@maudecode/talaria-web 0.0.0

package/dist/api/router.d.ts

@@ -0,0 +1,226 @@
+/**
+ * Implementation of the core route contract. Procedures receive the
+ * `RequestContext` and may throw `HttpError` for a byte-compatible
+ * `{"error": ...}` body, or `RawResponse` to emit an arbitrary payload/status.
+ */
+import { ORPCError } from '@orpc/server';
+import { type Bootstrap, type Health } from '@maudecode/talaria-web-contracts';
+import type { RequestContext } from '../http/context.js';
+export interface ApiContext {
+    ctx: RequestContext;
+}
+/** `{"error": message, ...extra}` with the given status (Python `bad()`). */
+export declare class HttpError extends ORPCError<string, Record<string, unknown>> {
+    constructor(status: number, message: string, extra?: Record<string, unknown>);
+}
+/** Python `require()`: every named field must be present and truthy (`0` counts as present); all misses are named at once. */
+export declare function requireFields(input: Record<string, unknown>, ...fields: string[]): void;
+/** A non-2xx response whose body is the payload itself (no `error` key), e.g. degraded `/health`. */
+export declare class RawResponse extends ORPCError<string, Record<string, unknown>> {
+    constructor(status: number, body: Record<string, unknown>, headers?: Record<string, string>);
+}
+/** Convert an oRPC error into the Python-shaped error body. */
+export declare function errorResponseBody(error: ORPCError<string, unknown>): Record<string, unknown>;
+export declare function errorResponseHeaders(error: ORPCError<string, unknown>): Record<string, string>;
+export declare function bootstrapPayload(ctx: RequestContext): Promise<Bootstrap>;
+/** The `language` setting as a BCP 47 tag for the shell `lang` attribute, or ``. */
+export declare function shellLanguage(ctx: RequestContext): string;
+export declare function healthPayload(ctx: RequestContext, deep: boolean): {
+    status: number;
+    body: Health;
+    headers?: Record<string, string>;
+};
+export declare const coreRouter: {
+    health: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("zod").ZodObject<{
+        deep: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        release: import("zod").ZodObject<{
+            tag: import("zod").ZodNullable<import("zod").ZodString>;
+            version: import("zod").ZodString;
+            sourceRevision: import("zod").ZodNullable<import("zod").ZodString>;
+            releaseSet: import("zod").ZodNullable<import("zod").ZodString>;
+            contracts: import("zod").ZodObject<{
+                appWeb: import("zod").ZodArray<import("zod").ZodNumber>;
+                webRelay: import("zod").ZodArray<import("zod").ZodNumber>;
+            }, import("zod/v4/core").$strip>;
+            compatibleAgent: import("zod").ZodObject<{
+                sourceRevision: import("zod").ZodString;
+                version: import("zod").ZodString;
+                image: import("zod").ZodString;
+            }, import("zod/v4/core").$catchall<import("zod").ZodUnknown>>;
+        }, import("zod/v4/core").$strip>;
+        status: import("zod").ZodEnum<{
+            ok: "ok";
+            degraded: "degraded";
+            starting: "starting";
+        }>;
+        phase: import("zod").ZodOptional<import("zod").ZodString>;
+        sessions: import("zod").ZodNumber;
+        active_streams: import("zod").ZodNumber;
+        active_runs: import("zod").ZodNumber;
+        runs: import("zod").ZodArray<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        last_run_finished_at: import("zod").ZodNullable<import("zod").ZodNumber>;
+        server_started_at: import("zod").ZodNumber;
+        uptime_seconds: import("zod").ZodNumber;
+        accept_loop: import("zod").ZodObject<{
+            requests_total: import("zod").ZodNumber;
+            last_request_at: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strip>;
+        checks: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    bootstrap: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+        webui_version: import("zod").ZodString;
+        max_upload_bytes: import("zod").ZodNumber;
+        csrf_token: import("zod").ZodString;
+        language: import("zod").ZodString;
+        bot_name: import("zod").ZodString;
+        auth: import("zod").ZodObject<{
+            auth_enabled: import("zod").ZodBoolean;
+            logged_in: import("zod").ZodBoolean;
+            oidc_enabled: import("zod").ZodBoolean;
+            oidc_native_handoff_enabled: import("zod").ZodBoolean;
+            password_auth_enabled: import("zod").ZodBoolean;
+            passwordless_enabled: import("zod").ZodBoolean;
+            passkeys_enabled: import("zod").ZodBoolean;
+            passkeys_count: import("zod").ZodNumber;
+            passkey_feature_flag: import("zod").ZodBoolean;
+            auth_disabled_acknowledged: import("zod").ZodBoolean;
+            can_manage_server: import("zod").ZodBoolean;
+            trusted_auth_enabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            auth_type: import("zod").ZodOptional<import("zod").ZodString>;
+            user: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+            bound_profile: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+        }, import("zod/v4/core").$strip>;
