@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/routes/update.js

@@ -0,0 +1,536 @@
+import { execFile as nodeExecFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { Router } from 'express';
+import { getSetting } from '../db/index.js';
+import { getAppVersion } from '../lib/app-version.js';
+const execFileAsync = promisify(nodeExecFile);
+const CACHE_TTL_MS = 5 * 60 * 1000;
+/**
+ * The automatic release check is opt-in (see UPDATE_CHECK_SETTING), and even
+ * once enabled a dashboard reload must not become an outbound request. Six
+ * hours means at most four calls a day regardless of how often the operator
+ * reloads, or how many browsers point at the same install.
+ */
+const RELEASE_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
+const MAX_RELEASE_BODY_LENGTH = 20_000;
+const MAX_TAG_LENGTH = 64;
+// Failures are cached too, briefly. Without this a box that cannot reach GitHub
+// re-dials the API and then the Atom feed on every single click.
+const FAILURE_TTL_MS = 45 * 1000;
+const SHA_PATTERN = /^[0-9a-f]{40}$/i;
+const COMPARE_STATUSES = ['identical', 'ahead', 'behind', 'diverged'];
+const MAX_CHANGES = 8;
+const MAX_CHANGE_MESSAGE_LENGTH = 160;
+const MAX_ATOM_FEED_LENGTH = 1_000_000;
+/**
+ * Settings-table key for the dashboard's automatic release check (#782).
+ * Absent or anything other than '1' means off, so an install that has never
+ * been told otherwise never phones GitHub on its own. The manual checker above
+ * is a separate surface and stays available regardless.
+ */
+export const UPDATE_CHECK_SETTING = 'update_check_enabled';
+export function isAutoUpdateCheckEnabled() {
+    return getSetting(UPDATE_CHECK_SETTING) === '1';
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function validSha(value) {
+    return typeof value === 'string' && SHA_PATTERN.test(value.trim())
+        ? value.trim().toLowerCase()
+        : null;
+}
+function compareStatus(value) {
+    return typeof value === 'string' && COMPARE_STATUSES.includes(value)
+        ? value
+        : null;
+}
+function validDate(value) {
+    return typeof value === 'string' && value.length <= 64 && !Number.isNaN(Date.parse(value));
+}
+function mapCompareStatus(status) {
+    switch (status) {
+        case 'identical': return 'current';
+        case 'ahead': return 'available';
+        case 'behind': return 'ahead';
+        case 'diverged': return 'diverged';
+    }
+}
+function remoteCommit(body, status) {
+    if (!Array.isArray(body.commits)) {
+        throw new Error('GitHub compare response has no commits array');
+    }
+    const lastCommit = body.commits.at(-1);
+    const candidate = lastCommit
+        ?? (status === 'behind' ? body.merge_base_commit : body.base_commit);
+    if (candidate === undefined || candidate === null)
+        return null;
+    if (!isRecord(candidate))
+        throw new Error('GitHub compare response has an invalid commit');
+    return candidate;
+}
+function parseRemoteMetadata(body, status, localSha) {
+    const candidate = remoteCommit(body, status);
+    if (!candidate) {
+        return status === 'identical' ? { remoteSha: localSha.slice(0, 7) } : {};
+    }
+    const sha = validSha(candidate.sha);
+    if (!sha)
+        throw new Error('GitHub compare response has an invalid commit SHA');
+    const metadata = {
+        remoteSha: sha.slice(0, 7),
+    };
+    if (candidate.commit === undefined || candidate.commit === null)
+        return metadata;
+    if (!isRecord(candidate.commit))
+        throw new Error('GitHub compare response has invalid commit metadata');
+    if (candidate.commit.message !== undefined) {
+        if (typeof candidate.commit.message !== 'string') {
+            throw new Error('GitHub compare response has an invalid commit message');
+        }
+        metadata.remoteMessage = candidate.commit.message.slice(0, 200);
+    }
+    const committer = candidate.commit.committer;
+    if (committer !== undefined && committer !== null) {
+        if (!isRecord(committer))
+            throw new Error('GitHub compare response has an invalid committer');
+        if (committer.date !== undefined && committer.date !== null) {
+            if (!validDate(committer.date)) {
+                throw new Error('GitHub compare response has an invalid commit date');
+            }
+            metadata.remoteDate = committer.date;
+        }
+    }
+    return metadata;
+}
+function parseChanges(body, status) {
+    if (status !== 'ahead')
+        return undefined;
+    if (!Array.isArray(body.commits)) {
+        throw new Error('GitHub compare response has no commits array');
+    }
+    return body.commits.slice(-MAX_CHANGES).reverse().map((candidate) => {
+        if (!isRecord(candidate))
