@serfab/cadre-host 0.7.1 → 0.8.1

package/dist/orchestrator/types.d.ts

@@ -2,6 +2,7 @@
  * Public + internal types for the HostProcessOrchestrator.
  */
 import type { ChildProcess } from 'node:child_process';
+import type { PushCredentials } from '@serfab/cadre-core';
 /** User-facing configuration for `HostProcessOrchestrator`. */
 export interface HostProcessConfig {
     /** Root directory under which per-container workdirs live. */
@@ -28,6 +29,29 @@ export interface HostProcessConfig {
     spawn?: {
         entrypoint?: string;
     };
+    /**
+     * Resolver for the platform push credentials (FCM/APNs) to inject into a
+     * spawned strand-participating node's `cadre.json` (`config.push`). Called
+     * fresh on EVERY spawn/re-spawn so the secret store stays the source of truth
+     * and no raw private key is ever persisted in `state.json`. Returns `undefined`
+     * when no push credentials are configured (the default — push is opt-in). The
+     * resolver itself is responsible for rejecting a partial credential set.
+     */
+    pushResolver?: PushCredentialsResolver;
+}
+/**
+ * Resolves the push credentials to inject into a node being spawned. Re-invoked
+ * per spawn so a restart re-reads the secret store rather than replaying stale
+ * (or persisted) material. See {@link HostProcessConfig.pushResolver}.
+ */
+export type PushCredentialsResolver = () => Promise<PushCredentials | undefined>;
+/** Per-child allocated ports. `admin` carries the loopback admin channel (6.6). */
+export interface NodePorts {
+    health: number;
+    metrics: number;
+    p2p: number;
+    /** Loopback admin-channel port. Bound only by the authority node. */
+    admin: number;
 }
 /** In-memory record per managed child. */
 export interface Handle {
@@ -36,14 +60,12 @@ export interface Handle {
     pid: number;
     startupToken: string;
     workdir: string;
-    ports: {
-        health: number;
-        metrics: number;
-        p2p: number;
-    };
+    ports: NodePorts;
     spawnedAt: string;
     partyId: string;
     profile: 'storage' | 'transaction';
+    /** True for the admin's authority node (binds the admin channel). */
+    authority?: boolean;
     /** Live ChildProcess reference; absent after re-attach via init(). */
     child?: ChildProcess;
     /** Marked false when init() finds the PID dead or token mismatched. */
@@ -61,11 +83,24 @@ export interface ManagedNodeInfo {
     status: 'running' | 'stopped';
     spawnedAt: string;
     workdir: string;
-    ports: {
-        health: number;
-        metrics: number;
-        p2p: number;
-    };
+    ports: NodePorts;
+    /** True for the admin's authority node. */
+    authority?: boolean;
+}
+/**
+ * Persisted spawn parameters for the admin's authority node. Stored alongside
+ * the handles so an orchestrator restart can re-spawn the authority node from
+ * `/api/nodes/:id/{start,restart}` without the caller re-supplying them.
+ */
+export interface AuthoritySpawnConfig {
+    /** Absolute path to the host's libp2p protobuf identity (`identity.key`). */
+    identityPath: string;
+    /** Control-network partyId (the host's installId). */
+    partyId: string;
+    /** External libp2p port — mapped to the child's listen address. */
+    libp2pPort: number;
+    /** Node profile. Defaults to `storage` (the household node holds strands). */
+    profile?: 'storage' | 'transaction';
 }
 /**
  * Listener invoked when a managed node's lifecycle state changes

package/dist/orchestrator/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/orchestrator/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAgEH,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,KAAa;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,eAAe,GAAG,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/orchestrator/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AA8GH,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,KAAa;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,eAAe,GAAG,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC"}

