        use_mmap: true,
+        numa: false,
+    },
+    mtp: {
+        enabled: true,
+        drafter_tier: "eliza-1-2b",
+        speculative_window: 5,
+    },
+    ctx_size_tokens: 32768,
+    notes: "24 GB GDDR6X. Best fit is Eliza-1 9B with 4B/2B fallbacks. MTP enabled with the 2B drafter.",
+};
+const RTX_4090 = {
+    id: "rtx-4090",
+    display_name: "NVIDIA RTX 4090",
+    vram_gb: 24,
+    cuda_compute: "8.9",
+    features: ["fp16", "bf16", "int8", "int4", "fp8"],
+    recommended_tiers: {
+        primary: "eliza-1-27b",
+        secondary: "eliza-1-9b",
+        heavy: null,
+    },
+    llama_cpp_flags: {
+        n_gpu_layers: 99,
+        tensor_split: null,
+        flash_attn: true,
+        use_mmap: true,
+        numa: false,
+    },
+    mtp: {
+        enabled: true,
+        drafter_tier: "eliza-1-2b",
+        speculative_window: 6,
+    },
+    ctx_size_tokens: 65536,
+    notes: "24 GB GDDR6X, Ada Lovelace. FP8 available. Runs Eliza-1 27B with compressed KV and keeps 9B/4B as fast fallbacks.",
+};
+const RTX_5090 = {
+    id: "rtx-5090",
+    display_name: "NVIDIA RTX 5090",
+    vram_gb: 32,
+    cuda_compute: "12.0",
+    features: ["fp16", "bf16", "int8", "int4", "fp8", "fp4"],
+    recommended_tiers: {
+        primary: "eliza-1-27b-256k",
+        secondary: "eliza-1-27b",
+        heavy: "eliza-1-9b",
+    },
+    llama_cpp_flags: {
+        n_gpu_layers: 99,
+        tensor_split: null,
+        flash_attn: true,
+        use_mmap: true,
+        numa: false,
+    },
+    mtp: {
+        enabled: true,
+        drafter_tier: "eliza-1-2b",
+        speculative_window: 8,
+    },
+    ctx_size_tokens: 131072,
+    notes: "32 GB GDDR7, Blackwell. FP4 available. Best fit is the 27B 256k bundle with 27B and 9B fallbacks.",
+};
+const H200 = {
+    id: "h200",
+    display_name: "NVIDIA H200",
+    vram_gb: 141,
+    cuda_compute: "9.0",
+    features: ["fp16", "bf16", "int8", "int4", "fp8"],
+    recommended_tiers: {
+        primary: "eliza-1-27b-256k",
+        secondary: "eliza-1-27b",
+        heavy: "eliza-1-9b",
+    },
+    llama_cpp_flags: {
+        n_gpu_layers: 99,
+        tensor_split: null,
+        flash_attn: true,
+        use_mmap: false,
+        numa: true,
+    },
+    mtp: {
+        enabled: true,
+        drafter_tier: "eliza-1-4b",
+        speculative_window: 10,
+    },
+    ctx_size_tokens: 262144,
+    notes: "141 GB HBM3e. SXM5 form factor. Best fit is the 27B 256k bundle (262k natural context). MTP uses the 4B drafter for high throughput.",
+};
+// ---------------------------------------------------------------------------
+// Public registry
+// ---------------------------------------------------------------------------
+/**
+ * All built-in profiles keyed by id.
+ *
+ * Data is inlined — no fs reads at runtime — so the map is available in
+ * every environment (mobile, edge, server) without extra IO.
+ */
+export const GPU_PROFILES = {
+    "rtx-3090": RTX_3090,
+    "rtx-4090": RTX_4090,
+    "rtx-5090": RTX_5090,
+    h200: H200,
+};
+/**
+ * Look up a profile by its canonical id. Returns `null` when the id is
+ * not in the built-in registry (including when the caller passes an
+ * unrecognised override id from `ELIZA_GPU_PROFILE`).
+ */
+export function getGpuProfile(id) {
+    return GPU_PROFILES[id] ?? null;
+}
+// ---------------------------------------------------------------------------
+// Compute-capability comparison helpers
+// ---------------------------------------------------------------------------
+/**
+ * Parse a dotted compute-capability string (`"8.9"`) to a single
+ * comparable float. Handles both `"8.9"` and `"sm_89"` spellings.
+ */
+function parseCudaCompute(cc) {
+    // Strip optional "sm_" prefix used by some tools.
