@qodalis/cli-server-node 1.0.0-beta.5 → 1.0.0-beta.6

package/README.md

@@ -1,5 +1,8 @@
 # Qodalis CLI Server (Node.js)
 
+[![npm @qodalis/cli-server-node](https://img.shields.io/npm/v/@qodalis/cli-server-node?label=%40qodalis%2Fcli-server-node)](https://www.npmjs.com/package/@qodalis/cli-server-node)
+[![npm @qodalis/cli-server-abstractions](https://img.shields.io/npm/v/@qodalis/cli-server-abstractions?label=%40qodalis%2Fcli-server-abstractions)](https://www.npmjs.com/package/@qodalis/cli-server-abstractions)
+
 A Node.js CLI server framework for the [Qodalis CLI](https://github.com/qodalis-solutions/web-cli) ecosystem. Build custom server-side commands that integrate with the Qodalis web terminal.
 
 ## Installation
@@ -303,11 +306,103 @@ The server exposes versioned endpoints:
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/api/cli/versions` | Version discovery (supported versions, preferred version) |
-| GET | `/api/v1/cli/version` | V1 server version |
-| GET | `/api/v1/cli/commands` | V1 commands (all processors) |
-| POST | `/api/v1/cli/execute` | V1 execute |
-| WS | `/ws/cli/events` | WebSocket events (also `/ws/v1/cli/events`) |
+| GET | `/api/qcli/versions` | Version discovery (supported versions, preferred version) |
+| GET | `/api/v1/qcli/version` | V1 server version |
+| GET | `/api/v1/qcli/commands` | V1 commands (all processors) |
+| POST | `/api/v1/qcli/execute` | V1 execute |
+| POST | `/api/v1/qcli/execute/stream` | V1 SSE streaming execute |
+| WS | `/ws/qcli/events` | WebSocket events (also `/ws/v1/qcli/events`) |
+| WS | `/ws/v1/qcli/shell` | Interactive PTY shell session |
+
+`GET /capabilities` reports `shell: true|false` and, when the shell is enabled, `shellAuth: 'users' | 'token' | 'custom' | 'anonymous' | 'locked'`.
+
+## Remote Shell Security
+
+The PTY shell (`/ws/v1/qcli/shell`, `/ws/qcli/shell`) gives OS-level access to the server. It is **off** unless `enableShell: true`. When enabled, exactly one access mode applies:
+
+| Mode (`shellAuth`) | When | Client must |
+|---|---|---|
+| `users` | the users plugin is mounted | connect with a WS ticket (`?ticket=`) of a session holding `shell:execute` |
+| `token` | no users plugin, `shell.token` set | send `Authorization: Bearer <token>` (header, or the `_header_Authorization` query parameter) |
+| `custom` | no users plugin, `shell.authorize` set | pass the host's `authorize(request, { url, remoteAddress, mode })` check |
+| `anonymous` | no users plugin, `shell.allowAnonymous: true` | nothing (a startup WARNING is logged) |
+| `locked` | none of the above | — every connection is closed with 4401 and a startup ERROR explains the options |
+
+Precedence: users plugin mounted (even with `protectServer: false`) ⇒ `users`; otherwise `token`, then `custom`, then `anonymous`. Whatever the mode, **every configured check among `token` and `authorize` must pass** (so with both set, both are required and `shellAuth` reports `token`); `allowAnonymous` is ignored once either is set. Tokens are compared in constant time (SHA-256 of both, then `timingSafeEqual`) and never logged; an `authorize` that throws or rejects denies.
+
+### With the users plugin
+
+```typescript
+const { mountPlugin, eventSocketManager } = createCliServer({ enableShell: true });
+mountPlugin(new CliUsersBuilder().build((m) => eventSocketManager.broadcastMessage(m)));
+// Grant shell:execute to a group (root/admin has '*'):
+//   PUT /api/v1/qcli/groups/ops  { "permissions": ["commands:execute", "shell:execute"] }
+```
+
+An open shell is bound to the session that opened it: logout, idle/absolute session expiry, admin revoke (kick), user disabled or deleted, or losing `shell:execute` (checked once more right after the shell is registered and before it is spawned, so a logout racing the open is not missed; then immediately on session/user/group changes and every `sessionCheckIntervalMs`, default 30 s, max 60 s), or a password change becoming required closes it with **4401** `session ended` and kills its process tree. Users authenticated by an external auth adapter have no stored session: their shells are re-checked by calling the adapter again with the shell's original upgrade request (see the users plugin README). Re-checks never extend the session by themselves; stdin received since the previous check counts as session activity (at most one touch per 30 s), so an active shell user is not idle-logged-out. Opens and closes are audited as `shell_opened` / `shell_closed` (`userId`, `actorId`, `metadata: { mode: 'interactive' | 'command', sessionId, durationMs, reason, exitCode? }`), never with the command text or stdin. `reason` is one of `exited` (then `exitCode` is set), `closed`, `session ended`, `permission removed`, `shell timed out`, `server shutdown`, `error`.
+
+### Without the users plugin (token mode)
+
+```typescript
+createCliServer({
