@teambit/api-server 1.0.997 → 1.0.999

package/dist/api-for-ide.d.ts

@@ -157,8 +157,8 @@ export declare class APIForIDE {
         [relativePath: string]: string;
     }>;
     catObject(hash: string): Promise<string>;
-    logFile(filePath: string): Promise<import("@teambit/component-log/dist/component-log.main.runtime").FileLog[]>;
-    blame(filePath: string): Promise<import("@teambit/component-log/dist/component-log.main.runtime").BlameLineInfo[]>;
+    logFile(filePath: string): Promise<import("@teambit/component-log/component-log.main.runtime").FileLog[]>;
+    blame(filePath: string): Promise<import("@teambit/component-log/component-log.main.runtime").BlameLineInfo[]>;
     changedFilesFromParent(id: string): Promise<FileHashDiffFromParent[]>;
     getConfigForDiff(id: string): Promise<{
         version?: string;

package/dist/api-server.main.runtime.d.ts

@@ -49,11 +49,27 @@ export declare class ApiServerMain {
      */
     private writeServerToken;
     private getServerTokenFilePath;
+    /**
+     * Host-header check: only accept requests targeting a loopback hostname.
+     * Defends against DNS-rebinding attacks where a malicious page on
+     * `evil.example` flips DNS to 127.0.0.1 — the browser sends `Host:
+     * evil.example`, which we reject with 403 here.
+     *
+     * The server already listens on 127.0.0.1 only, so any request reaching us
+     * arrived via loopback. The remaining concern is the *named* origin the
+     * browser thinks it's talking to.
+     */
+    private createHostCheckMiddleware;
     /**
      * Authentication middleware: requires `Authorization: Bearer <serverToken>`
      * on every request except OPTIONS preflight (handled by cors) and the
      * unauthenticated `/api/_health` liveness probe.
      *
+     * GET requests can also authenticate via a `?token=...` query parameter,
+     * since browser-native WebSocket and EventSource cannot set custom headers
+     * from JavaScript. The param is stripped from `req.url` before downstream
+     * handling so the proxy and logs never see it.
+     *
      * Runs before bodyParser so unauthenticated requests can't trigger
      * large-body parsing.
      */

package/dist/api-server.main.runtime.js

@@ -352,7 +352,10 @@ class ApiServerMain {
     // trigger large-body parsing. CORS is registered before auth so 401
     // responses still carry CORS headers; otherwise browser-based clients
     // (bit-vscode) see a misleading CORS failure instead of the JSON 401.
+    // The host-check middleware runs first to reject DNS-rebinding attacks
+    // (where a malicious page resolves attacker.example to 127.0.0.1).
     const app = (0, _express().default)();
+    app.use(this.createHostCheckMiddleware());
     app.use((0, _cors().default)({
       origin(origin, callback) {
         callback(null, true);
@@ -420,11 +423,12 @@ class ApiServerMain {
       pathFilter: '/',
       target: symphonyUrl,
       ws: true,
-      secure: false,
-      // Disable SSL verification for proxy to remote server
       changeOrigin: true
     }));
-    const server = await app.listen(port);
+
+    // Bind to loopback only — never accept connections from the LAN. Clients
+    // are expected to use 127.0.0.1 (or localhost, which resolves to it).
+    const server = await app.listen(port, '127.0.0.1');
     return new Promise((resolve, reject) => {
       server.on('error', err => {
         reject(err);
@@ -440,7 +444,13 @@ class ApiServerMain {
   }
   writeUsedPort(port) {
     const filePath = this.getServerPortFilePath();
-    _fsExtra().default.writeFileSync(filePath, port.toString());
+    _fsExtra().default.writeFileSync(filePath, port.toString(), {
+      mode: 0o600
+    });
+    // Node's `mode` write option is only honored when the file is created.
+    // chmod explicitly so a pre-existing file with broader permissions gets
+    // tightened to 0600.
+    _fsExtra().default.chmodSync(filePath, 0o600);
   }
 
   /**
@@ -471,11 +481,44 @@ class ApiServerMain {
     return (0, _path().join)(this.workspace.scope.path, 'server-token.txt');
   }
 
+  /**
+   * Host-header check: only accept requests targeting a loopback hostname.
+   * Defends against DNS-rebinding attacks where a malicious page on
+   * `evil.example` flips DNS to 127.0.0.1 — the browser sends `Host:
+   * evil.example`, which we reject with 403 here.
+   *
+   * The server already listens on 127.0.0.1 only, so any request reaching us
+   * arrived via loopback. The remaining concern is the *named* origin the
+   * browser thinks it's talking to.
+   */
+  createHostCheckMiddleware() {
+    const allowed = new Set(['localhost', '127.0.0.1', '::1']);
+    return (req, res, next) => {
+      const hostHeader = req.headers.host || '';
+      // Parse hostname from "host:port". IPv6 may be bracketed: "[::1]:1234"
+      // → "::1"; IPv4 / hostname is plain: "127.0.0.1:1234" → "127.0.0.1".
+      // HTTP hostnames are case-insensitive, so normalize before checking.
+      const match = hostHeader.match(/^\[([^\]]+)\]|^([^:]+)/);
+      const host = match ? (match[1] || match[2]).toLowerCase() : '';
+      if (!allowed.has(host)) {
+        this.logger.debug(`api-server: rejected non-loopback Host header: ${hostHeader}`);
+        res.status(403).end();
+        return;
+      }
+      return next();
+    };
+  }
+
   /**
    * Authentication middleware: requires `Authorization: Bearer <serverToken>`
    * on every request except OPTIONS preflight (handled by cors) and the
    * unauthenticated `/api/_health` liveness probe.
    *
+   * GET requests can also authenticate via a `?token=...` query parameter,
+   * since browser-native WebSocket and EventSource cannot set custom headers
+   * from JavaScript. The param is stripped from `req.url` before downstream
+   * handling so the proxy and logs never see it.
+   *
    * Runs before bodyParser so unauthenticated requests can't trigger
    * large-body parsing.
    */
@@ -486,7 +529,20 @@ class ApiServerMain {
       // health-check exemption — e.g. /api/_health?cache-buster=1.
       if (req.path === '/api/_health') return next();
       const provided = parseBearerToken(req.headers.authorization);
-      if (!this.serverToken || provided !== this.serverToken) {
+      let authorized = !!this.serverToken && provided === this.serverToken;
+      if (!authorized && this.serverToken && req.method === 'GET') {
+        const queryIdx = req.url.indexOf('?');
+        if (queryIdx >= 0) {
+          const params = new URLSearchParams(req.url.slice(queryIdx + 1));
+          if (params.get('token') === this.serverToken) {
+            authorized = true;
+            params.delete('token');
+            const remaining = params.toString();
+            req.url = req.url.slice(0, queryIdx) + (remaining ? `?${remaining}` : '');
+          }
+        }
+      }
+      if (!authorized) {
         this.logger.debug(`api-server: rejected unauthenticated request to ${req.path}`);
         res.status(401).jsonp({
           error: 'unauthorized',
@@ -562,8 +618,7 @@ class ApiServerMain {
   }
   async getRandomPort() {
     const startingPort = 4000; // we prefer to have the ports between 4000 and 4999.
-    // get random number in the range of [startingPort, 4999].
-    const randomNumber = Math.floor(Math.random() * (4999 - startingPort + 1) + startingPort);
+    const randomNumber = _crypto().default.randomInt(startingPort, 5000);
     const port = await _toolboxNetwork().Port.getPort(randomNumber, 65500);
     return port;
   }

package/dist/api-server.main.runtime.js.map

@@ -1 +1 @@
-{"version":3,"names":["_cli","data","require","_toolboxNetwork","_fsExtra","_interopRequireDefault","_crypto","_express","_express2","_logger","_lanes","_remove","_snapping","_generator","_componentCompare","_componentLog","_watcher","_config","_export","_checkout","_install","_importer","_component","_workspace","_harmonyModules","_cors","_httpProxyMiddleware","_apiServer","_cli2","_server","_ide","_apiForIde","_sseEvents","_path","_child_process","_cliRaw","_application","_deprecation","_envs","_scope","_legacy","_graph","_scope2","_schema","e","__esModule","default","_defineProperty","r","t","_toPropertyKey","Object","defineProperty","value","enumerable","configurable","writable","i","_toPrimitive","Symbol","toPrimitive","call","TypeError","String","Number","ApiServerMain","constructor","workspace","logger","express","watcher","installer","importer","runApiServer","options","Error","process","cwd","registerOnComponentChange","component","files","removedFiles","sendEventsToClients","id","toStringWithoutVersion","registerOnBitmapChange","lastModifiedTimestamp","bitMap","getLastModifiedBitmapThroughBit","secondsPassedSinceLastModified","Date","now","debug","importCurrentObjects","registerOnWorkspaceConfigChange","scope","registerOnPostExport","registerPostInstall","watch","preCompile","compile","port","getRandomPort","writeServerToken","app","expressFactory","use","cors","origin","callback","credentials","createAuthMiddleware","createApp","proxyHeaders","Authorization","DEFAULT_AUTH_TYPE","Http","getToken","symphonyUrl","getSymphonyUrl","createProxyMiddleware","target","changeOrigin","headers","on","error","err","req","res","writeHead","end","proxyReq","fixRequestBody","proxyRes","proxyReqWs","entries","forEach","key","setHeader","pathFilter","ws","secure","server","listen","Promise","resolve","reject","consoleSuccess","writeUsedPort","startParentProcessMonitor","filePath","getServerPortFilePath","fs","writeFileSync","toString","token","crypto","randomBytes","getServerTokenFilePath","mode","chmodSync","serverToken","join","path","next","method","provided","parseBearerToken","authorization","status","jsonp","message","originalPpid","ppid","parentInfo","getProcessInfo","pid","platform","checkInterval","intervalId","setInterval","currentPpid","clearInterval","exit","unref","psCommand","output","execSync","encoding","timeout","trim","startingPort","randomNumber","Math","floor","random","Port","getPort","getExistingUsedPort","fileContent","readFile","parseInt","code","undefined","provider","cli","loggerMain","snapping","lanes","exporter","checkout","componentLog","componentCompare","generator","remove","config","application","deprecation","envs","graph","schema","createLogger","ApiServerAspect","apiServer","register","ServerCmd","apiForIDE","APIForIDE","cliRoute","CLIRoute","cliRawRoute","CLIRawRoute","ideRoute","IDERoute","sseEventsRoute","SSEEventsRoute","exports","CLIAspect","WorkspaceAspect","LoggerAspect","ExpressAspect","WatcherAspect","SnappingAspect","LanesAspect","InstallAspect","ExportAspect","CheckoutAspect","ComponentLogAspect","ImporterAspect","ComponentCompareAspect","GeneratorAspect","RemoveAspect","ConfigAspect","ApplicationAspect","DeprecationAspect","EnvsAspect","GraphAspect","ScopeAspect","ComponentAspect","SchemaAspect","MainRuntime","addRuntime","header","match","_default"],"sources":["api-server.main.runtime.ts"],"sourcesContent":["import