@tapflowio/relay 0.27.0 → 0.28.0

package/dist/api/settings.js

@@ -1,18 +1,35 @@
 import fs from 'fs';
 import path from 'path';
 import busboy from 'busboy';
+import { randomUUID } from 'crypto';
 import { getDb } from '../db.js';
 import { requireRole, requireAuth } from '../middleware/auth.js';
 import { json } from '../router.js';
-export function handleGetSettings(req, res) {
+import { pipeUpload, unlinkSafe } from '../lib/uploads.js';
+import { diskRoomFor, videoSettings, videoUsageBytes } from './runVideos.js';
+/** Bounds for the video policy fields: 0 days keeps no passed video; the cap is at least 100 MB. */
+const MAX_RETENTION_DAYS = 365;
+const MIN_CAP_MB = 100;
+const MAX_CAP_MB = 10 * 1024 * 1024;
+export function handleGetSettings(req, res, videosDir) {
     const auth = requireAuth(req, res);
     if (!auth)
         return;
     const db = getDb();
     const settings = db.prepare('SELECT team_name, logo_path FROM team_settings WHERE id = 1').get();
+    // The video policy and what it is using. **The effective cap is the smaller of the setting and the disk's
+    // room**, because a cap larger than the volume is a promise the disk cannot keep — the floor the relay keeps for
+    // itself comes off first.
+    const video = videoSettings();
+    const usage = videoUsageBytes();
+    const room = videosDir ? diskRoomFor(videosDir) : { free: Number.MAX_SAFE_INTEGER, floor: 0 };
     json(res, 200, {
         team_name: settings?.team_name ?? 'tapflow',
         logo_url: settings?.logo_path ? `/uploads/team/${path.basename(settings.logo_path)}` : null,
+        video_pass_retention_days: video.passRetentionDays,
+        video_storage_cap_mb: Math.round(video.storageCapBytes / (1024 * 1024)),
+        video_usage_bytes: usage,
+        video_effective_cap_bytes: Math.min(video.storageCapBytes, usage + Math.max(0, room.free - room.floor)),
     });
 }
 export function handleUpdateSettings(req, res, uploadsDir) {
@@ -22,9 +39,14 @@ export function handleUpdateSettings(req, res, uploadsDir) {
     const bb = busboy({ headers: req.headers, limits: { fileSize: 2 * 1024 * 1024 } });
     const fields = {};
     let logoPath = '';
+    let stagedPath = '';
+    let written = null;
     let sizeError = false;
     bb.on('field', (name, val) => { fields[name] = val; });
     bb.on('file', (_field, stream, info) => {
+        // busboy destroys a file's stream with an error when the body ends inside it, and a stream with no
+        // `'error'` listener throws. The response is `bb`'s own `'error'` handler's job.
+        stream.on('error', () => { });
         const allowed = ['image/png', 'image/jpeg'];
         if (!allowed.includes(info.mimeType)) {
             stream.resume();
@@ -33,17 +55,48 @@ export function handleUpdateSettings(req, res, uploadsDir) {
         const ext = info.mimeType === 'image/png' ? '.png' : '.jpg';
         logoPath = path.join(uploadsDir, 'team', `logo${ext}`);
         fs.mkdirSync(path.dirname(logoPath), { recursive: true });
-        let size = 0;
-        stream.on('data', (chunk) => {
-            size += chunk.length;
-            if (size > 2 * 1024 * 1024)
-                sizeError = true;
-        });
-        stream.pipe(fs.createWriteStream(logoPath));
+        // **Staged, then renamed into place.** It used to be written straight over the live image, so an upload
+        // that failed partway left the current one empty or truncated. busboy also stops at the size limit
+        // rather than erroring, which `'limit'` reports.
+        stagedPath = `${logoPath}.${randomUUID()}.part`;
+        stream.on('limit', () => { sizeError = true; });
+        written = pipeUpload(stream, stagedPath, 'staged team logo');
     });
-    bb.on('finish', () => {
-        if (sizeError)
+    bb.on('finish', async () => {
+        // The policy fields are checked before the logo is put in place, so a refused update changes nothing.
+        const videoFields = [];
+        for (const [field, min, max] of [
+            ['video_pass_retention_days', 0, MAX_RETENTION_DAYS],
+            ['video_storage_cap_mb', MIN_CAP_MB, MAX_CAP_MB],
+        ]) {
+            const raw = fields[field];
+            if (raw === undefined)
+                continue;
+            const n = Number(raw);
+            if (!/^\d+$/.test(raw) || n < min || n > max) {
+                if (stagedPath) {
+                    await written?.catch(() => { });
+                    unlinkSafe(stagedPath, 'staged team logo');
+                }
+                return json(res, 400, { error: `${field} must be an integer from ${min} to ${max}` });
+            }
+            videoFields.push([field, n]);
+        }
+        if (sizeError) {
+            if (stagedPath)
+                unlinkSafe(stagedPath, 'oversized team logo');
             return json(res, 400, { error: 'Max 2MB for logo' });
+        }
+        if (written) {
+            try {
+                await written;
+                fs.renameSync(stagedPath, logoPath);
+            }
+            catch {
+                unlinkSafe(stagedPath, 'staged team logo');
+                return json(res, 500, { error: 'Update failed' });
+            }
+        }
         const db = getDb();
         const updates = ['updated_at = datetime(\'now\')'];
         const params = [];
@@ -51,6 +104,10 @@ export function handleUpdateSettings(req, res, uploadsDir) {
             updates.push('team_name = ?');
             params.push(fields.team_name);
         }
+        for (const [field, n] of videoFields) {
+            updates.push(`${field} = ?`);
+            params.push(n);
+        }
         if (logoPath) {
             updates.push('logo_path = ?');
             params.push(logoPath);