package/dist/push/index.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Push (FCM/APNs) credential storage + resolution for cadre-host.
+ *
+ * The platform-push secrets a self-hosted deployment provisions live in the host
+ * secret store (keytar with file-store fallback — the same store DDNS tokens use);
+ * the non-secret app-config bits (APNs bundle id / sandbox toggle, cooldown /
+ * debounce) live in `host.config.json` (`PushSettings`). At node-spawn time the
+ * orchestrator's `pushResolver` calls {@link resolvePushCredentials}, which reads
+ * BOTH and merges them into the `PushCredentials` block written into the spawned
+ * node's `cadre.json`.
+ *
+ * Secret hygiene: the FCM service-account fields and the APNs `.p8` key are stored
+ * ONLY in the secret store, never in `host.config.json` and never in `state.json`.
+ * They are re-read on every spawn so a restart picks up rotated keys, and the
+ * resolver redacts on any log line. A partial credential set (a present platform
+ * missing required fields) is rejected — fail fast, not at first push.
+ */
+import type { PushCredentials } from '@serfab/cadre-core';
+import type { SecretsStore } from '../nat/secrets/index.js';
+import type { PushSettings } from '../installer/config.js';
+/** Push platform whose secret bundle lives in the secret store. */
+export type PushSecretPlatform = 'fcm' | 'apns';
+/** Build the secret-store account key for a platform's credential bundle. */
+export declare function pushAccount(platform: PushSecretPlatform): string;
+/** FCM secret bundle persisted in the secret store (the whole set is sensitive). */
+export interface FcmSecret {
+    projectId: string;
+    clientEmail: string;
+    /** Service-account RSA private key, PEM. */
+    privateKey: string;
+}
+/**
+ * APNs secret bundle persisted in the secret store. `bundleId` / `production` are
+ * NOT here — they are non-secret app-config in {@link PushSettings}.
+ */
+export interface ApnsSecret {
+    keyId: string;
+    teamId: string;
+    /** `.p8` ES256 private key, PEM. */
+    privateKey: string;
+}
+/** Store (or replace) the FCM service-account secret bundle. */
+export declare function setFcmSecret(secrets: SecretsStore, secret: FcmSecret): Promise<void>;
+/** Store (or replace) the APNs auth-key secret bundle. */
+export declare function setApnsSecret(secrets: SecretsStore, secret: ApnsSecret): Promise<void>;
+/** Remove a platform's secret bundle. Returns true if one was present. */
+export declare function clearPushSecret(secrets: SecretsStore, platform: PushSecretPlatform): Promise<boolean>;
+/**
+ * Resolve the full {@link PushCredentials} block to inject into a spawned node,
+ * merging the secret-store bundles with the non-secret {@link PushSettings}.
+ *
+ * Returns `undefined` when NO platform is configured (push is opt-in — the node
+ * then constructs no fan-out). Throws when a configured platform is incomplete
+ * (e.g. APNs secret present but `bundleId` unset), so a misconfig surfaces at the
+ * spawn boundary rather than silently at first push.
+ */
+export declare function resolvePushCredentials(secrets: SecretsStore, settings: PushSettings | undefined): Promise<PushCredentials | undefined>;
+/**
+ * A description of which push platforms are configured, for the `push status` CLI
+ * and any UI — derived without exposing any secret material.
+ */
+export interface PushStatus {
+    fcm: boolean;
+    apns: boolean;
+}
+/** Report which platforms have a stored secret bundle (no secret material). */
+export declare function pushStatus(secrets: SecretsStore): Promise<PushStatus>;