+    enableShell: true,
+    shell: { token: process.env.QCLI_SHELL_TOKEN },   // long random secret
+});
+```
+
+Browser clients cannot set WebSocket headers: configure the server in web-cli with `headers: { Authorization: 'Bearer <token>' }` and the client forwards it as `?_header_Authorization=Bearer%20<token>`. The standalone server (`src/server.ts`) enables token mode when `QCLI_SHELL_TOKEN` is set. Use HTTPS/WSS so the token is not sent in clear text.
+
+For your own scheme (reverse-proxy identity, IP allow-list, …) use `authorize`:
+
+```typescript
+createCliServer({
+    enableShell: true,
+    shell: { authorize: async (req, { remoteAddress }) => remoteAddress === '127.0.0.1' && req.headers['x-ops'] === 'yes' },
+});
+```
+
+Non-users modes log one info line per open/close (remote address, mode, reason) without the command text.
+
+### Options
+
+```typescript
+shell: {
+    token?: string;                    // token mode (or extra requirement with the users plugin)
+    authorize?: (req, ctx) => boolean | Promise<boolean>;  // custom mode (or extra requirement)
+    allowAnonymous?: boolean;          // open to anyone who can reach the server (not recommended)
+    maxSessionsPerUser?: number;       // per user (users mode) or per remote address (default 3; X-Forwarded-For only with trustProxy)
+    maxSessions?: number;              // total concurrent shells (default 20)
+    idleTimeoutMs?: number;            // close after no stdin (resize does not count; default 15 min, 0 = off)
+    maxDurationMs?: number;            // absolute limit (default none)
+    sessionCheckIntervalMs?: number;   // users-mode re-check (default 30 000, max 60 000)
+    cwd?: string;                      // working directory (default: home directory)
+    shell?: string;                    // shell binary (default: detected)
+    env?: { allow?: string[]; set?: Record<string, string> };
+}
+```
+
+The shell does **not** inherit the server environment: it gets only `PATH`, `HOME`, `USER`, `LANG`, `TERM`, `COLUMNS`, `LINES`, `SHELL` (plus the variables Windows needs to start PowerShell), the names in `env.allow`, and `env.set`. Secrets such as database passwords stay out of the shell.
+
+### Process cleanup
+
+Whenever a shell ends (exit, client close, session ended or permission removed, timeout, server shutdown), the server first collects everything the shell started — its process group, its descendants by parent PID (including background jobs that interactive shells move to their own process groups, and `setsid`/`nohup` children), on Linux every process of its session, and every process tagged with the shell's marker (below) — and then sends SIGHUP, SIGTERM and, after a 1 s grace period, SIGKILL to all of them (re-collecting before the SIGKILL). The server's own process and process group are never targeted. Linux reads `/proc` for everything (no `ps` needed); macOS and other Unixes run `ps`. On Windows only the shell process is killed.
+
+Every shell gets a unique marker in its environment, `QCLI_SHELL_ID=<random 128-bit hex>`, added after the `env.allow`/`env.set` filtering so configuration can neither override nor remove it. Children inherit it, so processes that were re-parented to init *and* left the shell's process group and session — e.g. `setsid sleep 100 &` from an interactive shell, double-forking daemons — are still found: on Linux by reading `/proc/<pid>/environ`, on macOS through `ps -A -E -ww` (which shows the environment of the server user's processes).
+
+Limitations: a process escapes only if it deliberately unsets or changes `QCLI_SHELL_ID` before detaching (`env -u QCLI_SHELL_ID setsid …`), or runs as a different user whose environment the server cannot read (e.g. via `sudo`). On macOS the environment of Apple platform binaries (`/bin/sleep`, `/usr/bin/perl`, …) is hidden from `ps -E`, so such a binary that left the shell's tree and session is not found there either. Run the server in a container or under a service manager (cgroup) if every process must be contained.
+
+### Close codes
+
+Refusals are sent as *accept, then close* so browsers can read them (a foreign `Origin` is still rejected with HTTP 403):
+
+| Code | Reason | When |
+|---|---|---|
+| 4401 | `login required` / `session ended` / `shell access is not configured` | missing ticket or (Bearer) token; session ended (logout, expiry, kick, user disabled/deleted, `shell:execute` removed, password change now required) — shell, events and logs sockets; shell locked |
+| 4403 | `forbidden` | wrong token, `authorize` false or threw, no `shell:execute`, password change required |
+| 4404 | `shell disabled` | `enableShell` is false |
+| 4408 | `shell timed out` | idle timeout or `maxDurationMs` |
+| 4429 | `too many shell sessions` | `maxSessionsPerUser` or `maxSessions` reached |
+| 1001 | `server shutdown` | the server is shutting down |
 
