@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/scripts/export-catalog.js

@@ -0,0 +1,114 @@
+/**
+ * export-catalog — build the signed catalog product from the live srouter DB.
+ *
+ * This is the single source of truth pipeline: every model and its resolved
+ * quirks come straight out of the same SQLite DB the router uses, so the
+ * published catalog can never drift from what the gateway actually serves.
+ * The output JSON is what the standalone catalog server (../../catalog) hands
+ * to clients — a monthly snapshot to all users.
+ *
+ * Usage:
+ *   tsx src/scripts/export-catalog.ts [--db <path>] [--out <path>]
+ *                                     [--version <YYYY.MM.DD>] [--tier live|monthly]
+ *                                     [--stdout]
+ *
+ * Defaults: reads the server's data/srouter.db, writes the suite's
+ * catalog/data/catalog.live.json. The catalog server signs it separately
+ * (catalog/src/scripts/sign-catalog.ts) so the signature covers the exact
+ * bytes served.
+ */
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { initDb, getDb } from '../db/index.js';
+import { getAllProviders } from '../providers/index.js';
+import { resolveQuirksByModel, quirkKey, listQuirkDefinitions } from '../services/quirks.js';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const SUITE_ROOT = path.resolve(__dirname, '../../../..'); // srouter/server/src/scripts -> suite root
+function arg(name) {
+    const i = process.argv.indexOf(`--${name}`);
+    return i !== -1 ? process.argv[i + 1] : undefined;
+}
+function flag(name) {
+    return process.argv.includes(`--${name}`);
+}
+function dateVersion(d = new Date()) {
+    const yyyy = d.getUTCFullYear();
+    const mm = String(d.getUTCMonth() + 1).padStart(2, '0');
+    const dd = String(d.getUTCDate()).padStart(2, '0');
+    return `${yyyy}.${mm}.${dd}`;
+}
+function main() {
+    const dbPath = arg('db');
+    const tier = arg('tier') ?? 'live';
+    const version = arg('version') ?? dateVersion();
+    // In --stdout mode stdout must carry ONLY the JSON document; incidental
+    // logs (e.g. initDb's "Database initialized at ...") go to stderr instead.
+    if (flag('stdout'))
+        console.log = console.error;
+    initDb(dbPath);
+    const db = getDb();
+    const models = db
+        .prepare(`SELECT platform, model_id, display_name, intelligence_rank, speed_rank, size_label,
+              rpm_limit, rpd_limit, tpm_limit, tpd_limit, monthly_token_budget, context_window,
+              enabled, supports_vision, supports_tools
+         FROM models
+        ORDER BY intelligence_rank ASC, platform ASC, model_id ASC`)
+        .all();
+    const quirksByModel = resolveQuirksByModel(db);
+    const quirkDefs = listQuirkDefinitions(db);
+    // Only platforms that actually have a registered provider AND a model in the
+    // catalog — skip 'custom' (user-supplied endpoint, nothing to publish).
+    const livePlatforms = new Set(models.map((m) => m.platform));
+    const platforms = getAllProviders()
+        .filter((p) => p.platform !== 'custom' && livePlatforms.has(p.platform))
+        .map((p) => ({ id: p.platform, name: p.name }))
+        .sort((a, b) => a.id.localeCompare(b.id));
+    const catalogModels = models.map((m) => ({
+        platform: m.platform,
+        modelId: m.model_id,
+        displayName: m.display_name,
+        intelligenceRank: m.intelligence_rank,
+        speedRank: m.speed_rank,
+        sizeLabel: m.size_label,
+        limits: {
+            rpm: m.rpm_limit,
+            rpd: m.rpd_limit,
+            tpm: m.tpm_limit,
+            tpd: m.tpd_limit,
+        },
+        monthlyTokenBudget: m.monthly_token_budget,
+        contextWindow: m.context_window,
+        enabled: m.enabled === 1,
+        supportsVision: m.supports_vision === 1,
+        supportsTools: m.supports_tools === 1,
+        quirks: quirksByModel.get(quirkKey(m.platform, m.model_id)) ?? [],
+    }));
+    const catalog = {
+        version,
+        generatedAt: new Date().toISOString(),
+        tier,
+        counts: {
+            platforms: platforms.length,
+            models: catalogModels.length,
+            enabledModels: catalogModels.filter((m) => m.enabled).length,