package/dist/push/index.js

@@ -0,0 +1,101 @@
+/**
+ * Push (FCM/APNs) credential storage + resolution for cadre-host.
+ *
+ * The platform-push secrets a self-hosted deployment provisions live in the host
+ * secret store (keytar with file-store fallback — the same store DDNS tokens use);
+ * the non-secret app-config bits (APNs bundle id / sandbox toggle, cooldown /
+ * debounce) live in `host.config.json` (`PushSettings`). At node-spawn time the
+ * orchestrator's `pushResolver` calls {@link resolvePushCredentials}, which reads
+ * BOTH and merges them into the `PushCredentials` block written into the spawned
+ * node's `cadre.json`.
+ *
+ * Secret hygiene: the FCM service-account fields and the APNs `.p8` key are stored
+ * ONLY in the secret store, never in `host.config.json` and never in `state.json`.
+ * They are re-read on every spawn so a restart picks up rotated keys, and the
+ * resolver redacts on any log line. A partial credential set (a present platform
+ * missing required fields) is rejected — fail fast, not at first push.
+ */
+import debug from 'debug';
+import { validatePushCredentials } from '@serfab/cadre-core';
+const log = debug('cadre:host:push');
+/** Build the secret-store account key for a platform's credential bundle. */
+export function pushAccount(platform) {
+    return `push:${platform}`;
+}
+/** Store (or replace) the FCM service-account secret bundle. */
+export async function setFcmSecret(secrets, secret) {
+    await secrets.set(pushAccount('fcm'), JSON.stringify(secret));
+}
+/** Store (or replace) the APNs auth-key secret bundle. */
+export async function setApnsSecret(secrets, secret) {
+    await secrets.set(pushAccount('apns'), JSON.stringify(secret));
+}
+/** Remove a platform's secret bundle. Returns true if one was present. */
+export async function clearPushSecret(secrets, platform) {
+    return secrets.delete(pushAccount(platform));
+}
+/** Read a platform's stored secret bundle, or null when unset. */
+async function readSecret(secrets, platform) {
+    const raw = await secrets.get(pushAccount(platform));
+    if (raw === null)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Stored ${platform} push secret is not valid JSON: ${err.message}`, { cause: err });
+    }
+}
+/**
+ * Resolve the full {@link PushCredentials} block to inject into a spawned node,
+ * merging the secret-store bundles with the non-secret {@link PushSettings}.
+ *
+ * Returns `undefined` when NO platform is configured (push is opt-in — the node
+ * then constructs no fan-out). Throws when a configured platform is incomplete
+ * (e.g. APNs secret present but `bundleId` unset), so a misconfig surfaces at the
+ * spawn boundary rather than silently at first push.
+ */
+export async function resolvePushCredentials(secrets, settings) {
+    const fcmSecret = await readSecret(secrets, 'fcm');
+    const apnsSecret = await readSecret(secrets, 'apns');
+    if (!fcmSecret && !apnsSecret)
+        return undefined;
+    const push = {};
+    if (fcmSecret) {
+        const fcm = {
+            projectId: fcmSecret.projectId,
+            clientEmail: fcmSecret.clientEmail,
+            privateKey: fcmSecret.privateKey,
+        };
+        push.fcm = fcm;
+    }
+    if (apnsSecret) {
+        const apns = {
+            keyId: apnsSecret.keyId,
+            teamId: apnsSecret.teamId,
+            bundleId: settings?.apns?.bundleId ?? '',
+            privateKey: apnsSecret.privateKey,
+            ...(settings?.apns?.production !== undefined ? { production: settings.apns.production } : {}),
+        };
+        push.apns = apns;
+    }
+    if (settings?.cooldownMs !== undefined)
+        push.cooldownMs = settings.cooldownMs;
+    if (settings?.debounceMs !== undefined)
+        push.debounceMs = settings.debounceMs;
+    const errors = validatePushCredentials(push);
+    if (errors.length > 0) {
+        throw new Error(`Invalid push credentials: ${errors.join('; ')}`);
+    }
+    log('resolved push credentials (fcm=%s apns=%s)', !!push.fcm, !!push.apns);
+    return push;
+}
+/** Report which platforms have a stored secret bundle (no secret material). */
+export async function pushStatus(secrets) {
+    const accounts = await secrets.list();
+    return {
+        fcm: accounts.includes(pushAccount('fcm')),
+        apns: accounts.includes(pushAccount('apns')),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/push/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/push/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAKrC,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,QAA4B;IACtD,OAAO,QAAQ,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAqBD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE,MAAiB;IACzE,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAqB,EAAE,MAAkB;IAC3E,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAqB,EAAE,QAA4B;IACvF,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,UAAU,CAAI,OAAqB,EAAE,QAA4B;IAC9E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,mCAAoC,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAqB,EACrB,QAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAY,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,UAAU,CAAa,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAmB;YAC1B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAoB;YAC5B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;YACxC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,EAAE,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IAC9E,IAAI,QAAQ,EAAE,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IAE9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,GAAG,CAAC,4CAA4C,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAqB;IACpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/server/error-handler.d.ts

@@ -7,6 +7,7 @@
  *       invalid_label, invalid_token             → 400
  *       not_found, already_redeemed              → 404
  *       expired                                  → 410
+ *       node_unavailable                         → 503
  *       storage_error                            → 500
  *   - NatError
  *       invalid_config, ddns_provider_unknown,
@@ -14,6 +15,7 @@
  *       secrets_unavailable, storage_error,
  *       mapping_failed, router_unreachable,
  *       ip_detection_failed, ddns_update_failed  → 500
+ *       node_unavailable                         → 503
  *   - UpdateErrorException
  *       manifest_invalid, no_update_available,
  *       min_previous_version                     → 400

package/dist/server/error-handler.js

@@ -7,6 +7,7 @@
  *       invalid_label, invalid_token             → 400
  *       not_found, already_redeemed              → 404
  *       expired                                  → 410
+ *       node_unavailable                         → 503
  *       storage_error                            → 500
  *   - NatError
  *       invalid_config, ddns_provider_unknown,
@@ -14,6 +15,7 @@
  *       secrets_unavailable, storage_error,
  *       mapping_failed, router_unreachable,
  *       ip_detection_failed, ddns_update_failed  → 500
+ *       node_unavailable                         → 503
  *   - UpdateErrorException
  *       manifest_invalid, no_update_available,
  *       min_previous_version                     → 400
@@ -34,6 +36,7 @@ const TRUST_STATUS = {
     already_redeemed: 404,
     expired: 410,
     storage_error: 500,
+    node_unavailable: 503,
 };
 const NAT_STATUS = {
     invalid_config: 400,
@@ -45,6 +48,7 @@ const NAT_STATUS = {
     router_unreachable: 500,
     ip_detection_failed: 500,
     ddns_update_failed: 500,
+    node_unavailable: 503,
 };
 const UPDATE_STATUS = {
     manifest_invalid: 400,

package/dist/server/error-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/server/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAA6B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAqB,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAwB,MAAM,oBAAoB,CAAC;AAEhF,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,MAAM,YAAY,GAAyC;IACzD,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,OAAO,EAAE,GAAG;IACZ,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,MAAM,UAAU,GAAiC;IAC/C,cAAc,EAAE,GAAG;IACnB,qBAAqB,EAAE,GAAG;IAC1B,wBAAwB,EAAE,GAAG;IAC7B,mBAAmB,EAAE,GAAG;IACxB,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,GAAG;IACnB,kBAAkB,EAAE,GAAG;IACvB,mBAAmB,EAAE,GAAG;IACxB,kBAAkB,EAAE,GAAG;CACxB,CAAC;AAEF,MAAM,aAAa,GAAoC;IACrD,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;IACxB,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,iBAAiB,EAAE,GAAG;IACtB,yBAAyB,EAAE,GAAG;IAC9B,YAAY,EAAE,GAAG;IACjB,eAAe,EAAE,GAAG;IACpB,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,GAAG,CAAC,eAAe,CAAC,CAAC,GAAiB,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACtF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,SAAS,QAAQ,CAAC,GAAiB;IACjC,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC1F,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QACxF,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB;SACzC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;AACrF,CAAC"}
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/server/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAA6B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAqB,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAwB,MAAM,oBAAoB,CAAC;AAEhF,MAAM,GAAG,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9C,MAAM,YAAY,GAAyC;IACzD,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,OAAO,EAAE,GAAG;IACZ,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAEF,MAAM,UAAU,GAAiC;IAC/C,cAAc,EAAE,GAAG;IACnB,qBAAqB,EAAE,GAAG;IAC1B,wBAAwB,EAAE,GAAG;IAC7B,mBAAmB,EAAE,GAAG;IACxB,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,GAAG;IACnB,kBAAkB,EAAE,GAAG;IACvB,mBAAmB,EAAE,GAAG;IACxB,kBAAkB,EAAE,GAAG;IACvB,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAEF,MAAM,aAAa,GAAoC;IACrD,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;IACxB,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,iBAAiB,EAAE,GAAG;IACtB,yBAAyB,EAAE,GAAG;IAC9B,YAAY,EAAE,GAAG;IACjB,eAAe,EAAE,GAAG;IACpB,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,GAAG,CAAC,eAAe,CAAC,CAAC,GAAiB,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACtF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC7B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,SAAS,QAAQ,CAAC,GAAiB;IACjC,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC1F,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QACxF,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB;SACzC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;AACrF,CAAC"}