 ## Processor Base Class Reference
 
@@ -329,12 +424,25 @@ The server exposes versioned endpoints:
 
 ```typescript
 interface CliServerOptions {
-    basePath?: string;                     // API base path (default: '/api/cli')
-    cors?: boolean | cors.CorsOptions;     // CORS config (default: false)
+    basePath?: string;                     // API base path (default: '/api/qcli')
+    cors?: boolean | cors.CorsOptions;     // CORS config (default: only allowedOrigins; off when none)
+    allowedOrigins?: string[];             // CORS + WebSocket Origin allow-list ('http://host:*' = any port)
+    enableShell?: boolean;                 // Interactive shell WebSocket (default: false)
+    shell?: CliShellOptions;               // Shell access mode, limits, timeouts, env (see Remote Shell Security)
+    trustProxy?: boolean | number;         // Trusted proxy hops for X-Forwarded-* (true = 1; default false = none)
+    auth?: ICliServerAuth;                 // Protect the whole server (e.g. usersPlugin.serverAuth)
     configure?: (builder: CliBuilder) => void;  // Processor registration
 }
 ```
 
+CORS is disabled unless `allowedOrigins` (or an explicit `cors` option) is given. The shell socket is off unless `enableShell: true`, and even then it is locked until an access mode applies (see [Remote Shell Security](#remote-shell-security)).
+
+Same-origin requests (e.g. the bundled admin dashboard at `/qcli/admin`) are always allowed by the Origin, CORS and CSRF checks, even when `allowedOrigins` does not list the server's own origin (`X-Forwarded-Proto`/`X-Forwarded-Host` are honoured only with `trustProxy`, and read like `X-Forwarded-For`: the entry at index `len - hops`, the leftmost when the list is shorter, an empty entry ignored).
+
+`trustProxy` is the number of trusted reverse-proxy hops in front of the server (`true` = 1, `false`/`0`/absent = none). With n hops the client IP (Express `req.ip`, the shell's per-address limits) is the `X-Forwarded-For` entry at index `len - n` of the comma-separated list, i.e. with one hop the rightmost entry, appended by your proxy; the leftmost entries are client-controlled and never used unless the list is shorter than n. Without the header (or when the selected entry is empty) the socket address is used. Set it to the exact number of proxies you run, otherwise clients can spoof their IP.
+
+When the users plugin is mounted (`mountPlugin(usersPlugin)`) or passed as `auth`, every `/api/...` route and every WebSocket requires a users session (see [Users Plugin](#users-plugin)); without it the server behaves as before.
+
 `createCliServer()` returns:
 
 ```typescript
@@ -342,7 +450,11 @@ interface CliServerOptions {
     app: Express;                          // Configured Express app
     registry: CliCommandRegistry;          // Processor registry
     builder: CliBuilder;                   // Registration builder
-    eventSocketManager: CliEventSocketManager;  // WebSocket manager
+    executor: CliCommandExecutorService;   // Command executor
+    eventSocketManager: CliEventSocketManager;  // WebSocket event manager
+    logSocketManager: CliLogSocketManager;      // WebSocket log manager
+    mountPlugin(plugin: MountablePlugin): void; // Mount a plugin with its routes (installs plugin.serverAuth)
+    setAuth(auth?: ICliServerAuth): void;       // Install/remove the server auth provider
 }
 ```
 
@@ -391,19 +503,19 @@ import {
 
 ## File Storage
 
-The server includes a pluggable file storage system exposed at `/api/cli/fs/*`. Enable it with `setFileStorageProvider()` and choose a storage backend.
+The server includes a pluggable file storage system exposed at `/api/qcli/fs/*`. Enable it with `setFileStorageProvider()` and choose a storage backend.
 