package/dist/api/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/api/settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAEnC,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,EACjC,CAAA;IAE7D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;QACb,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,SAAS;QAC3C,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC5F,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAyB,EACzB,GAAwB,EACxB,UAAkB;IAElB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA,CAAC,CAAC,CAAC,CAAA;IAErD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,OAAM;QAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAC3D,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,CAAC,CAAA;QACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;YACpB,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,SAAS,GAAG,IAAI,CAAA;QAC9C,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnB,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAEnE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,GAAa,CAAC,gCAAgC,CAAC,CAAA;QAC5D,MAAM,MAAM,GAAc,EAAE,CAAA;QAE5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;QACtF,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAAC,CAAC;QAEtE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACd,EAAE,CAAC,OAAO,CAAC,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QAExF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IAChE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACd,CAAC"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/api/settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE5E,oGAAoG;AACpG,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAC9B,MAAM,UAAU,GAAG,GAAG,CAAA;AACtB,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnC,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB,EAAE,SAAkB;IACvG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,EACjC,CAAA;IAE7D,0GAA0G;IAC1G,iHAAiH;IACjH,0BAA0B;IAC1B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC7F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;QACb,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,SAAS;QAC3C,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC3F,yBAAyB,EAAE,KAAK,CAAC,iBAAiB;QAClD,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACvE,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;KACxG,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAyB,EACzB,GAAwB,EACxB,UAAkB;IAElB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,OAAO,GAAyB,IAAI,CAAA;IACxC,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA,CAAC,CAAC,CAAC,CAAA;IAErD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACrC,mGAAmG;QACnG,iFAAiF;QACjF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5B,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,OAAM;QAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAC3D,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,CAAC,CAAA;QACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,wGAAwG;QACxG,mGAAmG;QACnG,iDAAiD;QACjD,UAAU,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,OAAO,CAAA;QAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;QAC9C,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACzB,sGAAsG;QACtG,MAAM,WAAW,GAAuB,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI;YAC9B,CAAC,2BAA2B,EAAE,CAAC,EAAE,kBAAkB,CAAC;YACpD,CAAC,sBAAsB,EAAE,UAAU,EAAE,UAAU,CAAC;SACxC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAQ;YAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;gBAC7C,IAAI,UAAU,EAAE,CAAC;oBAAC,MAAM,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAAC,UAAU,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;gBAAC,CAAC;gBAC9F,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,4BAA4B,GAAG,OAAO,GAAG,EAAE,EAAE,CAAC,CAAA;YACvF,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,UAAU;gBAAE,UAAU,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAA;YAC7D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,OAAO,CAAA;gBACb,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;gBAC1C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,GAAa,CAAC,gCAAgC,CAAC,CAAA;QAC5D,MAAM,MAAM,GAAc,EAAE,CAAA;QAE5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;QACtF,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;QACtF,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAAC,CAAC;QAEtE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACd,EAAE,CAAC,OAAO,CAAC,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QAExF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IAChE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACd,CAAC"}

package/dist/db.d.ts

@@ -1,5 +1,7 @@
 import Database from 'better-sqlite3';
 export declare function getDb(): Database.Database;
+/** Whether `initDb` has run — for a socket handler that touches the database when one is there. */
+export declare function isDbOpen(): boolean;
 export declare function closeDb(): void;
 export declare function initDb(dbPath: string): void;
 //# sourceMappingURL=db.d.ts.map

package/dist/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AAOrC,wBAAgB,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAGzC;AAED,wBAAgB,OAAO,IAAI,IAAI,CAG9B;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAM3C"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AAOrC,wBAAgB,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAGzC;AAED,mGAAmG;AACnG,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED,wBAAgB,OAAO,IAAI,IAAI,CAG9B;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAM3C"}

package/dist/db.js

@@ -8,6 +8,10 @@ export function getDb() {
         throw new PlatformError('DB not initialized — call initDb() first');
     return db;
 }
+/** Whether `initDb` has run — for a socket handler that touches the database when one is there. */
+export function isDbOpen() {
+    return db !== null;
+}
 export function closeDb() {
     db?.close();
     db = null;