+            throw new Error('GitHub compare response has an invalid commit');
+        const sha = validSha(candidate.sha);
+        if (!sha)
+            throw new Error('GitHub compare response has an invalid commit SHA');
+        if (!isRecord(candidate.commit)) {
+            throw new Error('GitHub compare response has invalid commit metadata');
+        }
+        if (typeof candidate.commit.message !== 'string') {
+            throw new Error('GitHub compare response has an invalid commit message');
+        }
+        const change = {
+            sha: sha.slice(0, 7),
+            message: candidate.commit.message
+                .slice(0, MAX_CHANGE_MESSAGE_LENGTH)
+                .split(/[\r\n]/, 1)[0],
+        };
+        const committer = candidate.commit.committer;
+        if (committer !== undefined && committer !== null) {
+            if (!isRecord(committer))
+                throw new Error('GitHub compare response has an invalid committer');
+            if (committer.date !== undefined && committer.date !== null) {
+                if (!validDate(committer.date)) {
+                    throw new Error('GitHub compare response has an invalid commit date');
+                }
+                change.date = committer.date;
+            }
+        }
+        return change;
+    });
+}
+function decodeXmlText(value) {
+    const named = {
+        amp: '&',
+        apos: "'",
+        gt: '>',
+        lt: '<',
+        quot: '"',
+    };
+    return value.replace(/&(?:#(\d+)|#x([0-9a-f]+)|(amp|apos|gt|lt|quot));/gi, (entity, decimal, hex, name) => {
+        if (decimal)
+            return String.fromCodePoint(Number.parseInt(decimal, 10));
+        if (hex)
+            return String.fromCodePoint(Number.parseInt(hex, 16));
+        return named[String(name).toLowerCase()] ?? entity;
+    });
+}
+/**
+ * Read a response body with a hard byte ceiling, so an oversized feed is refused
+ * on the way in rather than after it is already resident. Checking `.length`
+ * after `await response.text()` — as this used to — is a cap that never bounds
+ * anything.
+ */
+async function readCapped(response, limit) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > limit) {
+        throw new Error('GitHub Atom feed is too large');
+    }
+    const body = response.body;
+    if (!body || typeof body.getReader !== 'function') {
+        // A fetch implementation without a readable body (or a stub); fall back to
+        // buffering, and still refuse anything over the ceiling.
+        const text = await response.text();
+        if (text.length > limit)
+            throw new Error('GitHub Atom feed is too large');
+        return text;
+    }
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let read = 0;
+    let text = '';
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            read += value.byteLength;
+            if (read > limit)
+                throw new Error('GitHub Atom feed is too large');
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    return text + decoder.decode();
+}
+function parseAtomFallback(xml, localSha, baseResult) {
+    const commits = [];
+    for (const match of xml.matchAll(/<entry>([\s\S]*?)<\/entry>/gi)) {
+        const entry = match[1];
+        const sha = entry.match(/<id>[^<]*Commit\/([0-9a-f]{40})<\/id>/i)?.[1]?.toLowerCase();
+        const title = entry.match(/<title>\s*([\s\S]*?)\s*<\/title>/i)?.[1];
+        const updated = entry.match(/<updated>\s*([^<]+)\s*<\/updated>/i)?.[1]?.trim();
+        if (!sha || title === undefined || (updated !== undefined && !validDate(updated))) {
+            throw new Error('GitHub Atom feed has an invalid commit');
+        }
+        commits.push({
+            fullSha: sha,
+            sha: sha.slice(0, 7),
+            message: decodeXmlText(title).replace(/\s+/g, ' ').trim().slice(0, MAX_CHANGE_MESSAGE_LENGTH),
+            ...(updated ? { date: updated } : {}),
+        });
+    }
+    if (commits.length === 0 || commits[0].message.length === 0) {
+        throw new Error('GitHub Atom feed has no commits');
+    }
+    const latest = commits[0];
+    const localIndex = commits.findIndex(commit => commit.fullSha === localSha);
+    const status = localIndex === 0
+        ? 'current'
+        : localIndex > 0
+            ? 'available'
+            : 'unknown';
+    return {
+        status,
+        ...baseResult,
+        remoteSha: latest.sha,
+        remoteMessage: latest.message,
+        ...(latest.date ? { remoteDate: latest.date } : {}),
+        ...(status === 'available'
+            ? { changes: commits.slice(0, localIndex).slice(0, MAX_CHANGES).map(({ fullSha: _fullSha, ...change }) => change) }
+            : {}),
+    };
+}
+export function createUpdateRouter(options = {}) {
+    const router = Router();
