@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/app.js

@@ -0,0 +1,372 @@
+import express from 'express';
+import compression from 'compression';
+import cors from 'cors';
+import helmet from 'helmet';
+import path from 'path';
+import fs from 'fs';
+import { fileURLToPath } from 'url';
+import { keysRouter } from './routes/keys.js';
+import { clientProfilesRouter } from './routes/client-profiles.js';
+import { conversationsRouter } from './routes/conversations.js';
+import { logsRouter } from './routes/logs.js';
+import { modelsRouter } from './routes/models.js';
+import { proxyRouter } from './routes/proxy.js';
+import { responsesRouter } from './routes/responses.js';
+import { anthropicRouter } from './routes/anthropic.js';
+import { fallbackRouter } from './routes/fallback.js';
+import { profilesRouter } from './routes/profiles.js';
+import { embeddingsRouter } from './routes/embeddings.js';
+import { mediaRouter } from './routes/media.js';
+import { analyticsRouter } from './routes/analytics.js';
+import { healthRouter } from './routes/health.js';
+import { freeTierRouter } from './routes/free-tier.js';
+import { settingsRouter } from './routes/settings.js';
+import { backupsRouter } from './routes/backups.js';
+import { cacheRouter } from './routes/cache.js';
+import { compressionRouter } from './routes/compression.js';
+import { authRouter } from './routes/auth.js';
+import { docsRouter } from './routes/docs.js';
+import { mcpRouter } from './routes/mcp.js';
+import { statusRouter, providersRouter } from './routes/status.js';
+import { geminiRouter } from './routes/gemini.js';
+import { syncCatalog, getSyncState } from './services/catalog-sync.js';
+import { ollamaRouter } from './routes/ollama.js';
+import { urlTokenRouter } from './routes/url-tokens.js';
+import { updateRouter } from './routes/update.js';
+import { requireAuth } from './middleware/requireAuth.js';
+import { createProxyRateLimiter, createAdminRateLimiter } from './middleware/rateLimit.js';
+// Password-guess ceiling for GET /api/keys/export. Deliberately low: a real
+// user exports keys occasionally, never ten times a minute.
+const EXPORT_RATE_LIMIT_RPM = 10;
+import { errorHandler } from './middleware/errorHandler.js';
+import { clientContextMiddleware } from './lib/client-context.js';
+import { loadConfig } from './lib/config.js';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const DEFAULT_DASHBOARD_ORIGINS = [
+    'http://localhost:5173',
+    'http://127.0.0.1:5173',
+    'http://[::1]:5173',
+];
+// SHA-256 of the inline theme/direction bootstrap in client/index.html, which
+// must run before first paint. Kept as a literal so the CSP header stays a
+// constant string; csp-inline-bootstrap.test.ts recomputes it from the real
+// index.html (source and build) and fails if the two ever drift apart.
+export const INLINE_BOOTSTRAP_SHA = "'sha256-1OTmTnZneXffbmIPwWo5eUgYng1kx7QMYftxJ/QGmvw='";
+// A build asset is safe to cache forever+immutable when its URL is
+// content-addressed. Vite parks every hashed chunk (JS, CSS, fonts, images)
+// under assets/, so that directory is the reliable signal; the -<hash>.<ext>
+// suffix is a belt-and-braces fallback for any hashed file emitted elsewhere.
+// index.html and other unhashed entries deliberately fall through to no-cache.
+const HASHED_ASSET_RE = /-[A-Za-z0-9_-]{6,}\.[A-Za-z0-9]+$/;
+function isImmutableAsset(filePath) {
+    return (filePath.includes(`${path.sep}assets${path.sep}`) ||
+        HASHED_ASSET_RE.test(path.basename(filePath)));
+}
+// Loopback and *.localhost are "potentially trustworthy" origins even over
+// plain HTTP (https://www.w3.org/TR/powerful-features/#is-origin-trustworthy),
+// so a desktop/localhost install still gets the secure-context-only headers.
+const LOOPBACK_HOST_RE = /^(?:localhost|[^.]+(?:\.[^.]+)*\.localhost|127(?:\.\d{1,3}){3}|\[?::1\]?)$/i;
+// TLS terminated here (req.secure), or in front of us and forwarded. The
+// X-Forwarded-Proto check is the documented reverse-proxy setup for publishing
+// the proxy beyond localhost.