package/dist/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AACrC,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,IAAI,EAAE,GAA6B,IAAI,CAAA;AAEvC,MAAM,UAAU,KAAK;IACnB,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IAC5E,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,EAAE,EAAE,KAAK,EAAE,CAAA;IACX,EAAE,GAAG,IAAI,CAAA;AACX,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAc;IACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzB,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC/B,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC9B,aAAa,EAAE,CAAA;AACjB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAA;IACjB,CAAC,CAAC,IAAI,CAAC;;;;;;GAMN,CAAC,CAAA;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAChB,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC3F,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC3B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;QACpE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;YACjB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACX,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAClE,CAAC,CAAC,EAAE,CAAA;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AACrC,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,IAAI,EAAE,GAA6B,IAAI,CAAA;AAEvC,MAAM,UAAU,KAAK;IACnB,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAA;IAC5E,OAAO,EAAE,CAAA;AACX,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,QAAQ;IACtB,OAAO,EAAE,KAAK,IAAI,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,EAAE,EAAE,KAAK,EAAE,CAAA;IACX,EAAE,GAAG,IAAI,CAAA;AACX,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAc;IACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzB,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC/B,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC9B,aAAa,EAAE,CAAA;AACjB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAA;IACjB,CAAC,CAAC,IAAI,CAAC;;;;;;GAMN,CAAC,CAAA;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAEpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAChB,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC3F,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC3B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;QACpE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;YACjB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACX,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAClE,CAAC,CAAC,EAAE,CAAA;IACN,CAAC;AACH,CAAC"}

package/dist/lib/buildDeletion.d.ts

@@ -0,0 +1,21 @@
+/** Where a build's dependents keep their files. All three are this install's, not the stored paths'. */
+export interface BuildFileDirs {
+    uploadsDir: string;
+    recordingsDir: string;
+    runScreenshotsDir: string;
+    runVideosDir: string;
+}
+/**
+ * Delete builds together with every row that points at them, then their files.
+ *
+ * **One path for both ways a build goes**, the daily purge and deleting its app. They had drifted: the purge
+ * removed recordings first, and app deletion removed nothing — so an app with a recorded build failed its
+ * delete on the recordings foreign key (`foreign_keys = ON`), and one without left every build file on disk.
+ * Run records are a third dependent, and adding them to one path only would have rebuilt the same drift.
+ *
+ * Rows go in one transaction and files after it commits: a failed transaction leaves rows pointing at files
+ * that still exist, where the opposite order could leave rows pointing at nothing. `alsoInTransaction` runs
+ * inside it, for a caller whose own delete (the app row) must land with the builds or not at all.
+ */
+export declare function deleteBuildsWithDependents(buildIds: number[], dirs: BuildFileDirs, alsoInTransaction?: () => void): void;
+//# sourceMappingURL=buildDeletion.d.ts.map

package/dist/lib/buildDeletion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildDeletion.d.ts","sourceRoot":"","sources":["../../src/lib/buildDeletion.ts"],"names":[],"mappings":"AAKA,wGAAwG;AACxG,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB,EAAE,MAAM,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;CACrB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAAE,EAClB,IAAI,EAAE,aAAa,EACnB,iBAAiB,GAAE,MAAM,IAAe,GACvC,IAAI,CAkCN"}

package/dist/lib/buildDeletion.js

@@ -0,0 +1,58 @@
+import path from 'path';
+import { getDb } from '../db.js';
+import { unlinkSafe } from './uploads.js';
+import { resolveBuildFile } from './buildFiles.js';
+const SQLITE_MAX_PARAMS = 999;
+function chunked(arr) {
+    const chunks = [];
+    for (let i = 0; i < arr.length; i += SQLITE_MAX_PARAMS)
+        chunks.push(arr.slice(i, i + SQLITE_MAX_PARAMS));
+    return chunks;
+}
+/**
+ * Delete builds together with every row that points at them, then their files.
+ *
+ * **One path for both ways a build goes**, the daily purge and deleting its app. They had drifted: the purge
+ * removed recordings first, and app deletion removed nothing — so an app with a recorded build failed its
+ * delete on the recordings foreign key (`foreign_keys = ON`), and one without left every build file on disk.
+ * Run records are a third dependent, and adding them to one path only would have rebuilt the same drift.
+ *
+ * Rows go in one transaction and files after it commits: a failed transaction leaves rows pointing at files
+ * that still exist, where the opposite order could leave rows pointing at nothing. `alsoInTransaction` runs
+ * inside it, for a caller whose own delete (the app row) must land with the builds or not at all.
+ */
+export function deleteBuildsWithDependents(buildIds, dirs, alsoInTransaction = () => { }) {
+    const db = getDb();
+    const chunks = chunked(buildIds);
+    const select = (sql) => chunks.flatMap((chunk) => db.prepare(sql(chunk.map(() => '?').join(','))).all(...chunk));
+    const builds = select((ph) => `SELECT file_path FROM builds WHERE id IN (${ph})`);
+    const recordings = select((ph) => `SELECT filename FROM recordings WHERE build_id IN (${ph})`);
+    const screenshots = select((ph) => `
+    SELECT f.screenshot_file FROM flow_run_flows f JOIN flow_runs r ON r.seq = f.run_seq
+    WHERE r.build_id IN (${ph}) AND f.screenshot_file IS NOT NULL`);
+    const videos = select((ph) => `
+    SELECT v.file FROM flow_run_videos v JOIN flow_runs r ON r.seq = v.run_seq
+    WHERE r.build_id IN (${ph}) AND v.evicted_at IS NULL`);
+    db.transaction(() => {
+        for (const chunk of chunks) {
+            const ph = chunk.map(() => '?').join(',');
+            db.prepare(`DELETE FROM recordings WHERE build_id IN (${ph})`).run(...chunk);
+            // `flow_run_flows` and the run's videos go with it (ON DELETE CASCADE).
+            db.prepare(`DELETE FROM flow_runs WHERE build_id IN (${ph})`).run(...chunk);
+            db.prepare(`DELETE FROM builds WHERE id IN (${ph})`).run(...chunk);
+        }
+        alsoInTransaction();
+    })();
+    for (const { filename } of recordings)
+        unlinkSafe(path.join(dirs.recordingsDir, filename), 'recording');
+    for (const { screenshot_file } of screenshots)
+        unlinkSafe(path.join(dirs.runScreenshotsDir, screenshot_file), 'run screenshot');
+    for (const { file } of videos)
+        unlinkSafe(path.join(dirs.runVideosDir, file), 'run video');
+    for (const { file_path } of builds) {
+        const found = resolveBuildFile(file_path, dirs.uploadsDir);
+        if (found !== null)
+            unlinkSafe(found, 'build');
+    }
+}
+//# sourceMappingURL=buildDeletion.js.map