+    const env = options.env ?? process.env;
+    const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+    const execFile = options.execFile ?? ((file, args, execOptions) => (execFileAsync(file, args, execOptions)));
+    const now = options.now ?? Date.now;
+    const logger = options.logger ?? console;
+    const appVersion = options.version ?? getAppVersion;
+    const autoCheckEnabled = options.autoCheckEnabled ?? isAutoUpdateCheckEnabled;
+    const updateCheckDisabled = env.SROUTER_UPDATE_CHECK?.trim().toLowerCase() === 'off';
+    const githubToken = env.SROUTER_UPDATE_GITHUB_TOKEN?.trim();
+    /**
+     * The fork's own owner/repo, and the one valid comparison target. There is
+     * deliberately no upstream default: this fork replaced upstream, and
+     * checking upstream announced every upstream release (v0.13.4 > our 0.3.1)
+     * as an endless bogus "update available". Until SROUTER_UPDATE_REPO names a
+     * repository that actually carries releases for THIS install, every surface
+     * below reports disabled instead of phoning GitHub.
+     */
+    const repository = (env.SROUTER_UPDATE_REPO ?? '').trim();
+    const repositoryMissing = repository.length === 0;
+    const releasesUrl = `https://github.com/${repository}/releases`;
+    let identity;
+    let cache = null;
+    let failedAt = null;
+    let inFlight = null;
+    let releaseCache = null;
+    let releaseFailedAt = null;
+    let releaseInFlight = null;
+    function githubHeaders(accept) {
+        return {
+            Accept: accept,
+            'User-Agent': 'srouter-update-checker',
+            'X-GitHub-Api-Version': '2022-11-28',
+            ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
+        };
+    }
+    // Lazily resolved, and asynchronously: `git rev-parse` used to run through
+    // execFileSync inside the request handler, which blocked the event loop for
+    // every other in-flight request on the first open of Settings.
+    async function resolveIdentity() {
+        if (identity)
+            return identity;
+        const environmentSha = validSha(env.SROUTER_COMMIT_SHA);
+        const installMethod = env.SROUTER_INSTALL_METHOD;
+        if (installMethod === 'docker' || installMethod === 'desktop') {
+            // Deliberately before the SHA check: a self-built image without
+            // --build-arg has no embedded SHA, and it is still a container install.
+            identity = { sha: environmentSha, installation: installMethod };
+            return identity;
+        }
+        try {
+            const { stdout } = await execFile('git', ['rev-parse', 'HEAD'], {
+                cwd: options.cwd ?? process.cwd(),
+                encoding: 'utf8',
+                timeout: 5_000,
+            });
+            const gitSha = validSha(stdout.toString());
+            if (gitSha) {
+                identity = { sha: gitSha, installation: 'source' };
+                return identity;
+            }
+        }
+        catch {
+            // A packaged or custom build may not have Git metadata.
+        }
+        identity = { sha: null, installation: 'unknown' };
+        return identity;
+    }
+    async function performCheck(currentIdentity) {
+        const checkedAtMs = now();
+        const baseResult = {
+            installation: currentIdentity.installation,
+            localSha: currentIdentity.sha.slice(0, 7),
+            checkedAt: new Date(checkedAtMs).toISOString(),
+            version: appVersion(),
+        };
+        // A desktop build can only be replaced by installing a published release,
+        // so it must compare against the latest tag rather than `main` (#1270):
+        // untagged commits on main have no installer, and offering them produced
+        // an "Update available" that did nothing when clicked.
+        let compareTarget = 'main';
+        if (currentIdentity.installation === 'desktop') {
+            try {
+                compareTarget = (await latestRelease()).tagName;
+            }
+            catch {
+                return { status: 'unknown', ...baseResult };
+            }
+        }
+        const url = `https://api.github.com/repos/${repository}/compare/${currentIdentity.sha}...${compareTarget}`;
+        const response = await fetchImpl(url, {
+            headers: githubHeaders('application/vnd.github+json'),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (response.status === 404) {
+            return { status: 'unknown', ...baseResult };
+        }
+        if (response.status === 401 || response.status === 403 || response.status === 429) {
+            // The Atom feed tracks `main` only; for a desktop install it would
+            // reintroduce the bug this branch fixes, so let the rate limit surface.