+function isHttpsRequest(req) {
+    const forwardedProto = req.headers['x-forwarded-proto'];
+    // A proxy chain sends a comma-separated list; the client-facing hop is first.
+    const first = String(forwardedProto ?? '').split(',')[0].trim().toLowerCase();
+    return first === 'https' || req.secure;
+}
+// Whether the browser will treat this origin as a secure context. Headers that
+// only apply to secure contexts are worse than useless elsewhere: the browser
+// drops them and logs an error, which is exactly what a plain-HTTP LAN install
+// reported in #734.
+function isTrustworthyOrigin(req) {
+    return isHttpsRequest(req) || LOOPBACK_HOST_RE.test(req.hostname ?? '');
+}
+export function createApp(config) {
+    const cfg = config ?? loadConfig();
+    const app = express();
+    // TRUST_PROXY (#1024): opt-in trust of X-Forwarded-* from a reverse proxy.
+    // false (default) ignores forwarded headers so direct callers cannot spoof
+    // the client IP; true trusts every hop; a comma-separated list of addresses
+    // /CIDRs trusts only those proxies. Must be set before client-context and
+    // the rate-limit middleware, which both resolve the client IP.
+    app.set('trust proxy', cfg.trustProxy);
+    const allowedCorsOrigins = new Set([
+        ...DEFAULT_DASHBOARD_ORIGINS,
+        ...cfg.dashboardOrigins,
+    ]);
+    // CSP: default-src 'self' restricts content to the same origin. Scripts
+    // are hashed by the Vite/React build, so 'self' works in production. Inline
+    // styles from React hydration need 'unsafe-inline'. HSTS stays off because
+    // this is a single-user local proxy served over HTTP (see README).
+    //
+    // `upgrade-insecure-requests` is emitted by Helmet by default; v0.6.6's
+    // CSP hardening (#498) inherited it and broke HTTP LAN installs because the
+    // browser rewrites /assets/* to https:// on an origin that has no TLS,
+    // producing ERR_SSL_PROTOCOL_ERROR and a blank dashboard (#682).
+    // The directive is dropped from the static Helmet config and re-added per
+    // request below, gated by protocol + the CSP_UPGRADE_INSECURE_REQUESTS env.
+    //
+    // Cross-Origin-Opener-Policy and Origin-Agent-Cluster are handled the same
+    // way, for the same reason: both only apply to secure contexts, so on a
+    // plain-HTTP LAN origin the browser discards them and logs a console error
+    // instead (#734). They are re-added per request whenever the origin is one
+    // the browser trusts — HTTPS, or loopback, which covers desktop/localhost.
+    app.use(helmet({
+        contentSecurityPolicy: {
+            directives: {
+                defaultSrc: ["'self'"],
+                // index.html carries one inline <script>: the theme/direction bootstrap
+                // that has to run before first paint, or every dark-mode user gets a
+                // white flash. 'self' alone blocks it on every install, HTTPS included,
+                // so it is allowed by hash — nothing else inline is. INLINE_BOOTSTRAP_SHA
+                // is asserted against the real index.html in csp-inline-bootstrap.test.ts,
+                // so editing that script fails the suite instead of silently breaking it.
+                scriptSrc: ["'self'", INLINE_BOOTSTRAP_SHA],
+                styleSrc: ["'self'", "'unsafe-inline'"],
+                imgSrc: ["'self'", "data:"],
+                connectSrc: ["'self'"],
+                fontSrc: ["'self'"],
+                formAction: ["'self'"],
+                baseUri: ["'self'"],
+                upgradeInsecureRequests: null,
+            },
+        },
+        hsts: false,
+        crossOriginOpenerPolicy: false,
+        originAgentCluster: false,
+    }));
+    // Per-request re-issue of the headers that depend on how the page was
+    // reached. Only HTTPS origins should tell the browser to upgrade http→https,
+    // since plain-HTTP LAN setups have no TLS to upgrade to; the env flag
+    // overrides that either way. COOP and Origin-Agent-Cluster go back on for any
+    // origin the browser considers trustworthy (HTTPS or loopback), which is
+    // every origin that would have honoured them in the first place.