 ### Filesystem API Endpoints
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/api/cli/fs/ls?path=/` | List directory contents |
-| GET | `/api/cli/fs/cat?path=/file.txt` | Read file content |
-| GET | `/api/cli/fs/stat?path=/file.txt` | File/directory metadata |
-| GET | `/api/cli/fs/download?path=/file.txt` | Download file |
-| POST | `/api/cli/fs/upload` | Upload file (multipart) |
-| POST | `/api/cli/fs/mkdir` | Create directory |
-| DELETE | `/api/cli/fs/rm?path=/file.txt` | Delete file or directory |
+| GET | `/api/qcli/fs/ls?path=/` | List directory contents |
+| GET | `/api/qcli/fs/cat?path=/file.txt` | Read file content |
+| GET | `/api/qcli/fs/stat?path=/file.txt` | File/directory metadata |
+| GET | `/api/qcli/fs/download?path=/file.txt` | Download file |
+| POST | `/api/qcli/fs/upload` | Upload file (multipart) |
+| POST | `/api/qcli/fs/mkdir` | Create directory |
+| DELETE | `/api/qcli/fs/rm?path=/file.txt` | Delete file or directory |
 
 ### Storage Providers
 
@@ -615,6 +727,37 @@ All commands support `--region` (`-r`) for region override and `--output` (`-o`)
 
 See [`plugins/aws/README.md`](plugins/aws/README.md) for the full command reference.
 
+### Users Plugin
+
+The users plugin (`@qodalis/cli-server-plugin-users`) adds REST endpoints under `/api/v1/qcli` for authentication, users, groups with permissions, sessions and an audit log, with swappable storage (in-memory by default). It is the server side of the `@qodalis/cli-users` browser plugin's *server mode*.
+
+```typescript
+import { CliUsersBuilder } from '@qodalis/cli-server-plugin-users';
+
+const usersPlugin = new CliUsersBuilder()
+    .build((msg) => eventSocketManager.broadcastMessage(msg));
+mountPlugin(usersPlugin); // protects the whole server (protectServer: true)
+```
+
+Once mounted, every server route and socket requires a users session (login, version discovery and capabilities stay public):
+
+| Surface | Permission |
+|---|---|
+| `GET /commands` | authenticated |
+| `POST /execute`, `/execute/stream` | `commands:execute` + the processor's `requiredPermissions` |
+| fs `ls`/`cat`/`stat`/`download` | `files:read` |
+| fs `upload`/`mkdir`/`rm` | `files:write` |
+| data explorer | `data:query` |
+| jobs read / manage | `jobs:read` / `jobs:manage` |
+| events / logs / shell WebSocket | authenticated / `logs:read` / `shell:execute` (see [Remote Shell Security](#remote-shell-security)) |
+| admin dashboard | `admin:access` |
+
+WebSockets authenticate with a single-use ticket: `POST /api/v1/qcli/sessions/ws-ticket` → `{ ticket, expiresIn: 30 }`, then connect with `?ticket=<ticket>`. Host routes can use `usersPlugin.requireAuth()` / `usersPlugin.requirePermission('perm')`. Processors declare `requiredPermissions: ['deploy:run']` to be enforced server-side.
+
+Events and logs sockets authenticated with a stored session are bound to it: when the session ends (logout, revoke/kick, user disabled or deleted, a password change becoming required, idle/absolute expiry) the socket is closed with **4401** `session ended`; for a revoke the events socket first receives `session-kicked`. Bound sockets are re-checked on every session/user/group change and after each expired-session sweep (`setCleanupInterval`, default 5 minutes). Sockets authenticated by an external auth adapter have no stored session and are not re-checked.
+
+See [`plugins/users/README.md`](plugins/users/README.md) for options, endpoints, custom storage and external auth adapters.
+
 ## Built-in Processors
 
 These processors ship with the library and are included in the standalone server:
@@ -627,7 +770,6 @@ These processors ship with the library and are included in the standalone server
 | `http` | HTTP request operations |
 | `hash` | Hash computation (MD5, SHA1, SHA256, SHA512) |
 | `base64` | Base64 encode/decode (sub-commands) |
-| `uuid` | UUID generation |
 