type { CLIMain } from '@teambit/cli';\nimport { CLIAspect, MainRuntime } from '@teambit/cli';\nimport { Port } from '@teambit/toolbox.network.get-port';\nimport fs from 'fs-extra';\nimport crypto from 'crypto';\nimport expressFactory from 'express';\nimport type { ExpressMain, Middleware, Request, Response, NextFunction } from '@teambit/express';\nimport { ExpressAspect } from '@teambit/express';\nimport type { Logger, LoggerMain } from '@teambit/logger';\nimport { LoggerAspect } from '@teambit/logger';\nimport type { LanesMain } from '@teambit/lanes';\nimport { LanesAspect } from '@teambit/lanes';\nimport type { RemoveMain } from '@teambit/remove';\nimport { RemoveAspect } from '@teambit/remove';\nimport type { SnappingMain } from '@teambit/snapping';\nimport { SnappingAspect } from '@teambit/snapping';\nimport type { GeneratorMain } from '@teambit/generator';\nimport { GeneratorAspect } from '@teambit/generator';\nimport type { ComponentCompareMain } from '@teambit/component-compare';\nimport { ComponentCompareAspect } from '@teambit/component-compare';\nimport type { ComponentLogMain } from '@teambit/component-log';\nimport { ComponentLogAspect } from '@teambit/component-log';\nimport type { WatcherMain } from '@teambit/watcher';\nimport { WatcherAspect } from '@teambit/watcher';\nimport type { ConfigMain } from '@teambit/config';\nimport { ConfigAspect } from '@teambit/config';\nimport type { ExportMain } from '@teambit/export';\nimport { ExportAspect } from '@teambit/export';\nimport type { CheckoutMain } from '@teambit/checkout';\nimport { CheckoutAspect } from '@teambit/checkout';\nimport type { InstallMain } from '@teambit/install';\nimport { InstallAspect } from '@teambit/install';\nimport type { ImporterMain } from '@teambit/importer';\nimport { ImporterAspect } from '@teambit/importer';\nimport type { Component, ComponentMain } from '@teambit/component';\nimport { ComponentAspect } from '@teambit/component';\nimport type { Workspace } from '@teambit/workspace';\nimport { WorkspaceAspect } from '@teambit/workspace';\nimport { sendEventsToClients } from '@teambit/harmony.modules.send-server-sent-events';\nimport cors from 'cors';\nimport { createProxyMiddleware, fixRequestBody } from 'http-proxy-middleware';\nimport { ApiServerAspect } from './api-server.aspect';\nimport { CLIRoute } from './cli.route';\nimport { ServerCmd } from './server.cmd';\nimport { IDERoute } from './ide.route';\nimport { APIForIDE } from './api-for-ide';\nimport { SSEEventsRoute } from './sse-events.route';\nimport { join } from 'path';\nimport { execSync } from 'child_process';\nimport { CLIRawRoute } from './cli-raw.route';\nimport type { ApplicationMain } from '@teambit/application';\nimport { ApplicationAspect } from '@teambit/application';\nimport type { DeprecationMain } from '@teambit/deprecation';\nimport { DeprecationAspect } from '@teambit/deprecation';\nimport type { EnvsMain } from '@teambit/envs';\nimport { EnvsAspect } from '@teambit/envs';\nimport { DEFAULT_AUTH_TYPE, Http } from '@teambit/scope.network';\nimport { getSymphonyUrl } from '@teambit/legacy.constants';\nimport type { GraphMain } from '@teambit/graph';\nimport { GraphAspect } from '@teambit/graph';\nimport type { ScopeMain } from '@teambit/scope';\nimport { ScopeAspect } from '@teambit/scope';\nimport type { SchemaMain } from '@teambit/schema';\nimport { SchemaAspect } from '@teambit/schema';\n\nexport class ApiServerMain {\n  private serverToken?: string;\n\n  constructor(\n    private workspace: Workspace,\n    private logger: Logger,\n    private express: ExpressMain,\n    private watcher: WatcherMain,\n    private installer: InstallMain,\n    private importer: ImporterMain\n  ) {}\n\n  async runApiServer(options: { port: number; compile: boolean }) {\n    if (!this.workspace) {\n      throw new Error(`unable to run bit-server, the current directory ${process.cwd()} is not a workspace`);\n    }\n\n    this.workspace.registerOnComponentChange(\n      async (\n        component: Component,\n        files: string[], // os absolute paths\n        removedFiles?: string[] // os absolute paths\n      ) => {\n        sendEventsToClients('onComponentChange', {\n          id: component.id.toStringWithoutVersion(),\n          files,\n          removedFiles,\n        });\n      }\n    );\n\n    this.workspace.registerOnBitmapChange(async () => {\n      const lastModifiedTimestamp = await this.workspace.bitMap.getLastModifiedBitmapThroughBit();\n      const secondsPassedSinceLastModified = lastModifiedTimestamp && (Date.now() - lastModifiedTimestamp) / 1000;\n      if (secondsPassedSinceLastModified && secondsPassedSinceLastModified > 1) {\n        // changes by bit were done more than a second ago, so probably this .bitmap change was done by \"git pull\"\n        this.logger.debug(\n          `running import because we assume the .bitmap file has changed due to \"git pull\", last time it was modified by bit was ${secondsPassedSinceLastModified} seconds ago`\n        );\n        await this.importer.importCurrentObjects();\n      }\n      sendEventsToClients('onBitmapChange', {});\n    });\n\n    this.workspace.registerOnWorkspaceConfigChange(async () => {\n      sendEventsToClients('onWorkspaceConfigChange', {});\n    });\n\n    this.workspace.scope.registerOnPostExport(async () => {\n      sendEventsToClients('onPostExport', {});\n    });\n\n    this.installer.registerPostInstall(async () => {\n      sendEventsToClients('onPostInstall', {});\n    });\n\n    await this.watcher.watch({\n      preCompile: false,\n      compile: options.compile,\n    });\n\n    const port = options.port || (await this.getRandomPort());\n\n    // Generate a per-server auth token and persist it to a 0600 file before\n    // any HTTP request can be handled. Clients (e.g. the bit-vscode extension)\n    // read it from <workspace.scope.path>/server-token.txt and send it as\n    // `Authorization: Bearer <token>`. See createAuthMiddleware below.\n    this.writeServerToken();\n\n    // Create the app *before* express.createApp registers routes, so the auth\n    // middleware runs before bodyParser — unauthenticated requests can't\n    // trigger large-body parsing. CORS is registered before auth so 401\n    // responses still carry CORS headers; otherwise browser-based clients\n    // (bit-vscode) see a misleading CORS failure instead of the JSON 401.\n    const app = expressFactory();\n    app.use(\n      cors({\n        origin(origin, callback) {\n          callback(null, true);\n        },\n        credentials: true,\n      })\n    );\n    app.use(this.createAuthMiddleware());\n    this.express.createApp(app);\n    const proxyHeaders = {\n      Authorization: `${DEFAULT_AUTH_TYPE} ${Http.getToken()}`,\n      origin: '',\n      'user-agent': 'bit-vscode-proxy',\n    };\n    const symphonyUrl = getSymphonyUrl();\n    app.use(\n      '/api/cloud-graphql',\n      // eslint-disable-next-line @typescript-eslint/no-misused-promises\n      createProxyMiddleware({\n        target: `${symphonyUrl}/graphql`,\n        changeOrigin: true,\n        headers: proxyHeaders,\n        on: {\n          error: (err, req, res) => {\n            this.logger.error('graphql cloud proxy error', err);\n            // @ts-ignore\n            res.writeHead(500, {\n              'Content-Type': 'text/plain',\n            });\n            res.end('Something went wrong with the proxy server of bit cloud graphql');\n          },\n          proxyReq: fixRequestBody,\n        },\n      })\n    );\n\n    app.use(\n      '/api/cloud-rest',\n      // eslint-disable-next-line @typescript-eslint/no-misused-promises\n      createProxyMiddleware({\n        target: `${symphonyUrl}`,\n        changeOrigin: true,\n        headers: proxyHeaders,\n        on: {\n          proxyRes: (proxyRes) => {\n            proxyRes.headers['Access-Control-Allow-Credentials'] = 'true';\n          },\n          error: (err, req, res) => {\n            this.logger.error('rest cloud proxy error', err);\n            // @ts-ignore\n            res.writeHead(500, {\n              'Content-Type': 'text/plain',\n            });\n            res.end('Something went wrong with the proxy server of bit cloud rest');\n          },\n          proxyReq: fixRequestBody,\n        },\n      })\n    );\n\n    app.use(\n      '/websocket-server/subscriptions',\n      createProxyMiddleware({\n        on: {\n          proxyReqWs: (proxyReq) => {\n            Object.entries(proxyHeaders).forEach(([key, value]) => {\n              proxyReq.setHeader(key, value);\n            });\n          },\n          error: (err) => {\n            this.logger.error('websocket cloud proxy error', err);\n          },\n        },\n        pathFilter: '/',\n        target: symphonyUrl,\n        ws: true,\n        secure: false, // Disable SSL verification for proxy to remote server\n        changeOrigin: true,\n      })\n    );\n\n    const server = await app.listen(port);\n\n    return new Promise((resolve, reject) => {\n      server.on('error', (err) => {\n        reject(err);\n      });\n      server.on('listening', () => {\n        // important! if you change the message here, change it also in server-forever.ts and also in the vscode extension.