+    // Helmet ran above and synchronously set its headers on res; this runs next,
+    // still before any route handler writes the body, so setHeader here lands
+    // before the response is flushed.
+    app.use((req, res, next) => {
+        const shouldEmit = cfg.cspUpgradeInsecureRequests === true ||
+            (cfg.cspUpgradeInsecureRequests === undefined && isHttpsRequest(req));
+        if (shouldEmit) {
+            const csp = res.getHeader('content-security-policy');
+            if (typeof csp === 'string' && !csp.includes('upgrade-insecure-requests')) {
+                res.setHeader('content-security-policy', `${csp}; upgrade-insecure-requests`);
+            }
+        }
+        if (isTrustworthyOrigin(req)) {
+            res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+            res.setHeader('Origin-Agent-Cluster', '?1');
+        }
+        next();
+    });
+    app.use(cors({
+        origin(origin, callback) {
+            callback(null, !origin || allowedCorsOrigins.has(origin));
+        },
+    }));
+    // Two-tier JSON body limits. The LLM wire surfaces carry vision payloads —
+    // base64 images inline in the body (~33% inflation; google.ts forwards
+    // images up to 8MB apiece) — so a single-screenshot Codex turn can clear
+    // 10MB and used to 413 HERE, before auth/routing: no fallback attempt, no
+    // analytics row, just an opaque 'request entity too large'. Those surfaces
+    // get the larger REQUEST_BODY_LIMIT_MB ceiling (default 25MB); everything
+    // else keeps the #200 limit — code agents (OpenCode, AionUI, Qwen Code)
+    // ship very large system prompts + tool schemas + repo context, and 1mb cut
+    // their sessions off mid-conversation. body-parser skips requests whose
+    // body was already parsed, so the second parser only sees what the first
+    // didn't own; an over-limit body throws from whichever parser matched.
+    app.use(['/v1', '/v1beta', '/mcp', '/api/chat', '/api/generate', '/api/embed', '/api/embeddings'], express.json({ limit: cfg.requestBodyLimitBytes }));
+    app.use(express.json({ limit: '10mb' }));
+    // Caller identity (IP + User-Agent) for request analytics, carried in
+    // AsyncLocalStorage so logRequest() can read it from any depth.
+    app.use(clientContextMiddleware);
+    // Ollama emulation owns only its exact fixed /api/* paths. Mount it before
+    // the dashboard session gate because real Ollama clients do not use that
+    // auth scheme. Its legacy /api/embeddings handler explicitly falls through
+    // when it sees a valid dashboard session.
+    // The same per-IP limiter as /v1 runs first: key-required mode is a
+    // brute-forceable credential check without it. Dashboard traffic on the
+    // shared /api/embeddings path shares the (generous, configurable) budget.
+    app.use(['/api/tags', '/api/version', '/api/show', '/api/chat', '/api/generate', '/api/embed', '/api/embeddings'], createProxyRateLimiter(cfg.proxyRateLimitRpm));
+    app.use(ollamaRouter);
+    // Admin API — all routes share an IP-based rate limiter to throttle
+    // brute-force attempts (auth, key export, etc). The limiter is mounted
+    // broadly on /api; requireAuth gates each sub-path individually so that
+    // unauthenticated endpoints under /api (like /api/ping) are not blocked.
+    //
+    // This MUST stay above the /api/auth mount below. Express runs middleware in
+    // registration order, so while the limiter was registered after authRouter,
+    // authRouter answered and ended /api/auth/login before the limiter was ever
+    // entered — leaving the password endpoint this comment names as the reason
+    // for the limiter as the one /api path it did not cover. It still sits below
+    // the Ollama /api/* mount above, which carries its own proxy limiter.
+    const adminRateLimiter = createAdminRateLimiter();
+    app.use('/api', adminRateLimiter);
+    // Dashboard auth (#35): /api/auth/{status,setup,login} bootstrap without a
+    // session; everything else under /api/* requires a logged-in dashboard user.
+    // The /v1 proxy keeps its own unified-API-key auth and is NOT gated here.
+    app.use('/api/auth', authRouter);
+    // Key export re-verifies the dashboard password, which makes it the one admin
+    // endpoint a guesser can attack. The broad limiter above is sized for normal
+    // dashboard traffic and far too loose for that, so this path gets its own
+    // tight per-IP bucket on top of it.