+    const cleaned = cc.replace(/^sm_/i, "").replace("_", ".");
+    const val = parseFloat(cleaned);
+    return Number.isNaN(val) ? -1 : val;
+}
+/**
+ * Return the best-fit profile for a detected GPU.
+ *
+ * "Best fit" = the profile with the highest `vram_gb` that still
+ * satisfies both of:
+ *   1. `profile.vram_gb <= vramGb`   (card has at least as much VRAM)
+ *   2. `profile.cuda_compute <= cudaCompute`  (card meets compute level)
+ *
+ * Returns `null` when no profile fits (e.g. only 8 GB VRAM — below all
+ * supported cards).
+ */
+export function selectBestProfile(vramGb, cudaCompute) {
+    const hostCc = parseCudaCompute(cudaCompute);
+    let best = null;
+    let bestCc = -1;
+    for (const profile of Object.values(GPU_PROFILES)) {
+        const profileCc = parseCudaCompute(profile.cuda_compute);
+        if (profile.vram_gb > vramGb)
+            continue;
+        if (profileCc > hostCc)
+            continue;
+        if (best === null ||
+            profile.vram_gb > best.vram_gb ||
+            (profile.vram_gb === best.vram_gb && profileCc > bestCc)) {
+            best = profile;
+            bestCc = profileCc;
+        }
+    }
+    return best;
+}
+// ---------------------------------------------------------------------------
+// CLI-flag builder
+// ---------------------------------------------------------------------------
+/**
+ * Produce a `llama-server` argv array from a profile.
+ *
+ * Flags produced (in order):
+ *   --n-gpu-layers <N>
+ *   --flash-attn             (when flash_attn is true)
+ *   --no-mmap                (when use_mmap is false)
+ *   --numa                   (when numa is true)
+ *   --ctx-size <N>
+ *
+ * Any value in `overrides` replaces the corresponding profile field
+ * before the flags are built — useful for per-call adjustments without
+ * modifying the shared profile object.
+ *
+ * Note: `--model <path>` is intentionally omitted. Callers must append
+ * it themselves so this function never needs to touch model files.
+ */
+export function buildLlamaCppArgs(profile, overrides) {
+    const flags = overrides
+        ? { ...profile.llama_cpp_flags, ...overrides }
+        : profile.llama_cpp_flags;
+    const ctxSize = overrides?.ctx_size_tokens ?? profile.ctx_size_tokens;
+    const argv = [];
+    argv.push("--n-gpu-layers", String(flags.n_gpu_layers));
+    if (flags.flash_attn) {
+        argv.push("--flash-attn");
+    }
+    if (!flags.use_mmap) {
+        argv.push("--no-mmap");
+    }
+    if (flags.numa) {
+        argv.push("--numa");
+    }
+    argv.push("--ctx-size", String(ctxSize));
+    return argv;
+}
+//# sourceMappingURL=gpu-tier-profiles.js.map

package/local-inference-gpu/gpu-tier-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gpu-tier-profiles.js","sourceRoot":"","sources":["../../src/local-inference-gpu/gpu-tier-profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA8CH,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,QAAQ,GAAe;IAC3B,EAAE,EAAE,UAAU;IACd,YAAY,EAAE,iBAAiB;IAC/B,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAC1C,iBAAiB,EAAE;QACjB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE,YAAY;QACvB,KAAK,EAAE,IAAI;KACZ;IACD,eAAe,EAAE;QACf,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,KAAK;KACZ;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,YAAY;QAC1B,kBAAkB,EAAE,CAAC;KACtB;IACD,eAAe,EAAE,KAAK;IACtB,KAAK,EACH,6FAA6F;CAChG,CAAC;AAEF,MAAM,QAAQ,GAAe;IAC3B,EAAE,EAAE,UAAU;IACd,YAAY,EAAE,iBAAiB;IAC/B,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IACjD,iBAAiB,EAAE;QACjB,OAAO,EAAE,aAAa;QACtB,SAAS,EAAE,YAAY;QACvB,KAAK,EAAE,IAAI;KACZ;IACD,eAAe,EAAE;QACf,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,KAAK;KACZ;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,YAAY;QAC1B,kBAAkB,EAAE,CAAC;KACtB;IACD,eAAe,EAAE,KAAK;IACtB,KAAK,EACH,mHAAmH;CACtH,CAAC;AAEF,MAAM,QAAQ,GAAe;IAC3B,EAAE,EAAE,UAAU;IACd,YAAY,EAAE,iBAAiB;IAC/B,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,MAAM;IACpB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;IACxD,iBAAiB,EAAE;QACjB,OAAO,EAAE,kBAAkB;QAC3B,