package/dist/lib/buildDeletion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildDeletion.js","sourceRoot":"","sources":["../../src/lib/buildDeletion.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAUlD,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B,SAAS,OAAO,CAAI,GAAQ;IAC1B,MAAM,MAAM,GAAU,EAAE,CAAA;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,iBAAiB;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAA;IACxG,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAkB,EAClB,IAAmB,EACnB,oBAAgC,GAAG,EAAE,GAAE,CAAC;IAExC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,CAAI,GAA2B,EAAO,EAAE,CACrD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAQ,CAAC,CAAA;IAEjG,MAAM,MAAM,GAAG,MAAM,CAAwB,CAAC,EAAE,EAAE,EAAE,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAA;IACxG,MAAM,UAAU,GAAG,MAAM,CAAuB,CAAC,EAAE,EAAE,EAAE,CAAC,sDAAsD,EAAE,GAAG,CAAC,CAAA;IACpH,MAAM,WAAW,GAAG,MAAM,CAA8B,CAAC,EAAE,EAAE,EAAE,CAAC;;2BAEvC,EAAE,qCAAqC,CAAC,CAAA;IAEjE,MAAM,MAAM,GAAG,MAAM,CAAmB,CAAC,EAAE,EAAE,EAAE,CAAC;;2BAEvB,EAAE,4BAA4B,CAAC,CAAA;IAExD,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACzC,EAAE,CAAC,OAAO,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;YAC5E,wEAAwE;YACxE,EAAE,CAAC,OAAO,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;YAC3E,EAAE,CAAC,OAAO,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;QACpE,CAAC;QACD,iBAAiB,EAAE,CAAA;IACrB,CAAC,CAAC,EAAE,CAAA;IAEJ,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,UAAU;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAA;IACvG,KAAK,MAAM,EAAE,eAAe,EAAE,IAAI,WAAW;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,gBAAgB,CAAC,CAAA;IAC/H,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,CAAA;IAC1F,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1D,IAAI,KAAK,KAAK,IAAI;YAAE,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC;AACH,CAAC"}

package/dist/lib/clientAddress.d.ts

@@ -22,6 +22,18 @@ export interface ResolvedClientAddress {
  * resolved as usual: it keys the login rate limiter and appears in the logs.
  */
 export declare function resolveClientAddress(input: ResolveClientAddressInput): ResolvedClientAddress;
+/**
+ * A request from a listed proxy that carries no `X-Forwarded-For` is resolved by its socket — local, for a
+ * proxy on loopback. That is deliberate: this host's own agent, CLI and first-admin claim arrive exactly so,
+ * and by address they cannot be told from a proxied request (GHSA-pq37's finding 2). So it cannot be refused,
+ * only noticed. Returns the proxy header that gives such a request away, or `null`.
+ *
+ * Only on a header a proxy adds, because "from a listed proxy, no `X-Forwarded-For`" alone is every
+ * connection the host's agent makes — a warning on that would greet every correct deployment on every
+ * start. What this catches is the common slip: an nginx block that sets `X-Real-IP` or
+ * `X-Forwarded-Proto` and not `X-Forwarded-For`. A proxy that adds nothing at all cannot be seen.
+ */
+export declare function proxiedWithoutForwardedFor(socketAddr: string, headers: http.IncomingHttpHeaders, trustedProxies: string[]): string | null;
 export declare function markTunnelIngress(req: http.IncomingMessage): void;
 export declare function isTunnelIngress(req: http.IncomingMessage): boolean;
 /**