+            quirks: quirkDefs.length,
+        },
+        platforms,
+        models: catalogModels,
+        quirks: quirkDefs,
+    };
+    const json = JSON.stringify(catalog, null, 2) + '\n';
+    if (flag('stdout')) {
+        process.stdout.write(json);
+        return;
+    }
+    const outPath = arg('out') ?? path.join(SUITE_ROOT, 'catalog', 'data', `catalog.${tier}.json`);
+    fs.mkdirSync(path.dirname(outPath), { recursive: true });
+    fs.writeFileSync(outPath, json);
+    console.log(`Wrote ${tier} catalog ${version}: ${catalog.counts.models} models ` +
+        `(${catalog.counts.enabledModels} enabled), ${catalog.counts.platforms} platforms, ` +
+        `${catalog.counts.quirks} quirks -> ${outPath}`);
+}
+main();
+//# sourceMappingURL=export-catalog.js.map

package/dist/scripts/export-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-catalog.js","sourceRoot":"","sources":["../../src/scripts/export-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,2CAA2C;AAEtG,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AACD,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE;IACjC,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO,GAAG,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;AAC/B,CAAC;AAoBD,SAAS,IAAI;IACX,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAoC,IAAI,MAAM,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC;IAEhD,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;IAEhD,MAAM,CAAC,MAAM,CAAC,CAAC;IACf,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IAEnB,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CACN;;;;mEAI6D,CAC9D;SACA,GAAG,EAAgB,CAAC;IAEvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAE3C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,eAAe,EAAE;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,gBAAgB,EAAE,CAAC,CAAC,iBAAiB;QACrC,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,MAAM,EAAE;YACN,GAAG,EAAE,CAAC,CAAC,SAAS;YAChB,GAAG,EAAE,CAAC,CAAC,SAAS;YAChB,GAAG,EAAE,CAAC,CAAC,SAAS;YAChB,GAAG,EAAE,CAAC,CAAC,SAAS;SACjB;QACD,kBAAkB,EAAE,CAAC,CAAC,oBAAoB;QAC1C,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC;QACxB,cAAc,EAAE,CAAC,CAAC,eAAe,KAAK,CAAC;QACvC,aAAa,EAAE,CAAC,CAAC,cAAc,KAAK,CAAC;QACrC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;KAClE,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG;QACd,OAAO;QACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI;QACJ,MAAM,EAAE;YACN,SAAS,EAAE,SAAS,CAAC,MAAM;YAC3B,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM;YAC5D,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB;QACD,SAAS;QACT,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,SAAS;KAClB,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAErD,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,CAAC;IAC/F,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CACT,SAAS,IAAI,YAAY,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,UAAU;QAClE,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,cAAc,OAAO,CAAC,MAAM,CAAC,SAAS,cAAc;QACpF,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAClD,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/rotate-encryption-key.d.ts

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+export declare function encryptWith(key: Buffer, text: string): {
+    encrypted: string;
+    iv: string;
+    authTag: string;
+};
+export declare function decryptWith(key: Buffer, encrypted: string, iv: string, authTag: string): string;
+/**
+ * Ciphertext stored in dedicated columns: the IV and tag live next to their
+ * ciphertext in sibling columns, all TEXT.
+ */
+interface ColumnGroup {
+    kind: 'columns';
+    table: string;
+    idColumn: string;
+    encrypted: string;
+    iv: string;
+    authTag: string;
+    label: string;
+}
+/**
+ * Ciphertext stored as a JSON blob in a single `settings` value, in the shape
+ * `JSON.stringify(encrypt(plaintext))` — i.e. `{"encrypted","iv","authTag"}`.
+ * The Fetch Relay bearer token is written this way by
+ * `encodeFetchRelayToken()` (server/src/lib/proxy.ts) and read back by
+ * `decodeFetchRelayToken()`, which degrades to '' with a warning when the
+ * value will not decrypt. Miss it here and a rotate silently drops the relay
+ * credential on the next restart.