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,YAAY;KACpB;IACD,eAAe,EAAE;QACf,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,KAAK;KACZ;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,YAAY;QAC1B,kBAAkB,EAAE,CAAC;KACtB;IACD,eAAe,EAAE,MAAM;IACvB,KAAK,EACH,mGAAmG;CACtG,CAAC;AAEF,MAAM,IAAI,GAAe;IACvB,EAAE,EAAE,MAAM;IACV,YAAY,EAAE,aAAa;IAC3B,OAAO,EAAE,GAAG;IACZ,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IACjD,iBAAiB,EAAE;QACjB,OAAO,EAAE,kBAAkB;QAC3B,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,YAAY;KACpB;IACD,eAAe,EAAE;QACf,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,IAAI;KACX;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,YAAY;QAC1B,kBAAkB,EAAE,EAAE;KACvB;IACD,eAAe,EAAE,MAAM;IACvB,KAAK,EACH,sIAAsI;CACzI,CAAC;AAEF,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAA+B;IACtD,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,YAAY,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,gBAAgB,CAAC,EAAU;IAClC,kDAAkD;IAClD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,WAAmB;IAEnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAE7C,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,OAAO,GAAG,MAAM;YAAE,SAAS;QACvC,IAAI,SAAS,GAAG,MAAM;YAAE,SAAS;QACjC,IACE,IAAI,KAAK,IAAI;YACb,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO;YAC9B,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,SAAS,GAAG,MAAM,CAAC,EACxD,CAAC;YACD,IAAI,GAAG,OAAO,CAAC;YACf,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAmB,EACnB,SAEC;IAED,MAAM,KAAK,GAAG,SAAS;QACrB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,GAAG,SAAS,EAAE;QAC9C,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAC5B,MAAM,OAAO,GAAG,SAAS,EAAE,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC;IAEtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IAExD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/loopback-trust.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Same-machine ("loopback") request trust evaluation.
+ *
+ * This is a SECURITY BOUNDARY: it decides whether an unauthenticated HTTP
+ * request is allowed to act as the local dashboard owner. Previously the exact
+ * same logic was triplicated across `@elizaos/app-core` (`compat-route-shared`)
+ * and `@elizaos/agent` (`server-helpers-auth`), with subtly divergent env-policy
+ * gates and a non-equivalent `isLoopbackBindHost`. The divergence was a parity
+ * hazard, so the logic is unified here and parameterised so each consumer keeps
+ * its EXACT prior trust decisions.
+ *
+ * The two consumers differ ONLY in their policy gates, expressed via
+ * {@link LoopbackTrustOptions}:
+ *  - app-core: requireLocalAuthEnv + devAuthBypassEnv, cloudCheck "env"
+ *    (`ELIZA_CLOUD_PROVISIONED === "1"`).
+ *  - agent:    requireLocalAuthEnv (no dev bypass), cloudCheck "container"
+ *    (`isCloudProvisionedContainer()` — flag AND a provisioning token).
+ *
+ * The host/origin classification (`isLoopbackBindHost`) is the canonical strict
+ * implementation from `runtime-env.ts` for BOTH consumers. For app-core this is
+ * byte-identical (it already imported the shared helper). For the agent this is
+ * a strict tightening in the safe direction: the agent's hand-rolled copy
+ * accepted any `127.*`-prefixed host string (e.g. the DNS-rebinding host
+ * `127.0.0.1.evil.com`), which the strict parser correctly rejects. The change
+ * can only ever turn a previously-trusted request into an untrusted one, never
+ * the reverse.
+ */
+import type http from "node:http";
+export interface LoopbackTrustOptions {
+    /**
+     * When true, deny local trust if `ELIZA_REQUIRE_LOCAL_AUTH === "1"`. On-device
+     * local agents (Android) set this flag alongside a per-boot API token because
+     * the loopback interface is shared with every other app on the device, so
+     * loopback alone is NOT a trust signal there.
+     */
+    requireLocalAuthEnv: boolean;
+    /**
+     * When true, `ELIZA_DEV_AUTH_BYPASS === "1"` in a development `NODE_ENV`
+     * overrides {@link requireLocalAuthEnv}, restoring local trust for the dev
+     * dashboard. Only app-core honours this; the agent never does.