\n        this.logger.consoleSuccess(`Bit Server is listening on port ${port}`);\n        this.writeUsedPort(port);\n        this.startParentProcessMonitor();\n        resolve(port);\n      });\n    });\n  }\n\n  writeUsedPort(port: number) {\n    const filePath = this.getServerPortFilePath();\n    fs.writeFileSync(filePath, port.toString());\n  }\n\n  /**\n   * Generate a fresh per-server bearer token and persist it to a 0600 file.\n   * Clients (e.g. the bit-vscode extension) read this file and send the token\n   * as `Authorization: Bearer <token>` on every request.\n   *\n   * Backwards compatibility: clients that don't yet know about this file (older\n   * extension versions) won't send the header and will receive 401 with a\n   * message pointing them at the upgrade. Old bit-server versions don't write\n   * this file, so a new client checking for it gracefully falls back to no\n   * auth header — meaning a NEW extension keeps working against an OLD\n   * bit-server.\n   */\n  private writeServerToken() {\n    const token = crypto.randomBytes(32).toString('hex');\n    const filePath = this.getServerTokenFilePath();\n    fs.writeFileSync(filePath, token, { mode: 0o600 });\n    // Node's `mode` write option is only honored when the file is created.\n    // chmod explicitly so a pre-existing file with broader permissions gets\n    // tightened to 0600.\n    fs.chmodSync(filePath, 0o600);\n    this.serverToken = token;\n  }\n\n  private getServerTokenFilePath() {\n    return join(this.workspace.scope.path, 'server-token.txt');\n  }\n\n  /**\n   * Authentication middleware: requires `Authorization: Bearer <serverToken>`\n   * on every request except OPTIONS preflight (handled by cors) and the\n   * unauthenticated `/api/_health` liveness probe.\n   *\n   * Runs before bodyParser so unauthenticated requests can't trigger\n   * large-body parsing.\n   */\n  private createAuthMiddleware(): Middleware {\n    return (req: Request, res: Response, next: NextFunction) => {\n      if (req.method === 'OPTIONS') return next();\n      // Use req.path (not req.url) so query strings don't bypass the\n      // health-check exemption — e.g. /api/_health?cache-buster=1.\n      if (req.path === '/api/_health') return next();\n\n      const provided = parseBearerToken(req.headers.authorization);\n      if (!this.serverToken || provided !== this.serverToken) {\n        this.logger.debug(`api-server: rejected unauthenticated request to ${req.path}`);\n        res.status(401).jsonp({\n          error: 'unauthorized',\n          message:\n            'This bit-server requires authentication. Please upgrade your bit VS Code extension to the latest version.',\n        });\n        return;\n      }\n      return next();\n    };\n  }\n\n  /**\n   * Monitor the parent process (typically VSCode) and shut down if it dies.\n   *\n   * On Unix-like systems (macOS, Linux), when a parent process dies, orphaned children are\n   * re-parented to PID 1 (init/launchd). By watching for `process.ppid` changing from\n   * the original value to 1, we can detect that the parent exited and proactively\n   * shut down the bit server to avoid leaving stale background processes running.\n   *\n   * Note: This orphan detection does not work on Windows, as Windows does not re-parent\n   * processes to PID 1. On Windows, this method only logs the parent process info at startup.\n   */\n  private startParentProcessMonitor() {\n    const originalPpid = process.ppid;\n\n    // Log parent process info at startup\n    const parentInfo = this.getProcessInfo(originalPpid);\n    this.logger.debug(\n      `bit server started. PID: ${process.pid}, Parent PID: ${originalPpid}, Parent command: ${parentInfo}`\n    );\n\n    // Skip orphan detection on Windows - PPID doesn't change to 1 when parent dies\n    if (process.platform === 'win32') {\n      return;\n    }\n\n    const checkInterval = 5000; // Check every 5 seconds\n    const intervalId = setInterval(() => {\n      const currentPpid = process.ppid;\n      // If PPID changed to 1, our parent (e.g., VSCode) died and we were re-parented to init\n      if (currentPpid === 1 && originalPpid !== 1) {\n        this.logger.debug(\n          `Parent process died (was PID ${originalPpid}: ${parentInfo}). Current PPID is now 1 (init/launchd). Shutting down bit server.`\n        );\n        clearInterval(intervalId);\n        process.exit(0);\n      }\n    }, checkInterval);\n\n    // Don't let this interval keep the process alive if everything else is done\n    intervalId.unref();\n  }\n\n  /**\n   * Get the command/path of a process by its PID.\n   */\n  private getProcessInfo(pid: number): string {\n    try {\n      if (process.platform === 'win32') {\n        // Windows: use PowerShell Get-CimInstance (WMIC is deprecated/removed on modern Windows)\n        const psCommand = `Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}' | Select-Object -ExpandProperty CommandLine`;\n        const output = execSync(`powershell.exe -NoProfile -Command \"${psCommand}\"`, {\n          encoding: 'utf8',\n          timeout: 2000,\n        });\n        return output.trim() || 'unknown';\n      } else {\n        // macOS/Linux: use ps\n        const output = execSync(`ps -o command= -p ${pid}`, { encoding: 'utf8', timeout: 2000 });\n        return output.trim() || 'unknown';\n      }\n    } catch {\n      return 'unknown (process may have exited)';\n    }\n  }\n\n  async getRandomPort() {\n    const startingPort = 4000; // we prefer to have the ports between 4000 and 4999.\n    // get random number in the range of [startingPort, 4999].\n    const randomNumber = Math.floor(Math.random() * (4999 - startingPort + 1) + startingPort);\n    const port = await Port.getPort(randomNumber, 65500);\n    return port;\n  }\n\n  async getExistingUsedPort(): Promise<number | undefined> {\n    const filePath = this.getServerPortFilePath();\n    try {\n      const fileContent = await fs.readFile(filePath, 'utf8');\n      return parseInt(fileContent, 10);\n    } catch (err: any) {\n      if (err.code === 'ENOENT') {\n        return undefined;\n      }\n      throw err;\n    }\n  }\n\n  private getServerPortFilePath() {\n    return join(this.workspace.scope.path, 'server-port.txt');\n  }\n\n  static dependencies = [\n    CLIAspect,\n    WorkspaceAspect,\n    LoggerAspect,\n    ExpressAspect,\n    WatcherAspect,\n    SnappingAspect,\n    LanesAspect,\n    InstallAspect,\n    ExportAspect,\n    CheckoutAspect,\n    ComponentLogAspect,\n    ImporterAspect,\n    ComponentCompareAspect,\n    GeneratorAspect,\n    RemoveAspect,\n    ConfigAspect,\n    ApplicationAspect,\n    DeprecationAspect,\n    EnvsAspect,\n    GraphAspect,\n    ScopeAspect,\n    ComponentAspect,\n    SchemaAspect,\n  ];\n  static runtime = MainRuntime;\n  static async provider([\n    cli,\n    workspace,\n    loggerMain,\n    express,\n    watcher,\n    snapping,\n    lanes,\n    installer,\n    exporter,\n    checkout,\n    componentLog,\n    importer,\n    componentCompare,\n    generator,\n    remove,\n    config,\n    application,\n    deprecation,\n    envs,\n    graph,\n    scope,\n    component,\n    schema,\n  ]: [\n    CLIMain,\n    Workspace,\n    LoggerMain,\n    ExpressMain,\n    WatcherMain,\n    SnappingMain,\n    LanesMain,\n    InstallMain,\n    ExportMain,\n    CheckoutMain,\n    ComponentLogMain,\n    ImporterMain,\n    ComponentCompareMain,\n    GeneratorMain,\n    RemoveMain,\n    ConfigMain,\n    ApplicationMain,\n    DeprecationMain,\n    EnvsMain,\n    GraphMain,\n    ScopeMain,\n    ComponentMain,\n    SchemaMain,\n  ]) {\n    const logger = loggerMain.createLogger(ApiServerAspect.id);\n    const apiServer = new ApiServerMain(workspace, logger, express, watcher, installer, importer);\n    cli.register(new ServerCmd(apiServer));\n\n    const apiForIDE = new APIForIDE(\n      workspace,\n      snapping,\n      lanes,\n      installer,\n      exporter,\n      checkout,\n      componentLog,\n      componentCompare,\n      generator,\n      remove,\n      config,\n      application,\n      deprecation,\n      envs,\n      graph,\n      scope,\n      component,\n      schema,\n      logger\n    );\n    const cliRoute = new CLIRoute(logger, cli, apiForIDE);\n    const cliRawRoute = new CLIRawRoute(logger, cli, apiForIDE);\n    const ideRoute = new IDERoute(logger, apiForIDE);\n    const sseEventsRoute = new SSEEventsRoute(logger, cli);\n    // register only when the workspace is available. don't register this on a remote-scope, for security reasons.\n    if (workspace) {\n      express.register([cliRoute, cliRawRoute, ideRoute, sseEventsRoute]);\n    }\n\n    return apiServer;\n  }\n}\n\nApiServerAspect.addRuntime(ApiServerMain);\n\n/**\n * Extract the token from an `Authorization: Bearer <token>` header.\n * Lenient on scheme casing and surrounding whitespace so a slightly\n * non-canonical client header doesn't get rejected.\n */\nfunction parseBearerToken(header: string | undefined): string | undefined {\n  if (!header) return undefined;\n  const match = header.match(/^\\s*Bearer\\s+(\\S+)\\s*$/i);\n  return match?.