package/dist/server/routes/nodes.d.ts

@@ -6,9 +6,10 @@
  * `onStateChange` (forwarded by `createLocalUiServer.start`) — the route
  * handlers don't re-publish.
  *
- * v1 limits: cadre-host doesn't yet auto-spawn nodes (the trust-circle →
- * node mapping ticket is separate). Until it lands, `listNodes()` is
- * usually empty and start/restart are stubs. Stop on a running node works.
+ * start/restart are real for the admin's authority node (re-spawned from the
+ * persisted `AuthoritySpawnConfig`). Generic per-member node spawn from saved
+ * config is out of scope and returns `not_implemented`. Stop works for any
+ * running node.
  */
 import type { FastifyInstance } from 'fastify';
 import type { HostProcessOrchestrator } from '../../orchestrator/index.js';

package/dist/server/routes/nodes.js

@@ -6,9 +6,10 @@
  * `onStateChange` (forwarded by `createLocalUiServer.start`) — the route
  * handlers don't re-publish.
  *
- * v1 limits: cadre-host doesn't yet auto-spawn nodes (the trust-circle →
- * node mapping ticket is separate). Until it lands, `listNodes()` is
- * usually empty and start/restart are stubs. Stop on a running node works.
+ * start/restart are real for the admin's authority node (re-spawned from the
+ * persisted `AuthoritySpawnConfig`). Generic per-member node spawn from saved
+ * config is out of scope and returns `not_implemented`. Stop works for any
+ * running node.
  */
 import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
 import { defaultLogPath } from '../../orchestrator/log-rotator.js';
@@ -64,32 +65,45 @@ export function registerNodesRoutes(app, opts) {
         // forwards that to the bus. Don't double-publish here.
         return { ok: true };
     });
-    // start / restart: the orchestrator's createContainer requires a full
-    // OrchestratorCreateRequest (partyId, bootstrapNodes, profile, ...).
-    // cadre-host doesn't yet own a "spawn this node from saved config" path
-    // — that lives in the trust-circle-driven node spawner planned for a
-    // follow-up ticket. Until then these endpoints stub out cleanly so the
-    // SPA gets a predictable error rather than a route-not-found 404.
+    // start / restart: real for the admin's authority node (spawned from the
+    // persisted AuthoritySpawnConfig). Generic per-member node spawn from saved
+    // config is out of scope — those ids return a clear not_implemented; unknown
+    // ids 404.
     app.post('/api/nodes/:id/start', async (request, reply) => {
-        return reply.code(501).send({
-            ok: false,
-            error: {
-                code: 'not_implemented',
-                message: `start ${request.params.id}: cadre-host v1 has no auto-spawn path. ` +
-                    `Restart the cadre-host service to bring up persisted nodes.`,
-            },
-        });
+        const { id } = request.params;
+        if (orchestrator.isAuthorityNode(id)) {
+            if (!orchestrator.hasAuthorityConfig()) {
+                return notImplemented(reply, `start ${id}: authority node has no saved spawn config.`);
+            }
+            const node = await orchestrator.ensureAuthorityNode();
+            return { ok: true, data: { node } };
+        }
+        return startRestartFallback(reply, orchestrator, id, 'start');
     });
     app.post('/api/nodes/:id/restart', async (request, reply) => {
-        return reply.code(501).send({
+        const { id } = request.params;
+        if (orchestrator.isAuthorityNode(id)) {
+            if (!orchestrator.hasAuthorityConfig()) {
+                return notImplemented(reply, `restart ${id}: authority node has no saved spawn config.`);
+            }
+            const node = await orchestrator.restartAuthorityNode();
+            return { ok: true, data: { node } };
+        }
+        return startRestartFallback(reply, orchestrator, id, 'restart');
+    });
+}
+/** 404 for unknown ids; 501 not_implemented for known non-authority nodes. */
+function startRestartFallback(reply, orchestrator, id, verb) {
+    if (!orchestrator.getNode(id)) {
+        return reply.code(404).send({
             ok: false,
-            error: {
-                code: 'not_implemented',
-                message: `restart ${request.params.id}: cadre-host v1 has no auto-spawn path. ` +
-                    `Restart the cadre-host service to bring up persisted nodes.`,
-            },
+            error: { code: 'not_found', message: `Unknown node: ${id}` },
         });
-    });
+    }
+    return notImplemented(reply, `${verb} ${id}: only the authority node is start/restart-able; generic node spawn is out of scope.`);
+}
+function notImplemented(reply, message) {
+    return reply.code(501).send({ ok: false, error: { code: 'not_implemented', message } });
 }
 /**
  * Read the last `n` lines from a log file by walking the tail in chunks.