 ## Docker
 
@@ -663,10 +805,22 @@ packages/
       cli-command-parameter-descriptor.ts  # Parameter declaration
       cli-command-author.ts           # Author metadata
 plugins/
+  admin/                              # Admin dashboard plugin (auth, status, config, logs)
+  aws/                                # AWS cloud services (S3, EC2, Lambda, CloudWatch, etc.)
+  data-explorer/                      # Core data explorer abstraction
+  data-explorer-sql/                  # SQL data explorer provider (SQLite)
+  data-explorer-mongo/                # MongoDB data explorer provider
+  data-explorer-postgres/             # PostgreSQL data explorer provider
+  data-explorer-mysql/                # MySQL data explorer provider
+  data-explorer-mssql/                # MS SQL data explorer provider
+  data-explorer-redis/                # Redis data explorer provider
+  data-explorer-elasticsearch/        # Elasticsearch data explorer provider
   filesystem/                         # Core file storage abstraction (IFileStorageProvider, InMemory, OS)
   filesystem-json/                    # JSON file persistence provider
   filesystem-sqlite/                  # SQLite persistence provider (better-sqlite3)
   filesystem-s3/                      # Amazon S3 storage provider (@aws-sdk/client-s3)
+  jobs/                               # Job scheduling plugin
+  users/                              # Users plugin (auth, sessions, groups, audit)
   weather/                            # Weather module (example plugin)
 src/
   abstractions/                       # Re-exports from @qodalis/cli-server-abstractions
@@ -679,9 +833,11 @@ src/
     cli-command-executor-service.ts   # Command execution pipeline
     cli-response-builder.ts           # Structured output builder
     cli-event-socket-manager.ts       # WebSocket event broadcasting
+    cli-log-socket-manager.ts         # WebSocket log streaming
+    cli-shell-session-manager.ts      # PTY shell session management
   controllers/
-    cli-controller.ts                 # V1 REST API (/api/v1/cli)
-    cli-version-controller.ts         # Version discovery (/api/cli/versions)
+    cli-controller.ts                 # V1 REST API (/api/v1/qcli)
+    cli-version-controller.ts         # Version discovery (/api/qcli/versions)
   extensions/
     cli-builder.ts                    # Fluent registration API (addProcessor, addModule)
   processors/                         # Built-in processors

package/dist/src/auth/cli-server-auth-gate.d.ts

@@ -0,0 +1,31 @@
+import { RequestHandler } from 'express';
+import { ICliCommandRegistry } from '../services/cli-command-registry';
+import { CliServerAuthContext, ICliServerAuth } from './cli-server-auth';
+declare global {
+    namespace Express {
+        interface Request {
+            /** Set by the server auth gate when the users plugin protects the server. */
+            qcliServerAuth?: CliServerAuthContext;
+        }
+    }
+}
+/** Normalizes a request path for classification: lower-case, single slashes, no trailing slash. */
+export declare function normalizePath(path: string): string;
+export interface ServerAuthGateOptions {
+    registry: ICliCommandRegistry;
+    /** Prefixes serving the CLI controller (`/api/v1/qcli`, custom basePath). */
+    cliPrefixes: string[];
+    /** Extra public routes as `"METHOD /path"` (e.g. a plugin's own login). */
+    publicRoutes: Set<string>;
+}
+/** Collects `requiredPermissions` along the resolved processor chain. */
+export declare function processorPermissions(registry: ICliCommandRegistry, command: unknown, chain: unknown): string[];
+/** Permissions required for a (protected) server route. */
+export declare function requiredServerPermissions(method: string, path: string, body: any, options: ServerAuthGateOptions): string[];
+/**
+ * Express middleware protecting every `/api/...` route of the CLI server when
+ * an auth provider with `protectServer` is installed. Without a provider it is
+ * a no-op, so servers without the users plugin behave as before.
+ */
+export declare function createServerAuthGate(getAuth: () => ICliServerAuth | undefined, options: ServerAuthGateOptions): RequestHandler;
+//# sourceMappingURL=cli-server-auth-gate.d.ts.map

package/dist/src/auth/cli-server-auth-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth-gate.d.ts","sourceRoot":"","sources":["../../../src/auth/cli-server-auth-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAA6B,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKpG,OAAO,CAAC,MAAM,CAAC;IACX,UAAU,OAAO,CAAC;QACd,UAAU,OAAO;YACb,6EAA6E;YAC7E,cAAc,CAAC,EAAE,oBAAoB,CAAC;SACzC;KACJ;CACJ;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlD;AAgBD,MAAM,WAAW,qBAAqB;IAClC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAChC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,GACf,MAAM,EAAE,CAkBV;AAED,2DAA2D;AAC3D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAiB3H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,OAAO,EAAE,MAAM,cAAc,GAAG,SAAS,EACzC,OAAO,EAAE,qBAAqB,GAC/B,cAAc,CAkDhB"}