[1];\n}\n\nexport default ApiServerMain;\n"],"mappings":";;;;;;AACA,SAAAA,KAAA;EAAA,MAAAC,IAAA,GAAAC,OAAA;EAAAF,IAAA,YAAAA,CAAA;IAAA,OAAAC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAE,gBAAA;EAAA,MAAAF,IAAA,GAAAC,OAAA;EAAAC,eAAA,YAAAA,CAAA;IAAA,OAAAF,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAG,SAAA;EAAA,MAAAH,IAAA,GAAAI,sBAAA,CAAAH,OAAA;EAAAE,QAAA,YAAAA,CAAA;IAAA,OAAAH,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAK,QAAA;EAAA,MAAAL,IAAA,GAAAI,sBAAA,CAAAH,OAAA;EAAAI,OAAA,YAAAA,CAAA;IAAA,OAAAL,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAM,SAAA;EAAA,MAAAN,IAAA,GAAAI,sBAAA,CAAAH,OAAA;EAAAK,QAAA,YAAAA,CAAA;IAAA,OAAAN,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAO,UAAA;EAAA,MAAAP,IAAA,GAAAC,OAAA;EAAAM,SAAA,YAAAA,CAAA;IAAA,OAAAP,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAQ,QAAA;EAAA,MAAAR,IAAA,GAAAC,OAAA;EAAAO,OAAA,YAAAA,CAAA;IAAA,OAAAR,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAS,OAAA;EAAA,MAAAT,IAAA,GAAAC,OAAA;EAAAQ,MAAA,YAAAA,CAAA;IAAA,OAAAT,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAU,QAAA;EAAA,MAAAV,IAAA,GAAAC,OAAA;EAAAS,OAAA,YAAAA,CAAA;IAAA,OAAAV,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAW,UAAA;EAAA,MAAAX,IAAA,GAAAC,OAAA;EAAAU,SAAA,YAAAA,CAAA;IAAA,OAAAX,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAY,WAAA;EAAA,MAAAZ,IAAA,GAAAC,OAAA;EAAAW,UAAA,YAAAA,CAAA;IAAA,OAAAZ,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAa,kBAAA;EAAA,MAAAb,IAAA,GAAAC,OAAA;EAAAY,iBAAA,YAAAA,CAAA;IAAA,OAAAb,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAc,cAAA;EAAA,MAAAd,IAAA,GAAAC,OAAA;EAAAa,aAAA,YAAAA,CAAA;IAAA,OAAAd,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAe,SAAA;EAAA,MAAAf,IAAA,GAAAC,OAAA;EAAAc,QAAA,YAAAA,CAAA;IAAA,OAAAf,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAgB,QAAA;EAAA,MAAAhB,IAAA,GAAAC,OAAA;EAAAe,OAAA,YAAAA,CAAA;IAAA,OAAAhB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAiB,QAAA;EAAA,MAAAjB,IAAA,GAAAC,OAAA;EAAAgB,OAAA,YAAAA,CAAA;IAAA,OAAAjB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAkB,UAAA;EAAA,MAAAlB,IAAA,GAAAC,OAAA;EAAAiB,SAAA,YAAAA,CAAA;IAAA,OAAAlB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAmB,SAAA;EAAA,MAAAnB,IAAA,GAAAC,OAAA;EAAAkB,QAAA,YAAAA,CAAA;IAAA,OAAAnB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAoB,UAAA;EAAA,MAAApB,IAAA,GAAAC,OAAA;EAAAmB,SAAA,YAAAA,CAAA;IAAA,OAAApB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAqB,WAAA;EAAA,MAAArB,IAAA,GAAAC,OAAA;EAAAoB,UAAA,YAAAA,CAAA;IAAA,OAAArB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAsB,WAAA;EAAA,MAAAtB,IAAA,GAAAC,OAAA;EAAAqB,UAAA,YAAAA,CAAA;IAAA,OAAAtB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAuB,gBAAA;EAAA,MAAAvB,IAAA,GAAAC,OAAA;EAAAsB,eAAA,YAAAA,CAAA;IAAA,OAAAvB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAwB,MAAA;EAAA,MAAAxB,IAAA,GAAAI,sBAAA,CAAAH,OAAA;EAAAuB,KAAA,YAAAA,CAAA;IAAA,OAAAxB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAyB,qBAAA;EAAA,MAAAzB,IAAA,GAAAC,OAAA;EAAAwB,oBAAA,YAAAA,CAAA;IAAA,OAAAzB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA0B,WAAA;EAAA,MAAA1B,IAAA,GAAAC,OAAA;EAAAyB,UAAA,YAAAA,CAAA;IAAA,OAAA1B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA2B,MAAA;EAAA,MAAA3B,IAAA,GAAAC,OAAA;EAAA0B,KAAA,YAAAA,CAAA;IAAA,OAAA3B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA4B,QAAA;EAAA,MAAA5B,IAAA,GAAAC,OAAA;EAAA2B,OAAA,YAAAA,CAAA;IAAA,OAAA5B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA6B,KAAA;EAAA,MAAA7B,IAAA,GAAAC,OAAA;EAAA4B,IAAA,YAAAA,CAAA;IAAA,OAAA7B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA8B,WAAA;EAAA,MAAA9B,IAAA,GAAAC,OAAA;EAAA6B,UAAA,YAAAA,CAAA;IAAA,OAAA9B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA+B,WAAA;EAAA,MAAA/B,IAAA,GAAAC,OAAA;EAAA8B,UAAA,YAAAA,CAAA;IAAA,OAAA/B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAgC,MAAA;EAAA,MAAAhC,IAAA,GAAAC,OAAA;EAAA+B,KAAA,YAAAA,CAAA;IAAA,OAAAhC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAiC,eAAA;EAAA,MAAAjC,IAAA,GAAAC,OAAA;EAAAgC,cAAA,YAAAA,CAAA;IAAA,OAAAjC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAkC,QAAA;EAAA,MAAAlC,IAAA,GAAAC,OAAA;EAAAiC,OAAA,YAAAA,CAAA;IAAA,OAAAlC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAmC,aAAA;EAAA,MAAAnC,IAAA,GAAAC,OAAA;EAAAkC,YAAA,YAAAA,CAAA;IAAA,OAAAnC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAoC,aAAA;EAAA,MAAApC,IAAA,GAAAC,OAAA;EAAAmC,YAAA,YAAAA,CAAA;IAAA,OAAApC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAqC,MAAA;EAAA,MAAArC,IAAA,GAAAC,OAAA;EAAAoC,KAAA,YAAAA,CAAA;IAAA,OAAArC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAsC,OAAA;EAAA,MAAAtC,IAAA,GAAAC,OAAA;EAAAqC,MAAA,YAAAA,CAAA;IAAA,OAAAtC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAuC,QAAA;EAAA,MAAAvC,IAAA,GAAAC,OAAA;EAAAsC,OAAA,YAAAA,CAAA;IAAA,OAAAvC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAwC,OAAA;EAAA,MAAAxC,IAAA,GAAAC,OAAA;EAAAuC,MAAA,YAAAA,CAAA;IAAA,OAAAxC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAyC,QAAA;EAAA,MAAAzC,IAAA,GAAAC,OAAA;EAAAwC,OAAA,YAAAA,CAAA;IAAA,OAAAzC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAA0C,QAAA;EAAA,MAAA1C,IAAA,GAAAC,OAAA;EAAAyC,OAAA,YAAAA,CAAA;IAAA,OAAA1C,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAA+C,SAAAI,uBAAAuC,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAAA,SAAAG,gBAAAH,CAAA,EAAAI,CAAA,EAAAC,CAAA,YAAAD,CAAA,GAAAE,cAAA,CAAAF,CAAA,MAAAJ,CAAA,GAAAO,MAAA,CAAAC,cAAA,CAAAR,CAAA,EAAAI,CAAA,IAAAK,KAAA,EAAAJ,CAAA,EAAAK,UAAA,MAAAC,YAAA,MAAAC,QAAA,UAAAZ,CAAA,CAAAI,CAAA,IAAAC,CAAA,EAAAL,CAAA;AAAA,SAAAM,eAAAD,CAAA,QAAAQ,CAAA,GAAAC,YAAA,CAAAT,CAAA,uCAAAQ,CAAA,GAAAA,CAAA,GAAAA,CAAA;AAAA,SAAAC,aAAAT,CAAA,EAAAD,CAAA,2BAAAC,CAAA,KAAAA,CAAA,SAAAA,CAAA,MAAAL,CAAA,GAAAK,CAAA,CAAAU,MAAA,CAAAC,WAAA,kBAAAhB,CAAA,QAAAa,CAAA,GAAAb,CAAA,CAAAiB,IAAA,CAAAZ,CAAA,EAAAD,CAAA,uCAAAS,CAAA,SAAAA,CAAA,YAAAK,SAAA,yEAAAd,CAAA,GAAAe,MAAA,GAAAC,MAAA,EAAAf,CAAA;AAExC,MAAMgB,aAAa,CAAC;EAGzBC,WAAWA,CACDC,SAAoB,EACpBC,MAAc,EACdC,OAAoB,EACpBC,OAAoB,EACpBC,SAAsB,EACtBC,QAAsB,EAC9B;IAAA,KANQL,SAAoB,GAApBA,SAAoB;IAAA,KACpBC,MAAc,GAAdA,MAAc;IAAA,KACdC,OAAoB,GAApBA,OAAoB;IAAA,KACpBC,OAAoB,GAApBA,OAAoB;IAAA,KACpBC,SAAsB,GAAtBA,SAAsB;IAAA,KACtBC,QAAsB,GAAtBA,QAAsB;IAAAzB,eAAA;EAC7B;EAEH,MAAM0B,YAAYA,CAACC,OAA2C,EAAE;IAC9D,IAAI,CAAC,IAAI,CAACP,SAAS,EAAE;MACnB,MAAM,IAAIQ,KAAK,CAAC,mDAAmDC,OAAO,CAACC,GAAG,CAAC,CAAC,qBAAqB,CAAC;IACxG;IAEA,IAAI,CAACV,SAAS,CAACW,yBAAyB,CACtC,OACEC,SAAoB,EACpBC,KAAe,EACfC,YAAuB,KACpB;MACH,IAAAC,qCAAmB,EAAC,mBAAmB,EAAE;QACvCC,EAAE,EAAEJ,SAAS,CAACI,EAAE,CAACC,sBAAsB,CAAC,CAAC;QACzCJ,KAAK;QACLC;MACF,CAAC,CAAC;IACJ,CACF,CAAC;IAED,IAAI,CAACd,SAAS,CAACkB,sBAAsB,CAAC,YAAY;MAChD,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAACnB,SAAS,CAACoB,MAAM,CAACC,+BAA+B,CAAC,CAAC;MAC3F,MAAMC,8BAA8B,GAAGH,qBAAqB,IAAI,CAACI,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGL,qBAAqB,IAAI,IAAI;MAC3G,IAAIG,8BAA8B,IAAIA,8BAA8B,GAAG,CAAC,EAAE;QACxE;QACA,IAAI,CAACrB,MAAM,CAACwB,KAAK,CACf,yHAAyHH,8BAA8B,cACzJ,CAAC;QACD,MAAM,IAAI,CAACjB,QAAQ,CAACqB,oBAAoB,CAAC,CAAC;MAC5C;MACA,IAAAX,qCAAmB,EAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,IAAI,CAACf,SAAS,CAAC2B,+BAA+B,CAAC,YAAY;MACzD,IAAAZ,qCAAmB,EAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC;IAEF,IAAI,CAACf,SAAS,CAAC4B,KAAK,CAACC,oBAAoB,CAAC,YAAY;MACpD,IAAAd,qCAAmB,EAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,IAAI,CAACX,SAAS,CAAC0B,mBAAmB,CAAC,YAAY;MAC7C,IAAAf,qCAAmB,EAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,IAAI,CAACZ,OAAO,CAAC4B,KAAK,CAAC;MACvBC,UAAU,EAAE,KAAK;MACjBC,OAAO,EAAE1B,OAAO,CAAC0B;IACnB,CAAC,CAAC;IAEF,MAAMC,IAAI,GAAG3B,OAAO,CAAC2B,IAAI,KAAK,MAAM,IAAI,CAACC,aAAa,CAAC,CAAC,CAAC;;IAEzD;IACA;IACA;IACA;IACA,IAAI,CAACC,gBAAgB,CAAC,CAAC;;IAEvB;IACA;IACA;IACA;IACA;IACA,MAAMC,GAAG,GAAG,IAAAC,kBAAc,EAAC,CAAC;IAC5BD,GAAG,CAACE,GAAG,CACL,IAAAC,eAAI,EAAC;MACHC,MAAMA,CAACA,MAAM,EAAEC,QAAQ,EAAE;QACvBA,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;MACtB,CAAC;MACDC,WAAW,EAAE;IACf,CAAC,CACH,CAAC;IACDN,GAAG,CAACE,GAAG,CAAC,IAAI,CAACK,oBAAoB,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC1C,OAAO,CAAC2C,SAAS,CAACR,GAAG,CAAC;IAC3B,MAAMS,YAAY,GAAG;MACnBC,aAAa,EAAE,GAAGC,0BAAiB,IAAIC,aAAI,CAACC,QAAQ,CAAC,CAAC,EAAE;MACxDT,MAAM,EAAE,EAAE;MACV,YAAY,EAAE;IAChB,CAAC;IACD,MAAMU,WAAW,GAAG,IAAAC,wBAAc,EAAC,CAAC;IACpCf,GAAG,CAACE,GAAG,CACL,oBAAoB;IACpB;IACA,IAAAc,4CAAqB,EAAC;MACpBC,MAAM,EAAE,GAAGH,WAAW,UAAU;MAChCI,YAAY,EAAE,IAAI;MAClBC,OAAO,EAAEV,YAAY;MACrBW,EAAE,EAAE;QACFC,KAAK,EAAEA,CAACC,GAAG,EAAEC,GAAG,EAAEC,GAAG,KAAK;UACxB,IAAI,CAAC5D,MAAM,CAACyD,KAAK,CAAC,2BAA2B,EAAEC,GAAG,CAAC;UACnD;UACAE,GAAG,CAACC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE;UAClB,CAAC,CAAC;UACFD,GAAG,CAACE,GAAG,CAAC,iEAAiE,CAAC;QAC5E,CAAC;QACDC,QAAQ,EAAEC;MACZ;IACF,CAAC,CACH,CAAC;IAED5B,GAAG,CAACE,GAAG,CACL,iBAAiB;IACjB;IACA,IAAAc,4CAAqB,EAAC;MACpBC,MAAM,EAAE,GAAGH,WAAW,EAAE;MACxBI,YAAY,EAAE,IAAI;MAClBC,OAAO,EAAEV,YAAY;MACrBW,EAAE,EAAE;QACFS,QAAQ,EAAGA,QAAQ,IAAK;UACtBA,QAAQ,CAACV,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM;QAC/D,CAAC;QACDE,KAAK,EAAEA,CAACC,GAAG,EAAEC,GAAG,EAAEC,GAAG,KAAK;UACxB,IAAI,CAAC5D,MAAM,CAACyD,KAAK,CAAC,wBAAwB,EAAEC,GAAG,CAAC;UAChD;UACAE,GAAG,CAACC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE;UAClB,CAAC,CAAC;UACFD,GAAG,CAACE,GAAG,CAAC,8DAA8D,CAAC;QACzE,CAAC;QACDC,QAAQ,EAAEC;MACZ;IACF,CAAC,CACH,CAAC;IAED5B,GAAG,CAACE,GAAG,CACL,iCAAiC,EACjC,IAAAc,4CAAqB,EAAC;MACpBI,EAAE,EAAE;QACFU,UAAU,EAAGH,QAAQ,IAAK;UACxBhF,MAAM,CAACoF,OAAO,CAACtB,YAAY,CAAC,CAACuB,OAAO,CAAC,CAAC,CAACC,GAAG,EAAEpF,KAAK,CAAC,KAAK;YACrD8E,QAAQ,CAACO,SAAS,CAACD,GAAG,EAAEpF,KAAK,CAAC;UAChC,CAAC,CAAC;QACJ,CAAC;QACDwE,KAAK,EAAGC,GAAG,IAAK;UACd,IAAI,CAAC1D,MAAM,CAACyD,KAAK,CAAC,6BAA6B,EAAEC,GAAG,CAAC;QACvD;MACF,CAAC;MACDa,UAAU,EAAE,GAAG;MACflB,MAAM,EAAEH,WAAW;MACnBsB,EAAE,EAAE,IAAI;MACRC,MAAM,EAAE,KAAK;MAAE;MACfnB,YAAY,EAAE;IAChB,CAAC,CACH,CAAC;IAED,MAAMoB,MAAM,GAAG,MAAMtC,GAAG,CAACuC,MAAM,CAAC1C,IAAI,CAAC;IAErC,OAAO,IAAI2C,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAK;MACtCJ,MAAM,CAAClB,EAAE,CAAC,OAAO,EAAGE,GAAG,IAAK;QAC1BoB,MAAM,CAACpB,GAAG,CAAC;MACb,CAAC,CAAC;MACFgB,MAAM,CAAClB,EAAE,CAAC,WAAW,EAAE,MAAM;QAC3B;QACA,IAAI,CAACxD,MAAM,CAAC+E,cAAc,CAAC,mCAAmC9C,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC+C,aAAa,CAAC/C,IAAI,CAAC;QACxB,IAAI,CAACgD,yBAAyB,CAAC,CAAC;QAChCJ,OAAO,CAAC5C,IAAI,CAAC;MACf,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ;EAEA+C,aAAaA,CAAC/C,IAAY,EAAE;IAC1B,MAAMiD,QAAQ,GAAG,IAAI,CAACC,qBAAqB,CAAC,CAAC;IAC7CC,kBAAE,CAACC,aAAa,CAACH,QAAQ,EAAEjD,IAAI,CAACqD,QAAQ,CAAC,CAAC,CAAC;EAC7C;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACUnD,gBAAgBA,CAAA,EAAG;IACzB,MAAMoD,KAAK,GAAGC,iBAAM,CAACC,WAAW,CAAC,EAAE,CAAC,CAACH,QAAQ,CAAC,KAAK,CAAC;IACpD,MAAMJ,QAAQ,GAAG,IAAI,CAACQ,sBAAsB,CAAC,CAAC;IAC9CN,kBAAE,CAACC,aAAa,CAACH,QAAQ,EAAEK,KAAK,EAAE;MAAEI,IAAI,EAAE;IAAM,CAAC,CAAC;IAClD;IACA;IACA;IACAP,kBAAE,CAACQ,SAAS,CAACV,QAAQ,EAAE,KAAK,CAAC;IAC7B,IAAI,CAACW,WAAW,GAAGN,KAAK;EAC1B;EAEQG,sBAAsBA,CAAA,EAAG