+        profile: import("zod").ZodNullable<import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            is_default: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strip>>;
+        onboarding: import("zod").ZodNullable<import("zod").ZodObject<{
+            completed: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strip>>;
+        features: import("zod").ZodObject<{
+            dashboard: import("zod").ZodBoolean;
+            terminal_remote_backend: import("zod").ZodBoolean;
+            extensions: import("zod").ZodBoolean;
+            single_profile_mode: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    auth: {
+        status: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+            auth_enabled: import("zod").ZodBoolean;
+            logged_in: import("zod").ZodBoolean;
+            oidc_enabled: import("zod").ZodBoolean;
+            oidc_native_handoff_enabled: import("zod").ZodBoolean;
+            password_auth_enabled: import("zod").ZodBoolean;
+            passwordless_enabled: import("zod").ZodBoolean;
+            passkeys_enabled: import("zod").ZodBoolean;
+            passkeys_count: import("zod").ZodNumber;
+            passkey_feature_flag: import("zod").ZodBoolean;
+            auth_disabled_acknowledged: import("zod").ZodBoolean;
+            can_manage_server: import("zod").ZodBoolean;
+            trusted_auth_enabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            auth_type: import("zod").ZodOptional<import("zod").ZodString>;
+            user: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+            bound_profile: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        login: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("zod").ZodObject<{
+            password: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            ok: import("zod").ZodLiteral<true>;
+            message: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$loose>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        logout: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+            ok: import("zod").ZodLiteral<true>;
+            trusted_logout_url: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        oidcNativeStart: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("zod").ZodObject<{
+            callback_url: import("zod").ZodString;
+            state: import("zod").ZodString;
+            code_challenge: import("zod").ZodString;
+            code_challenge_method: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            flow_id: import("zod").ZodString;
+            authorization_url: import("zod").ZodString;
+            server_id: import("zod").ZodString;
+            expires_in: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        oidcNativeExchange: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("zod").ZodObject<{
+            flow_id: import("zod").ZodString;
+            code: import("zod").ZodString;
+            state: import("zod").ZodString;
+            code_verifier: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            ok: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        oidcNativeCancel: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("zod").ZodObject<{
+            flow_id: import("zod").ZodString;
+            state: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            ok: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        passkeyOptions: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+            ok: import("zod").ZodLiteral<true>;
+            publicKey: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        passkeyLogin: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("zod").ZodObject<{
+            id: import("zod").ZodOptional<import("zod").ZodString>;
+            rawId: import("zod").ZodOptional<import("zod").ZodString>;
+            type: import("zod").ZodOptional<import("zod").ZodString>;
+            name: import("zod").ZodOptional<import("zod").ZodString>;
+            response: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        }, import("zod/v4/core").$catchall<import("zod").ZodUnknown>>, import("zod").ZodObject<{
+            ok: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        passkeyRegisterOptions: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+            ok: import("zod").ZodLiteral<true>;
+            publicKey: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        passkeyRegister: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("zod").ZodObject<{
+            id: import("zod").ZodOptional<import("zod").ZodString>;
+            rawId: import("zod").ZodOptional<import("zod").ZodString>;
+            type: import("zod").ZodOptional<import("zod").ZodString>;
+            name: import("zod").ZodOptional<import("zod").ZodString>;
+            response: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        }, import("zod/v4/core").$catchall<import("zod").ZodUnknown>>, import("zod").ZodObject<{
+            ok: import("zod").ZodLiteral<true>;
+            credential: import("zod").ZodObject<{
+                id: import("zod").ZodString;
+                label: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>;
+            credentials: import("zod").ZodArray<import("zod").ZodObject<{
+                id: import("zod").ZodString;
+                label: import("zod").ZodString;
+                created_at: import("zod").ZodNumber;