+ */
+interface SettingGroup {
+    kind: 'setting';
+    table: 'settings';
+    settingKey: string;
+    label: string;
+}
+type EncryptionGroup = ColumnGroup | SettingGroup;
+interface RowToRotate {
+    group: EncryptionGroup;
+    /** Row id for column groups, the settings key for settings blobs. */
+    id: number | string;
+    plaintext: string;
+    reEncrypted: {
+        encrypted: string;
+        iv: string;
+        authTag: string;
+    };
+}
+/** Result of a rotate attempt: rows re-encrypted, or an error that aborted it. */
+export interface RotateResult {
+    rows: RowToRotate[];
+    error?: string;
+}
+/** The read surface rotateSecrets needs — better-sqlite3 and the app's Db both satisfy it. */
+export interface RotateReadDb {
+    prepare(sql: string): {
+        all(...args: unknown[]): unknown[];
+        get(...args: unknown[]): unknown;
+    };
+}
+/** The write surface applyRotation needs, including better-sqlite3's transaction(). */
+export interface RotateWriteDb {
+    prepare(sql: string): {
+        run(...args: unknown[]): unknown;
+    };
+    transaction<A extends unknown[]>(fn: (...args: A) => void): (...args: A) => unknown;
+}
+/**
+ * Core rotate routine, exported so tests can drive it against an in-memory
+ * DB. Decrypts every stored secret with `oldKey` and re-encrypts with
+ * `newKey`. Returns `{ rows }` on success and `{ rows: [], error }` when ANY
+ * value fails to decrypt — the caller must treat the error case as "nothing
+ * written".
+ */
+export declare function rotateSecrets(db: RotateReadDb, oldKey: Buffer, newKey: Buffer): RotateResult;
+/**
+ * Apply a rotate result: write every re-encrypted value back to its row, in
+ * one transaction. Exported so main() and tests share the exact write path.
+ */
+export declare function applyRotation(db: RotateWriteDb, rows: RowToRotate[]): void;
+export {};
+//# sourceMappingURL=rotate-encryption-key.d.ts.map

package/dist/scripts/rotate-encryption-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-encryption-key.d.ts","sourceRoot":"","sources":["../../src/scripts/rotate-encryption-key.ts"],"names":[],"mappings":";AAmEA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMzG;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAM/F;AAED;;;GAGG;AACH,UAAU,WAAW;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,UAAU,YAAY;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,KAAK,eAAe,GAAG,WAAW,GAAG,YAAY,CAAC;AAclD,UAAU,WAAW;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,qEAAqE;IACrE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8FAA8F;AAC9F,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QAAC,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;KAAE,CAAC;CAChG;AAED,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;KAAE,CAAC;IAK3D,WAAW,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;CACrF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,YAAY,CAqEd;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,WAAW,EAAE,GAClB,IAAI,CAgBN"}

package/dist/scripts/rotate-encryption-key.js

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+/**
+ * rotate-encryption-key — re-encrypt every stored secret under a new
+ * ENCRYPTION_KEY without losing a single value.
+ *
+ * Why this exists: AES-256-GCM is authenticated, so a DB carried over to a
+ * different ENCRYPTION_KEY fails loudly on the first decrypt — every stored
+ * API key, proxy override, client-profile credential and the Fetch Relay
+ * token becomes unreadable at once, and there is no recovery path short of
+ * re-entering secrets by hand.
+ * Rotating keys (compromise, policy expiry, onboarding) therefore has to walk
+ * the ciphertext, decrypt each value with the OLD key and re-encrypt it with
+ * the NEW one, atomically, before the new key ever becomes active.
+ *
+ * The cipher parameters deliberately mirror server/src/lib/crypto.ts
+ * (aes-256-gcm, 32-byte key hex, 16-byte IV, 16-byte GCM tag) so a value
+ * written here decrypts under the running server exactly like one written by
+ * `encrypt()`. The script does NOT touch the module-level key cache — it
+ * performs every decrypt with `--old-key` and every encrypt with `--new-key`
+ * explicitly, so it is safe to run while the server is stopped (recommended)
+ * or even live (a writer that fires mid-run sees only already-migrated rows
+ * because both keys are valid until the process restarts with the new key).
+ *
+ * Usage:
+ *   tsx src/scripts/rotate-encryption-key.ts --old-key <64hex> --new-key <64hex> [--db <path>] [--dry-run]
+ *
+ *   --old-key  the current key (hex, 64 chars). Falls back to ENCRYPTION_KEY.
+ *   --new-key  the key to rotate to (hex, 64 chars). Required.
+ *   --db       SQLite path (default: the server's data/srouter.db).
+ *   --dry-run  decrypt + print every affected row WITHOUT writing anything.
+ *
+ * Exits 0 on success (or a clean dry run), 1 on any decrypt/validation error.
+ * Nothing is written unless EVERY row decrypts — a partial rotate would leave
+ * the DB in a mixed-key state that is exactly the failure this script exists
+ * to prevent.