package/dist/server/routes/nodes.js.map

@@ -1 +1 @@
-{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../../src/server/routes/nodes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK9E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAC;AAM3B,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAwB;IAChF,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE9B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAA6B,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,iBAAiB,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAA6B,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnF,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,qEAAqE;QACrE,uDAAuD;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,GAAG,CAAC,IAAI,CAA6B,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EACL,SAAS,OAAO,CAAC,MAAM,CAAC,EAAE,0CAA0C;oBACpE,6DAA6D;aAChE;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAA6B,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EACL,WAAW,OAAO,CAAC,MAAM,CAAC,EAAE,0CAA0C;oBACtE,6DAA6D;aAChE;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,CAAS;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,GAAG,IAAI,OAAO,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,YAAY,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../../src/server/routes/nodes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK9E,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAC;AAM3B,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAwB;IAChF,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE9B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAA6B,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,iBAAiB,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAA6B,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnF,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,qEAAqE;QACrE,uDAAuD;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,WAAW;IACX,GAAG,CAAC,IAAI,CAA6B,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBACvC,OAAO,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,mBAAmB,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAA6B,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBACvC,OAAO,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,6CAA6C,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,oBAAoB,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB,CAC3B,KAAqC,EACrC,YAAqC,EACrC,EAAU,EACV,IAAY;IAEZ,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,cAAc,CACnB,KAAK,EACL,GAAG,IAAI,IAAI,EAAE,sFAAsF,CACpG,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAqC,EAAE,OAAe;IAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,CAAS;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,GAAG,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,GAAG,IAAI,OAAO,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,YAAY,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/server/static.d.ts

@@ -23,3 +23,15 @@ export interface StaticMountOptions {
     rootDir?: string;
 }
 export declare function registerStaticMount(app: FastifyInstance, opts?: StaticMountOptions): void;
+/**
+ * Resolve a request path to an absolute file path inside `rootDir`, or `null`
+ * if it would escape the root.
+ *
+ * Exported for direct unit testing. The containment check uses `path.relative`
+ * rather than a bare `startsWith` prefix test: the latter is the classic
+ * prefix-bypass anti-pattern, accepting sibling directories whose name shares
+ * `rootDir`'s basename as a prefix (e.g. `dist/ui-private` vs `dist/ui`).
+ * `relative` respects the path-separator boundary on both POSIX and Windows,
+ * and surfaces cross-drive escapes on Windows as an absolute result.
+ */
+export declare function resolveSafe(rootDir: string, urlPath: string): string | null;