+                last_used_at: import("zod").ZodNullable<import("zod").ZodNumber>;
+                sign_count: import("zod").ZodNumber;
+            }, import("zod/v4/core").$strip>>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        passkeyDelete: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("zod").ZodObject<{
+            id: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            ok: import("zod").ZodLiteral<true>;
+            credentials: import("zod").ZodArray<import("zod").ZodObject<{
+                id: import("zod").ZodString;
+                label: import("zod").ZodString;
+                created_at: import("zod").ZodNumber;
+                last_used_at: import("zod").ZodNullable<import("zod").ZodNumber>;
+                sign_count: import("zod").ZodNumber;
+            }, import("zod/v4/core").$strip>>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        passkeys: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<ApiContext & Record<never, never>, ApiContext & Record<never, never>, ApiContext>, ApiContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+            credentials: import("zod").ZodArray<import("zod").ZodObject<{
+                id: import("zod").ZodString;
+                label: import("zod").ZodString;
+                created_at: import("zod").ZodNumber;
+                last_used_at: import("zod").ZodNullable<import("zod").ZodNumber>;
+                sign_count: import("zod").ZodNumber;
+            }, import("zod/v4/core").$strip>>;
+            disabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    };
+};
+/** Python `_client_ip_for_rate_limit` + trusted-proxy forwarding for the native OIDC start limiter. */
+export declare function rateLimitClientIp(ctx: RequestContext): string;
+export type CoreRouter = typeof coreRouter;
+/** Python `_send_still_starting`: the phase is in the text, and the connection closes after the 503. */
+export declare function startupUnavailable(ctx: RequestContext): void;

package/dist/api/router.js

@@ -0,0 +1,331 @@
+/**
+ * Implementation of the core route contract. Procedures receive the
+ * `RequestContext` and may throw `HttpError` for a byte-compatible
+ * `{"error": ...}` body, or `RawResponse` to emit an arbitrary payload/status.
+ */
+import { implement, ORPCError } from '@orpc/server';
+import { coreContract } from '@maudecode/talaria-web-contracts';
+import { authStatusPayload, clearAuthCookieHeader, clearProfileCookieHeader, ensureTrustedAuthSession, sessionCanManageServer } from '../auth/gate.js';
+import { OidcAuthError, OidcConfigError } from '../auth/oidc.js';
+import { PasskeyError, PasskeyRateLimitError, rpContext } from '../auth/passkeys.js';
+import { requestBaseUrl } from './auth-raw.js';
+import { onboardingGateAllows } from './settings-router.js';
+import { forwardedClientIp, rawPeerIsTrustedProxy } from '../http/origin.js';
+import { truthy } from '../config.js';
+import { STARTUP_RECOVERY_CONDITION } from '../startup.js';
+const STATUS_CODES = {
+    400: 'BAD_REQUEST', 401: 'UNAUTHORIZED', 403: 'FORBIDDEN', 404: 'NOT_FOUND', 409: 'CONFLICT', 413: 'PAYLOAD_TOO_LARGE',
+    422: 'UNPROCESSABLE_CONTENT', 429: 'TOO_MANY_REQUESTS', 500: 'INTERNAL_SERVER_ERROR', 501: 'NOT_IMPLEMENTED', 503: 'SERVICE_UNAVAILABLE',
+};
+/** `{"error": message, ...extra}` with the given status (Python `bad()`). */
+export class HttpError extends ORPCError {
+    constructor(status, message, extra = {}) {
+        super(STATUS_CODES[status] ?? 'INTERNAL_SERVER_ERROR', { status, message, data: extra });
+    }
+}
+/** Python `require()`: every named field must be present and truthy (`0` counts as present); all misses are named at once. */
+export function requireFields(input, ...fields) {
+    const missing = fields.filter((f) => { const v = input[f]; return v === undefined || v === null || v === '' || v === false; });
+    if (missing.length)
+        throw new HttpError(400, `Missing required field(s): ${missing.join(', ')}`);
+}
+/** A non-2xx response whose body is the payload itself (no `error` key), e.g. degraded `/health`. */
+export class RawResponse extends ORPCError {
+    constructor(status, body, headers = {}) {
+        super(STATUS_CODES[status] ?? 'INTERNAL_SERVER_ERROR', { status, message: 'raw', data: { __raw: true, body, headers } });
+    }
+}
+/** Convert an oRPC error into the Python-shaped error body. */
+export function errorResponseBody(error) {
+    const data = error.data;
+    if (data && typeof data === 'object' && data.__raw)
+        return data.body;
+    const extra = data && typeof data === 'object' && !Array.isArray(data) ? data : {};
+    if (error.code === 'INTERNAL_SERVER_ERROR' && !error.defined && error.message === 'Internal server error')
+        return { error: 'Internal server error' };
+    if (error.code === 'BAD_REQUEST' && Object.keys(extra).length === 0 && error.message.startsWith('Malformed request'))
+        return { error: 'Invalid JSON body' };
+    if (error.code === 'BAD_REQUEST' && error.message === 'Input validation failed') {
+        const issues = Array.isArray(extra.issues) ? extra.issues : [];
+        const mapped = issues.map((i) => ({ path: i.path ?? [], message: i.message ?? '' }));
+        // Python `require()` named every absent top-level field at once; only a malformed value is reported as invalid.