+ */
+import Database from 'better-sqlite3';
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+const ALGORITHM = 'aes-256-gcm';
+const KEY_HEX_LEN = 64;
+const AUTH_TAG_BYTES = 16;
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const DEFAULT_DB = path.resolve(__dirname, '../../data/srouter.db');
+function arg(name) {
+    const i = process.argv.indexOf(`--${name}`);
+    return i !== -1 ? process.argv[i + 1] : undefined;
+}
+function flag(name) {
+    return process.argv.includes(`--${name}`);
+}
+function parseHexKey(value, source) {
+    if (value.length !== KEY_HEX_LEN || !/^[0-9a-fA-F]+$/.test(value)) {
+        throw new Error(`Invalid key (${source}): expected ${KEY_HEX_LEN} hex chars (32 bytes), got ${value.length} chars. ` +
+            `Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`);
+    }
+    return Buffer.from(value, 'hex');
+}
+export function encryptWith(key, text) {
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    return { encrypted, iv: iv.toString('hex'), authTag: cipher.getAuthTag().toString('hex') };
+}
+export function decryptWith(key, encrypted, iv, authTag) {
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, Buffer.from(iv, 'hex'), { authTagLength: AUTH_TAG_BYTES });
+    decipher.setAuthTag(Buffer.from(authTag, 'hex'));
+    let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+// Every place a secret is persisted. Keep this in step with the `encrypt()`
+// call sites in server/src/lib/crypto.ts consumers: api_keys (keys.ts,
+// custom-endpoint.ts, declarative-config.ts), api_keys proxy columns
+// (lib/key-proxy.ts), client_profiles (routes/client-profiles.ts) and the
+// settings blob (lib/proxy.ts).
+const ENCRYPTION_GROUPS = [
+    { kind: 'columns', table: 'api_keys', idColumn: 'id', encrypted: 'encrypted_key', iv: 'iv', authTag: 'auth_tag', label: 'api key' },
+    { kind: 'columns', table: 'api_keys', idColumn: 'id', encrypted: 'proxy_encrypted', iv: 'proxy_iv', authTag: 'proxy_auth_tag', label: 'per-key proxy override' },
+    { kind: 'columns', table: 'client_profiles', idColumn: 'id', encrypted: 'encrypted_key', iv: 'iv', authTag: 'auth_tag', label: 'client-profile credential' },
+    { kind: 'setting', table: 'settings', settingKey: 'fetch_relay_token', label: 'fetch relay token' },
+];
+/**
+ * Core rotate routine, exported so tests can drive it against an in-memory
+ * DB. Decrypts every stored secret with `oldKey` and re-encrypts with
+ * `newKey`. Returns `{ rows }` on success and `{ rows: [], error }` when ANY
+ * value fails to decrypt — the caller must treat the error case as "nothing
+ * written".
+ */
+export function rotateSecrets(db, oldKey, newKey) {
+    const rowsToRotate = [];
+    for (const group of ENCRYPTION_GROUPS) {
+        const cols = db.prepare(`PRAGMA table_info(${group.table})`).all();
+        const names = new Set(cols.map((c) => c.name));
+        // Ciphertext held as (encrypted, iv, auth_tag) columns.
+        if (group.kind === 'columns') {
+            if (!names.has(group.encrypted) || !names.has(group.iv) || !names.has(group.authTag)) {
+                continue;
+            }
+            const rows = db.prepare(`SELECT ${group.idColumn} AS id, ${group.encrypted} AS enc, ${group.iv} AS iv, ${group.authTag} AS tag ` +
+                `FROM ${group.table} WHERE ${group.encrypted} IS NOT NULL`).all();
+            for (const row of rows) {
+                let plaintext;
+                try {
+                    plaintext = decryptWith(oldKey, row.enc, row.iv, row.tag);
+                }
+                catch (err) {
+                    return {
+                        rows: [],
+                        error: `cannot decrypt ${group.label} #${row.id} with --old-key — wrong key or corrupted ciphertext (${err.message}). Aborting; nothing was written.`,
+                    };
+                }
+                rowsToRotate.push({ group, id: row.id, plaintext, reEncrypted: encryptWith(newKey, plaintext) });
+            }
+            continue;
+        }
+        // Ciphertext held as a JSON blob in settings.value.
+        if (!names.has('key') || !names.has('value'))
+            continue;
+        const row = db.prepare('SELECT value FROM settings WHERE key = ?').get(group.settingKey);
+        // An unset or cleared setting stores '' rather than a blob — nothing to do.