+    app.use('/api/keys/export', createAdminRateLimiter(EXPORT_RATE_LIMIT_RPM));
+    app.use('/api/keys', requireAuth, keysRouter);
+    // Per-client key management (#411). Dashboard-session gated like the rest of
+    // /api — the profile keys it mints authenticate only the /v1 inference
+    // surface and are never valid here.
+    app.use('/api/client-profiles', requireAuth, clientProfilesRouter);
+    // Saved Playground transcripts (the chat sidebar). Dashboard-session gated
+    // like every other admin route; the unified /v1 key does not open it.
+    app.use('/api/conversations', requireAuth, conversationsRouter);
+    // Server logs for the dashboard viewer. Dashboard-session gated like the rest
+    // of /api — these lines name providers, models and key ids, so the unified
+    // /v1 key must not open them.
+    app.use('/api/logs', requireAuth, logsRouter);
+    app.use('/api/models', requireAuth, modelsRouter);
+    app.use('/api/profiles', requireAuth, profilesRouter);
+    app.use('/api/fallback', requireAuth, fallbackRouter);
+    app.use('/api/embeddings', requireAuth, embeddingsRouter);
+    app.use('/api/media', requireAuth, mediaRouter);
+    app.use('/api/analytics', requireAuth, analyticsRouter);
+    app.use('/api/health', requireAuth, healthRouter);
+    app.use('/api/free-tier', requireAuth, freeTierRouter);
+    app.use('/api/settings', requireAuth, settingsRouter);
+    // Database dumps and restores. Dashboard-session gated: the dump files carry
+    // encrypted provider keys and every routing setting, so the unified /v1 key
+    // must not open this surface.
+    app.use('/api/backups', requireAuth, backupsRouter);
+    app.use('/api/cache', requireAuth, cacheRouter);
+    app.use('/api/compression', requireAuth, compressionRouter);
+    app.use('/api/update', requireAuth, updateRouter);
+    // Catalog sync — lightweight endpoint that triggers an immediate catalog
+    // sync AND auto-discover, then returns the current sync state. Replaces
+    // the old /api/premium/sync route that was removed with the premium/license
+    // system. Running both ensures all model types (catalog + user-key-discovered)
+    // are refreshed in one go.
+    app.post('/api/catalog/sync', requireAuth, async (_req, res) => {
+        try {
+            const catalogResult = await syncCatalog(true);
+            // Also run auto-discover to refresh models from user API keys
+            try {
+                const { autoDiscoverAll } = await import('./services/auto-discover.js');
+                await autoDiscoverAll();
+            }
+            catch (err) {
+                console.warn(`[api] auto-discover during sync-all failed: ${err instanceof Error ? err.message : err}`);
+            }
+            res.json({ ...catalogResult, state: getSyncState() });
+        }
+        catch (err) {
+            res.status(500).json({ ok: false, error: err?.message ?? String(err) });
+        }
+    });
+    // Health check — no auth required.
+    app.get('/api/ping', (_req, res) => {
+        res.json({ status: 'ok', timestamp: new Date().toISOString() });
+    });
+    // Static, unauthenticated API reference: GET /v1/docs (viewer) and
+    // GET /v1/openapi.json (spec). Mounted before the rate limiter so the docs
+    // are always reachable and don't draw down a caller's request budget. It only
+    // owns those two paths; everything else falls through to the routers below.
+    app.use('/v1', docsRouter);
+    // Read-only per-upstream status for meta-gateways (GET /v1/providers, #433).
+    // Unified-key auth is enforced inside the handler; mounted before the rate
+    // limiter (like docsRouter) so status polling doesn't draw down a caller's
+    // request budget.
+    app.use('/v1', providersRouter);
+    // Separately revocable URL tokens for clients that cannot set headers.
+    app.use('/v1/t/:token', createProxyRateLimiter(cfg.proxyRateLimitRpm));
+    app.use('/v1/t/:token', urlTokenRouter);
+    // OpenAI-compatible proxy. Per-IP rate limiting (#35 item #6) runs first so
+    // it throttles unauthenticated brute-force / flood attempts before any
+    // routing work. Tune via PROXY_RATE_LIMIT_RPM; 0 disables it.