+        const missing = issues.filter((i) => i.path?.length === 1 && (i.message ?? '').includes('received undefined')).map((i) => String(i.path?.[0]));
+        if (missing.length && missing.length === issues.length)
+            return { error: `Missing required field(s): ${missing.join(', ')}`, issues: mapped };
+        const first = issues[0];
+        const field = first?.path?.map(String).join('.') ?? '';
+        return { error: field ? `Invalid ${field}` : 'Invalid request', issues: mapped };
+    }
+    return { error: error.message, ...extra };
+}
+export function errorResponseHeaders(error) {
+    const data = error.data;
+    if (data && typeof data === 'object' && data.__raw)
+        return data.headers;
+    return {};
+}
+const os = implement(coreContract).$context();
+export async function bootstrapPayload(ctx) {
+    const { deps } = ctx;
+    const auth = await authStatusPayload(ctx);
+    let csrfToken = '';
+    if (await deps.auth.isAuthEnabled()) {
+        const cookieVal = ctx.authCookie() ?? ctx.trusted.cookieValue ?? null;
+        if (cookieVal && deps.auth.verifySession(cookieVal))
+            csrfToken = deps.auth.csrfTokenForSession(cookieVal) ?? '';
+    }
+    const authenticated = !auth.auth_enabled || auth.logged_in;
+    const settings = authenticated ? deps.settings.load() : {};
+    let profile = null;
+    let onboarding = null;
+    let features = { dashboard: false, terminal_remote_backend: false, extensions: false, single_profile_mode: false };
+    if (authenticated) {
+        const active = ctx.requestProfile ?? deps.activeProfile();
+        profile = { name: active, is_default: deps.isRootProfile(active) };
+        onboarding = { completed: deps.onboardingCompleted() };
+        features = deps.features();
+    }
+    return {
+        webui_version: deps.version,
+        max_upload_bytes: deps.config.maxUploadBytes,
+        csrf_token: csrfToken,
+        language: authenticated ? shellLanguage(ctx) : '',
+        bot_name: authenticated ? (typeof settings.bot_name === 'string' && settings.bot_name ? settings.bot_name : 'Hermes') : 'Hermes',
+        auth,
+        profile,
+        onboarding,
+        features,
+    };
+}
+/** Python `_SHELL_LANG_RE`. */
+const SHELL_LANG_RE = /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
+/** The `language` setting as a BCP 47 tag for the shell `lang` attribute, or ``. */
+export function shellLanguage(ctx) {
+    let lang = '';
+    try {
+        const raw = ctx.deps.settings.load().language;
+        lang = typeof raw === 'string' ? raw.trim() : '';
+    }
+    catch {
+        return '';
+    }
+    return SHELL_LANG_RE.test(lang) ? lang : '';
+}
+export function healthPayload(ctx, deep) {
+    const { deps } = ctx;
+    const h = deps.health();
+    const now = deps.auth.now();
+    const body = {
+        release: deps.release,
+        status: 'ok',
+        sessions: h.sessions,
+        active_streams: h.activeStreams,
+        active_runs: h.activeRuns,
+        runs: h.runs,
+        last_run_finished_at: h.lastRunFinishedAt,
+        server_started_at: deps.startedAt,
+        uptime_seconds: Math.round((now - deps.startedAt) * 10) / 10,
+        accept_loop: { requests_total: deps.stats.requestsTotal, last_request_at: Math.round(deps.stats.lastRequestAt * 1000) / 1000 },
+    };
+    if (deep) {
+        if (!deps.startup.ready) {
+            body.status = 'starting';
+            body.phase = deps.startup.phase;
+            return { status: 503, body, headers: { 'Retry-After': '5' } };
+        }
+        body.checks = { streams_lock: { status: 'ok', active_streams: h.activeStreams, ms: 0 }, startup: { status: 'ok' } };
+    }
+    return { status: 200, body };
+}
+export const coreRouter = os.router({
+    health: os.health.handler(({ input, context }) => {
+        const deep = ['1', 'true', 'yes', 'on'].includes((input.deep ?? '').toLowerCase());
+        const result = healthPayload(context.ctx, deep);
+        if (result.status !== 200)
+            throw new RawResponse(result.status, result.body, result.headers ?? {});
+        return result.body;
+    }),
+    bootstrap: os.bootstrap.handler(({ context }) => bootstrapPayload(context.ctx)),
+    auth: {
+        status: os.auth.status.handler(({ context }) => authStatusPayload(context.ctx)),
+        login: os.auth.login.handler(async ({ input, context }) => {
+            const { ctx } = context;
+            const auth = ctx.deps.auth;
+            if (!(await auth.isAuthEnabled()))
+                return { ok: true, message: 'Auth not enabled' };
+            const clientIp = ctx.peer;
+            if (!auth.checkLoginRate(clientIp))
+                throw new HttpError(429, 'Too many attempts. Try again in a minute.');
+            if (!(await auth.verifyPassword(input.password ?? ''))) {
+                auth.recordLoginAttempt(clientIp);
+                throw new HttpError(401, 'Invalid password');
+            }