+        if (!row || !row.value)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(row.value);
+        }
+        catch {
+            return {
+                rows: [],
+                error: `${group.label} (settings.${group.settingKey}) is not valid JSON — refusing to guess. Aborting; nothing was written.`,
+            };
+        }
+        if (!parsed.encrypted || !parsed.iv || !parsed.authTag) {
+            return {
+                rows: [],
+                error: `${group.label} (settings.${group.settingKey}) is missing encrypted/iv/authTag. Aborting; nothing was written.`,
+            };
+        }
+        let plaintext;
+        try {
+            plaintext = decryptWith(oldKey, parsed.encrypted, parsed.iv, parsed.authTag);
+        }
+        catch (err) {
+            return {
+                rows: [],
+                error: `cannot decrypt ${group.label} (settings.${group.settingKey}) with --old-key — wrong key or corrupted ciphertext (${err.message}). Aborting; nothing was written.`,
+            };
+        }
+        rowsToRotate.push({ group, id: group.settingKey, plaintext, reEncrypted: encryptWith(newKey, plaintext) });
+    }
+    return { rows: rowsToRotate };
+}
+/**
+ * Apply a rotate result: write every re-encrypted value back to its row, in
+ * one transaction. Exported so main() and tests share the exact write path.
+ */
+export function applyRotation(db, rows) {
+    const write = db.transaction((items) => {
+        for (const r of items) {
+            if (r.group.kind === 'setting') {
+                // Same encoding encodeFetchRelayToken() writes, so the running server
+                // reads it back unchanged.
+                db.prepare('UPDATE settings SET value = ? WHERE key = ?')
+                    .run(JSON.stringify(r.reEncrypted), r.group.settingKey);
+                continue;
+            }
+            db.prepare(`UPDATE ${r.group.table} SET ${r.group.encrypted} = ?, ${r.group.iv} = ?, ${r.group.authTag} = ? WHERE ${r.group.idColumn} = ?`).run(r.reEncrypted.encrypted, r.reEncrypted.iv, r.reEncrypted.authTag, r.id);
+        }
+    });
+    write(rows);
+}
+function main() {
+    const oldKeyHex = arg('old-key') ?? process.env.ENCRYPTION_KEY;
+    const newKeyHex = arg('new-key');
+    const dbPath = arg('db') ?? DEFAULT_DB;
+    const dryRun = flag('dry-run');
+    if (!oldKeyHex) {
+        console.error('error: --old-key is required (or set ENCRYPTION_KEY)');
+        process.exit(1);
+    }
+    if (!newKeyHex) {
+        console.error('error: --new-key is required');
+        process.exit(1);
+    }
+    if (!fs.existsSync(dbPath)) {
+        console.error(`error: database not found at ${dbPath}`);
+        process.exit(1);
+    }
+    const oldKey = parseHexKey(oldKeyHex, 'old');
+    const newKey = parseHexKey(newKeyHex, 'new');
+    if (oldKey.equals(newKey)) {
+        console.error('error: --old-key and --new-key are identical — nothing to rotate');
+        process.exit(1);
+    }
+    const db = new Database(dbPath, { readonly: dryRun });
+    try {
+        const result = rotateSecrets(db, oldKey, newKey);
+        if (result.error) {
+            console.error(`error: ${result.error}`);
+            process.exit(1);
+        }
+        const rowsToRotate = result.rows;
+        if (rowsToRotate.length === 0) {
+            console.log('No encrypted values found — nothing to rotate.');
+            return;
+        }
+        if (dryRun) {
+            console.log(`[dry-run] would rotate ${rowsToRotate.length} value(s):`);
+            for (const r of rowsToRotate) {
+                const where = r.group.kind === 'setting' ? `settings.${r.group.settingKey}` : `#${r.id}`;
+                console.log(`  ${r.group.label} ${where} -> ${r.plaintext.slice(0, 3)}*** (${r.plaintext.length} chars)`);
+            }
+            return;
+        }
+        applyRotation(db, rowsToRotate);
+        console.log(`Rotated ${rowsToRotate.length} value(s) to the new key.`);
+        console.log('Next steps: set ENCRYPTION_KEY to the new key (or overwrite the .encryption-key file next to the DB) and restart the server.');
+    }
+    finally {
+        db.close();
+    }
+}
+// Only run when invoked directly (`tsx src/scripts/rotate-encryption-key.ts`),
+// not when the module is imported by tests for `rotateSecrets`/`encryptWith`.