;IAC/B,OAAO,IAAAI,YAAI,EAAC,IAAI,CAAC/F,SAAS,CAAC4B,KAAK,CAACoE,IAAI,EAAE,kBAAkB,CAAC;EAC5D;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACUpD,oBAAoBA,CAAA,EAAe;IACzC,OAAO,CAACgB,GAAY,EAAEC,GAAa,EAAEoC,IAAkB,KAAK;MAC1D,IAAIrC,GAAG,CAACsC,MAAM,KAAK,SAAS,EAAE,OAAOD,IAAI,CAAC,CAAC;MAC3C;MACA;MACA,IAAIrC,GAAG,CAACoC,IAAI,KAAK,cAAc,EAAE,OAAOC,IAAI,CAAC,CAAC;MAE9C,MAAME,QAAQ,GAAGC,gBAAgB,CAACxC,GAAG,CAACJ,OAAO,CAAC6C,aAAa,CAAC;MAC5D,IAAI,CAAC,IAAI,CAACP,WAAW,IAAIK,QAAQ,KAAK,IAAI,CAACL,WAAW,EAAE;QACtD,IAAI,CAAC7F,MAAM,CAACwB,KAAK,CAAC,mDAAmDmC,GAAG,CAACoC,IAAI,EAAE,CAAC;QAChFnC,GAAG,CAACyC,MAAM,CAAC,GAAG,CAAC,CAACC,KAAK,CAAC;UACpB7C,KAAK,EAAE,cAAc;UACrB8C,OAAO,EACL;QACJ,CAAC,CAAC;QACF;MACF;MACA,OAAOP,IAAI,CAAC,CAAC;IACf,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACUf,yBAAyBA,CAAA,EAAG;IAClC,MAAMuB,YAAY,GAAGhG,OAAO,CAACiG,IAAI;;IAEjC;IACA,MAAMC,UAAU,GAAG,IAAI,CAACC,cAAc,CAACH,YAAY,CAAC;IACpD,IAAI,CAACxG,MAAM,CAACwB,KAAK,CACf,4BAA4BhB,OAAO,CAACoG,GAAG,iBAAiBJ,YAAY,qBAAqBE,UAAU,EACrG,CAAC;;IAED;IACA,IAAIlG,OAAO,CAACqG,QAAQ,KAAK,OAAO,EAAE;MAChC;IACF;IAEA,MAAMC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5B,MAAMC,UAAU,GAAGC,WAAW,CAAC,MAAM;MACnC,MAAMC,WAAW,GAAGzG,OAAO,CAACiG,IAAI;MAChC;MACA,IAAIQ,WAAW,KAAK,CAAC,IAAIT,YAAY,KAAK,CAAC,EAAE;QAC3C,IAAI,CAACxG,MAAM,CAACwB,KAAK,CACf,gCAAgCgF,YAAY,KAAKE,UAAU,oEAC7D,CAAC;QACDQ,aAAa,CAACH,UAAU,CAAC;QACzBvG,OAAO,CAAC2G,IAAI,CAAC,CAAC,CAAC;MACjB;IACF,CAAC,EAAEL,aAAa,CAAC;;IAEjB;IACAC,UAAU,CAACK,KAAK,CAAC,CAAC;EACpB;;EAEA;AACF;AACA;EACUT,cAAcA,CAACC,GAAW,EAAU;IAC1C,IAAI;MACF,IAAIpG,OAAO,CAACqG,QAAQ,KAAK,OAAO,EAAE;QAChC;QACA,MAAMQ,SAAS,GAAG,sDAAsDT,GAAG,+CAA+C;QAC1H,MAAMU,MAAM,GAAG,IAAAC,yBAAQ,EAAC,uCAAuCF,SAAS,GAAG,EAAE;UAC3EG,QAAQ,EAAE,MAAM;UAChBC,OAAO,EAAE;QACX,CAAC,CAAC;QACF,OAAOH,MAAM,CAACI,IAAI,CAAC,CAAC,IAAI,SAAS;MACnC,CAAC,MAAM;QACL;QACA,MAAMJ,MAAM,GAAG,IAAAC,yBAAQ,EAAC,qBAAqBX,GAAG,EAAE,EAAE;UAAEY,QAAQ,EAAE,MAAM;UAAEC,OAAO,EAAE;QAAK,CAAC,CAAC;QACxF,OAAOH,MAAM,CAACI,IAAI,CAAC,CAAC,IAAI,SAAS;MACnC;IACF,CAAC,CAAC,MAAM;MACN,OAAO,mCAAmC;IAC5C;EACF;EAEA,MAAMxF,aAAaA,CAAA,EAAG;IACpB,MAAMyF,YAAY,GAAG,IAAI,CAAC,CAAC;IAC3B;IACA,MAAMC,YAAY,GAAGC,IAAI,CAACC,KAAK,CAACD,IAAI,CAACE,MAAM,CAAC,CAAC,IAAI,IAAI,GAAGJ,YAAY,GAAG,CAAC,CAAC,GAAGA,YAAY,CAAC;IACzF,MAAM1F,IAAI,GAAG,MAAM+F,sBAAI,CAACC,OAAO,CAACL,YAAY,EAAE,KAAK,CAAC;IACpD,OAAO3F,IAAI;EACb;EAEA,MAAMiG,mBAAmBA,CAAA,EAAgC;IACvD,MAAMhD,QAAQ,GAAG,IAAI,CAACC,qBAAqB,CAAC,CAAC;IAC7C,IAAI;MACF,MAAMgD,WAAW,GAAG,MAAM/C,kBAAE,CAACgD,QAAQ,CAAClD,QAAQ,EAAE,MAAM,CAAC;MACvD,OAAOmD,QAAQ,CAACF,WAAW,EAAE,EAAE,CAAC;IAClC,CAAC,CAAC,OAAOzE,GAAQ,EAAE;MACjB,IAAIA,GAAG,CAAC4E,IAAI,KAAK,QAAQ,EAAE;QACzB,OAAOC,SAAS;MAClB;MACA,MAAM7E,GAAG;IACX;EACF;EAEQyB,qBAAqBA,CAAA,EAAG;IAC9B,OAAO,IAAAW,YAAI,EAAC,IAAI,CAAC/F,SAAS,CAAC4B,KAAK,CAACoE,IAAI,EAAE,iBAAiB,CAAC;EAC3D;EA4BA,aAAayC,QAAQA,CAAC,CACpBC,GAAG,EACH1I,SAAS,EACT2I,UAAU,EACVzI,OAAO,EACPC,OAAO,EACPyI,QAAQ,EACRC,KAAK,EACLzI,SAAS,EACT0I,QAAQ,EACRC,QAAQ,EACRC,YAAY,EACZ3I,QAAQ,EACR4I,gBAAgB,EAChBC,SAAS,EACTC,MAAM,EACNC,MAAM,EACNC,WAAW,EACXC,WAAW,EACXC,IAAI,EACJC,KAAK,EACL5H,KAAK,EACLhB,SAAS,EACT6I,MAAM,CAyBP,EAAE;IACD,MAAMxJ,MAAM,GAAG0I,UAAU,CAACe,YAAY,CAACC,4BAAe,CAAC3I,EAAE,CAAC;IAC1D,MAAM4I,SAAS,GAAG,IAAI9J,aAAa,CAACE,SAAS,EAAEC,MAAM,EAAEC,OAAO,EAAEC,OAAO,EAAEC,SAAS,EAAEC,QAAQ,CAAC;IAC7FqI,GAAG,CAACmB,QAAQ,CAAC,KAAIC,mBAAS,EAACF,SAAS,CAAC,CAAC;IAEtC,MAAMG,SAAS,GAAG,KAAIC,sBAAS,EAC7BhK,SAAS,EACT4I,QAAQ,EACRC,KAAK,EACLzI,SAAS,EACT0I,QAAQ,EACRC,QAAQ,EACRC,YAAY,EACZC,gBAAgB,EAChBC,SAAS,EACTC,MAAM,EACNC,MAAM,EACNC,WAAW,EACXC,WAAW,EACXC,IAAI,EACJC,KAAK,EACL5H,KAAK,EACLhB,SAAS,EACT6I,MAAM,EACNxJ,MACF,CAAC;IACD,MAAMgK,QAAQ,GAAG,KAAIC,gBAAQ,EAACjK,MAAM,EAAEyI,GAAG,EAAEqB,SAAS,CAAC;IACrD,MAAMI,WAAW,GAAG,KAAIC,qBAAW,EAACnK,MAAM,EAAEyI,GAAG,EAAEqB,SAAS,CAAC;IAC3D,MAAMM,QAAQ,GAAG,KAAIC,eAAQ,EAACrK,MAAM,EAAE8J,SAAS,CAAC;IAChD,MAAMQ,cAAc,GAAG,KAAIC,2BAAc,EAACvK,MAAM,EAAEyI,GAAG,CAAC;IACtD;IACA,IAAI1I,SAAS,EAAE;MACbE,OAAO,CAAC2J,QAAQ,CAAC,CAACI,QAAQ,EAAEE,WAAW,EAAEE,QAAQ,EAAEE,cAAc,CAAC,CAAC;IACrE;IAEA,OAAOX,SAAS;EAClB;AACF;AAACa,OAAA,CAAA3K,aAAA,GAAAA,aAAA;AAAAlB,eAAA,CAnbYkB,aAAa,kBAoUF,CACpB4K,gBAAS,EACTC,4BAAe,EACfC,sBAAY,EACZC,yBAAa,EACbC,wBAAa,EACbC,0BAAc,EACdC,oBAAW,EACXC,wBAAa,EACbC,sBAAY,EACZC,0BAAc,EACdC,kCAAkB,EAClBC,0BAAc,EACdC,0CAAsB,EACtBC,4BAAe,EACfC,sBAAY,EACZC,sBAAY,EACZC,gCAAiB,EACjBC,gCAAiB,EACjBC,kBAAU,EACVC,oBAAW,EACXC,qBAAW,EACXC,4BAAe,EACfC,sBAAY,CACb;AAAApN,eAAA,CA5VUkB,aAAa,aA6VPmM,kBAAW;AAwF9BtC,4BAAe,CAACuC,UAAU,CAACpM,aAAa,CAAC;;AAEzC;AACA;AACA;AACA;AACA;AACA,SAASsG,gBAAgBA,CAAC+F,MAA0B,EAAsB;EACxE,IAAI,CAACA,MAAM,EAAE,OAAO3D,SAAS;EAC7B,MAAM4D,KAAK,GAAGD,MAAM,CAACC,KAAK,CAAC,yBAAyB,CAAC;EACrD,OAAOA,KAAK,GAAG,CAAC,CAAC;AACnB;AAAC,IAAAC,QAAA,GAAA5B,OAAA,CAAA9L,OAAA,GAEcmB,aAAa","ignoreList":[]}
+{"version":3,"names":["_cli","data","require","_toolboxNetwork","_fsExtra","_interopRequireDefault","_crypto","_express","_express2","_logger","_lanes","_remove","_snapping","_generator","_componentCompare","_componentLog","_watcher","_config","_export","_checkout","_install","_importer","_component","_workspace","_harmonyModules","_cors","_httpProxyMiddleware","_apiServer","_cli2","_server","_ide","_apiForIde","_sseEvents","_path","_child_process","_cliRaw","_application","_deprecation","_envs","_scope","_legacy","_graph","_scope2","_schema","e","__esModule","default","_defineProperty","r","t","_toPropertyKey","Object","defineProperty","value","enumerable","configurable","writable","i","_toPrimitive","Symbol","toPrimitive","call","TypeError","String","Number","ApiServerMain","constructor","workspace","logger","express","watcher","installer","importer","runApiServer","options","Error","process","cwd","registerOnComponentChange","component","files","removedFiles","sendEventsToClients","id","toStringWithoutVersion","registerOnBitmapChange","lastModifiedTimestamp","bitMap","getLastModifiedBitmapThroughBit","secondsPassedSinceLastModified","Date","now","debug","importCurrentObjects","registerOnWorkspaceConfigChange","scope","registerOnPostExport","registerPostInstall","watch","preCompile","compile","port","getRandomPort","writeServerToken","app","expressFactory","use","createHostCheckMiddleware","cors","origin","callback","credentials","createAuthMiddleware","createApp","proxyHeaders","Authorization","DEFAULT_AUTH_TYPE","Http","getToken","symphonyUrl","getSymphonyUrl","createProxyMiddleware","target","changeOrigin","headers","on","error","err","req","res","writeHead","end","proxyReq","fixRequestBody","proxyRes","proxyReqWs","entries","forEach","key","setHeader","pathFilter","ws","server","listen","Promise","resolve","reject","consoleSuccess","writeUsedPort","startParentProcessMonitor","filePath","getServerPortFilePath","fs","writeFileSync","toString","mode","chmodSync","token","crypto","randomBytes","getServerTokenFilePath","serverToken","join","path","allowed","Set","next","hostHeader","host","match","toLowerCase","has","status","method","provided","parseBearerToken","authorization","authorized","queryIdx","url","indexOf","params","URLSearchParams","slice","get","delete","remaining","jsonp","message","originalPpid","ppid","parentInfo","getProcessInfo","pid","platform","checkInterval","intervalId","setInterval","currentPpid","clearInterval","exit","unref","psCommand","output","execSync","encoding","timeout","trim","startingPort","randomNumber","randomInt","Port","getPort","getExistingUsedPort","fileContent","readFile","parseInt","code","undefined","provider","cli","loggerMain","snapping","lanes","exporter","checkout","componentLog","componentCompare","generator","remove","config","application","deprecation","envs","graph","schema","createLogger","ApiServerAspect","apiServer","register","ServerCmd","apiForIDE","APIForIDE","cliRoute","CLIRoute","cliRawRoute","CLIRawRoute","ideRoute","IDERoute","sseEventsRoute","SSEEventsRoute","exports","CLIAspect","WorkspaceAspect","LoggerAspect","ExpressAspect","WatcherAspect","SnappingAspect","LanesAspect","InstallAspect","ExportAspect","CheckoutAspect","ComponentLogAspect","ImporterAspect","ComponentCompareAspect","GeneratorAspect","RemoveAspect","ConfigAspect","ApplicationAspect","DeprecationAspect","EnvsAspect","GraphAspect","ScopeAspect","ComponentAspect","SchemaAspect","MainRuntime","addRuntime","header","_default"],"sources":["api-server.main.runtime.ts"],"sourcesContent":["import type { CLIMain } from '@teambit/cli';\nimport { CLIAspect, MainRuntime } from '@teambit/cli';\nimport { Port } from '@teambit/toolbox.network.get-port';\nimport fs from 'fs-extra';\nimport crypto from 'crypto';\nimport expressFactory from 'express';\nimport type { ExpressMain, Middleware, Request, Response, NextFunction } from '@teambit/express';\nimport { ExpressAspect } from '@teambit/express';\nimport type { Logger, LoggerMain } from '@teambit/logger';\nimport { LoggerAspect } from '@teambit/logger';\nimport type { LanesMain } from '@teambit/lanes';\nimport { LanesAspect } from '@teambit/lanes';\nimport type { RemoveMain } from '@teambit/remove';\nimport { RemoveAspect } from '@teambit/remove';\nimport type { SnappingMain } from '@teambit/snapping';\nimport { SnappingAspect } from '@teambit/snapping';\nimport type { GeneratorMain } from '@teambit/generator';\nimport { GeneratorAspect } from '@teambit/generator';\nimport type { ComponentCompareMain } from '@teambit/component-compare';\nimport { ComponentCompareAspect } from '@teambit/component-compare';\nimport type { ComponentLogMain } from '@teambit/component-log';\nimport { ComponentLogAspect } from '@teambit/component-log';\nimport type { WatcherMain } from '@teambit/watcher';\nimport { WatcherAspect } from '@teambit/watcher';\nimport type { ConfigMain } from '@teambit/config';\nimport { ConfigAspect } from '@teambit/config';\nimport type { ExportMain } from '@teambit/export';\nimport { ExportAspect } from '@teambit/export';\nimport type { CheckoutMain } from '@teambit/checkout';\nimport { CheckoutAspect } from '@teambit/checkout';\nimport type { InstallMain } from '@teambit/install';\nimport { InstallAspect } from '@teambit/install';\nimport type { ImporterMain } from '@teambit/importer';\nimport { ImporterAspect } from '@teambit/importer';\nimport type { Component, ComponentMain } from '@teambit/component';\nimport { ComponentAspect } from '@teambit/component';\nimport type { Workspace } from '@teambit/workspace';\nimport { WorkspaceAspect } from '@teambit/workspace';\nimport { sendEventsToClients } from '@teambit/harmony.modules.send-server-sent-events';\nimport cors from 'cors';\nimport { createProxyMiddleware, fixRequestBody } from 'http-proxy-middleware';\nimport { ApiServerAspect } from './api-server.aspect';\nimport { CLIRoute } from './cli.route';\nimport { ServerCmd } from './server.cmd';\nimport { IDERoute } from './ide.route';\nimport { APIForIDE } from './api-for-ide';\nimport { SSEEventsRoute } from './sse-events.route';\nimport { join } from 'path';\nimport { execSync } from 'child_process';\nimport { CLIRawRoute } from './cli-raw.route';\nimport type { ApplicationMain } from '@teambit/application';\nimport { ApplicationAspect } from '@teambit/application';\nimport type { DeprecationMain } from '@teambit/deprecation';\nimport { DeprecationAspect } from '@teambit/deprecation';\nimport type { EnvsMain } from '@teambit/envs';\nimport { EnvsAspect } from '@teambit/envs';\nimport { DEFAULT_AUTH_TYPE, Http } from '@teambit/scope.network';\nimport { getSymphonyUrl } from '@teambit/legacy.constants';\nimport type { GraphMain } from '@teambit/graph';\nimport { GraphAspect } from '@teambit/graph';\nimport type { ScopeMain } from '@teambit/scope';\nimport { ScopeAspect } from '@teambit/scope';\nimport type { SchemaMain } from '@teambit/schema';\nimport { SchemaAspect } from '@teambit/schema';\n\nexport class ApiServerMain {\n  private serverToken?: string;\n\n  constructor(\n    private workspace: Workspace,\n    private logger: Logger,\n    private express: ExpressMain,\n    private watcher: WatcherMain,\n    private installer: InstallMain,\n    private importer: ImporterMain\n  ) {}\n\n  async runApiServer(options: { port: number; compile: boolean }) {\n    if (!this.workspace) {\n      throw new Error(`unable to run bit-server, the current directory ${process.cwd()} is not a workspace`);\n    }\n\n    this.workspace.registerOnComponentChange(\n      async (\n        component: Component,\n        files: string[], // os absolute paths\n        removedFiles?: string[] // os absolute paths\n      ) => {\n        sendEventsToClients('onComponentChange', {\n          id: component.id.toStringWithoutVersion(),\n          files,\n          removedFiles,\n        });\n      }\n    );\n\n    this.workspace.registerOnBitmapChange(async () => {\n      const lastModifiedTimestamp = await this.workspace.bitMap.getLastModifiedBitmapThroughBit();\n      const secondsPassedSinceLastModified = lastModifiedTimestamp && (Date.now() - lastModifiedTimestamp) / 1000;\n      if (secondsPassedSinceLastModified && secondsPassedSinceLastModified > 1) {\n        // changes by bit were done more than a second ago, so probably this .bitmap change was done by \"git pull\"\n        this.logger.debug(\n          `running import because we assume the .bitmap file has changed due to \"git pull\", last time it was modified by bit was ${secondsPassedSinceLastModified} seconds ago`\n        );\n        await this.importer.importCurrentObjects();\n      }\n      sendEventsToClients('onBitmapChange', {});\n    });\n\n    this.workspace.registerOnWorkspaceConfigChange(async () => {\n      sendEventsToClients('onWorkspaceConfigChange', {});\n    });\n\n    this.workspace.scope.registerOnPostExport(async () => {\n      sendEventsToClients('onPostExport', {});\n    });\n\n    this.installer.registerPostInstall(async () => {\n      sendEventsToClients('onPostInstall', {});\n    });\n\n    await this.watcher.watch({\n      preCompile: false,\n      compile: options.compile,\n    });\n\n    const port = options.port || (await this.getRandomPort());\n\n    // Generate a per-server auth token and persist it to a 0600 file before\n    // any HTTP request can be handled. Clients (e.g. the bit-vscode extension)\n    // read it from <workspace.scope.path>/server-token.txt and send it as\n    // `Authorization: Bearer <token>`. See createAuthMiddleware below.\n    this.writeServerToken();\n\n    // Create the app *before* express.createApp registers routes, so the auth\n    // middleware runs before bodyParser — unauthenticated requests can't\n    // trigger large-body parsing. CORS is registered before auth so 401\n    // responses still carry CORS headers; otherwise browser-based clients\n    // (bit-vscode) see a misleading CORS failure instead of the JSON 401.\n    // The host-check middleware runs first to reject DNS-rebinding attacks\n    // (where a malicious page resolves attacker.example to 127.0.0.1).\n    const app = expressFactory();\n    app.use(this.createHostCheckMiddleware());\n    app.use(\n      cors({\n        origin(origin, callback) {\n          callback(null, true);\n        },\n        credentials: true,\n      })\n    );\n    app.use(this.createAuthMiddleware());\n    this.express.createApp(app);\n    const proxyHeaders = {\n      Authorization: `${DEFAULT_AUTH_TYPE} ${Http.getToken()}`,\n      origin: '',\n      'user-agent': 'bit-vscode-proxy',\n    };\n    const symphonyUrl = getSymphonyUrl();\n    app.use(\n      '/api/cloud-graphql',\n      // eslint-disable-next-line @typescript-eslint/no-misused-promises\n      createProxyMiddleware({\n        target: `${symphonyUrl}/graphql`,\n        changeOrigin: true,\n        headers: proxyHeaders,\n        on: {\n          error: (err, req, res) => {\n            this.logger.error('graphql cloud proxy error', err);\n            // @ts-ignore\n            res.writeHead(500, {\n              'Content-Type': 'text/plain',\n            });\n            res.end('Something went wrong with the proxy server of bit cloud graphql');\n          },\n          proxyReq: fixRequestBody,\n        },\n      })\n    );\n\n    app.use(\n      '/api/cloud-rest',\n      // eslint-disable-next-line @typescript-eslint/no-misused-promises\n      createProxyMiddleware({\n        target: `${symphonyUrl}`,\n        changeOrigin: true,\n        headers: proxyHeaders,\n        on: {\n          proxyRes: (proxyRes) => {\n            proxyRes.headers['Access-Control-Allow-Credentials'] = 'true';\n          },\n          error: (err, req, res) => {\n            this.logger.error('rest cloud proxy error', err);\n            // @ts-ignore\n            res.writeHead(500, {\n              'Content-Type': 'text/plain',\n            });\n            res.end('Something went wrong with the proxy server of bit cloud rest');\n          },\n          proxyReq: fixRequestBody,\n        },\n      })\n    );\n\n    app.use(\n      '/websocket-server/subscriptions',\n      createProxyMiddleware({\n        on: {\n          proxyReqWs: (proxyReq) => {\n            Object.entries(proxyHeaders).forEach(([key, value]) => {\n              proxyReq.setHeader(key, value);\n            });\n          },\n          error: (err) => {\n            this.logger.error('websocket cloud proxy error', err);\n          },\n        },\n        pathFilter: '/',\n        target: symphonyUrl,\n        ws: true,\n        changeOrigin: true,\n      })\n    );\n\n    // Bind to loopback only — never accept connections from the LAN. Clients\n    // are expected to use 127.0.0.1 (or localhost, which resolves to it).\n    const server = await app.listen(port, '127.0.0.1');\n\n    return new Promise((resolve, reject) => {\n      server.on('error', (err) => {\n        reject(err);\n      });\n      server.on('listening', () => {\n        // important! if you change the message here, change it also in server-forever.ts and also in the vscode extension.\n        this.logger.consoleSuccess(`Bit Server is listening on port ${port}`);\n        this.writeUsedPort(port);\n        this.startParentProcessMonitor();\n        resolve(port);\n      });\n    });\n  }\n\n  writeUsedPort(port: number) {\n    const filePath = this.getServerPortFilePath();\n    fs.writeFileSync(filePath, port.toString(), { mode: 0o600 });\n    // Node's `mode` write option is only honored when the file is created.\n    // chmod explicitly so a pre-existing file with broader permissions gets\n    // tightened to 0600.\n    fs.chmodSync(filePath, 0o600);\n  }\n\n  /**\n   * Generate a fresh per-server bearer token and persist it to a 0600 file.\n   * Clients (e.g. the bit-vscode extension) read this file and send the token\n   * as `Authorization: Bearer <token>` on every request.\n   *\n   * Backwards compatibility: clients that don't yet know about this file (older\n   * extension versions) won't send the header and will receive 401 with a\n   * message pointing them at the upgrade. Old bit-server versions don't write\n   * this file, so a new client checking for it gracefully falls back to no\n   * auth header — meaning a NEW extension keeps working against an OLD\n   * bit-server.\n   */\n  private writeServerToken() {\n    const token = crypto.randomBytes(32).toString('hex');\n    const filePath = this.getServerTokenFilePath();\n    fs.writeFileSync(filePath, token, { mode: 0o600 });\n    // Node's `mode` write option is only honored when the file is created.\n    // chmod explicitly so a pre-existing file with broader permissions gets\n    // tightened to 0600.\n    fs.chmodSync(filePath, 0o600);\n    this.serverToken = token;\n  }\n\n  private getServerTokenFilePath() {\n    return join(this.workspace.scope.path, 'server-token.txt');\n  }\n\n  /**\n   * Host-header check: only accept requests targeting a loopback hostname.\n   * Defends against DNS-rebinding attacks where a malicious page on\n   * `evil.example` flips DNS to 127.0.0.1 — the browser sends `Host:\n   * evil.example`, which we reject with 403 here.\n   *\n   * The server already listens on 127.0.0.1 only, so any request reaching us\n   * arrived via loopback. The remaining concern is the *named* origin the\n   * browser thinks it's talking to.