+            auth.clearLoginAttempts(clientIp);
+            const cookieVal = auth.createSession({ authType: 'password' });
+            ctx.queueCookie(ctx.authCookieHeader(cookieVal));
+            return { ok: true };
+        }),
+        logout: os.auth.logout.handler(async ({ context }) => {
+            const { ctx } = context;
+            const auth = ctx.deps.auth;
+            const sessionInfo = await ensureTrustedAuthSession(ctx);
+            const cookieVal = ctx.trusted.cookieValue ?? ctx.authCookie();
+            if (cookieVal)
+                auth.invalidateSession(cookieVal);
+            const payload = { ok: true };
+            if (sessionInfo?.auth_type === 'trusted') {
+                const logoutUrl = (ctx.deps.config.env.HERMES_WEBUI_TRUSTED_AUTH_LOGOUT_URL ?? '').trim();
+                if (logoutUrl)
+                    payload.trusted_logout_url = logoutUrl;
+            }
+            ctx.queueCookie(clearAuthCookieHeader(ctx));
+            ctx.queueCookie(clearProfileCookieHeader(ctx));
+            return payload;
+        }),
+        oidcNativeStart: os.auth.oidcNativeStart.handler(async ({ input, context }) => {
+            const { ctx } = context;
+            if (input.code_challenge_method !== 'S256')
+                throw new HttpError(400, 'Native OIDC requires S256 PKCE');
+            if (ctx.deps.nativeOidcLimiter.limited(rateLimitClientIp(ctx)))
+                throw new HttpError(429, 'Too many native OIDC starts; try again in a minute');
+            return oidcCall(() => ctx.deps.oidc.beginNative(requestBaseUrl(ctx), input.callback_url, input.state, input.code_challenge));
+        }),
+        oidcNativeExchange: os.auth.oidcNativeExchange.handler(async ({ input, context }) => {
+            const { ctx } = context;
+            const identity = await oidcCall(() => ctx.deps.oidc.exchangeNative(requestBaseUrl(ctx), input.flow_id, input.code, input.state, input.code_verifier));
+            const cookieVal = ctx.deps.auth.createSession({ authType: 'oidc', username: identity.email || identity.subject, boundProfile: identity.bound_profile, oidcBinding: identity.oidc_binding ?? null });
+            ctx.queueCookie(ctx.authCookieHeader(cookieVal));
+            return { ok: true };
+        }),
+        oidcNativeCancel: os.auth.oidcNativeCancel.handler(({ input, context }) => ({ ok: context.ctx.deps.oidc.cancelNative(input.flow_id, input.state) })),
+        passkeyOptions: os.auth.passkeyOptions.handler(async ({ context }) => {
+            const { ctx } = context;
+            if (!ctx.deps.auth.passkeyFeatureFlagEnabled())
+                throw new HttpError(404, 'Passkey support is disabled. Set HERMES_WEBUI_PASSKEY=1 or webui_passkey_enabled: true to enable.');
+            if (!(await ctx.deps.auth.isAuthEnabled()))
+                throw new HttpError(400, 'Auth not enabled');
+            const [rpId, origin] = passkeyRp(ctx);
+            return { ok: true, publicKey: passkeyCall(() => ctx.deps.passkeys.authenticationOptions(rpId, origin)) };
+        }),
+        passkeyLogin: os.auth.passkeyLogin.handler(async ({ input, context }) => {
+            const { ctx } = context;
+            const auth = ctx.deps.auth;
+            if (!auth.passkeyFeatureFlagEnabled())
+                throw new HttpError(404, 'Passkey support is disabled.');
+            if (!(await auth.isAuthEnabled()))
+                throw new HttpError(400, 'Auth not enabled');
+            const clientIp = ctx.peer;
+            if (!auth.checkLoginRate(clientIp))
+                throw new HttpError(429, 'Too many attempts. Try again in a minute.');
+            try {
+                ctx.deps.passkeys.finishLogin(input);
+            }
+            catch (error) {
+                if (!(error instanceof PasskeyError))
+                    throw error;
+                auth.recordLoginAttempt(clientIp);
+                throw new HttpError(401, error.message);
+            }
+            ctx.queueCookie(ctx.authCookieHeader(auth.createSession({ authType: 'passkey' })));
+            return { ok: true };
+        }),
+        passkeyRegisterOptions: os.auth.passkeyRegisterOptions.handler(async ({ context }) => {
+            const { ctx } = context;
+            if (!ctx.deps.auth.passkeyFeatureFlagEnabled())
+                throw new HttpError(404, 'Passkey support is disabled.');
+            await requirePasskeyManagementAuth(ctx);
+            const [rpId, origin] = passkeyRp(ctx);
+            return { ok: true, publicKey: passkeyCall(() => ctx.deps.passkeys.registrationOptions(rpId, origin)) };
+        }),
+        passkeyRegister: os.auth.passkeyRegister.handler(async ({ input, context }) => {
+            const { ctx } = context;
+            if (!ctx.deps.auth.passkeyFeatureFlagEnabled())
+                throw new HttpError(404, 'Passkey support is disabled.');
+            await requirePasskeyManagementAuth(ctx);
+            const result = passkeyCall(() => ctx.deps.passkeys.finishRegistration(input));
