@panguard-ai/panguard 1.4.14 → 1.4.16

package/dist/cli/commands/serve-types.js

@@ -1,108 +0,0 @@
-/**
- * Shared types, helpers and middleware for serve sub-modules.
- */
-import { authenticateRequest, requireAdmin } from '@panguard-ai/panguard-auth';
-// ── JSON Response ──────────────────────────────────────────────
-export function sendJson(res, status, data) {
-    res.writeHead(status, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(data));
-}
-// ── Request Body Reader ────────────────────────────────────────
-/** Read request body with 1MB size limit */
-export function readRequestBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let size = 0;
-        const MAX_BODY = 1_048_576; // 1MB
-        req.on('data', (chunk) => {
-            size += chunk.length;
-            if (size > MAX_BODY) {
-                req.destroy();
-                reject(new Error('Request body too large'));
-                return;
-            }
-            chunks.push(chunk);
-        });
-        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
-        req.on('error', reject);
-    });
-}
-// ── Timing-safe Comparison ─────────────────────────────────────
-/** Timing-safe string comparison to prevent side-channel attacks */
-export function timingSafeCompare(a, b) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { timingSafeEqual } = require('node:crypto');
-    const ab = Buffer.from(a);
-    const bb = Buffer.from(b);
-    if (ab.length !== bb.length) {
-        // Compare against self to maintain constant time
-        timingSafeEqual(ab, ab);
-        return false;
-    }
-    return timingSafeEqual(ab, bb);
-}
-// ── Threat Cloud Auth Helpers ──────────────────────────────────
-/**
- * Require TC_API_KEY auth for write endpoints.
- * In production: BLOCK if TC_API_KEY not set (refuse unauthenticated writes).
- * In dev: allow passthrough with warning.
- */
-export function requireTCWriteAuth(req, res) {
-    const tcApiKey = process.env['TC_API_KEY'];
-    if (!tcApiKey) {
-        if (process.env['NODE_ENV'] === 'production') {
-            sendJson(res, 503, {
-                ok: false,
-                error: 'Threat Cloud write API not configured (TC_API_KEY missing)',
-            });
-            return false;
-        }
-        return true; // dev passthrough
-    }
-    const authHeader = req.headers.authorization ?? '';
-    const token = authHeader.replace('Bearer ', '');
-    if (!timingSafeCompare(token, tcApiKey)) {
-        sendJson(res, 401, { ok: false, error: 'Invalid API key' });
-        return false;
-    }
-    return true;
-}
-/**
- * Require admin session auth for admin-only GET endpoints.
- * Verifies the Bearer token is a valid session with admin role.
- */
-export function requireTCAdminAuth(req, res, db) {
-    const user = authenticateRequest(req, db);
-    if (!user) {
-        sendJson(res, 401, { ok: false, error: 'Authentication required' });
-        return false;
-    }
-    if (!requireAdmin(user)) {
-        sendJson(res, 403, { ok: false, error: 'Admin access required' });
-        return false;
-    }
-    return true;
-}
-/** Validate Content-Type is application/json for POST requests */
-export function requireJsonContentType(req, res) {
-    const ct = req.headers['content-type'] ?? '';
-    if (!ct.includes('application/json')) {
-        sendJson(res, 400, { ok: false, error: 'Content-Type must be application/json' });
-        return false;
-    }
-    return true;
-}
-// ── Rate Limiter ───────────────────────────────────────────────
-/** Per-IP rate limiter for Threat Cloud endpoints (120 req/min) */
-const tcRateLimits = new Map();
-export function checkTCRateLimit(ip) {
-    const now = Date.now();
-    const entry = tcRateLimits.get(ip);
-    if (!entry || now > entry.resetAt) {
-        tcRateLimits.set(ip, { count: 1, resetAt: now + 60_000 });
-        return true;
-    }
-    entry.count++;
-    return entry.count <= 120;
-}
-//# sourceMappingURL=serve-types.js.map

package/dist/cli/commands/serve-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve-types.js","sourceRoot":"","sources":["../../../src/cli/commands/serve-types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAoB/E,kEAAkE;AAElE,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACzE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,kEAAkE;AAElE,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,MAAM;QAElC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAElE,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,iEAAiE;IACjE,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IACnF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;QAC5B,iDAAiD;QACjD,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,4DAA4D;aACpE,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAU;IACtF,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,GAAmB;IAC9E,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAElE,mEAAmE;AACnE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8C,CAAC;AAE3E,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC;AAC5B,CAAC"}

package/dist/cli/commands/serve.d.ts

@@ -1,14 +0,0 @@
-/**
- * panguard serve - Unified HTTP server gateway
- *
- * Serves auth API, admin API, admin dashboard UI, and health check.