\n   */\n  private createHostCheckMiddleware(): Middleware {\n    const allowed = new Set(['localhost', '127.0.0.1', '::1']);\n    return (req: Request, res: Response, next: NextFunction) => {\n      const hostHeader = req.headers.host || '';\n      // Parse hostname from \"host:port\". IPv6 may be bracketed: \"[::1]:1234\"\n      // → \"::1\"; IPv4 / hostname is plain: \"127.0.0.1:1234\" → \"127.0.0.1\".\n      // HTTP hostnames are case-insensitive, so normalize before checking.\n      const match = hostHeader.match(/^\\[([^\\]]+)\\]|^([^:]+)/);\n      const host = match ? (match[1] || match[2]).toLowerCase() : '';\n      if (!allowed.has(host)) {\n        this.logger.debug(`api-server: rejected non-loopback Host header: ${hostHeader}`);\n        res.status(403).end();\n        return;\n      }\n      return next();\n    };\n  }\n\n  /**\n   * Authentication middleware: requires `Authorization: Bearer <serverToken>`\n   * on every request except OPTIONS preflight (handled by cors) and the\n   * unauthenticated `/api/_health` liveness probe.\n   *\n   * GET requests can also authenticate via a `?token=...` query parameter,\n   * since browser-native WebSocket and EventSource cannot set custom headers\n   * from JavaScript. The param is stripped from `req.url` before downstream\n   * handling so the proxy and logs never see it.\n   *\n   * Runs before bodyParser so unauthenticated requests can't trigger\n   * large-body parsing.\n   */\n  private createAuthMiddleware(): Middleware {\n    return (req: Request, res: Response, next: NextFunction) => {\n      if (req.method === 'OPTIONS') return next();\n      // Use req.path (not req.url) so query strings don't bypass the\n      // health-check exemption — e.g. /api/_health?cache-buster=1.\n      if (req.path === '/api/_health') return next();\n\n      const provided = parseBearerToken(req.headers.authorization);\n      let authorized = !!this.serverToken && provided === this.serverToken;\n\n      if (!authorized && this.serverToken && req.method === 'GET') {\n        const queryIdx = req.url.indexOf('?');\n        if (queryIdx >= 0) {\n          const params = new URLSearchParams(req.url.slice(queryIdx + 1));\n          if (params.get('token') === this.serverToken) {\n            authorized = true;\n            params.delete('token');\n            const remaining = params.toString();\n            req.url = req.url.slice(0, queryIdx) + (remaining ? `?${remaining}` : '');\n          }\n        }\n      }\n\n      if (!authorized) {\n        this.logger.debug(`api-server: rejected unauthenticated request to ${req.path}`);\n        res.status(401).jsonp({\n          error: 'unauthorized',\n          message:\n            'This bit-server requires authentication. Please upgrade your bit VS Code extension to the latest version.',\n        });\n        return;\n      }\n      return next();\n    };\n  }\n\n  /**\n   * Monitor the parent process (typically VSCode) and shut down if it dies.\n   *\n   * On Unix-like systems (macOS, Linux), when a parent process dies, orphaned children are\n   * re-parented to PID 1 (init/launchd). By watching for `process.ppid` changing from\n   * the original value to 1, we can detect that the parent exited and proactively\n   * shut down the bit server to avoid leaving stale background processes running.\n   *\n   * Note: This orphan detection does not work on Windows, as Windows does not re-parent\n   * processes to PID 1. On Windows, this method only logs the parent process info at startup.\n   */\n  private startParentProcessMonitor() {\n    const originalPpid = process.ppid;\n\n    // Log parent process info at startup\n    const parentInfo = this.getProcessInfo(originalPpid);\n    this.logger.debug(\n      `bit server started. PID: ${process.pid}, Parent PID: ${originalPpid}, Parent command: ${parentInfo}`\n    );\n\n    // Skip orphan detection on Windows - PPID doesn't change to 1 when parent dies\n    if (process.platform === 'win32') {\n      return;\n    }\n\n    const checkInterval = 5000; // Check every 5 seconds\n    const intervalId = setInterval(() => {\n      const currentPpid = process.ppid;\n      // If PPID changed to 1, our parent (e.g., VSCode) died and we were re-parented to init\n      if (currentPpid === 1 && originalPpid !== 1) {\n        this.logger.debug(\n          `Parent process died (was PID ${originalPpid}: ${parentInfo}). Current PPID is now 1 (init/launchd). Shutting down bit server.`\n        );\n        clearInterval(intervalId);\n        process.exit(0);\n      }\n    }, checkInterval);\n\n    // Don't let this interval keep the process alive if everything else is done\n    intervalId.unref();\n  }\n\n  /**\n   * Get the command/path of a process by its PID.\n   */\n  private getProcessInfo(pid: number): string {\n    try {\n      if (process.platform === 'win32') {\n        // Windows: use PowerShell Get-CimInstance (WMIC is deprecated/removed on modern Windows)\n        const psCommand = `Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}' | Select-Object -ExpandProperty CommandLine`;\n        const output = execSync(`powershell.exe -NoProfile -Command \"${psCommand}\"`, {\n          encoding: 'utf8',\n          timeout: 2000,\n        });\n        return output.trim() || 'unknown';\n      } else {\n        // macOS/Linux: use ps\n        const output = execSync(`ps -o command= -p ${pid}`, { encoding: 'utf8', timeout: 2000 });\n        return output.trim() || 'unknown';\n      }\n    } catch {\n      return 'unknown (process may have exited)';\n    }\n  }\n\n  async getRandomPort() {\n    const startingPort = 4000; // we prefer to have the ports between 4000 and 4999.\n    const randomNumber = crypto.randomInt(startingPort, 5000);\n    const port = await Port.getPort(randomNumber, 65500);\n    return port;\n  }\n\n  async getExistingUsedPort(): Promise<number | undefined> {\n    const filePath = this.getServerPortFilePath();\n    try {\n      const fileContent = await fs.readFile(filePath, 'utf8');\n      return parseInt(fileContent, 10);\n    } catch (err: any) {\n      if (err.code === 'ENOENT') {\n        return undefined;\n      }\n      throw err;\n    }\n  }\n\n  private getServerPortFilePath() {\n    return join(this.workspace.scope.path, 'server-port.txt');\n  }\n\n  static dependencies = [\n    CLIAspect,\n    WorkspaceAspect,\n    LoggerAspect,\n    ExpressAspect,\n    WatcherAspect,\n    SnappingAspect,\n    LanesAspect,\n    InstallAspect,\n    ExportAspect,\n    CheckoutAspect,\n    ComponentLogAspect,\n    ImporterAspect,\n    ComponentCompareAspect,\n    GeneratorAspect,\n    RemoveAspect,\n    ConfigAspect,\n    ApplicationAspect,\n    DeprecationAspect,\n    EnvsAspect,\n    GraphAspect,\n    ScopeAspect,\n    ComponentAspect,\n    SchemaAspect,\n  ];\n  static runtime = MainRuntime;\n  static async provider([\n    cli,\n    workspace,\n    loggerMain,\n    express,\n    watcher,\n    snapping,\n    lanes,\n    installer,\n    exporter,\n    checkout,\n    componentLog,\n    importer,\n    componentCompare,\n    generator,\n    remove,\n    config,\n    application,\n    deprecation,\n    envs,\n    graph,\n    scope,\n    component,\n    schema,\n  ]: [\n    CLIMain,\n    Workspace,\n    LoggerMain,\n    ExpressMain,\n    WatcherMain,\n    SnappingMain,\n    LanesMain,\n    InstallMain,\n    ExportMain,\n    CheckoutMain,\n    ComponentLogMain,\n    ImporterMain,\n    ComponentCompareMain,\n    GeneratorMain,\n    RemoveMain,\n    ConfigMain,\n    ApplicationMain,\n    DeprecationMain,\n    EnvsMain,\n    GraphMain,\n    ScopeMain,\n    ComponentMain,\n    SchemaMain,\n  ]) {\n    const logger = loggerMain.createLogger(ApiServerAspect.id);\n    const apiServer = new ApiServerMain(workspace, logger, express, watcher, installer, importer);\n    cli.register(new ServerCmd(apiServer));\n\n    const apiForIDE = new APIForIDE(\n      workspace,\n      snapping,\n      lanes,\n      installer,\n      exporter,\n      checkout,\n      componentLog,\n      componentCompare,\n      generator,\n      remove,\n      config,\n      application,\n      deprecation,\n      envs,\n      graph,\n      scope,\n      component,\n      schema,\n      logger\n    );\n    const cliRoute = new CLIRoute(logger, cli, apiForIDE);\n    const cliRawRoute = new CLIRawRoute(logger, cli, apiForIDE);\n    const ideRoute = new IDERoute(logger, apiForIDE);\n    const sseEventsRoute = new SSEEventsRoute(logger, cli);\n    // register only when the workspace is available. don't register this on a remote-scope, for security reasons.\n    if (workspace) {\n      express.register([cliRoute, cliRawRoute, ideRoute, sseEventsRoute]);\n    }\n\n    return apiServer;\n  }\n}\n\nApiServerAspect.addRuntime(ApiServerMain);\n\n/**\n * Extract the token from an `Authorization: Bearer <token>` header.\n * Lenient on scheme casing and surrounding whitespace so a slightly\n * non-canonical client header doesn't get rejected.\n */\nfunction parseBearerToken(header: string | undefined): string | undefined {\n  if (!header) return undefined;\n  const match = header.match(/^\\s*Bearer\\s+(\\S+)\\s*$/i);\n  return match?.