+            return { ...result, credentials: ctx.deps.passkeys.registered() };
+        }),
+        passkeyDelete: os.auth.passkeyDelete.handler(async ({ input, context }) => {
+            const { ctx } = context;
+            if (!ctx.deps.auth.passkeyFeatureFlagEnabled())
+                throw new HttpError(404, 'Passkey support is disabled.');
+            await requirePasskeyManagementAuth(ctx);
+            const creds = ctx.deps.passkeys.registered();
+            if ((await ctx.deps.auth.getPasswordHash()) === null && creds.length <= 1 && creds.some((c) => c.id === input.id)) {
+                throw new HttpError(409, 'Set a password or disable auth before removing the last passkey.');
+            }
+            try {
+                return ctx.deps.passkeys.delete(input.id);
+            }
+            catch (error) {
+                if (error instanceof PasskeyError)
+                    throw new HttpError(404, error.message);
+                throw error;
+            }
+        }),
+        passkeys: os.auth.passkeys.handler(({ context }) => {
+            const { ctx } = context;
+            if (!ctx.deps.auth.passkeyFeatureFlagEnabled())
+                return { credentials: [], disabled: true };
+            return { credentials: ctx.deps.passkeys.registered() };
+        }),
+    },
+});
+/** Python `_client_ip_for_rate_limit` + trusted-proxy forwarding for the native OIDC start limiter. */
+export function rateLimitClientIp(ctx) {
+    const env = ctx.deps.config.env;
+    if (truthy(env.HERMES_WEBUI_TRUST_FORWARDED_FOR) && rawPeerIsTrustedProxy(ctx.peer, env)) {
+        const forwarded = forwardedClientIp(ctx.headerAll('x-forwarded-for'), ctx.header('x-real-ip'), ctx.peer, env);
+        if (forwarded !== null)
+            return forwarded;
+    }
+    return ctx.peer;
+}
+async function oidcCall(fn) {
+    try {
+        return await fn();
+    }
+    catch (error) {
+        if (error instanceof OidcConfigError)
+            throw new HttpError(404, error.message);
+        if (error instanceof OidcAuthError)
+            throw new HttpError(error.status, error.message);
+        throw error;
+    }
+}
+function passkeyCall(fn) {
+    try {
+        return fn();
+    }
+    catch (error) {
+        if (error instanceof PasskeyRateLimitError)
+            throw new HttpError(429, error.message);
+        if (error instanceof PasskeyError)
+            throw new HttpError(400, error.message);
+        throw error;
+    }
+}
+function passkeyRp(ctx) {
+    return rpContext({ origin: ctx.header('origin'), host: ctx.header('host'), forwardedProto: ctx.header('x-forwarded-proto') }, ctx.isSecureContext());
+}
+/** Python `_require_passkey_management_auth`: an owner session, or the local first-run bootstrap gate while auth is off. */
+async function requirePasskeyManagementAuth(ctx) {
+    const auth = ctx.deps.auth;
+    const enabled = await auth.isAuthEnabled();
+    if (!enabled) {
+        if (await onboardingGateAllows(ctx, enabled))
+            return;
+        throw new HttpError(401, 'Authentication required');
+    }
+    const cookieVal = ctx.authCookie();
+    if (!cookieVal || !auth.verifySession(cookieVal))
+        throw new HttpError(401, 'Authentication required');
+    if (!(await sessionCanManageServer(ctx, await ensureTrustedAuthSession(ctx))))
+        throw new HttpError(403, 'An owner session is required to manage owner authentication credentials');
+}
+/** Python `_send_still_starting`: the phase is in the text, and the connection closes after the 503. */
+export function startupUnavailable(ctx) {
+    const phase = ctx.deps.startup.phase;
+    ctx.json({ error: `Server is still starting: ${phase}`, phase, condition: STARTUP_RECOVERY_CONDITION }, { status: 503, headers: { 'Retry-After': '5', Connection: 'close' } });
+}
+//# sourceMappingURL=router.js.map

package/dist/api/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/api/router.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,YAAY,EAAgD,MAAM,kCAAkC,CAAA;AAE7G,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACtJ,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAA;AAI1D,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,mBAAmB;IACtH,GAAG,EAAE,uBAAuB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,qBAAqB;CACzI,CAAA;AAED,6EAA6E;AAC7E,MAAM,OAAO,SAAU,SAAQ,SAA0C;IACvE,YAAY,MAAc,EAAE,OAAe,EAAE,QAAiC,EAAE;QAC9E,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1F,CAAC;CACF;AAED,8HAA8H;AAC9H,MAAM,UAAU,aAAa,CAAC,KAA8B,EAAE,GAAG,MAAgB;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;IAC7H,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAClG,CAAC;AAED,qGAAqG;AACrG,MAAM,OAAO,WAAY,SAAQ,SAA0C;IACzE,YAAY,MAAc,EAAE,IAA6B,EAAE,UAAkC,EAAE;QAC7F,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;IAC1H,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,KAAiC;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAK,IAAgC,CAAC,KAAK;QAAE,