- * Route handling is delegated to focused sub-modules:
- *   serve-core.ts  -- middleware, health, static files, rule seeding
- *   serve-auth.ts  -- auth, waitlist, usage routes
- *   serve-admin.ts -- admin dashboard + manager proxy routes
- *   serve-tc.ts    -- Threat Cloud API routes
- *   serve-types.ts -- shared types and utilities
- */
-import { Command } from 'commander';
-export declare function serveCommand(): Command;
-//# sourceMappingURL=serve.d.ts.map

package/dist/cli/commands/serve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2CpC,wBAAgB,YAAY,IAAI,OAAO,CA+XtC"}

package/dist/cli/commands/serve.js

@@ -1,383 +0,0 @@
-/**
- * panguard serve - Unified HTTP server gateway
- *
- * Serves auth API, admin API, admin dashboard UI, and health check.
- * Route handling is delegated to focused sub-modules:
- *   serve-core.ts  -- middleware, health, static files, rule seeding
- *   serve-auth.ts  -- auth, waitlist, usage routes
- *   serve-admin.ts -- admin dashboard + manager proxy routes
- *   serve-tc.ts    -- Threat Cloud API routes
- *   serve-types.ts -- shared types and utilities
- */
-import { Command } from 'commander';
-import { createServer } from 'node:http';
-import { join, dirname } from 'node:path';
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { fileURLToPath } from 'node:url';
-import { c, banner } from '@panguard-ai/core';
-import { PANGUARD_VERSION } from '../../index.js';
-import { AuthDB, createAuthHandlers, sendExpirationWarningEmail, initErrorTracking, captureRequestError, ManagerProxy, } from '@panguard-ai/panguard-auth';
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-let ManagerServer = null;
-let DEFAULT_MANAGER_CONFIG = {};
-try {
-    const mod = await import('@panguard-ai/manager');
-    ManagerServer = mod.ManagerServer;
-    DEFAULT_MANAGER_CONFIG = mod.DEFAULT_MANAGER_CONFIG;
-}
-catch {
-    // manager is optional — serve command will work without it
-}
-import { sendJson } from './serve-types.js';
-import { applyMiddleware, handleCoreRoutes, seedRulesFromBundled } from './serve-core.js';
-import { handleAuthRoutes } from './serve-auth.js';
-import { handleAdminRoutes } from './serve-admin.js';
-import { handleTCRoutes } from './serve-tc.js';
-export function serveCommand() {
-    return new Command('serve')
-        .description('Start unified HTTP server / 啟動統一 HTTP 伺服器')
-        .option('--port <port>', 'Port number', '3000')
-        .option('--host <host>', 'Host to bind', '127.0.0.1')
-        .option('--db <path>', 'Database path', join(homedir(), '.panguard', 'auth.db'))
-        .option('--manager-port <port>', 'Manager server port / Manager 伺服器埠', '8443')
-        .action(async (options) => {
-        const port = parseInt(options.port, 10);
-        const host = options.host;
-        console.log(banner(PANGUARD_VERSION));
-        console.log(`  ${c.sage('Panguard Serve')} - Unified Server Gateway`);
-        console.log('');
-        // Startup environment validation
-        const isProd = process.env['NODE_ENV'] === 'production';
-        const errors = [];
-        const warnings = [];
-        // Critical in production
-        if (isProd && !process.env['PANGUARD_BASE_URL']) {
-            errors.push('PANGUARD_BASE_URL not set in production — OAuth and email links will break');
-        }
-        if (isProd && !process.env['CORS_ALLOWED_ORIGINS']) {
-            errors.push('CORS_ALLOWED_ORIGINS not set in production — API will reject cross-origin requests');
-        }
-        // Warnings (non-fatal)
-        if (!process.env['PANGUARD_BASE_URL']) {
-            warnings.push('PANGUARD_BASE_URL not set — OAuth callbacks will use localhost');
-        }
-        if (!process.env['GOOGLE_CLIENT_ID']) {
-            warnings.push('GOOGLE_CLIENT_ID not set — Google OAuth login disabled');
-        }
-        if (!process.env['RESEND_API_KEY'] && !process.env['SMTP_HOST']) {
-            warnings.push('No email config (RESEND_API_KEY or SMTP_HOST) — password reset and waitlist emails disabled');
-        }
-        if (!process.env['SENTRY_DSN']) {
-            warnings.push('SENTRY_DSN not set — error tracking disabled');
-        }
-        if (isProd && !process.env['MANAGER_AUTH_TOKEN']) {
-            errors.push('MANAGER_AUTH_TOKEN not set in production — Manager API would allow unauthenticated access');
-        }
-        if (!isProd && !process.env['MANAGER_AUTH_TOKEN']) {
-            warnings.push('MANAGER_AUTH_TOKEN not set — Manager API allows unauthenticated access (OK for dev)');
-        }
-        if (!process.env['TC_API_KEY']) {