package/dist/server/static.js

@@ -12,10 +12,8 @@
  * static serving anyway.
  */
 import { readFileSync, statSync, existsSync } from 'node:fs';
-import { dirname, extname, join, normalize, resolve } from 'node:path';
+import { dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import debug from 'debug';
-const log = debug('cadre:host:static');
 const MIME_TYPES = {
     '.html': 'text/html; charset=utf-8',
     '.js': 'application/javascript; charset=utf-8',
@@ -103,13 +101,32 @@ function serveStatic(rootDir, request, reply) {
         error: { code: 'not_found', message: `No static asset for ${request.url}` },
     });
 }
-function resolveSafe(rootDir, urlPath) {
+/**
+ * Resolve a request path to an absolute file path inside `rootDir`, or `null`
+ * if it would escape the root.
+ *
+ * Exported for direct unit testing. The containment check uses `path.relative`
+ * rather than a bare `startsWith` prefix test: the latter is the classic
+ * prefix-bypass anti-pattern, accepting sibling directories whose name shares
+ * `rootDir`'s basename as a prefix (e.g. `dist/ui-private` vs `dist/ui`).
+ * `relative` respects the path-separator boundary on both POSIX and Windows,
+ * and surfaces cross-drive escapes on Windows as an absolute result.
+ */
+export function resolveSafe(rootDir, urlPath) {
     const cleaned = decodeSafe(urlPath);
     if (cleaned === null)
         return null;
-    const target = normalize(join(rootDir, cleaned === '/' ? '' : cleaned));
-    // Disallow path traversal above rootDir.
-    if (!target.startsWith(normalize(rootDir)))
+    const root = normalize(rootDir);
+    const target = normalize(join(root, cleaned === '/' ? '' : cleaned));
+    // Containment: target must be rootDir itself or strictly beneath it.
+    // `relative(root, target)` is '' for root itself (accepted) and a descendant
+    // path with no leading '..' for in-root assets. Reject when it climbs out
+    // (exactly '..', or '..' + separator) or — cross-drive on Windows — is
+    // absolute. Guarding on '..' + separator rather than a bare '..' prefix avoids
+    // falsely rejecting legitimate in-root names that merely *begin* with '..'
+    // (e.g. a '..foo' asset), which would re-introduce a looser prefix check.
+    const rel = relative(root, target);
+    if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel))
         return null;
     return target;
 }

package/dist/server/static.js.map

@@ -1 +1 @@
-{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAEvC,MAAM,UAAU,GAA2B;IACzC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,OAA2B,EAAE;IACrF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,iBAAiB,EAAE,CAAC;IAEpD,gDAAgD;IAChD,GAAG,CAAC,kBAAkB,CAAC,CAAC,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE;aACvF,CAAC,CAAC;QACL,CAAC;QACD,0CAA0C;QAC1C,IACE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EACjC,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE;aACvF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,OAAuB,EAAE,KAAmB;IAChF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,CAAC,GAAG,EAAE,EAAE;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IACD,gEAAgE;IAChE,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC1C,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1B,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,CAAC,GAAG,EAAE,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,OAAe;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,yCAAyC;IACzC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCR,CAAC;AACF,CAAC"}
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,MAAM,UAAU,GAA2B;IACzC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,OAA2B,EAAE;IACrF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,iBAAiB,EAAE,CAAC;IAEpD,gDAAgD;IAChD,GAAG,CAAC,kBAAkB,CAAC,CAAC,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE;aACvF,CAAC,CAAC;QACL,CAAC;QACD,0CAA0C;QAC1C,IACE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EACjC,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE;aACvF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,OAAuB,EAAE,KAAmB;IAChF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,CAAC,GAAG,EAAE,EAAE;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IACD,gEAAgE;IAChE,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC1C,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1B,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,CAAC,GAAG,EAAE,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAe;IAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,qEAAqE;IACrE,6EAA6E;IAC7E,0EAA0E;IAC1E,uEAAuE;IACvE,+EAA+E;IAC/E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCR,CAAC;AACF,CAAC"}