+     */
+    devAuthBypassEnv: boolean;
+    /**
+     * Cloud-container detection strategy. `"env"` trusts the raw
+     * `ELIZA_CLOUD_PROVISIONED` flag; `"container"` requires the flag AND a
+     * provisioning token (see {@link isCloudProvisionedContainer}). These are
+     * DIFFERENT semantics — do not swap them between consumers.
+     */
+    cloudCheck: "env" | "container";
+}
+/**
+ * True when any proxy-style client-IP header carries a non-loopback (or
+ * unparseable) address. A request that reaches a same-machine listener but
+ * advertises a remote client behind a proxy must NOT be granted local trust.
+ */
+export declare function proxyClientHeaderBlocksLocalTrust(headers: http.IncomingHttpHeaders): boolean;
+/**
+ * True when the TCP peer address is a loopback address. Note this is stricter
+ * than {@link isLoopbackBindHost}: it matches only fully-normalised loopback
+ * addresses (no host:port or URL forms), since `socket.remoteAddress` is always
+ * a bare IP.
+ */
+export declare function isLoopbackRemoteAddress(remoteAddress: string | null | undefined): boolean;
+/**
+ * Same-machine dashboard access. Intentionally stricter than a bare
+ * `remoteAddress` check: the browser must also target a loopback Host and must
+ * not present cross-site browser metadata or proxy client-IP headers.
+ *
+ * Each consumer supplies {@link LoopbackTrustOptions} matching its historical
+ * policy gates; the host/origin/proxy classification is identical for all.
+ */
+export declare function isTrustedLocalRequest(req: Pick<http.IncomingMessage, "headers" | "socket">, options: LoopbackTrustOptions): boolean;
+//# sourceMappingURL=loopback-trust.d.ts.map

package/loopback-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-trust.d.ts","sourceRoot":"","sources":["../src/loopback-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAKlC,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,KAAK,GAAG,WAAW,CAAC;CACjC;AA6HD;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,IAAI,CAAC,mBAAmB,GAChC,OAAO,CAkBT;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAUT;AA0CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EACrD,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAqBT"}

package/loopback-trust.js

@@ -0,0 +1,241 @@
+/**
+ * Same-machine ("loopback") request trust evaluation.
+ *
+ * This is a SECURITY BOUNDARY: it decides whether an unauthenticated HTTP
+ * request is allowed to act as the local dashboard owner. Previously the exact
+ * same logic was triplicated across `@elizaos/app-core` (`compat-route-shared`)
+ * and `@elizaos/agent` (`server-helpers-auth`), with subtly divergent env-policy
+ * gates and a non-equivalent `isLoopbackBindHost`. The divergence was a parity
+ * hazard, so the logic is unified here and parameterised so each consumer keeps
+ * its EXACT prior trust decisions.
+ *
+ * The two consumers differ ONLY in their policy gates, expressed via
+ * {@link LoopbackTrustOptions}:
+ *  - app-core: requireLocalAuthEnv + devAuthBypassEnv, cloudCheck "env"
+ *    (`ELIZA_CLOUD_PROVISIONED === "1"`).
+ *  - agent:    requireLocalAuthEnv (no dev bypass), cloudCheck "container"
+ *    (`isCloudProvisionedContainer()` — flag AND a provisioning token).
+ *
+ * The host/origin classification (`isLoopbackBindHost`) is the canonical strict
+ * implementation from `runtime-env.ts` for BOTH consumers. For app-core this is
+ * byte-identical (it already imported the shared helper). For the agent this is
+ * a strict tightening in the safe direction: the agent's hand-rolled copy
+ * accepted any `127.*`-prefixed host string (e.g. the DNS-rebinding host
+ * `127.0.0.1.evil.com`), which the strict parser correctly rejects. The change
+ * can only ever turn a previously-trusted request into an untrusted one, never
+ * the reverse.