package/dist/lib/clientAddress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientAddress.d.ts","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAmB5B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAMrE;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,qBAAqB,CAG5F;AA6BD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,IAAI,CAEjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAQ/G"}
+{"version":3,"file":"clientAddress.d.ts","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAmB5B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAMrE;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,qBAAqB,CAG5F;AA4BD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,IAAI,CAAC,mBAAmB,EACjC,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CAKf;AAOD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,IAAI,CAEjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAQ/G"}

package/dist/lib/clientAddress.js

@@ -54,6 +54,28 @@ function resolveByAddress(input) {
     // 비신뢰 출발지가 보낸 XFF는 스푸핑 가능하므로 무시하고, 어느 경우든 소켓 IP로 판정한다.
     return { addr: socket, isLocal: isLoopback(socket) };
 }
+/** Headers a reverse proxy adds and nothing on the relay host sends: the agent, the CLI and a browser on
+ *  this Mac connect with none of them. */
+const PROXY_ONLY_HEADERS = ['forwarded', 'x-real-ip', 'x-forwarded-proto', 'x-forwarded-host', 'via'];
+/**
+ * A request from a listed proxy that carries no `X-Forwarded-For` is resolved by its socket — local, for a
+ * proxy on loopback. That is deliberate: this host's own agent, CLI and first-admin claim arrive exactly so,
+ * and by address they cannot be told from a proxied request (GHSA-pq37's finding 2). So it cannot be refused,
+ * only noticed. Returns the proxy header that gives such a request away, or `null`.
+ *
+ * Only on a header a proxy adds, because "from a listed proxy, no `X-Forwarded-For`" alone is every
+ * connection the host's agent makes — a warning on that would greet every correct deployment on every
+ * start. What this catches is the common slip: an nginx block that sets `X-Real-IP` or
+ * `X-Forwarded-Proto` and not `X-Forwarded-For`. A proxy that adds nothing at all cannot be seen.
+ */
+export function proxiedWithoutForwardedFor(socketAddr, headers, trustedProxies) {
+    if (!trustedProxies.includes(normalize(socketAddr)))
+        return null;
+    const xff = headers['x-forwarded-for'];
+    if ((Array.isArray(xff) ? xff.join('') : xff ?? '').trim().length > 0)
+        return null;
+    return PROXY_ONLY_HEADERS.find((h) => headers[h] !== undefined) ?? null;
+}
 // Keyed by the request object rather than the socket: an HTTPS server hands its `connection` listener the
 // raw TCP socket while `req.socket` is the TLS one, and the upgrade path passes this same object on to the
 // WebSocket `connection` handler.

package/dist/lib/clientAddress.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientAddress.js","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,sEAAsE;AAEtE,6EAA6E;AAC7E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7C,IAAI,gBAAgB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,kEAAkE;QAClE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAA;QAC7D,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,8DAA8D;IAC9D,uDAAuD;IACvD,uDAAuD;IACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,0GAA0G;AAC1G,2GAA2G;AAC3G,kCAAkC;AAClC,MAAM,cAAc,GAAG,IAAI,OAAO,EAAwB,CAAA;AAE1D,MAAM,UAAU,iBAAiB,CAAC,GAAyB;IACzD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB;IACvD,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAyB,EAAE,cAAwB;IACtF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1C,OAAO,oBAAoB,CAAC;QAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;QAC1C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC/C,cAAc;QACd,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC;KAChC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"clientAddress.js","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,sEAAsE;AAEtE,6EAA6E;AAC7E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7C,IAAI,gBAAgB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,kEAAkE;QAClE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAA;QAC7D,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,8DAA8D;IAC9D,uDAAuD;IACvD,uDAAuD;IACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAA;AACtD,CAAC;AAED;0CAC0C;AAC1C,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,KAAK,CAAU,CAAA;AAE9G;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,OAAiC,EACjC,cAAwB;IAExB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClF,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,IAAI,CAAA;AACzE,CAAC;AAED,0GAA0G;AAC1G,2GAA2G;AAC3G,kCAAkC;AAClC,MAAM,cAAc,GAAG,IAAI,OAAO,EAAwB,CAAA;AAE1D,MAAM,UAAU,iBAAiB,CAAC,GAAyB;IACzD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB;IACvD,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAyB,EAAE,cAAwB;IACtF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1C,OAAO,oBAAoB,CAAC;QAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;QAC1C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC/C,cAAc;QACd,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC;KAChC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/uploads.d.ts