-            warnings.push('TC_API_KEY not set — Threat Cloud write API disabled in production, open in dev');
-        }
-        if (errors.length > 0) {
-            console.error(`  ${c.critical('FATAL — Missing required environment variables:')}`);
-            for (const e of errors) {
-                console.error(`    ${c.critical('x')} ${e}`);
-            }
-            console.error('');
-            console.error(`  Set the variables above and restart. Aborting.`);
-            process.exit(1);
-        }
-        if (warnings.length > 0) {
-            console.log(`  ${c.caution('Environment warnings:')}`);
-            for (const w of warnings) {
-                console.log(`    ${c.dim('-')} ${w}`);
-            }
-            console.log('');
-        }
-        // Initialize error tracking (Sentry if configured, console fallback)
-        await initErrorTracking();
-        // Initialize database
-        const db = new AuthDB(options.db);
-        // Initialize Threat Cloud database (optional -- graceful if unavailable)
-        let threatDb = null;
-        try {
-            const tcMod = '@panguard-ai/threat-cloud';
-            const tc = await import(/* webpackIgnore: true */ tcMod);
-            const threatDbPath = join(dirname(options.db), 'threat-cloud.db');
-            threatDb = new tc.ThreatCloudDB(threatDbPath);
-            console.log(`  ${c.safe('Threat Cloud DB')} initialized at ${c.dim(threatDbPath)}`);
-            // Auto-seed rules on first startup if rules table is empty
-            const stats = threatDb.getStats();
-            if (stats.totalRules === 0) {
-                console.log(`  ${c.sage('Seeding rules...')} (first startup detected)`);
-                const seeded = await seedRulesFromBundled(threatDb);
-                console.log(`  ${c.safe(`Seeded ${seeded} rules`)} into Threat Cloud DB`);
-            }
-            else {
-                console.log(`  ${c.dim(`Threat Cloud: ${stats.totalRules} rules, ${stats.totalThreats} threats`)}`);
-            }
-            console.log('');
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.error(`  [ERROR] Threat Cloud initialization failed: ${msg}`);
-            if (err instanceof Error && err.stack) {
-                console.error(`  ${err.stack}`);
-            }
-            console.log(`  ${c.dim('Threat Cloud API routes disabled due to error above')}`);
-            console.log('');
-        }
-        // Initialize LLM Reviewer for ATR proposals (optional -- needs ANTHROPIC_API_KEY)
-        let llmReviewer = null;
-        if (threatDb && process.env['ANTHROPIC_API_KEY']) {
-            try {
-                const tcMod = '@panguard-ai/threat-cloud';
-                const tc = await import(/* webpackIgnore: true */ tcMod);
-                llmReviewer = new tc.LLMReviewer(process.env['ANTHROPIC_API_KEY'], threatDb);
-                console.log(`  ${c.safe('LLM Reviewer')} enabled for ATR proposal review`);
-            }
-            catch {
-                console.log(`  ${c.dim('LLM Reviewer not available')}`);
-            }
-        }
-        // Promotion cron: every 15 minutes, promote confirmed + LLM-approved proposals to rules
-        let promotionTimer = null;
-        if (threatDb) {
-            promotionTimer = setInterval(() => {
-                try {
-                    const promoted = threatDb.promoteConfirmedProposals();
-                    if (promoted > 0) {
-                        console.log(`  [Promotion] ${promoted} proposal(s) promoted to rules`);
-                    }
-                }
-                catch (err) {
-                    console.error(`  [Promotion] Error: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }, 15 * 60 * 1000);
-        }
-        // Periodic database backup (every 6 hours)
-        let backupTimer = null;
-        if (threatDb) {
-            try {
-                const tcMod2 = '@panguard-ai/threat-cloud';
-                const tc2 = await import(/* webpackIgnore: true */ tcMod2);
-                const backupDir = join(dirname(options.db), 'backups');
-                const threatBackup = new tc2.BackupManager(join(dirname(options.db), 'threat-cloud.db'), backupDir, 7);
-                const authBackup = new tc2.BackupManager(options.db, backupDir, 7);
-                const runBackups = () => {
-                    try {
-                        const r1 = threatBackup.backup();
-                        const r2 = authBackup.backup();
-                        console.log(`  [Backup] threat-cloud.db (${tc2.BackupManager.formatSize(r1.sizeBytes)}), auth.db (${tc2.BackupManager.formatSize(r2.sizeBytes)})`);
-                    }