+    app.use('/v1', createProxyRateLimiter(cfg.proxyRateLimitRpm));
+    // Anthropic-compatible Messages API (`POST /v1/messages`, `/count_tokens`) for
+    // Claude Code and anything else speaking the Anthropic SDK. Mounted BEFORE the
+    // OpenAI router so it can content-negotiate `GET /v1/models` (Anthropic shape
+    // when the caller sends `anthropic-version`, else it falls through). All other
+    // paths it doesn't own fall through to the OpenAI router untouched.
+    app.use('/v1', anthropicRouter);
+    app.use('/v1', proxyRouter);
+    // OpenAI Responses API shim (Codex CLI requires wire_api="responses"; see #96)
+    app.use('/v1', responsesRouter);
+    // Native Gemini wire surface for Gemini CLI and Gemini-lineage agents.
+    app.use('/v1beta', createProxyRateLimiter(cfg.proxyRateLimitRpm));
+    app.use('/v1beta', geminiRouter);
+    // MCP server (Model Context Protocol over stateless Streamable HTTP):
+    // gateway introspection tools for MCP-speaking agents. Unified-key auth,
+    // like /v1 — NOT behind the dashboard session gate. Same per-IP limiter as
+    // /v1 (its own bucket): both surfaces guard the same unified key, so an
+    // unauthenticated brute-force must not get a free throttle-less oracle here.
+    app.use('/mcp', createProxyRateLimiter(cfg.proxyRateLimitRpm));
+    app.use('/mcp', mcpRouter);
+    // Liveness / readiness probes for orchestrators (GET /livez, /readyz, #433).
+    // Unauthenticated so a load balancer can probe them; registered before the
+    // static / SPA-fallback block below so these root paths resolve to JSON
+    // instead of index.html.
+    app.use(statusRouter);
+    // Error handler (for API routes)
+    app.use(errorHandler);
+    // Serve client static files (after API error handler). CLIENT_DIST lets
+    // embedders relocate the built dashboard (e.g. the desktop app ships it in
+    // extraResources, where the __dirname-relative path can't reach).
+    // Set serveStaticAssets: false in Config to skip static serving entirely
+    // (e.g. in runtimes that serve assets through a different mechanism).
+    if (cfg.serveStaticAssets) {
+        // CLIENT_DIST wins (embedders: the desktop app ships the dashboard in
+        // extraResources). Otherwise try both layouts: the dev checkout first
+        // (client/dist two levels up from server/dist), then the installed npm
+        // package (client/dist staged next to dist/ by
+        // scripts/prepare-server-pack.mjs — the two-level-up guess lands above
+        // node_modules there, so it alone would 404 a packaged dashboard).
+        const clientDist = cfg.clientDist
+            ? path.resolve(cfg.clientDist)
+            : ([path.resolve(__dirname, '../../client/dist'), path.resolve(__dirname, '../client/dist')]
+                .find(dir => fs.existsSync(path.join(dir, 'index.html')))
+                ?? path.resolve(__dirname, '../../client/dist'));
+        // Gzip the dashboard bundle (1+ MB uncompressed). Mounted HERE — after
+        // every API/proxy router and the error handler — so it only wraps the
+        // static-file / SPA-fallback responses below it. The /v1 and /api handlers
+        // end their responses upstream and never fall through to this middleware,
+        // so nothing (crucially the /v1/chat/completions SSE streams) gets buffered
+        // or re-encoded by compression.
+        app.use(compression());
+        app.use(express.static(clientDist, {
+            // Vite emits content-hashed build assets under assets/ (index-<hash>.js,
+            // chunk-<hash>.js, *.css, fonts…). The URL changes whenever the bytes do,
+            // so cache them for a year and mark them immutable. index.html and other
+            // unhashed root entries must stay revalidated (no-cache) so a redeploy
+            // propagates the new asset URLs immediately.
+            setHeaders(res, filePath) {
+                res.setHeader('Cache-Control', isImmutableAsset(filePath)
+                    ? 'public, max-age=31536000, immutable'
+                    : 'no-cache');
+            },
+        }));
+        // SPA fallback — serve index.html for non-API routes
+        app.use((req, res, next) => {
+            if (req.path.startsWith('/api/') || req.path.startsWith('/v1/') || req.path.startsWith('/v1beta/')) {
+                next();
+                return;
+            }
+            // Same no-cache policy as the statically-served index.html: SPA deep
+            // links must revalidate so a redeploy propagates new asset URLs.