+            if (currentIdentity.installation === 'desktop') {
+                throw new Error(`GitHub compare request returned HTTP ${response.status}`);
+            }
+            const atomResponse = await fetchImpl(`https://github.com/${repository}/commits/main.atom`, {
+                headers: {
+                    Accept: 'application/atom+xml',
+                    'User-Agent': 'srouter-update-checker',
+                },
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!atomResponse.ok) {
+                throw new Error(`GitHub Atom request returned HTTP ${atomResponse.status}`);
+            }
+            return parseAtomFallback(await readCapped(atomResponse, MAX_ATOM_FEED_LENGTH), currentIdentity.sha, baseResult);
+        }
+        if (!response.ok) {
+            throw new Error(`GitHub compare request returned HTTP ${response.status}`);
+        }
+        const body = await response.json();
+        if (!isRecord(body))
+            throw new Error('GitHub compare response is not an object');
+        const upstreamStatus = compareStatus(body.status);
+        if (!upstreamStatus)
+            throw new Error('GitHub compare response has an invalid status');
+        return {
+            status: mapCompareStatus(upstreamStatus),
+            ...baseResult,
+            ...parseRemoteMetadata(body, upstreamStatus, currentIdentity.sha),
+            ...(upstreamStatus === 'ahead' ? { changes: parseChanges(body, upstreamStatus) } : {}),
+        };
+    }
+    function check(currentIdentity) {
+        const currentTime = now();
+        if (cache && currentTime - cache.cachedAt < CACHE_TTL_MS) {
+            return Promise.resolve(cache.result);
+        }
+        if (failedAt !== null && currentTime - failedAt < FAILURE_TTL_MS) {
+            return Promise.reject(new Error('GitHub update check failed recently'));
+        }
+        if (inFlight)
+            return inFlight;
+        const request = performCheck(currentIdentity)
+            .then((result) => {
+            cache = { result, cachedAt: now() };
+            failedAt = null;
+            return result;
+        })
+            .catch((error) => {
+            failedAt = now();
+            logger.error('[update] GitHub compare check failed', error);
+            throw error;
+        })
+            .finally(() => {
+            if (inFlight === request)
+                inFlight = null;
+        });
+        inFlight = request;
+        return request;
+    }
+    async function performReleaseCheck() {
+        const response = await fetchImpl(`https://api.github.com/repos/${repository}/releases/latest`, {
+            headers: githubHeaders('application/vnd.github+json'),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok) {
+            throw new Error(`GitHub latest-release request returned HTTP ${response.status}`);
+        }
+        const body = await response.json();
+        if (!isRecord(body))
+            throw new Error('GitHub latest-release response is not an object');
+        if (typeof body.tag_name !== 'string' || body.tag_name.trim().length === 0) {
+            throw new Error('GitHub latest-release response has no tag');
+        }
+        // The release notes are rendered as Markdown in the dashboard, so the body
+        // is capped rather than trusted at whatever length GitHub returns, and the
+        // link is only honoured when it points back at this repository.
+        const htmlUrl = typeof body.html_url === 'string' && body.html_url.startsWith(`${releasesUrl}/`)
+            ? body.html_url
+            : releasesUrl;
+        return {
+            tagName: body.tag_name.trim().slice(0, MAX_TAG_LENGTH),
+            body: typeof body.body === 'string' ? body.body.slice(0, MAX_RELEASE_BODY_LENGTH) : null,
+            htmlUrl,
+            publishedAt: validDate(body.published_at) ? body.published_at : null,
+        };
+    }
+    function latestRelease() {
+        const currentTime = now();
+        if (releaseCache && currentTime - releaseCache.cachedAt < RELEASE_CACHE_TTL_MS) {
+            return Promise.resolve(releaseCache.result);
+        }
+        if (releaseFailedAt !== null && currentTime - releaseFailedAt < FAILURE_TTL_MS) {
+            return Promise.reject(new Error('GitHub release check failed recently'));
+        }
+        if (releaseInFlight)
+            return releaseInFlight;
+        const request = performReleaseCheck()
+            .then((result) => {
+            releaseCache = { result, cachedAt: now() };
+            releaseFailedAt = null;
+            return result;
+        })
+            .catch((error) => {
+            releaseFailedAt = now();
+            logger.error('[update] GitHub latest-release check failed', error);
+            throw error;
+        })
+            .finally(() => {
+            if (releaseInFlight === request)
+                releaseInFlight = null;
+        });
+        releaseInFlight = request;
+        return request;
+    }
+    /**
+     * The latest published release, for the dashboard's automatic reminder (#782).