-                    catch (err) {
-                        console.error(`  [Backup] Failed: ${err instanceof Error ? err.message : String(err)}`);
-                    }
-                };
-                // Initial backup on startup
-                runBackups();
-                // Every 6 hours
-                backupTimer = setInterval(runBackups, 6 * 60 * 60 * 1000);
-                if (backupTimer.unref)
-                    backupTimer.unref();
-            }
-            catch {
-                console.log(`  ${c.dim('Backup manager not available — auto-backups disabled')}`);
-            }
-        }
-        // Build config from environment
-        // Prefer Resend API when RESEND_API_KEY is set; fall back to raw SMTP
-        const emailConfig = process.env['RESEND_API_KEY']
-            ? {
-                apiKey: process.env['RESEND_API_KEY'],
-                from: process.env['RESEND_FROM'] ??
-                    process.env['SMTP_FROM'] ??
-                    'Panguard AI <noreply@panguard.ai>',
-            }
-            : process.env['SMTP_HOST']
-                ? {
-                    host: process.env['SMTP_HOST'],
-                    port: parseInt(process.env['SMTP_PORT'] ?? '587', 10),
-                    secure: process.env['SMTP_SECURE'] === 'true',
-                    from: process.env['SMTP_FROM'] ?? 'noreply@panguard.ai',
-                    auth: {
-                        user: process.env['SMTP_USER'] ?? '',
-                        pass: process.env['SMTP_PASS'] ?? '',
-                    },
-                }
-                : undefined;
-        const google = process.env['GOOGLE_CLIENT_ID']
-            ? {
-                clientId: process.env['GOOGLE_CLIENT_ID'],
-                clientSecret: process.env['GOOGLE_CLIENT_SECRET'] ?? '',
-                redirectUri: process.env['GOOGLE_REDIRECT_URI'] ??
-                    `http://${host}:${port}/api/auth/google/callback`,
-            }
-            : undefined;
-        const sheets = process.env['GOOGLE_SHEETS_ID']
-            ? {
-                spreadsheetId: process.env['GOOGLE_SHEETS_ID'],
-                serviceAccountEmail: process.env['GOOGLE_SHEETS_SA_EMAIL'] ?? '',
-                privateKey: process.env['GOOGLE_SHEETS_PRIVATE_KEY'] ?? '',
-            }
-            : undefined;
-        const baseUrl = process.env['PANGUARD_BASE_URL'] ?? `http://${host}:${port}`;
-        const authConfig = {
-            db,
-            smtp: emailConfig,
-            baseUrl,
-            google,
-            sheets,
-        };
-        const handlers = createAuthHandlers(authConfig);
-        // Initialize Manager proxy for agent/event admin API routes
-        const managerProxy = new ManagerProxy(process.env['MANAGER_URL'], process.env['MANAGER_AUTH_TOKEN']);
-        // Resolve admin static directory
-        const thisDir = dirname(fileURLToPath(import.meta.url));
-        const adminDirs = [
-            join(process.cwd(), 'packages', 'admin'),
-            join(thisDir, '..', '..', '..', '..', 'admin'),
-        ];
-        const adminDir = adminDirs.find((d) => existsSync(d));
-        // Build shared route context (immutable after creation)
-        const routeCtx = {
-            handlers,
-            db,
-            adminDir,
-            managerProxy,
-            threatDb,
-            llmReviewer,
-        };
-        const server = createServer((req, res) => {
-            void handleRequest(req, res, routeCtx);
-        });
-        // Build Manager config from environment
-        const managerPort = parseInt(options.managerPort, 10);
-        const managerConfig = {
-            ...DEFAULT_MANAGER_CONFIG,
-            port: managerPort,
-            authToken: process.env['MANAGER_AUTH_TOKEN'] ?? '',
-        };
-        if (!ManagerServer) {
-            console.error('  Manager module not installed. Run: npm install @panguard-ai/manager');
-            process.exitCode = 1;
-            return;
-        }
-        const managerServer = new ManagerServer(managerConfig);
-        server.listen(port, host, () => {
-            console.log(`  ${c.safe('Server started')} on ${c.bold(`http://${host}:${port}`)}`);
-            console.log('');
-            console.log(`  Routes:`);
-            console.log(`    ${c.dim('/api/auth/*')}     Auth API`);
-            console.log(`    ${c.dim('/api/admin/*')}    Admin API`);
-            console.log(`    ${c.dim('/api/usage/*')}    Usage & Quota API`);
-            if (adminDir) {
-                console.log(`    ${c.dim('/admin')}          Admin Dashboard`);
-            }
-            else {