@@ -1,2 +1,15 @@
 export declare function unlinkSafe(filePath: string, label: string): void;
+/**
+ * Writes an uploaded file to `dest`. Resolves once it is on disk; on a failed upload or write, closes the
+ * writer, removes what was written and rejects.
+ *
+ * `stream.pipe(writer)` does neither: when busboy destroys a file's stream — a body that ends inside the
+ * part — the writer stays open and the partial file stays on disk, once per failed upload.
+ *
+ * The rejection is marked handled here, for the case where nobody awaits it: a failed part also fails the
+ * parser, whose `'error'` handler answers the request, and the route's `'finish'` never runs. A failed
+ * *write* (a full disk) is different — the parser still finishes and the route awaits a rejection, so every
+ * caller catches it.
+ */
+export declare function pipeUpload(stream: NodeJS.ReadableStream, dest: string, label: string): Promise<void>;
 //# sourceMappingURL=uploads.d.ts.map

package/dist/lib/uploads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploads.d.ts","sourceRoot":"","sources":["../../src/lib/uploads.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQhE"}
+{"version":3,"file":"uploads.d.ts","sourceRoot":"","sources":["../../src/lib/uploads.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBpG"}

package/dist/lib/uploads.js

@@ -11,4 +11,45 @@ export function unlinkSafe(filePath, label) {
         }
     }
 }
+/**
+ * Writes an uploaded file to `dest`. Resolves once it is on disk; on a failed upload or write, closes the
+ * writer, removes what was written and rejects.
+ *
+ * `stream.pipe(writer)` does neither: when busboy destroys a file's stream — a body that ends inside the
+ * part — the writer stays open and the partial file stays on disk, once per failed upload.
+ *
+ * The rejection is marked handled here, for the case where nobody awaits it: a failed part also fails the
+ * parser, whose `'error'` handler answers the request, and the route's `'finish'` never runs. A failed
+ * *write* (a full disk) is different — the parser still finishes and the route awaits a rejection, so every
+ * caller catches it.
+ */
+export function pipeUpload(stream, dest, label) {
+    const writer = fs.createWriteStream(dest);
+    const written = new Promise((resolve, reject) => {
+        let failed = false;
+        const fail = (err) => {
+            if (failed)
+                return;
+            failed = true;
+            // Keep reading the upload: a writer error unpipes it, and a part nobody reads holds the parser short
+            // of `'finish'`, so the route would never answer.
+            stream.resume();
+            // Remove the file once the writer has closed it: Windows refuses to delete an open file, and an error
+            // before the open completes would otherwise delete nothing and leave the file it then creates.
+            const remove = () => { unlinkSafe(dest, label); reject(err); };
+            if (writer.closed)
+                remove();
+            else {
+                writer.once('close', remove);
+                writer.destroy();
+            }
+        };
+        writer.on('finish', resolve);
+        writer.on('error', fail);
+        stream.on('error', fail);
+    });
+    written.catch(() => { });
+    stream.pipe(writer);
+    return written;
+}
 //# sourceMappingURL=uploads.js.map

package/dist/lib/uploads.js.map

@@ -1 +1 @@
-{"version":3,"file":"uploads.js","sourceRoot":"","sources":["../../src/lib/uploads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AAEnB,yDAAyD;AACzD,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,KAAa;IACxD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,EAAE,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"uploads.js","sourceRoot":"","sources":["../../src/lib/uploads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AAEnB,yDAAyD;AACzD,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,KAAa;IACxD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,EAAE,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,MAA6B,EAAE,IAAY,EAAE,KAAa;IACnF,MAAM,MAAM,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,EAAE;YAC5B,IAAI,MAAM;gBAAE,OAAM;YAClB,MAAM,GAAG,IAAI,CAAA;YACb,qGAAqG;YACrG,kDAAkD;YAClD,MAAM,CAAC,MAAM,EAAE,CAAA;YACf,sGAAsG;YACtG,+FAA+F;YAC/F,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,CAAA;YAC7D,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,EAAE,CAAA;iBACtB,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAA;YAAC,CAAC;QACzD,CAAC,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/lib/watchActions.d.ts

@@ -0,0 +1,10 @@
+import type { Point, WatchActionKind } from '@tapflowio/protocol';
+/**
+ * A key as watchers see it. **A key that types a character is not named**: watchers are the whole team, and the
+ * keys pressed one by one are the text typed. Keep in step with flow-runner's `activityLabel` (`pressKey`), which
+ * applies the same rule to a flow step's name.
+ */
+export declare function keyForWatchers(code: string): string;
+/** The gesture a touch made, from where it began (if seen) to where it ended. Null when there is nothing to show. */
+export declare function gestureAction(start: Point | null, end: Point | null): WatchActionKind | null;
+//# sourceMappingURL=watchActions.d.ts.map

package/dist/lib/watchActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watchActions.d.ts","sourceRoot":"","sources":["../../src/lib/watchActions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAUjE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKnD;AAED,qHAAqH;AACrH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,eAAe,GAAG,IAAI,CAM5F"}