package/dist/src/auth/cli-server-auth-gate.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizePath = normalizePath;
+exports.processorPermissions = processorPermissions;
+exports.requiredServerPermissions = requiredServerPermissions;
+exports.createServerAuthGate = createServerAuthGate;
+const cli_server_auth_1 = require("./cli-server-auth");
+const logger_1 = require("../utils/logger");
+const logger = (0, logger_1.createLogger)('ServerAuth');
+/** Normalizes a request path for classification: lower-case, single slashes, no trailing slash. */
+function normalizePath(path) {
+    const p = path.toLowerCase().replace(/\/{2,}/g, '/').replace(/\/+$/, '');
+    return p || '/';
+}
+const PUBLIC_GET = new Set([
+    '/api/qcli/versions',
+    '/api/qcli/version',
+    '/api/qcli/capabilities',
+    '/api/cli/versions',
+    '/api/v1/qcli/version',
+    '/api/v1/qcli/capabilities',
+    '/health',
+    '/healthz',
+    '/api/health',
+]);
+const FS_READ = new Set(['ls', 'cat', 'stat', 'download']);
+/** Collects `requiredPermissions` along the resolved processor chain. */
+function processorPermissions(registry, command, chain) {
+    if (typeof command !== 'string')
+        return [];
+    const root = registry.processors.find((p) => p.command.toLowerCase() === command.toLowerCase());
+    if (!root)
+        return [];
+    const out = [...(root.requiredPermissions ?? [])];
+    let current = root;
+    if (Array.isArray(chain)) {
+        for (const sub of chain) {
+            if (typeof sub !== 'string')
+                break;
+            const child = current.processors?.find((p) => p.command.toLowerCase() === sub.toLowerCase());
+            if (!child)
+                break;
+            out.push(...(child.requiredPermissions ?? []));
+            current = child;
+        }
+    }
+    return out;
+}
+/** Permissions required for a (protected) server route. */
+function requiredServerPermissions(method, path, body, options) {
+    for (const prefix of options.cliPrefixes) {
+        if (path === `${prefix}/execute` || path === `${prefix}/execute/stream`) {
+            return [cli_server_auth_1.CliServerPermissions.CommandsExecute, ...processorPermissions(options.registry, body?.command, body?.chainCommands)];
+        }
+    }
+    if (path === '/api/qcli/fs' || path.startsWith('/api/qcli/fs/')) {
+        const op = path.slice('/api/qcli/fs/'.length);
+        return [method === 'GET' && FS_READ.has(op) ? cli_server_auth_1.CliServerPermissions.FilesRead : cli_server_auth_1.CliServerPermissions.FilesWrite];
+    }
+    if (path === '/api/qcli/data-explorer' || path.startsWith('/api/qcli/data-explorer/')) {
+        return [cli_server_auth_1.CliServerPermissions.DataQuery];
+    }
+    if (path === '/api/v1/qcli/jobs' || path.startsWith('/api/v1/qcli/jobs/')) {
+        return [method === 'GET' ? cli_server_auth_1.CliServerPermissions.JobsRead : cli_server_auth_1.CliServerPermissions.JobsManage];
+    }
+    return [];
+}
+/**
+ * Express middleware protecting every `/api/...` route of the CLI server when
+ * an auth provider with `protectServer` is installed. Without a provider it is
+ * a no-op, so servers without the users plugin behave as before.
+ */
+function createServerAuthGate(getAuth, options) {
+    return (req, res, next) => {
+        const auth = getAuth();
+        if (!auth || !auth.protectServer) {
+            next();
+            return;
+        }
+        const method = req.method.toUpperCase();
+        if (method === 'OPTIONS') {
+            next();
+            return;
+        }
+        const path = normalizePath(req.path);
+        if (!path.startsWith('/api/') && path !== '/api') {
+            next();
+            return;
+        }
+        if ((method === 'GET' || method === 'HEAD') && PUBLIC_GET.has(path)) {
+            next();
+            return;
+        }
+        if (options.publicRoutes.has(`${method} ${path}`) || auth.handlesPath(path, method)) {
+            next();
+            return;
+        }
+        auth.authenticateRequest(req).then((ctx) => {
+            const missing = requiredServerPermissions(method, path, req.body, options).filter((p) => !auth.hasPermission(ctx, p));
+            if (missing.length > 0) {
+                res.status(403).json({ error: `forbidden: missing permission ${missing.join(', ')}` });
+                return;
+            }
+            req.qcliServerAuth = ctx;
+            next();
+        }, (err) => {
+            if (typeof err?.status !== 'number') {
+                // not an auth error (e.g. a store failure): never expose its message
+                logger.error('authentication failed unexpectedly:', err);
+                res.status(500).json({ error: 'internal server error' });
+                return;
+            }
+            const status = err.status;
+            res.status(status).json({ error: status === 401 ? err.message || 'unauthorized' : err.message || 'forbidden' });
+        });
+    };
+}
+//# sourceMappingURL=cli-server-auth-gate.js.map