-                console.log(`    ${c.dim('/admin')}          ${c.caution('Not found')} (packages/admin/ missing)`);
-            }
-            console.log(`    ${c.dim('/docs/api')}        API Documentation (Swagger UI)`);
-            console.log(`    ${c.dim('/openapi.json')}    OpenAPI 3.0 Spec`);
-            console.log(`    ${c.dim('/health')}         Health check`);
-            console.log(`    ${c.dim('/api/manager/*')}  Manager API (port ${managerPort})`);
-            if (threatDb) {
-                console.log(`    ${c.dim('/api/threats')}     Threat Cloud API (POST)`);
-                console.log(`    ${c.dim('/api/rules')}       Rule Distribution (GET/POST)`);
-                console.log(`    ${c.dim('/api/stats')}       Threat Statistics (GET)`);
-            }
-            console.log('');
-            console.log(`  Services:`);
-            console.log(`    Email:   ${emailConfig ? ('apiKey' in emailConfig ? c.safe('Resend API') : c.safe('SMTP')) : c.caution('Not configured')}`);
-            console.log(`    OAuth:   ${google ? c.safe('Google') : c.dim('Not configured')}`);
-            console.log(`    Sheets:  ${sheets ? c.safe('Google Sheets') : c.dim('Not configured')}`);
-            console.log(`    Manager: ${c.safe(`port ${managerPort}`)}${process.env['MANAGER_AUTH_TOKEN'] ? '' : c.dim(' (no auth)')}`);
-            console.log('');
-            // Start Manager server after auth server is listening
-            managerServer
-                .start()
-                .then(() => {
-                console.log(`  ${c.safe('Manager server started')} on ${c.bold(`http://${host}:${managerPort}`)}`);
-                console.log('');
-            })
-                .catch((err) => {
-                const message = err instanceof Error ? err.message : String(err);
-                console.log(`  ${c.caution('Manager server failed to start:')} ${message}`);
-                console.log(`  ${c.dim('Auth server continues running without Manager')}`);
-                console.log('');
-            });
-        });
-        // Subscription lifecycle: check expired plans hourly
-        const runPlanCheck = () => {
-            const expired = db.checkExpiredPlans();
-            if (expired.length > 0) {
-                console.log(`  [Plan] Downgraded ${expired.length} expired plan(s) to community tier`);
-            }
-            // Send warning emails for plans expiring in 3 days
-            if (emailConfig) {
-                const expiring = db.getExpiringPlans(3);
-                for (const user of expiring) {
-                    sendExpirationWarningEmail(emailConfig, user.email, user.name, user.tier, user.planExpiresAt, baseUrl).catch(() => {
-                        // Best-effort email delivery
-                    });
-                }
-                if (expiring.length > 0) {
-                    console.log(`  [Plan] Sent ${expiring.length} expiration warning email(s)`);
-                }
-            }
-        };
-        // Run immediately on startup, then every hour
-        runPlanCheck();
-        const planCheckTimer = setInterval(runPlanCheck, 60 * 60 * 1000);
-        if (planCheckTimer.unref)
-            planCheckTimer.unref();
-        // Graceful shutdown
-        const shutdown = () => {
-            console.log('\n  Shutting down...');
-            clearInterval(planCheckTimer);
-            if (backupTimer)
-                clearInterval(backupTimer);
-            if (promotionTimer)
-                clearInterval(promotionTimer);
-            managerServer.stop().catch(() => { });
-            server.close(() => {
-                db.close();
-                if (threatDb)
-                    threatDb.close();
-                process.exit(0);
-            });
-        };
-        process.on('SIGINT', shutdown);
-        process.on('SIGTERM', shutdown);
-    });
-}
-// ── Request Router ─────────────────────────────────────────────
-async function handleRequest(req, res, ctx) {
-    const url = req.url ?? '/';
-    const pathname = url.split('?')[0] ?? '/';
-    // Apply security headers and CORS; handle OPTIONS preflight
-    if (applyMiddleware(req, res))
-        return;
-    try {
-        // Core routes: health, OpenAPI, static files
-        if (handleCoreRoutes(req, res, pathname, ctx.db, ctx.threatDb, ctx.adminDir))
-            return;
-        // Threat Cloud API routes (rate-limited, auth-gated)
-        if (await handleTCRoutes(req, res, url, pathname, ctx))
-            return;
-        // Auth, waitlist, and usage routes
-        if (await handleAuthRoutes(req, res, url, pathname, ctx))
-            return;