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    main();
+}
+//# sourceMappingURL=rotate-encryption-key.js.map

package/dist/scripts/rotate-encryption-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-encryption-key.js","sourceRoot":"","sources":["../../src/scripts/rotate-encryption-key.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;AAEpE,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AACD,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,gBAAgB,MAAM,eAAe,WAAW,8BAA8B,KAAK,CAAC,MAAM,UAAU;YACpG,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,SAAiB,EAAE,EAAU,EAAE,OAAe;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IACpH,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAkCD,4EAA4E;AAC5E,uEAAuE;AACvE,qEAAqE;AACrE,0EAA0E;AAC1E,gCAAgC;AAChC,MAAM,iBAAiB,GAAsB;IAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;IACnI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAChK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC5J,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE;CACpG,CAAC;AA+BF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,EAAgB,EAChB,MAAc,EACd,MAAc;IAEd,MAAM,YAAY,GAAkB,EAAE,CAAC;IAEvC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,EAA6B,CAAC;QAC9F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/C,wDAAwD;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrF,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,UAAU,KAAK,CAAC,QAAQ,WAAW,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,EAAE,WAAW,KAAK,CAAC,OAAO,UAAU;gBACxG,QAAQ,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,SAAS,cAAc,CAC3D,CAAC,GAAG,EAAiE,CAAC;YAEvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,SAAiB,CAAC;gBACtB,IAAI,CAAC;oBACH,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,IAAI,EAAE,EAAE;wBACR,KAAK,EAAE,kBAAkB,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE,wDAAyD,GAAa,CAAC,OAAO,mCAAmC;qBACjK,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,SAAS;QACX,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAEvD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAkC,CAAC;QAC1H,4EAA4E;QAC5E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,SAAS;QAEjC,IAAI,MAA6D,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAA0D,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,UAAU,yEAAyE;aAC7H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACvD,OAAO;gBACL,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,UAAU,mEAAmE;aACvH,CAAC;QACJ,CAAC;QAED,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,kBAAkB,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,UAAU,yDAA0D,GAAa,CAAC,OAAO,mCAAmC;aACrL,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,EAAiB,EACjB,IAAmB;IAEnB,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,KAAoB,EAAE,EAAE;QACpD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,sEAAsE;gBACtE,2BAA2B;gBAC3B,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC;qBACtD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,EAAE,CAAC,OAAO,CACR,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC,KAAK,CAAC,QAAQ,MAAM,CAChI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,SAAS,IAAI;IACX,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAE/B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QACjC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,0BAA0B,YAAY,CAAC,MAAM,YAAY,CAAC,CAAC;YACvE,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACzF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO;QACT,CAAC;QAED,aAAa,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAEhC,OAAO,CAAC,GAAG,CAAC,WAAW,YAAY,CAAC,MAAM,2BAA2B,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,8HAA8H,CAAC,CAAC;IAC9I,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxF,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/scripts/routing-sim.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routing-sim.d.ts.map

package/dist/scripts/routing-sim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing-sim.d.ts","sourceRoot":"","sources":["../../src/scripts/routing-sim.ts"],"names":[],"mappings":""}

package/dist/scripts/routing-sim.js

@@ -0,0 +1,130 @@
+/**
+ * Routing simulation — exercises the real routeRequest() against an in-memory
+ * DB seeded with synthetic traffic, so you can SEE how each strategy distributes
+ * requests and how the bandit adapts when a model starts failing.
+ *
+ *   cd server && npm run build && node dist/scripts/routing-sim.js
+ */
+process.env.ENCRYPTION_KEY = '0'.repeat(64);
+process.env.DEV_MODE = 'true';
+import { initDb, getDb } from '../db/index.js';
+import { encrypt } from '../lib/crypto.js';
+import { routeRequest, refreshStatsCache, setRoutingStrategy, getRoutingScores, } from '../services/router.js';
+// Deliberately no model that wins on every axis — so each strategy's weight
+// vector picks a DIFFERENT winner (that's the whole point of the redesign).
+const PROFILES = [
+    // Frontier intelligence, good-not-great reliability, genuinely slow → wins SMARTEST.
+    { platform: 'google', modelId: 'gemini-x', name: 'Frontier-Smart', intelligenceRank: 1, sizeLabel: 'Frontier', budget: '~50M', successes: 22, failures: 4, outTokens: 200, latencyMs: 5000, ttfbMs: 2500 },
+    // Small/dumb but blazing fast and reliable → wins FASTEST.
+    { platform: 'groq', modelId: 'llama-fast', name: 'Speed-King', intelligenceRank: 9, sizeLabel: 'Small', budget: '~50M', successes: 27, failures: 3, outTokens: 1100, latencyMs: 700, ttfbMs: 110 },
+    // Middling intel/speed but rock-solid reliability → wins RELIABLE.