package/dist/lib/watchActions.js

@@ -0,0 +1,27 @@
+/**
+ * What a session's watchers are told the holder did (A2), derived from the input the relay passes on. Pure, so the
+ * rules are tested apart from the socket plumbing.
+ */
+/** A touch that ends within this distance of where it began is a tap; further is a swipe. Normalised 0–1. */
+const TAP_RADIUS = 0.02;
+/**
+ * A key as watchers see it. **A key that types a character is not named**: watchers are the whole team, and the
+ * keys pressed one by one are the text typed. Keep in step with flow-runner's `activityLabel` (`pressKey`), which
+ * applies the same rule to a flow step's name.
+ */
+export function keyForWatchers(code) {
+    return /^(Key[A-Z]|Digit\d|Numpad\d|Numpad(Add|Subtract|Multiply|Divide|Decimal|Comma|Equal|ParenLeft|ParenRight|Hash|Star)|Space|Minus|Equal|Bracket(Left|Right)|Backslash|Semicolon|Quote|Backquote|Comma|Period|Slash|IntlBackslash|IntlRo|IntlYen)$/.test(code)
+        || code.length === 1
+        ? 'character'
+        : code;
+}
+/** The gesture a touch made, from where it began (if seen) to where it ended. Null when there is nothing to show. */
+export function gestureAction(start, end) {
+    if (!start)
+        return end ? { kind: 'tap', x: end.x, y: end.y } : null;
+    const to = end ?? start;
+    return Math.hypot(to.x - start.x, to.y - start.y) <= TAP_RADIUS
+        ? { kind: 'tap', x: start.x, y: start.y }
+        : { kind: 'swipe', from: [start.x, start.y], to: [to.x, to.y] };
+}
+//# sourceMappingURL=watchActions.js.map

package/dist/lib/watchActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watchActions.js","sourceRoot":"","sources":["../../src/lib/watchActions.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,6GAA6G;AAC7G,MAAM,UAAU,GAAG,IAAI,CAAA;AAEvB;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,iPAAiP,CAAC,IAAI,CAAC,IAAI,CAAC;WAC9P,IAAI,CAAC,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,CAAA;AACV,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,GAAiB;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACnE,MAAM,EAAE,GAAG,GAAG,IAAI,KAAK,CAAA;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU;QAC7D,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE;QACzC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACnE,CAAC"}

package/dist/middleware/auth.d.ts

@@ -77,5 +77,6 @@ export declare function hashPat(token: string): string;
 export declare function requireViewAuth(req: http.IncomingMessage, res: http.ServerResponse): AuthContext | null;
 export declare function requireBuildAuth(req: http.IncomingMessage, res: http.ServerResponse): {
     userId: number;
+    patId?: number;
 } | null;
 //# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAOvB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEnE;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAWpD;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAE1D;AAOD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAM3D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAM3D;AAED,wFAAwF;AACxF,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,0GAA0G;IAC1G,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,WAAW,GAAG,IAAI,CASrE;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAK5F;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAQpB;AAKD,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUnF;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EAAE,GACd,WAAW,GAAG,IAAI,CAWpB;AAMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AAED,oEAAoE;AACpE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,GAAG,IAAI,CAMnE;AAED,uFAAuF;AACvF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAGrD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5C;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAgBpB;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAc3B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAOvB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEnE;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAWpD;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAE1D;AAOD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAM3D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAM3D;AAED,wFAAwF;AACxF,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,0GAA0G;IAC1G,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,WAAW,GAAG,IAAI,CASrE;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAK5F;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAQpB;AAKD,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUnF;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EAAE,GACd,WAAW,GAAG,IAAI,CAWpB;AAMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AAED,oEAAoE;AACpE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,GAAG,IAAI,CAMnE;AAED,uFAAuF;AACvF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAGrD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5C;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAgBpB;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAc3C"}

package/dist/middleware/auth.js

@@ -203,7 +203,7 @@ export function requireBuildAuth(req, res) {
             return null;
         }
         touchPat(pat.patId);
-        return { userId: pat.userId };
+        return { userId: pat.userId, patId: pat.patId };
     }
     const auth = requireAuth(req, res);
     if (!auth)