-        // Admin and Manager proxy routes
-        if (await handleAdminRoutes(req, res, url, pathname, ctx))
-            return;
-        sendJson(res, 404, { ok: false, error: 'Not found' });
-    }
-    catch (err) {
-        captureRequestError(err, req.method ?? 'UNKNOWN', pathname);
-        sendJson(res, 500, { ok: false, error: 'Internal server error' });
-    }
-}
-//# sourceMappingURL=serve.js.map

package/dist/cli/commands/serve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,MAAM,EACN,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,GACb,MAAM,4BAA4B,CAAC;AAUpC,8DAA8D;AAC9D,IAAI,aAAa,GAAgD,IAAI,CAAC;AACtE,IAAI,sBAAsB,GAAkB,EAAE,CAAC;AAC/C,IAAI,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,sBAAgC,CAAC,CAAC;IAC3D,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,sBAAsB,GAAG,GAAG,CAAC,sBAAsB,CAAC;AACtD,CAAC;AAAC,MAAM,CAAC;IACP,2DAA2D;AAC7D,CAAC;AAGD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;SACxB,WAAW,CAAC,2CAA2C,CAAC;SACxD,MAAM,CAAC,eAAe,EAAE,aAAa,EAAE,MAAM,CAAC;SAC9C,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,WAAW,CAAC;SACpD,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;SAC/E,MAAM,CAAC,uBAAuB,EAAE,oCAAoC,EAAE,MAAM,CAAC;SAC7E,MAAM,CAAC,KAAK,EAAE,OAAwE,EAAE,EAAE;QACzF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAE1B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,iCAAiC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC;QACxD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,yBAAyB;QACzB,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CACT,oFAAoF,CACrF,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CACX,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CACT,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CACX,qFAAqF,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,iFAAiF,CAClF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;YACpF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,qEAAqE;QACrE,MAAM,iBAAiB,EAAE,CAAC;QAE1B,sBAAsB;QACtB,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAElC,yEAAyE;QACzE,IAAI,QAAQ,GAA0B,IAAI,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,2BAA2B,CAAC;YAC1C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAClE,QAAQ,GAAG,IAAI,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAEpF,2DAA2D;YAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;gBACxE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,MAAM,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,UAAU,WAAW,KAAK,CAAC,YAAY,UAAU,CAAC,EAAE,CACvF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;YACtE,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,kFAAkF;QAClF,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,IAAI,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,2BAA2B,CAAC;gBAC1C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;gBACzD,WAAW,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC7E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,kCAAkC,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,wFAAwF;QACxF,IAAI,cAAc,GAA0C,IAAI,CAAC;QACjE,IAAI,QAAQ,EAAE,CAAC;YACb,cAAc,GAAG,WAAW,CAC1B,GAAG,EAAE;gBACH,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,yBAAyB,EAAE,CAAC;oBACtD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;wBACjB,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,gCAAgC,CAAC,CAAC;oBACzE,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,KAAK,CACX,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC,EACD,EAAE,GAAG,EAAE,GAAG,IAAI,CACf,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,IAAI,WAAW,GAA0C,IAAI,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;gBACvD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,aAAa,CACxC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,iBAAiB,CAAC,EAC5C,SAAS,EACT,CAAC,CACF,CAAC;gBACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;gBAEnE,MAAM,UAAU,GAAG,GAAG,EAAE;oBACtB,IAAI,CAAC;wBACH,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;wBACjC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;wBAC/B,OAAO,CAAC,GAAG,CACT,+BAA+B,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CACtI,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAY,EAAE,CAAC;wBACtB,OAAO,CAAC,KAAK,CACX,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC;gBAEF,4BAA4B;gBAC5B,UAAU,EAAE,CAAC;gBAEb,gBAAgB;gBAChB,WAAW,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1D,IAAI,WAAW,CAAC,KAAK;oBAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,sDAAsD,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,sEAAsE;QACtE,MAAM,WAAW,GAA4B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxE,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBACrC,IAAI,EACF,