+            //
+            // Send a path RELATIVE to `root` rather than an absolute one. `send`
+            // (behind res.sendFile) rejects any request path containing a dotted
+            // segment — including segments of an absolute path — so an install under
+            // e.g. `C:\Users\me\.srouter` would 404 every deep link while `/` and
+            // /assets/* kept working (express.static passes `root` internally). With
+            // `root` set, only the relative part is inspected, so a dotted install
+            // directory resolves normally.
+            res.sendFile('index.html', {
+                root: clientDist,
+                headers: { 'Cache-Control': 'no-cache' },
+            });
+        });
+    }
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,WAAW,MAAM,aAAa,CAAC;AACtC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAE3F,4EAA4E;AAC5E,4DAA4D;AAC5D,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,MAAM,yBAAyB,GAAG;IAChC,uBAAuB;IACvB,uBAAuB;IACvB,mBAAmB;CACpB,CAAC;AAEF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,uDAAuD,CAAC;AAE5F,mEAAmE;AACnE,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAC5D,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;QACjD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,6EAA6E,CAAC;AAEvG,yEAAyE;AACzE,+EAA+E;AAC/E,8BAA8B;AAC9B,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxD,8EAA8E;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/E,OAAO,KAAK,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,oBAAoB;AACpB,SAAS,mBAAmB,CAAC,GAAoB;IAC/C,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAe;IACvC,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,GAAG,yBAAyB;QAC5B,GAAG,GAAG,CAAC,gBAAgB;KACxB,CAAC,CAAC;IAEH,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,iEAAiE;IACjE,0EAA0E;IAC1E,4EAA4E;IAC5E,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;QACb,qBAAqB,EAAE;YACrB,UAAU,EAAE;gBACV,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,wEAAwE;gBACxE,qEAAqE;gBACrE,wEAAwE;gBACxE,0EAA0E;gBAC1E,2EAA2E;gBAC3E,0EAA0E;gBAC1E,SAAS,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC;gBAC3C,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACvC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAC3B,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,OAAO,EAAE,CAAC,QAAQ,CAAC;gBACnB,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,OAAO,EAAE,CAAC,QAAQ,CAAC;gBACnB,uBAAuB,EAAE,IAAI;aAC9B;SACF;QACD,IAAI,EAAE,KAAK;QACX,uBAAuB,EAAE,KAAK;QAC9B,kBAAkB,EAAE,KAAK;KAC1B,CAAC,CAAC,CAAC;IACJ,sEAAsE;IACtE,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,iEAAiE;IACjE,6EAA6E;IAC7E,0EAA0E;IAC1E,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,UAAU,GACd,GAAG,CAAC,0BAA0B,KAAK,IAAI;YACvC,CAAC,GAAG,CAAC,0BAA0B,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAExE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;YACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,GAAG,GAAG,6BAA6B,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;QACX,MAAM,CAAC,MAA0B,EAAE,QAAsD;YACvF,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC,CAAC,CAAC;IACJ,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,GAAG,CAAC,GAAG,CACL,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,CAAC,EACzF,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC,CACnD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,sEAAsE;IACtE,gEAAgE;IAChE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAEjC,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,0CAA0C;IAC1C,oEAAoE;IACpE,wEAAwE;IACxE,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CACL,CAAC,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,CAAC,EACzG,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC9C,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAEtB,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAElC,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAEjC,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,oCAAoC;IACpC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAE3E,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,uEAAuE;IACvE,oCAAoC;IACpC,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACnE,2EAA2E;IAC3E,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAChE,8EAA8E;IAC9E,2EAA2E;IAC3E,8BAA8B;IAC9B,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACtD,6EAA6E;IAC7E,4EAA4E;IAC5E,8BAA8B;IAC9B,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAC5D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAElD,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,+EAA+E;IAC/E,2BAA2B;IAC3B,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7D,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9C,8DAA8D;YAC9D,IAAI,CAAC;gBACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;gBACxE,MAAM,eAAe,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,+CAA+C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1G,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mCAAmC;IACnC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAE3B,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,kBAAkB;IAClB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAEhC,uEAAuE;IACvE,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAExC,4EAA4E;IAC5E,uEAAuE;IACvE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9D,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5B,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAEhC,uEAAuE;IACvE,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClE,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEjC,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE3B,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAEtB,iCAAiC;IACjC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAEtB,wEAAwE;IACxE,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC1B,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,+CAA+C;QAC/C,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU;YAC/B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAC9B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;iBACvF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;mBACtD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACvD,uEAAuE;QACvE,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,gCAAgC;QAChC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;YACjC,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,uEAAuE;YACvE,6CAA6C;YAC7C,UAAU,CAAC,GAAG,EAAE,QAAQ;gBACtB,GAAG,CAAC,SAAS,CACX,eAAe,EACf,gBAAgB,CAAC,QAAQ,CAAC;oBACxB,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,UAAU,CACf,CAAC;YACJ,CAAC;SACF,CAAC,CAAC,CAAC;QACJ,qDAAqD;QACrD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnG,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,iEAAiE;YACjE,EAAE;YACF,qEAAqE;YACrE,qEAAqE;YACrE,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,uEAAuE;YACvE,+BAA+B;YAC/B,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE;gBACzB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;aACzC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/db/index.d.ts

@@ -0,0 +1,49 @@
+import type { Db, DbFactory } from './types.js';
+export type { Db, DbFactory } from './types.js';
+export declare function getDb(): Db;
+export declare function getDefaultDbPath(): string;
+export declare function defaultDbFactory(platform?: NodeJS.Platform): DbFactory;
+export declare function connectDb(dbPath?: string, opts?: {
+    /** Create the parent directory if absent. Default: true. Set false in
+     *  environments that do not have a writable local filesystem. */
+    ensureDir?: boolean;
+    /** Factory that constructs the raw Db connection. Default: better-sqlite3. */
+    factory?: DbFactory;
+}): Db;
+/**
+ * Whether the directory holding the database may be restricted to this account.
+ *
+ * The sidecars can only be covered by the directory: SQLite creates `-wal` and
+ * `-shm` on the first write and deletes them on the last clean close, so at
+ * startup there is nothing there to chmod. But the directory is also shared
+ * state — SROUTER_DB_PATH may point anywhere — and locking down a directory
+ * that is not ours is a worse outage than the leak it prevents. Pointing the DB
+ * at `/tmp/srouter.db` must not chmod 0700 `/tmp`.
+ *
+ * So the rule is ownership by construction rather than a guess about what is
+ * safe. Two cases qualify, and nothing else does:
+ *
+ *   1. We just created the directory. Nothing else can be living in a directory
+ *      that did not exist a moment ago.
+ *   2. It is the built-in default data directory, which ships as ours.
+ *
+ * Case 2 is what covers the installed base: an existing deployment already has
+ * `server/data`, so case 1 alone would harden new installs and quietly leave
+ * every upgrade behind.
+ *
+ * An operator who points SROUTER_DB_PATH at a dedicated directory can opt in
+ * with SROUTER_DB_DIR_HARDENING=1, and one who dislikes the default can opt out
+ * with =0. It is a deliberate default-on-where-safe rather than a flag, because
+ * hardening that only runs when someone remembers to ask for it is the same
+ * class of failure as hardening nobody noticed had stopped running.
+ */
+export declare function shouldHardenDataDir(dataDir: string, created: boolean, platform?: NodeJS.Platform): boolean;
+export declare function initDb(dbPath?: string, opts?: {
+    ensureDir?: boolean;
+    factory?: DbFactory;
+}): Db;
+export declare function getUnifiedApiKey(): string;
+export declare function regenerateUnifiedKey(): string;
+export declare function getSetting(key: string): string | undefined;
+export declare function setSetting(key: string, value: string): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEhD,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQhD,wBAAgB,KAAK,IAAI,EAAE,CAK1B;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAgBD,wBAAgB,gBAAgB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,SAAS,CAExF;AAED,wBAAgB,SAAS,CACvB,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;IACL;qEACiE;IACjE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB,GACA,EAAE,CAmCJ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAUT;AA6DD,wBAAgB,MAAM,CACpB,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAClD,EAAE,CAuBJ;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAGD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI1D;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAM3D"}