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAQ/C,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,YAA2B;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC1G,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAEjF,CAAA;IACb,iGAAiG;IACjG,kDAAkD;IAClD,MAAM,MAAM,GAAc;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;QAChE,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,aAAa,IAAI,IAAI,CAAC;KACjD,CAAA;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,iBAAiB,OAAO,CAAC,OAAO,CAAC,6CAA6C,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA;AACtG,CAAC;AAOD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAgB,CAAA;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,OAAO,CAAC,GAAyB;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACvC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAqB,CAAA;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACjD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;AACtG,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,MAAM,CAEtF,CAAA;IACb,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACnG,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAwB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,MAAM,CAEhE,CAAA;IACb,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB,EACxB,KAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,GAAwB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAaD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,UAAU,EAAE,GAAG,CAAC,KAAK;QACrB,SAAS,EAAE,GAAG,CAAC,IAAI;KACpB,CAAA;AACH,CAAC;AAED,uGAAuG;AACvG,6FAA6F;AAC7F,6GAA6G;AAC7G,yGAAyG;AACzG,kEAAkE;AAClE,MAAM,UAAU,GAAG;;;;+EAI4D,CAAA;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,GAAyB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAA;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,yBAAyB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAuB,CAAA;IACnG,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAuB,CAAA;IAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,KAAK,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC7G,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAyB,EACzB,GAAwB;IAExB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,GAAwB;IAExB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;YACxD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAChC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAQ/C,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,YAA2B;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC1G,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAEjF,CAAA;IACb,iGAAiG;IACjG,kDAAkD;IAClD,MAAM,MAAM,GAAc;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;QAChE,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,aAAa,IAAI,IAAI,CAAC;KACjD,CAAA;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,iBAAiB,OAAO,CAAC,OAAO,CAAC,6CAA6C,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA;AACtG,CAAC;AAOD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAgB,CAAA;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,OAAO,CAAC,GAAyB;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACvC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAqB,CAAA;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACjD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;AACtG,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,MAAM,CAEtF,CAAA;IACb,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACnG,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAwB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,MAAM,CAEhE,CAAA;IACb,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB,EACxB,KAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,GAAwB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAaD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,UAAU,EAAE,GAAG,CAAC,KAAK;QACrB,SAAS,EAAE,GAAG,CAAC,IAAI;KACpB,CAAA;AACH,CAAC;AAED,uGAAuG;AACvG,6FAA6F;AAC7F,6GAA6G;AAC7G,yGAAyG;AACzG,kEAAkE;AAClE,MAAM,UAAU,GAAG;;;;+EAI4D,CAAA;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,GAAyB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAA;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,yBAAyB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAuB,CAAA;IACnG,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAuB,CAAA;IAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,KAAK,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC7G,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAyB,EACzB,GAAwB;IAExB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,GAAwB;IAExB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;YACxD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAChC,CAAC"}

package/dist/migrations/015_flow_runs.sql

@@ -0,0 +1,59 @@
+-- 015_flow_runs.sql
+-- A record of each `tapflow flow run`: the runs page lists them (in progress and history), and a build's
+-- runs go when the build goes. Written by the CLI over REST with a `builds:write` token.
+
+CREATE TABLE IF NOT EXISTS flow_runs (
+  -- `seq` orders and pages the list; `id` is what clients see, so a run's address does not count runs.
+  seq              INTEGER PRIMARY KEY AUTOINCREMENT,
+  id               TEXT NOT NULL UNIQUE,
+  -- No ON DELETE: a build's runs are removed with it by `deleteBuildsWithDependents`, which also unlinks
+  -- their screenshot files. A cascade would drop the rows and leave the files.
+  build_id         INTEGER REFERENCES builds(id),
+  -- The runner's `?client=` id. The run is live while a socket with that id is open — see `holderKeys`.
+  holder_client    TEXT NOT NULL,
+  -- SET NULL: removing a member keeps the team's history. Their PATs are gone, so nobody can write to it.
+  created_by       INTEGER REFERENCES users(id) ON DELETE SET NULL,
+  -- Not a foreign key: revoking a token deletes its row, and the run must outlive that.
+  pat_id           INTEGER,
+  is_ci            INTEGER NOT NULL DEFAULT 0,
+  ci_provider      TEXT,
+  ci_branch        TEXT,
+  ci_commit        TEXT,
+  ci_job_url       TEXT,
+  status           TEXT NOT NULL DEFAULT 'running' CHECK (status IN ('running', 'passed', 'failed', 'aborted')),
+  -- 'client' when the CLI finished it, 'relay' when the relay closed it because the holder went away.
+  finished_by      TEXT CHECK (finished_by IN ('client', 'relay')),
+  failure_kind     TEXT,
+  error_message    TEXT,
+  exit_code        INTEGER,
+  flows_json       TEXT NOT NULL,
+  flows_total      INTEGER NOT NULL,
+  created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+  last_activity_at TEXT NOT NULL DEFAULT (datetime('now')),
+  finished_at      TEXT,
+  -- Only for a run with no build; a build's runs follow the build's own lifecycle.
+  delete_after     TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_flow_runs_build ON flow_runs(build_id);
+CREATE INDEX IF NOT EXISTS idx_flow_runs_ci ON flow_runs(is_ci, seq);
+CREATE INDEX IF NOT EXISTS idx_flow_runs_status ON flow_runs(status, last_activity_at);
+CREATE INDEX IF NOT EXISTS idx_flow_runs_delete_after ON flow_runs(delete_after);
+
+CREATE TABLE IF NOT EXISTS flow_run_flows (
+  run_seq          INTEGER NOT NULL REFERENCES flow_runs(seq) ON DELETE CASCADE,
+  idx              INTEGER NOT NULL,
+  name             TEXT NOT NULL,
+  file             TEXT,
+  device_id        TEXT,
+  device_name      TEXT,
+  platform         TEXT,
+  status           TEXT NOT NULL CHECK (status IN ('passed', 'failed')),
+  failure_kind     TEXT,
+  failure_message  TEXT,
+  duration_ms      INTEGER NOT NULL,
+  steps_json       TEXT NOT NULL,
+  screenshot_file  TEXT,
+  screenshot_mime  TEXT,
+  PRIMARY KEY (run_seq, idx)
+);