+    { platform: 'openrouter', modelId: 'rock', name: 'Rock-Solid', intelligenceRank: 5, sizeLabel: 'Medium', budget: '~50M', successes: 40, failures: 1, outTokens: 250, latencyMs: 2000, ttfbMs: 1500 },
+    // Large/smart but flaky — high intelligence dragged down by failures.
+    { platform: 'cerebras', modelId: 'smart-flaky', name: 'Smart-Flaky', intelligenceRank: 3, sizeLabel: 'Large', budget: '~50M', successes: 18, failures: 14, outTokens: 500, latencyMs: 1500, ttfbMs: 600 },
+];
+function seed() {
+    const db = getDb();
+    db.exec('DELETE FROM fallback_config; DELETE FROM api_keys; DELETE FROM models; DELETE FROM requests;');
+    const insModel = db.prepare(`
+    INSERT INTO models (platform, model_id, display_name, intelligence_rank, speed_rank, size_label, rpm_limit, rpd_limit, tpm_limit, tpd_limit, monthly_token_budget, enabled)
+    VALUES (?, ?, ?, ?, 1, ?, 100000, 1000000, 100000000, 1000000000, ?, 1)
+  `);
+    const insFb = db.prepare('INSERT INTO fallback_config (model_db_id, priority, enabled) VALUES (?, ?, 1)');
+    const insHist = db.prepare(`
+    INSERT INTO requests (platform, model_id, key_id, status, input_tokens, output_tokens, latency_ms, error, ttfb_ms)
+    VALUES (?, ?, 1, ?, 0, ?, ?, ?, ?)
+  `);
+    PROFILES.forEach((p, i) => {
+        insModel.run(p.platform, p.modelId, p.name, p.intelligenceRank, p.sizeLabel, p.budget);
+        const id = db.prepare('SELECT id FROM models WHERE platform=? AND model_id=?').get(p.platform, p.modelId).id;
+        insFb.run(id, i + 1);
+        const { encrypted, iv, authTag } = encrypt(`key-${p.platform}`);
+        db.prepare(`INSERT INTO api_keys (platform, label, encrypted_key, iv, auth_tag, status, enabled) VALUES (?, 'sim', ?, ?, ?, 'healthy', 1)`)
+            .run(p.platform, encrypted, iv, authTag);
+        for (let s = 0; s < p.successes; s++)
+            insHist.run(p.platform, p.modelId, 'success', p.outTokens, p.latencyMs, null, p.ttfbMs);
+        for (let f = 0; f < p.failures; f++)
+            insHist.run(p.platform, p.modelId, 'error', 0, p.latencyMs, 'sim-fail', p.ttfbMs);
+    });
+}
+function distribution(runs) {
+    const counts = new Map();
+    for (let i = 0; i < runs; i++) {
+        const r = routeRequest(100);
+        counts.set(r.displayName, (counts.get(r.displayName) ?? 0) + 1);
+    }
+    return counts;
+}
+function pct(n, total) {
+    return `${((n / total) * 100).toFixed(1)}%`.padStart(6);
+}
+function printDistribution(title, counts, runs) {
+    console.log(`\n  ${title}`);
+    const sorted = [...counts.entries()].sort((a, b) => b[1] - a[1]);
+    for (const [name, n] of sorted) {
+        const bar = '█'.repeat(Math.round((n / runs) * 30));
+        console.log(`    ${name.padEnd(22)} ${pct(n, runs)}  ${bar}`);
+    }
+}
+function printScores() {
+    const { scores } = getRoutingScores();
+    console.log('    model                  rel  spd  int  guard  score');
+    for (const s of scores) {
+        const guard = s.headroom * s.rateLimit;
+        console.log(`    ${s.displayName.padEnd(22)} ` +
+            `${Math.round(s.reliability * 100).toString().padStart(3)}  ` +
+            `${Math.round(s.speed * 100).toString().padStart(3)}  ` +
+            `${Math.round(s.intelligence * 100).toString().padStart(3)}  ` +
+            `${guard.toFixed(2).padStart(5)}  ` +
+            `${s.score.toFixed(3)}`);
+    }
+}
+function main() {
+    initDb(':memory:');
+    seed();
+    const RUNS = 2000;
+    console.log('\n══════════════════════════════════════════════════════════════');
+    console.log('  ROUTING SIMULATION  —  4 models, 2000 requests per strategy');
+    console.log('══════════════════════════════════════════════════════════════');
+    console.log('\n  Synthetic profiles:');
+    for (const p of PROFILES) {
+        const rate = (p.successes / (p.successes + p.failures) * 100).toFixed(0);
+        const tps = (p.outTokens * 1000 / p.latencyMs).toFixed(0);
+        console.log(`    ${p.name.padEnd(22)} ${p.sizeLabel.padEnd(9)} success ${rate}%  ${tps} tok/s  ${p.ttfbMs}ms ttfb`);
+    }
+    const strategies = ['priority', 'balanced', 'smartest', 'fastest', 'reliable'];
+    for (const strat of strategies) {
+        setRoutingStrategy(strat);
+        refreshStatsCache(getDb(), true);
+        if (strat === 'balanced') {
+            console.log('\n  ── balanced score breakdown ──');
+            printScores();
+        }
+        printDistribution(`Strategy: ${strat.toUpperCase()}`, distribution(RUNS), RUNS);
+    }