+ */
+import { isIP } from "node:net";
+import { isCloudProvisionedContainer } from "./elizacloud/cloud-provisioning.js";
+import { isLoopbackBindHost } from "./runtime-env.js";
+function firstHeaderValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && typeof value[0] === "string")
+        return value[0];
+    return null;
+}
+const CLIENT_IP_PROXY_HEADERS = new Set([
+    "forwarded",
+    "forwarded-for",
+    "x-forwarded",
+    "x-forwarded-for",
+    "x-original-forwarded-for",
+    "x-real-ip",
+    "x-client-ip",
+    "x-forwarded-client-ip",
+    "x-cluster-client-ip",
+    "cf-connecting-ip",
+    "true-client-ip",
+    "fastly-client-ip",
+    "x-appengine-user-ip",
+    "x-azure-clientip",
+]);
+function headerValues(value) {
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value)) {
+        return value.filter((item) => typeof item === "string");
+    }
+    return [];
+}
+function isClientIpProxyHeaderName(name) {
+    const normalized = name.toLowerCase();
+    return (CLIENT_IP_PROXY_HEADERS.has(normalized) ||
+        normalized.endsWith("-client-ip") ||
+        normalized.endsWith("-connecting-ip") ||
+        normalized.endsWith("-real-ip"));
+}
+function extractForwardedForCandidates(raw) {
+    const candidates = [];
+    const pattern = /(?:^|[;,])\s*for=(?:"([^"]*)"|([^;,]*))/gi;
+    for (const match of raw.matchAll(pattern)) {
+        candidates.push(match[1] ?? match[2] ?? "");
+    }
+    return candidates;
+}
+function extractProxyClientAddressCandidates(headerName, raw) {
+    if (headerName === "forwarded") {
+        return extractForwardedForCandidates(raw);
+    }
+    const forwardedCandidates = raw.toLowerCase().includes("for=")
+        ? extractForwardedForCandidates(raw)
+        : [];
+    if (forwardedCandidates.length > 0)
+        return forwardedCandidates;
+    return raw.split(",");
+}
+function stripMatchingQuotes(value) {
+    const trimmed = value.trim();
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function isNeutralProxyClientAddress(raw) {
+    const normalized = stripMatchingQuotes(raw).trim().toLowerCase();
+    return (!normalized ||
+        normalized === "unknown" ||
+        normalized === "null" ||
+        normalized.startsWith("_"));
+}
+function normalizeProxyClientIp(raw) {
+    let normalized = stripMatchingQuotes(raw).trim();
+    if (!normalized)
+        return null;
+    if (normalized.startsWith("[")) {
+        const close = normalized.indexOf("]");
+        if (close > 0) {
+            normalized = normalized.slice(1, close);
+        }
+    }
+    else {
+        const ipv4HostPort = /^(\d{1,3}(?:\.\d{1,3}){3})(?::\d+)$/.exec(normalized);
+        if (ipv4HostPort?.[1]) {
+            normalized = ipv4HostPort[1];
+        }
+    }
+    const zoneIndex = normalized.indexOf("%");
+    if (zoneIndex >= 0) {
+        normalized = normalized.slice(0, zoneIndex);
+    }
+    normalized = normalized.trim().toLowerCase();
+    return isIP(normalized) ? normalized : null;
+}
+function isLoopbackProxyClientIp(ip) {
+    const normalized = ip.trim().toLowerCase();
+    return (normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized.startsWith("127.") ||
+        normalized.startsWith("::ffff:127.") ||
+        normalized.startsWith("::ffff:0:127."));
+}
+/**
+ * True when any proxy-style client-IP header carries a non-loopback (or
+ * unparseable) address. A request that reaches a same-machine listener but
+ * advertises a remote client behind a proxy must NOT be granted local trust.
+ */
+export function proxyClientHeaderBlocksLocalTrust(headers) {
+    for (const [rawName, rawValue] of Object.entries(headers)) {
+        const headerName = rawName.toLowerCase();
+        if (!isClientIpProxyHeaderName(headerName))
+            continue;
+        for (const value of headerValues(rawValue)) {
+            for (const candidate of extractProxyClientAddressCandidates(headerName, value)) {
+                if (isNeutralProxyClientAddress(candidate))
+                    continue;
+                const ip = normalizeProxyClientIp(candidate);
+                if (!ip || !isLoopbackProxyClientIp(ip))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * True when the TCP peer address is a loopback address. Note this is stricter
+ * than {@link isLoopbackBindHost}: it matches only fully-normalised loopback
+ * addresses (no host:port or URL forms), since `socket.remoteAddress` is always
+ * a bare IP.