+     *
+     * The browser cannot ask GitHub itself — the CSP this server sends is
+     * `connect-src 'self'`, so a direct fetch to api.github.com is blocked on
+     * every web install. Routing it through here also means the opt-in is
+     * enforced where it cannot be bypassed: when the check is off nothing leaves
+     * the box, not even a request that is thrown away afterwards.
+     */
+    router.get('/release', async (_req, res) => {
+        if (updateCheckDisabled || repositoryMissing || !autoCheckEnabled()) {
+            return res.json({ disabled: true });
+        }
+        try {
+            return res.json(await latestRelease());
+        }
+        catch {
+            return res.status(502).json({
+                error: {
+                    message: 'Unable to check for the latest release',
+                    type: 'upstream_error',
+                },
+            });
+        }
+    });
+    router.get('/check', async (_req, res) => {
+        if (updateCheckDisabled || repositoryMissing) {
+            return res.json({
+                status: 'disabled',
+                installation: 'unknown',
+                localSha: null,
+                checkedAt: new Date(now()).toISOString(),
+                version: null,
+            });
+        }
+        const currentIdentity = await resolveIdentity();
+        if (!currentIdentity.sha) {
+            return res.json({
+                status: 'unsupported',
+                installation: currentIdentity.installation,
+                localSha: null,
+                checkedAt: new Date(now()).toISOString(),
+                version: appVersion(),
+            });
+        }
+        try {
+            return res.json(await check(currentIdentity));
+        }
+        catch {
+            return res.status(502).json({
+                error: {
+                    message: 'Unable to check for updates',
+                    type: 'upstream_error',
+                },
+            });
+        }
+    });
+    router.get('/status', async (_req, res) => {
+        if (updateCheckDisabled || repositoryMissing) {
+            return res.json({
+                status: 'disabled',
+                installation: 'unknown',
+                localSha: null,
+                lastChecked: null,
+                version: null,
+                releasesUrl: null,
+            });
+        }
+        const currentIdentity = await resolveIdentity();
+        res.json({
+            status: currentIdentity.sha ? (cache?.result.status ?? 'idle') : 'unsupported',
+            installation: currentIdentity.installation,
+            localSha: currentIdentity.sha?.slice(0, 7) ?? null,
+            lastChecked: cache?.result.checkedAt ?? null,
+            version: appVersion(),
+            // Repo-aware releases page for the dashboard's fallback links; null while
+            // no repository is configured, so the client renders no link at all.
+            releasesUrl,
+        });
+    });
+    return router;
+}
+export const updateRouter = createUpdateRouter();
+//# sourceMappingURL=update.js.map

package/dist/routes/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/routes/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,MAAM,aAAa,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;AAE9C,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,gFAAgF;AAChF,iEAAiE;AACjE,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;AAC/E,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAuCvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,MAAM,UAAU,wBAAwB;IACtC,OAAO,UAAU,CAAC,oBAAoB,CAAC,KAAK,GAAG,CAAC;AAClD,CAAC;AAiCD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzF,CAAC,CAAC,KAAsB;QACxB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW,CAAC,CAAC,OAAO,SAAS,CAAC;QACnC,KAAK,OAAO,CAAC,CAAC,OAAO,WAAW,CAAC;QACjC,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;QAC9B,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAA6B,EAAE,MAAqB;IACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,UAAU;WACvB,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEvE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC3F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAA6B,EAC7B,MAAqB,EACrB,QAAgB;IAEhB,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAE/E,MAAM,QAAQ,GAAoE;QAChF,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;KAC3B,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACjF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAExG,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,QAAQ,CAAC,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC9F,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,QAAQ,CAAC,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,IAA6B,EAAE,MAAqB;IACxE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,SAAkB,EAAE,EAAE;QAC3E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAW;YACrB,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACpB,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO;iBAC9B,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC;iBACnC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACzB,CAAC;QACF,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAC9F,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC5D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAA2B;QACpC,GAAG,EAAE,GAAG;QACR,IAAI,EAAE,GAAG;QACT,EAAE,EAAE,GAAG;QACP,EAAE,EAAE,GAAG;QACP,IAAI,EAAE,GAAG;KACV,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,oDAAoD,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxG,IAAI,OAAO;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CAAC,QAAuB,EAAE,KAAa;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAClD,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnE,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAiD,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAW,EACX,QAAgB,EAChB,UAAoF;IAEpF,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACtF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/E,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACpB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC;YAC7F,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAgB,UAAU,KAAK,CAAC;QAC1C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,GAAG,CAAC;YACd,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM;QACN,GAAG,UAAU;QACb,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,aAAa,EAAE,MAAM,CAAC,OAAO;QAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,KAAK,WAAW;YACxB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE;YACnH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAa,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAC3E,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CACvC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IAC9E,MAAM,mBAAmB,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;IACrF,MAAM,WAAW,GAAG,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IAC5D;;;;;;;OAOG;IACH,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,sBAAsB,UAAU,WAAW,CAAC;IAEhE,IAAI,QAA8B,CAAC;IACnC,IAAI,KAAK,GAAwB,IAAI,CAAC;IACtC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,QAAQ,GAAgC,IAAI,CAAC;IACjD,IAAI,YAAY,GAAyB,IAAI,CAAC;IAC9C,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,eAAe,GAAkC,IAAI,CAAC;IAE1D,SAAS,aAAa,CAAC,MAAc;QACnC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,YAAY,EAAE,wBAAwB;YACtC,sBAAsB,EAAE,YAAY;YACpC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,+DAA+D;IAC/D,KAAK,UAAU,eAAe;QAC5B,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,GAAG,CAAC,sBAAsB,CAAC;QACjD,IAAI,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9D,gEAAgE;YAChE,wEAAwE;YACxE,QAAQ,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;YAChE,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;gBAC9D,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBACjC,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACX,QAAQ,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;gBACnD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QAED,QAAQ,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,eAAyB;QACnD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG;YACjB,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,QAAQ,EAAE,eAAe,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YAC9C,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,aAAa,GAAG,MAAM,CAAC;QAC3B,IAAI,eAAe,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,aAAa,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,gCAAgC,UAAU,YAAY,eAAe,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;QAC3G,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACpC,OAAO,EAAE,aAAa,CAAC,6BAA6B,CAAC;YACrD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClF,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,eAAe,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,sBAAsB,UAAU,oBAAoB,EAAE;gBACzF,OAAO,EAAE;oBACP,MAAM,EAAE,sBAAsB;oBAC9B,YAAY,EAAE,wBAAwB;iBACvC;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,iBAAiB,CACtB,MAAM,UAAU,CAAC,YAAY,EAAE,oBAAoB,CAAC,EACpD,eAAe,CAAC,GAAI,EACpB,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACjF,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAEtF,OAAO;YACL,MAAM,EAAE,gBAAgB,CAAC,cAAc,CAAC;YACxC,GAAG,UAAU;YACb,GAAG,mBAAmB,CAAC,IAAI,EAAE,cAAc,EAAE,eAAe,CAAC,GAAI,CAAC;YAClE,GAAG,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,CAAC;IACJ,CAAC;IAED,SAAS,KAAK,CAAC,eAAyB;QACtC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC;QAC1B,IAAI,KAAK,IAAI,WAAW,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,WAAW,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC;YACjE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,CAAC;aAC1C,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;YACpC,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,QAAQ,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,QAAQ,KAAK,OAAO;gBAAE,QAAQ,GAAG,IAAI,CAAC;QAC5C,CAAC,CAAC,CAAC;QACL,QAAQ,GAAG,OAAO,CAAC;QACnB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,mBAAmB;QAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gCAAgC,UAAU,kBAAkB,EAAE;YAC7F,OAAO,EAAE,aAAa,CAAC,6BAA6B,CAAC;YACrD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACxF,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC;YAC9F,CAAC,CAAC,IAAI,CAAC,QAAQ;YACf,CAAC,CAAC,WAAW,CAAC;QAEhB,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;YACtD,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI;YACxF,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;SACrE,CAAC;IACJ,CAAC;IAED,SAAS,aAAa;QACpB,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC;QAC1B,IAAI,YAAY,IAAI,WAAW,GAAG,YAAY,CAAC,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YAC/E,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,eAAe,KAAK,IAAI,IAAI,WAAW,GAAG,eAAe,GAAG,cAAc,EAAE,CAAC;YAC/E,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAE5C,MAAM,OAAO,GAAG,mBAAmB,EAAE;aAClC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;YAC3C,eAAe,GAAG,IAAI,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,eAAe,GAAG,GAAG,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACnE,MAAM,KAAK,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,eAAe,KAAK,OAAO;gBAAE,eAAe,GAAG,IAAI,CAAC;QAC1D,CAAC,CAAC,CAAC;QACL,eAAe,GAAG,OAAO,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5D,IAAI,mBAAmB,IAAI,iBAAiB,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACpE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE;oBACL,OAAO,EAAE,wCAAwC;oBACjD,IAAI,EAAE,gBAAgB;iBACvB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;QAC1D,IAAI,mBAAmB,IAAI,iBAAiB,EAAE,CAAC;YAC7C,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,UAAU;gBAClB,YAAY,EAAE,SAAS;gBACvB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE,IAAI;aACQ,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,EAAE,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,aAAa;gBACrB,YAAY,EAAE,eAAe,CAAC,YAAY;gBAC1C,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE,UAAU,EAAE;aACA,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE;oBACL,OAAO,EAAE,6BAA6B;oBACtC,IAAI,EAAE,gBAAgB;iBACvB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;QAC3D,IAAI,mBAAmB,IAAI,iBAAiB,EAAE,CAAC;YAC7C,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,UAAU;gBAClB,YAAY,EAAE,SAAS;gBACvB,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa;YAC9E,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;YAClD,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YAC5C,OAAO,EAAE,UAAU,EAAE;YACrB,0EAA0E;YAC1E,qEAAqE;YACrE,WAAW;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC"}

package/dist/routes/url-tokens.d.ts

@@ -0,0 +1,2 @@
+export declare const urlTokenRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=url-tokens.d.ts.map

package/dist/routes/url-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-tokens.d.ts","sourceRoot":"","sources":["../../src/routes/url-tokens.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,cAAc,4CAAgC,CAAC"}

package/dist/routes/url-tokens.js

@@ -0,0 +1,31 @@
+import { Router } from 'express';
+import { getUnifiedApiKey } from '../db/index.js';
+import { ollamaRouter } from './ollama.js';
+import { proxyRouter } from './proxy.js';
+import { responsesRouter } from './responses.js';
+import { validateUrlToken } from '../services/url-tokens.js';
+export const urlTokenRouter = Router({ mergeParams: true });
+urlTokenRouter.use((req, res, next) => {
+    const token = String(req.params.token ?? '');
+    if (!validateUrlToken(token)) {
+        res.status(401).json({
+            error: {
+                message: 'Invalid or revoked URL token',
+                type: 'authentication_error',
+            },
+        });
+        return;
+    }
+    // Downstream protocol routers retain their normal authentication checks.
+    // Supply the unified key internally only after the separately revocable URL
+    // token was verified; it never appears in the public URL.
+    req.headers.authorization = `Bearer ${getUnifiedApiKey()}`;
+    req.urlTokenAuthenticated = true;
+    next();
+});
+// OpenAI models/chat and Responses under /v1/t/{token}/...
+urlTokenRouter.use(proxyRouter);
+urlTokenRouter.use(responsesRouter);
+// Headerless clients may also use /v1/t/{token}/api/chat and /api/tags.
+urlTokenRouter.use(ollamaRouter);
+//# sourceMappingURL=url-tokens.js.map

package/dist/routes/url-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-tokens.js","sourceRoot":"","sources":["../../src/routes/url-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAE5D,cAAc,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE;gBACL,OAAO,EAAE,8BAA8B;gBACvC,IAAI,EAAE,sBAAsB;aAC7B;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,0DAA0D;IAC1D,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,UAAU,gBAAgB,EAAE,EAAE,CAAC;IAC1D,GAAqD,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACpF,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC;AAEH,2DAA2D;AAC3D,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAChC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAEpC,wEAAwE;AACxE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC"}

package/dist/scripts/export-catalog.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=export-catalog.d.ts.map

package/dist/scripts/export-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-catalog.d.ts","sourceRoot":"","sources":["../../src/scripts/export-catalog.ts"],"names":[],"mappings":""}