+    // ── Adaptation: the favored model under 'balanced' suddenly starts failing ──
+    console.log('\n══════════════════════════════════════════════════════════════');
+    console.log('  ADAPTATION  —  inject a failure burst into the top model');
+    console.log('══════════════════════════════════════════════════════════════');
+    setRoutingStrategy('balanced');
+    refreshStatsCache(getDb(), true);
+    const before = distribution(RUNS);
+    printDistribution('Before (balanced, steady state)', before, RUNS);
+    // Find the current favorite and slam it with fresh failures.
+    const fav = [...before.entries()].sort((a, b) => b[1] - a[1])[0][0];
+    const favProfile = PROFILES.find(p => p.name === fav);
+    const db = getDb();
+    const insHist = db.prepare(`
+    INSERT INTO requests (platform, model_id, key_id, status, input_tokens, output_tokens, latency_ms, error, ttfb_ms)
+    VALUES (?, ?, 1, 'error', 0, 0, 1000, 'outage', NULL)
+  `);
+    for (let i = 0; i < 300; i++)
+        insHist.run(favProfile.platform, favProfile.modelId);
+    console.log(`\n  → Injected 300 fresh failures into "${fav}" (simulated outage)…`);
+    refreshStatsCache(getDb(), true);
+    printScores();
+    printDistribution('After (balanced, post-outage)', distribution(RUNS), RUNS);
+    console.log('');
+}
+main();
+//# sourceMappingURL=routing-sim.js.map

package/dist/scripts/routing-sim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing-sim.js","sourceRoot":"","sources":["../../src/scripts/routing-sim.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC5C,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EACL,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,GACtE,MAAM,uBAAuB,CAAC;AAU/B,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,QAAQ,GAAc;IAC1B,qFAAqF;IACrF,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAC1M,2DAA2D;IAC3D,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE;IAClM,mEAAmE;IACnE,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IACpM,sEAAsE;IACtE,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;CAC1M,CAAC;AAEF,SAAS,IAAI;IACX,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,EAAE,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAG3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAG1B,CAAC,CAAC;IAEH,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,EAAE,GAAI,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAoB,CAAC,EAAE,CAAC;QACjI,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChE,EAAE,CAAC,OAAO,CAAC,+HAA+H,CAAC;aACxI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9H,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,GAAG,CAAC,CAAS,EAAE,KAAa;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,MAA2B,EAAE,IAAY;IACjF,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC;QACvC,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG;YAClC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC7D,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YACvD,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC9D,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YACnC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,MAAM,CAAC,UAAU,CAAC,CAAC;IACnB,IAAI,EAAE,CAAC;IACP,MAAM,IAAI,GAAG,IAAI,CAAC;IAElB,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,GAAG,WAAW,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,UAAU,GAAsB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAClG,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1B,iBAAiB,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAAC,WAAW,EAAE,CAAC;QAAC,CAAC;QAC/F,iBAAiB,CAAC,aAAa,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,+EAA+E;IAC/E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,iBAAiB,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,iBAAiB,CAAC,iCAAiC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAEnE,6DAA6D;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAE,CAAC;IACvD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAG1B,CAAC,CAAC;IACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,2CAA2C,GAAG,uBAAuB,CAAC,CAAC;IACnF,iBAAiB,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,WAAW,EAAE,CAAC;IACd,iBAAiB,CAAC,+BAA+B,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/test-all-models.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=test-all-models.d.ts.map

package/dist/scripts/test-all-models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-all-models.d.ts","sourceRoot":"","sources":["../../src/scripts/test-all-models.ts"],"names":[],"mappings":""}