package/dist/src/auth/cli-server-auth-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth-gate.js","sourceRoot":"","sources":["../../../src/auth/cli-server-auth-gate.ts"],"names":[],"mappings":";;AAkBA,sCAGC;AAyBD,oDAsBC;AAGD,8DAiBC;AAOD,oDAqDC;AAjJD,uDAAoG;AACpG,4CAA+C;AAE/C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC;AAW1C,mGAAmG;AACnG,SAAgB,aAAa,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,IAAI,GAAG,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACvB,oBAAoB;IACpB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,SAAS;IACT,UAAU;IACV,aAAa;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAU3D,yEAAyE;AACzE,SAAgB,oBAAoB,CAChC,QAA6B,EAC7B,OAAgB,EAChB,KAAc;IAEd,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAa,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM;YACnC,MAAM,KAAK,GAAqC,OAAO,CAAC,UAAU,EAAE,IAAI,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CACvD,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO,GAAG,KAAK,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,SAAgB,yBAAyB,CAAC,MAAc,EAAE,IAAY,EAAE,IAAS,EAAE,OAA8B;IAC7G,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,GAAG,MAAM,UAAU,IAAI,IAAI,KAAK,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACtE,OAAO,CAAC,sCAAC,CAAC,eAAe,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,sCAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sCAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,IAAI,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,sCAAC,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sCAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAC,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAChC,OAAyC,EACzC,OAA8B;IAE9B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,CAC9B,CAAC,GAAG,EAAE,EAAE;YACJ,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAC7E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CACrC,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvF,OAAO;YACX,CAAC;YACD,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC;YACzB,IAAI,EAAE,CAAC;QACX,CAAC,EACD,CAAC,GAA0C,EAAE,EAAE;YAC3C,IAAI,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,qEAAqE;gBACrE,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;QACpH,CAAC,CACJ,CAAC;IACN,CAAC,CAAC;AACN,CAAC"}