+ */
+export function isLoopbackRemoteAddress(remoteAddress) {
+    if (!remoteAddress)
+        return false;
+    const normalized = remoteAddress.trim().toLowerCase();
+    return (normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized === "::ffff:127.0.0.1" ||
+        normalized === "::ffff:0:127.0.0.1");
+}
+const LOCAL_APP_PROTOCOLS = new Set([
+    "file:",
+    "app:",
+    "tauri:",
+    "capacitor:",
+    "capacitor-electron:",
+    "electrobun:",
+]);
+function isTrustedLocalOrigin(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed === "null")
+        return true;
+    try {
+        const parsed = new URL(trimmed);
+        if (LOCAL_APP_PROTOCOLS.has(parsed.protocol)) {
+            return true;
+        }
+        return isLoopbackBindHost(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function cloudBlocksLocalTrust(cloudCheck) {
+    if (cloudCheck === "container")
+        return isCloudProvisionedContainer();
+    return process.env.ELIZA_CLOUD_PROVISIONED === "1";
+}
+function localAuthRequired(options) {
+    if (!options.requireLocalAuthEnv)
+        return false;
+    if (options.devAuthBypassEnv &&
+        process.env.ELIZA_DEV_AUTH_BYPASS === "1" &&
+        (process.env.NODE_ENV === "development" || process.env.NODE_ENV === "dev")) {
+        return false;
+    }
+    return process.env.ELIZA_REQUIRE_LOCAL_AUTH === "1";
+}
+/**
+ * Same-machine dashboard access. Intentionally stricter than a bare
+ * `remoteAddress` check: the browser must also target a loopback Host and must
+ * not present cross-site browser metadata or proxy client-IP headers.
+ *
+ * Each consumer supplies {@link LoopbackTrustOptions} matching its historical
+ * policy gates; the host/origin/proxy classification is identical for all.
+ */
+export function isTrustedLocalRequest(req, options) {
+    if (localAuthRequired(options))
+        return false;
+    if (cloudBlocksLocalTrust(options.cloudCheck))
+        return false;
+    if (!isLoopbackRemoteAddress(req.socket.remoteAddress))
+        return false;
+    if (proxyClientHeaderBlocksLocalTrust(req.headers))
+        return false;
+    const host = firstHeaderValue(req.headers.host);
+    if (host && !isLoopbackBindHost(host))
+        return false;
+    const secFetchSite = firstHeaderValue(req.headers["sec-fetch-site"])?.toLowerCase();
+    if (secFetchSite === "cross-site")
+        return false;
+    const origin = firstHeaderValue(req.headers.origin);
+    if (origin && !isTrustedLocalOrigin(origin))
+        return false;
+    const referer = firstHeaderValue(req.headers.referer);
+    if (!origin && referer && !isTrustedLocalOrigin(referer))
+        return false;
+    return true;
+}
+//# sourceMappingURL=loopback-trust.js.map

package/loopback-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-trust.js","sourceRoot":"","sources":["../src/loopback-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAyBtD,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,eAAe;IACf,aAAa;IACb,iBAAiB;IACjB,0BAA0B;IAC1B,WAAW;IACX,aAAa;IACb,uBAAuB;IACvB,qBAAqB;IACrB,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,qBAAqB;IACrB,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,KAAoC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,CACL,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;QACvC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACrC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,GAAW;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,2CAA2C,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mCAAmC,CAC1C,UAAkB,EAClB,GAAW;IAEX,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,mBAAmB,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAC,6BAA6B,CAAC,GAAG,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAE/D,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,OAAO,CACL,CAAC,UAAU;QACX,UAAU,KAAK,SAAS;QACxB,UAAU,KAAK,MAAM;QACrB,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,qCAAqC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,uBAAuB,CAAC,EAAU;IACzC,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CACL,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,iBAAiB;QAChC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC;QACpC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,CACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAAiC;IAEjC,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC;YAAE,SAAS;QAErD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,KAAK,MAAM,SAAS,IAAI,mCAAmC,CACzD,UAAU,EACV,KAAK,CACN,EAAE,CAAC;gBACF,IAAI,2BAA2B,CAAC,SAAS,CAAC;oBAAE,SAAS;gBACrD,MAAM,EAAE,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;gBAC7C,IAAI,CAAC,EAAE,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,aAAwC;IAExC,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,OAAO,CACL,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,iBAAiB;QAChC,UAAU,KAAK,kBAAkB;QACjC,UAAU,KAAK,oBAAoB,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO;IACP,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAA+B;IAC5D,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,2BAA2B,EAAE,CAAC;IACrE,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA6B;IACtD,IAAI,CAAC,OAAO,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC/C,IACE,OAAO,CAAC,gBAAgB;QACxB,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG;QACzC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,EAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAqD,EACrD,OAA6B;IAE7B,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpD,MAAM,YAAY,GAAG,gBAAgB,CACnC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAC9B,EAAE,WAAW,EAAE,CAAC;IACjB,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvE,OAAO,IAAI,CAAC;AACd,CAAC"}