OAAQ,IAA0C,CAAC,IAAI,CAAA;IACxI,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/G,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,uBAAuB;QAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAA;IACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC3J,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,OAAO,KAAK,yBAAyB,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,MAA6D,CAAC,CAAC,CAAC,EAAE,CAAA;QACtH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACpF,gHAAgH;QAChH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9I,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC5I,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAClF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAiC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAK,IAAgC,CAAC,KAAK;QAAE,OAAQ,IAA4C,CAAC,OAAO,CAAA;IAC7I,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAc,CAAA;AAEzD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAmB;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,SAAS,GAAG,EAAE,CAAA;IAClB,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAA;QACrE,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACjH,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,CAAA;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,IAAI,OAAO,GAAyB,IAAI,CAAA;IACxC,IAAI,UAAU,GAA4B,IAAI,CAAA;IAC9C,IAAI,QAAQ,GAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAA;IACzI,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,EAAE,CAAA;QACzD,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAA;QAClE,UAAU,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAA;QACtD,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;IAC5B,CAAC;IACD,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,OAAO;QAC3B,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;QAC5C,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;QACjD,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ;QAChI,IAAI;QACJ,OAAO;QACP,UAAU;QACV,QAAQ;KACT,CAAA;AACH,CAAC;AAED,+BAA+B;AAC/B,MAAM,aAAa,GAAG,oCAAoC,CAAA;AAE1D,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,GAAmB;IAC/C,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAA;QAC7C,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAmB,EAAE,IAAa;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAA;IACpB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAW;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,cAAc,EAAE,CAAC,CAAC,aAAa;QAC/B,WAAW,EAAE,CAAC,CAAC,UAAU;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,oBAAoB,EAAE,CAAC,CAAC,iBAAiB;QACzC,iBAAiB,EAAE,IAAI,CAAC,SAAS;QACjC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE;QAC5D,WAAW,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE;KAC/H,CAAA;IACD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAA;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;YAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,CAAA;QAC/D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAA;IACrH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QAClG,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC,CAAC;IACF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/E,IAAI,EAAE;QACJ,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAuB,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpG,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACxD,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAA;YAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;YAC5F,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAA;YACzB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA;YACzG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACjC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC9C,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;YAC9D,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAA;YAChD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAA;QAC9B,CAAC,CAAC;QACF,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACnD,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAA;YAC1B,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;YACvD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;YAC7D,IAAI,SAAS;gBAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;YAChD,MAAM,OAAO,GAA8C,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;YACvE,IAAI,WAAW,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;gBACzF,IAAI,SAAS;oBAAE,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAA;YACvD,CAAC;YACD,GAAG,CAAC,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAA;YAC3C,GAAG,CAAC,WAAW,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC;QACF,eAAe,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC5E,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,IAAI,KAAK,CAAC,qBAAqB,KAAK,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAA;YACtG,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAA;YAC9I,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QAC9H,CAAC,CAAC;QACF,kBAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAClF,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