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBACxB,mCAAmC;aACtC;YACH,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;gBACxB,CAAC,CAAC;oBACE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAC9B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,MAAM;oBAC7C,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,qBAAqB;oBACvD,IAAI,EAAE;wBACJ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;wBACpC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;qBACrC;iBACF;gBACH,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,MAAM,GAAkC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC3E,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBACzC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE;gBACvD,WAAW,EACT,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;oBAClC,UAAU,IAAI,IAAI,IAAI,2BAA2B;aACpD;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAAmC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5E,CAAC,CAAC;gBACE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAC9C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE;gBAChE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE;aAC3D;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAE7E,MAAM,UAAU,GAAoB;YAClC,EAAE;YACF,IAAI,EAAE,WAAW;YACjB,OAAO;YACP,MAAM;YACN,MAAM;SACP,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEhD,4DAA4D;QAC5D,MAAM,YAAY,GAAG,IAAI,YAAY,CACnC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAClC,CAAC;QAEF,iCAAiC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG;YAChB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;SAC/C,CAAC;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtD,wDAAwD;QACxD,MAAM,QAAQ,GAAiB;YAC7B,QAAQ;YACR,EAAE;YACF,QAAQ;YACR,YAAY;YACZ,QAAQ;YACR,WAAW;SACZ,CAAC;QAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,KAAK,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,wCAAwC;QACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,aAAa,GAAkB;YACnC,GAAG,sBAAsB;YACzB,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE;SACnD,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;YACvF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC;QAEvD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;YACjE,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CACtF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,WAAW,GAAG,CAAC,CAAC;YACjF,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,8BAA8B,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,qCAAqC,CAAC,CAAC;gBAC7E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,gCAAgC,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO,CAAC,GAAG,CACT,gBAAgB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAChI,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACnF,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC1F,OAAO,CAAC,GAAG,CACT,gBAAgB,CAAC,CAAC,IAAI,CAAC,QAAQ,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAC/G,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,sDAAsD;YACtD,aAAa;iBACV,KAAK,EAAE;iBACP,IAAI,CAAC,GAAG,EAAE;gBACT,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,WAAW,EAAE,CAAC,EAAE,CACtF,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;gBAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAC;gBAC3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,MAAM,oCAAoC,CAAC,CAAC;YACzF,CAAC;YAED,mDAAmD;YACnD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC5B,0BAA0B,CACxB,WAAW,EACX,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,aAAa,EAClB,OAAO,CACR,CAAC,KAAK,CAAC,GAAG,EAAE;wBACX,6BAA6B;oBAC/B,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,CAAC,MAAM,8BAA8B,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,8CAA8C;QAC9C,YAAY,EAAE,CAAC;QACf,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjE,IAAI,cAAc,CAAC,KAAK;YAAE,cAAc,CAAC,KAAK,EAAE,CAAC;QAEjD,oBAAoB;QACpB,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACpC,aAAa,CAAC,cAAc,CAAC,CAAC;YAC9B,IAAI,WAAW;gBAAE,aAAa,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,cAAc;gBAAE,aAAa,CAAC,cAAc,CAAC,CAAC;YAClD,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,QAAQ;oBAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,GAAmB,EACnB,GAAiB;IAEjB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAE1C,4DAA4D;IAC5D,IAAI,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO;IAEtC,IAAI,CAAC;QACH,6CAA6C;QAC7C,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAErF,qDAAqD;QACrD,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC;YAAE,OAAO;QAE/D,mCAAmC;QACnC,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC;YAAE,OAAO;QAEjE,iCAAiC;QACjC,IAAI,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC;YAAE,OAAO;QAElE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC"}