package/dist/src/auth/cli-server-auth.d.ts

@@ -0,0 +1,147 @@
+import type { IncomingMessage } from 'http';
+import type { Request } from 'express';
+/** Identity of an authenticated caller (HTTP request or WebSocket). */
+export interface CliServerAuthContext {
+    userId: string;
+    userName: string;
+    /** Absent for host-authenticated (adapter) callers. */
+    sessionId?: string;
+    /** Effective permissions (`resource:action`, `*` wildcards). */
+    permissions: string[];
+}
+/** Error thrown by {@link ICliServerAuth.authenticateRequest}; rendered as `{ error }`. */
+export interface CliServerAuthError extends Error {
+    status?: number;
+}
+/**
+ * Authentication provider that protects the whole CLI server (routes and
+ * sockets). Implemented by the users plugin (`usersPlugin.serverAuth`).
+ */
+export interface ICliServerAuth {
+    /** When false the server stays open; sockets only use tickets for optional identity. */
+    readonly protectServer: boolean;
+    /** True for routes the provider authenticates itself (its own API, its login). */
+    handlesPath(path: string, method: string): boolean;
+    /**
+     * Authenticates an HTTP request. Throws an error with `status`
+     * (401 unauthenticated, 403 e.g. password change required / CSRF); any
+     * other error is logged and answered with a generic 500.
+     */
+    authenticateRequest(req: Request): Promise<CliServerAuthContext>;
+    /**
+     * Consumes a single-use WebSocket ticket; undefined when invalid/expired/used.
+     * May throw an error with `status: 403` when the identity is valid but not
+     * allowed yet (e.g. password change required).
+     */
+    consumeTicket(ticket: string): Promise<CliServerAuthContext | undefined>;
+    hasPermission(ctx: CliServerAuthContext, permission: string): boolean;
+    /** Called once when installed into a server. */
+    attachToServer?(server: {
+        allowedOrigins?: string[];
+        broadcast: (message: Record<string, unknown>) => void;
+    }): void;
+    /**
+     * Re-validates a socket identity without sliding the session: the session still
+     * exists and is not expired, the user exists and is enabled. Returns the identity
+     * with fresh permissions, or undefined when it ended. Used to bind long-lived
+     * sockets (the shell) to their session. `request` is the socket's original
+     * upgrade request, for identities without a stored session that the provider
+     * re-authenticates from the request (e.g. a host auth adapter reading cookies).
+     */
+    revalidate?(ctx: CliServerAuthContext, request?: IncomingMessage): Promise<CliServerAuthContext | undefined>;
+    /** Records activity on the session behind `ctx` (slides the idle expiry). */
+    touch?(ctx: CliServerAuthContext): Promise<void>;
+    /** Writes an audit entry (never include secrets, command text or stdin). */
+    audit?(entry: CliServerAuditEntry): Promise<void>;
+    /** Subscribes to session lifecycle events; returns an unsubscribe function. */
+    onSessionEvent?(listener: (event: CliServerSessionEvent) => void): () => void;
+}
+/** Audit entry written by the server through {@link ICliServerAuth.audit}. */
+export interface CliServerAuditEntry {
+    event: string;
+    userId: string;
+    userName: string;
+    /** Acting user (defaults to the user). */
+    actorId?: string;
+    actorName?: string;
+    details?: string;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Session lifecycle events emitted by the auth provider:
+ * - `session-ended`: logout, expiry, revoke (kick), user disabled/deleted;
+ *   `revoked` is true for revocations, which also broadcast `session-kicked`;
+ * - `access-changed`: users/groups/permissions changed, or the expired-session
+ *   sweep ran (re-check open sockets).
+ */
+export type CliServerSessionEvent = {
+    type: 'session-ended';
+    sessionId: string;
+    userId?: string;
+    reason?: string;
+    revoked?: boolean;
+} | {
+    type: 'access-changed';
+    userId?: string;
+};
+/** Server permissions enforced when the users plugin protects the server. */
+export declare const CliServerPermissions: {
+    readonly CommandsExecute: "commands:execute";
+    readonly FilesRead: "files:read";
+    readonly FilesWrite: "files:write";
+    readonly DataQuery: "data:query";
+    readonly JobsRead: "jobs:read";
+    readonly JobsManage: "jobs:manage";
+    readonly LogsRead: "logs:read";
+    readonly ShellExecute: "shell:execute";
+    readonly AdminAccess: "admin:access";
+};
+/**
+ * Exact origin match. An entry ending in `:*` matches any port of that
+ * scheme+host (e.g. `http://127.0.0.1:*`).
+ */
+export declare function isOriginAllowed(origin: string | undefined, allowed: readonly string[] | undefined): boolean;
+/**
+ * Number of trusted reverse-proxy hops for a `trustProxy` setting:
+ * `false`/`0`/absent → 0 (untrusted), `true` → 1, a number n → n (values
+ * below 1 other than 0 count as 1).
+ */
+export declare function trustedProxyHops(trustProxy: boolean | number | undefined): number;
+/**
+ * The client address: the socket address, or with `trustProxy` (a hop count,
+ * `true` = 1) the `X-Forwarded-For` entry at index `len - hops`.
+ */
+export declare function clientAddress(req: {
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    } | null;
+}, trustProxy: boolean | number | undefined): string;
+/** Minimal request shape for {@link isSameOrigin} (Node `IncomingMessage` or Express `Request`). */
+export interface OriginCheckRequest {
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        encrypted?: boolean;
+        remoteAddress?: string;
+    } | null;
+    /** Express app (when present, its `trust proxy` setting is honoured). */
+    app?: {
+        get?: (name: string) => unknown;
+    };
+}
+/**
+ * The request's own origin (`scheme://host:port`, normalized): the scheme from
+ * the socket (TLS or not) and the `Host` header. Behind a trusted proxy
+ * (`trustProxy`, or the Express app's `trust proxy` setting when omitted)
+ * `X-Forwarded-Proto` / `X-Forwarded-Host` win, read like `X-Forwarded-For`:
+ * the entry at index `len - hops` (the rightmost with one hop; the leftmost
+ * when the list is shorter; an empty entry is ignored).
+ */
+export declare function requestOrigin(req: OriginCheckRequest, trustProxy?: boolean | number): string | undefined;
+/**
+ * True when `origin` is the request's own origin (e.g. the bundled admin
+ * dashboard served by this server). Same-origin requests are not cross-site
+ * and always pass Origin/CSRF checks. Case-insensitive; default ports normalized.
+ */
+export declare function isSameOrigin(origin: string | undefined, req: OriginCheckRequest, trustProxy?: boolean | number): boolean;
+//# sourceMappingURL=cli-server-auth.d.ts.map

package/dist/src/auth/cli-server-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/cli-server-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAmB,SAAQ,KAAK;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,kFAAkF;IAClF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD;;;;OAIG;IACH,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjE;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IACzE,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,gDAAgD;IAChD,cAAc,CAAC,CAAC,MAAM,EAAE;QACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KACzD,GAAG,IAAI,CAAC;IACT;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC7G,6EAA6E;IAC7E,KAAK,CAAC,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,4EAA4E;IAC5E,KAAK,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,+EAA+E;IAC/E,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACjF;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC3B;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACjG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB;;;;;;;;;;CAUvB,CAAC;AAEX;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAW3G;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAMjF;AAeD;;;GAGG;AACH,wBAAgB,aAAa,CACzB,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,EAC3G,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GACzC,MAAM,CAER;AAED,oGAAoG;AACpG,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE,yEAAyE;IACzE,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,CAAC;CAC7C;AAsCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAKxG;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAWxH"}