;YACrJ,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,CAAA;YACnM,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAA;YAChD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAA;QAC9B,CAAC,CAAC;QACF,gBAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpJ,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACnE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mGAAmG,CAAC,CAAA;YAC7K,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YACxF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YACrC,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAA;QACnH,CAAC,CAAC;QACF,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACtE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAA;YAC1B,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;YAC/F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAA;YACzB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA;YACzG,IAAI,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;oBAAE,MAAM,KAAK,CAAA;gBACjD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACjC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YACzC,CAAC;YACD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAA;YAClF,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAA;QAC9B,CAAC,CAAC;QACF,sBAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACnF,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;YACxG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YACrC,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAA;QACjH,CAAC,CAAC;QACF,eAAe,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC5E,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;YACxG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAA;YAC7E,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAW,EAAE,CAAA;QAC5E,CAAC,CAAC;QACF,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACxE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;YACxG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAA;YAC5C,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClH,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAA;YAC9F,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAU,CAAA;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,YAAY;oBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC1E,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;YAC1F,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAW,EAAE,CAAA;QACjE,CAAC,CAAC;KACH;CACF,CAAC,CAAA;AAEF,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAA;IAC/B,IAAI,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACzF,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC7G,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,EAAoB;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAA;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7E,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QACpF,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAI,EAAW;IACjC,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QACnF,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1E,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB;IACpC,OAAO,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAA;AACtJ,CAAC;AAED,4HAA4H;AAC5H,KAAK,UAAU,4BAA4B,CAAC,GAAmB;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAA;IAC1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAM;QACpD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,CAAA;IAClC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;IACrG,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yEAAyE,CAAC,CAAA;AACpL,CAAC;AAID,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,GAAmB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;IACpC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;AAChL,CAAC"}

package/dist/api/session-visibility.d.ts

@@ -0,0 +1,12 @@
+import { type ApiContext } from './router.js';
+import type { RequestContext } from '../http/context.js';
+/** Python `_session_id_visible_to_request_profile`: unknown or unsafe ids fall through to the handler's own error. */
+export declare function sessionIdVisibleToRequest(ctx: RequestContext, sid: unknown): boolean;
+/** Pre-dispatch query guard for every `/api/` request (raw, SSE, and contract routes). */
+export declare function guardQuerySessionId(ctx: RequestContext): boolean;
+/** Contract-route guard for the parsed input (query or JSON body) of every procedure. */
+export declare const requestSessionIdGuard: import("@orpc/server").DecoratedMiddleware<ApiContext & Record<never, never>, Record<never, never>, unknown, any, any, Record<never, never>>;
+/** Python `_stream_id_owner_session_id`: the live registry first, then the run journal once the run has finished. */
+export declare function streamOwnerSessionId(ctx: RequestContext, streamId: string): string | null;
+/** Python `_stream_id_visible_to_request_profile`: a stream is visible when its owner session is (or it has no known owner). */
+export declare function streamVisibleToRequest(ctx: RequestContext, streamId: string): boolean;