[1];\n}\n\nexport default ApiServerMain;\n"],"mappings":";;;;;;AACA,SAAAA,KAAA;EAAA,MAAAC,IAAA,GAAAC,OAAA;EAAAF,IAAA,YAAAA,CAAA;IAAA,OAAAC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAE,gBAAA;EAAA,MAAAF,IAAA,GAAAC,OAAA;EAAAC,eAAA,YAAAA,CAAA;IAAA,OAAAF,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAG,SAAA;EAAA,MAAAH,IAAA,GAAAI,sBAAA,CAAAH,OAAA;EAAAE,QAAA,YAAAA,CAAA;IAAA,OAAAH,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAK,QAAA;EAAA,MAAAL,IAAA,GAAAI,sBAAA,CAAAH,OAAA;EAAAI,OAAA,YAAAA,CAAA;IAAA,OAAAL,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAM,SAAA;EAAA,MAAAN,IAAA,GAAAI,sBAAA,CAAAH,OAAA;EAAAK,QAAA,YAAAA,CAAA;IAAA,OAAAN,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAO,UAAA;EAAA,MAAAP,IAAA,GAAAC,OAAA;EAAAM,SAAA,YAAAA,CAAA;IAAA,OAAAP,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAQ,QAAA;EAAA,MAAAR,IAAA,GAAAC,OAAA;EAAAO,OAAA,YAAAA,CAAA;IAAA,OAAAR,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAS,OAAA;EAAA,MAAAT,IAAA,GAAAC,OAAA;EAAAQ,MAAA,YAAAA,CAAA;IAAA,OAAAT,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAU,QAAA;EAAA,MAAAV,IAAA,GAAAC,OAAA;EAAAS,OAAA,YAAAA,CAAA;IAAA,OAAAV,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAW,UAAA;EAAA,MAAAX,IAAA,GAAAC,OAAA;EAAAU,SAAA,YAAAA,CAAA;IAAA,OAAAX,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAY,WAAA;EAAA,MAAAZ,IAAA,GAAAC,OAAA;EAAAW,UAAA,YAAAA,CAAA;IAAA,OAAAZ,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAa,kBAAA;EAAA,MAAAb,IAAA,GAAAC,OAAA;EAAAY,iBAAA,YAAAA,CAAA;IAAA,OAAAb,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAc,cAAA;EAAA,MAAAd,IAAA,GAAAC,OAAA;EAAAa,aAAA,YAAAA,CAAA;IAAA,OAAAd,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAe,SAAA;EAAA,MAAAf,IAAA,GAAAC,OAAA;EAAAc,QAAA,YAAAA,CAAA;IAAA,OAAAf,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAgB,QAAA;EAAA,MAAAhB,IAAA,GAAAC,OAAA;EAAAe,OAAA,YAAAA,CAAA;IAAA,OAAAhB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAiB,QAAA;EAAA,MAAAjB,IAAA,GAAAC,OAAA;EAAAgB,OAAA,YAAAA,CAAA;IAAA,OAAAjB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAkB,UAAA;EAAA,MAAAlB,IAAA,GAAAC,OAAA;EAAAiB,SAAA,YAAAA,CAAA;IAAA,OAAAlB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAmB,SAAA;EAAA,MAAAnB,IAAA,GAAAC,OAAA;EAAAkB,QAAA,YAAAA,CAAA;IAAA,OAAAnB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAoB,UAAA;EAAA,MAAApB,IAAA,GAAAC,OAAA;EAAAmB,SAAA,YAAAA,CAAA;IAAA,OAAApB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAqB,WAAA;EAAA,MAAArB,IAAA,GAAAC,OAAA;EAAAoB,UAAA,YAAAA,CAAA;IAAA,OAAArB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAsB,WAAA;EAAA,MAAAtB,IAAA,GAAAC,OAAA;EAAAqB,UAAA,YAAAA,CAAA;IAAA,OAAAtB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAuB,gBAAA;EAAA,MAAAvB,IAAA,GAAAC,OAAA;EAAAsB,eAAA,YAAAA,CAAA;IAAA,OAAAvB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAwB,MAAA;EAAA,MAAAxB,IAAA,GAAAI,sBAAA,CAAAH,OAAA;EAAAuB,KAAA,YAAAA,CAAA;IAAA,OAAAxB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAyB,qBAAA;EAAA,MAAAzB,IAAA,GAAAC,OAAA;EAAAwB,oBAAA,YAAAA,CAAA;IAAA,OAAAzB,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA0B,WAAA;EAAA,MAAA1B,IAAA,GAAAC,OAAA;EAAAyB,UAAA,YAAAA,CAAA;IAAA,OAAA1B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA2B,MAAA;EAAA,MAAA3B,IAAA,GAAAC,OAAA;EAAA0B,KAAA,YAAAA,CAAA;IAAA,OAAA3B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA4B,QAAA;EAAA,MAAA5B,IAAA,GAAAC,OAAA;EAAA2B,OAAA,YAAAA,CAAA;IAAA,OAAA5B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA6B,KAAA;EAAA,MAAA7B,IAAA,GAAAC,OAAA;EAAA4B,IAAA,YAAAA,CAAA;IAAA,OAAA7B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA8B,WAAA;EAAA,MAAA9B,IAAA,GAAAC,OAAA;EAAA6B,UAAA,YAAAA,CAAA;IAAA,OAAA9B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAA+B,WAAA;EAAA,MAAA/B,IAAA,GAAAC,OAAA;EAAA8B,UAAA,YAAAA,CAAA;IAAA,OAAA/B,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAgC,MAAA;EAAA,MAAAhC,IAAA,GAAAC,OAAA;EAAA+B,KAAA,YAAAA,CAAA;IAAA,OAAAhC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAiC,eAAA;EAAA,MAAAjC,IAAA,GAAAC,OAAA;EAAAgC,cAAA,YAAAA,CAAA;IAAA,OAAAjC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAkC,QAAA;EAAA,MAAAlC,IAAA,GAAAC,OAAA;EAAAiC,OAAA,YAAAA,CAAA;IAAA,OAAAlC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAmC,aAAA;EAAA,MAAAnC,IAAA,GAAAC,OAAA;EAAAkC,YAAA,YAAAA,CAAA;IAAA,OAAAnC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAoC,aAAA;EAAA,MAAApC,IAAA,GAAAC,OAAA;EAAAmC,YAAA,YAAAA,CAAA;IAAA,OAAApC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAqC,MAAA;EAAA,MAAArC,IAAA,GAAAC,OAAA;EAAAoC,KAAA,YAAAA,CAAA;IAAA,OAAArC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAsC,OAAA;EAAA,MAAAtC,IAAA,GAAAC,OAAA;EAAAqC,MAAA,YAAAA,CAAA;IAAA,OAAAtC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAuC,QAAA;EAAA,MAAAvC,IAAA,GAAAC,OAAA;EAAAsC,OAAA,YAAAA,CAAA;IAAA,OAAAvC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAwC,OAAA;EAAA,MAAAxC,IAAA,GAAAC,OAAA;EAAAuC,MAAA,YAAAA,CAAA;IAAA,OAAAxC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAAyC,QAAA;EAAA,MAAAzC,IAAA,GAAAC,OAAA;EAAAwC,OAAA,YAAAA,CAAA;IAAA,OAAAzC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAEA,SAAA0C,QAAA;EAAA,MAAA1C,IAAA,GAAAC,OAAA;EAAAyC,OAAA,YAAAA,CAAA;IAAA,OAAA1C,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAA+C,SAAAI,uBAAAuC,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAAA,SAAAG,gBAAAH,CAAA,EAAAI,CAAA,EAAAC,CAAA,YAAAD,CAAA,GAAAE,cAAA,CAAAF,CAAA,MAAAJ,CAAA,GAAAO,MAAA,CAAAC,cAAA,CAAAR,CAAA,EAAAI,CAAA,IAAAK,KAAA,EAAAJ,CAAA,EAAAK,UAAA,MAAAC,YAAA,MAAAC,QAAA,UAAAZ,CAAA,CAAAI,CAAA,IAAAC,CAAA,EAAAL,CAAA;AAAA,SAAAM,eAAAD,CAAA,QAAAQ,CAAA,GAAAC,YAAA,CAAAT,CAAA,uCAAAQ,CAAA,GAAAA,CAAA,GAAAA,CAAA;AAAA,SAAAC,aAAAT,CAAA,EAAAD,CAAA,2BAAAC,CAAA,KAAAA,CAAA,SAAAA,CAAA,MAAAL,CAAA,GAAAK,CAAA,CAAAU,MAAA,CAAAC,WAAA,kBAAAhB,CAAA,QAAAa,CAAA,GAAAb,CAAA,CAAAiB,IAAA,CAAAZ,CAAA,EAAAD,CAAA,uCAAAS,CAAA,SAAAA,CAAA,YAAAK,SAAA,yEAAAd,CAAA,GAAAe,MAAA,GAAAC,MAAA,EAAAf,CAAA;AAExC,MAAMgB,aAAa,CAAC;EAGzBC,WAAWA,CACDC,SAAoB,EACpBC,MAAc,EACdC,OAAoB,EACpBC,OAAoB,EACpBC,SAAsB,EACtBC,QAAsB,EAC9B;IAAA,KANQL,SAAoB,GAApBA,SAAoB;IAAA,KACpBC,MAAc,GAAdA,MAAc;IAAA,KACdC,OAAoB,GAApBA,OAAoB;IAAA,KACpBC,OAAoB,GAApBA,OAAoB;IAAA,KACpBC,SAAsB,GAAtBA,SAAsB;IAAA,KACtBC,QAAsB,GAAtBA,QAAsB;IAAAzB,eAAA;EAC7B;EAEH,MAAM0B,YAAYA,CAACC,OAA2C,EAAE;IAC9D,IAAI,CAAC,IAAI,CAACP,SAAS,EAAE;MACnB,MAAM,IAAIQ,KAAK,CAAC,mDAAmDC,OAAO,CAACC,GAAG,CAAC,CAAC,qBAAqB,CAAC;IACxG;IAEA,IAAI,CAACV,SAAS,CAACW,yBAAyB,CACtC,OACEC,SAAoB,EACpBC,KAAe,EACfC,YAAuB,KACpB;MACH,IAAAC,qCAAmB,EAAC,mBAAmB,EAAE;QACvCC,EAAE,EAAEJ,SAAS,CAACI,EAAE,CAACC,sBAAsB,CAAC,CAAC;QACzCJ,KAAK;QACLC;MACF,CAAC,CAAC;IACJ,CACF,CAAC;IAED,IAAI,CAACd,SAAS,CAACkB,sBAAsB,CAAC,YAAY;MAChD,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAACnB,SAAS,CAACoB,MAAM,CAACC,+BAA+B,CAAC,CAAC;MAC3F,MAAMC,8BAA8B,GAAGH,qBAAqB,IAAI,CAACI,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGL,qBAAqB,IAAI,IAAI;MAC3G,IAAIG,8BAA8B,IAAIA,8BAA8B,GAAG,CAAC,EAAE;QACxE;QACA,IAAI,CAACrB,MAAM,CAACwB,KAAK,CACf,yHAAyHH,8BAA8B,cACzJ,CAAC;QACD,MAAM,IAAI,CAACjB,QAAQ,CAACqB,oBAAoB,CAAC,CAAC;MAC5C;MACA,IAAAX,qCAAmB,EAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,IAAI,CAACf,SAAS,CAAC2B,+BAA+B,CAAC,YAAY;MACzD,IAAAZ,qCAAmB,EAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC;IAEF,IAAI,CAACf,SAAS,CAAC4B,KAAK,CAACC,oBAAoB,CAAC,YAAY;MACpD,IAAAd,qCAAmB,EAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,IAAI,CAACX,SAAS,CAAC0B,mBAAmB,CAAC,YAAY;MAC7C,IAAAf,qCAAmB,EAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,IAAI,CAACZ,OAAO,CAAC4B,KAAK,CAAC;MACvBC,UAAU,EAAE,KAAK;MACjBC,OAAO,EAAE1B,OAAO,CAAC0B;IACnB,CAAC,CAAC;IAEF,MAAMC,IAAI,GAAG3B,OAAO,CAAC2B,IAAI,KAAK,MAAM,IAAI,CAACC,aAAa,CAAC,CAAC,CAAC;;IAEzD;IACA;IACA;IACA;IACA,IAAI,CAACC,gBAAgB,CAAC,CAAC;;IAEvB;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAMC,GAAG,GAAG,IAAAC,kBAAc,EAAC,CAAC;IAC5BD,GAAG,CAACE,GAAG,CAAC,IAAI,CAACC,yBAAyB,CAAC,CAAC,CAAC;IACzCH,GAAG,CAACE,GAAG,CACL,IAAAE,eAAI,EAAC;MACHC,MAAMA,CAACA,MAAM,EAAEC,QAAQ,EAAE;QACvBA,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;MACtB,CAAC;MACDC,WAAW,EAAE;IACf,CAAC,CACH,CAAC;IACDP,GAAG,CAACE,GAAG,CAAC,IAAI,CAACM,oBAAoB,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC3C,OAAO,CAAC4C,SAAS,CAACT,GAAG,CAAC;IAC3B,MAAMU,YAAY,GAAG;MACnBC,aAAa,EAAE,GAAGC,0BAAiB,IAAIC,aAAI,CAACC,QAAQ,CAAC,CAAC,EAAE;MACxDT,MAAM,EAAE,EAAE;MACV,YAAY,EAAE;IAChB,CAAC;IACD,MAAMU,WAAW,GAAG,IAAAC,wBAAc,EAAC,CAAC;IACpChB,GAAG,CAACE,GAAG,CACL,oBAAoB;IACpB;IACA,IAAAe,4CAAqB,EAAC;MACpBC,MAAM,EAAE,GAAGH,WAAW,UAAU;MAChCI,YAAY,EAAE,IAAI;MAClBC,OAAO,EAAEV,YAAY;MACrBW,EAAE,EAAE;QACFC,KAAK,EAAEA,CAACC,GAAG,EAAEC,GAAG,EAAEC,GAAG,KAAK;UACxB,IAAI,CAAC7D,MAAM,CAAC0D,KAAK,CAAC,2BAA2B,EAAEC,GAAG,CAAC;UACnD;UACAE,GAAG,CAACC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE;UAClB,CAAC,CAAC;UACFD,GAAG,CAACE,GAAG,CAAC,iEAAiE,CAAC;QAC5E,CAAC;QACDC,QAAQ,EAAEC;MACZ;IACF,CAAC,CACH,CAAC;IAED7B,GAAG,CAACE,GAAG,CACL,iBAAiB;IACjB;IACA,IAAAe,4CAAqB,EAAC;MACpBC,MAAM,EAAE,GAAGH,WAAW,EAAE;MACxBI,YAAY,EAAE,IAAI;MAClBC,OAAO,EAAEV,YAAY;MACrBW,EAAE,EAAE;QACFS,QAAQ,EAAGA,QAAQ,IAAK;UACtBA,QAAQ,CAACV,OAAO,CAAC,kCAAkC,CAAC,GAAG,MAAM;QAC/D,CAAC;QACDE,KAAK,EAAEA,CAACC,GAAG,EAAEC,GAAG,EAAEC,GAAG,KAAK;UACxB,IAAI,CAAC7D,MAAM,CAAC0D,KAAK,CAAC,wBAAwB,EAAEC,GAAG,CAAC;UAChD;UACAE,GAAG,CAACC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE;UAClB,CAAC,CAAC;UACFD,GAAG,CAACE,GAAG,CAAC,8DAA8D,CAAC;QACzE,CAAC;QACDC,QAAQ,EAAEC;MACZ;IACF,CAAC,CACH,CAAC;IAED7B,GAAG,CAACE,GAAG,CACL,iCAAiC,EACjC,IAAAe,4CAAqB,EAAC;MACpBI,EAAE,EAAE;QACFU,UAAU,EAAGH,QAAQ,IAAK;UACxBjF,MAAM,CAACqF,OAAO,CAACtB,YAAY,CAAC,CAACuB,OAAO,CAAC,CAAC,CAACC,GAAG,EAAErF,KAAK,CAAC,KAAK;YACrD+E,QAAQ,CAACO,SAAS,CAACD,GAAG,EAAErF,KAAK,CAAC;UAChC,CAAC,CAAC;QACJ,CAAC;QACDyE,KAAK,EAAGC,GAAG,IAAK;UACd,IAAI,CAAC3D,MAAM,CAAC0D,KAAK,CAAC,6BAA6B,EAAEC,GAAG,CAAC;QACvD;MACF,CAAC;MACDa,UAAU,EAAE,GAAG;MACflB,MAAM,EAAEH,WAAW;MACnBsB,EAAE,EAAE,IAAI;MACRlB,YAAY,EAAE;IAChB,CAAC,CACH,CAAC;;IAED;IACA;IACA,MAAMmB,MAAM,GAAG,MAAMtC,GAAG,CAACuC,MAAM,CAAC1C,IAAI,EAAE,WAAW,CAAC;IAElD,OAAO,IAAI2C,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAK;MACtCJ,MAAM,CAACjB,EAAE,CAAC,OAAO,EAAGE,GAAG,IAAK;QAC1BmB,MAAM,CAACnB,GAAG,CAAC;MACb,CAAC,CAAC;MACFe,MAAM,CAACjB,EAAE,CAAC,WAAW,EAAE,MAAM;QAC3B;QACA,IAAI,CAACzD,MAAM,CAAC+E,cAAc,CAAC,mCAAmC9C,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC+C,aAAa,CAAC/C,IAAI,CAAC;QACxB,IAAI,CAACgD,yBAAyB,CAAC,CAAC;QAChCJ,OAAO,CAAC5C,IAAI,CAAC;MACf,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ;EAEA+C,aAAaA,CAAC/C,IAAY,EAAE;IAC1B,MAAMiD,QAAQ,GAAG,IAAI,CAACC,qBAAqB,CAAC,CAAC;IAC7CC,kBAAE,CAACC,aAAa,CAACH,QAAQ,EAAEjD,IAAI,CAACqD,QAAQ,CAAC,CAAC,EAAE;MAAEC,IAAI,EAAE;IAAM,CAAC,CAAC;IAC5D;IACA;IACA;IACAH,kBAAE,CAACI,SAAS,CAACN,QAAQ,EAAE,KAAK,CAAC;EAC/B;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACU/C,gBAAgBA,CAAA,EAAG;IACzB,MAAMsD,KAAK,GAAGC,iBAAM,CAACC,WAAW,CAAC,EAAE,CAAC,CAACL,QAAQ,CAAC,KAAK,CAAC;IACpD,MAAMJ,QAAQ,GAAG,IAAI,CAACU,sBAAsB,CAAC,CAAC;IAC9CR,kBAAE,CAACC,aAAa,CAACH,QAAQ,EAAEO,KAAK,EAAE;MAAEF,IAAI,EAAE;IAAM,CAAC,CAAC;IAClD;IACA;IACA;IACAH,kBAAE,CAACI,SAAS,CAACN,QAAQ,EAAE,KAAK,CAAC;IAC7B,IAAI,CAACW,WAAW,GAAGJ,KAAK;EAC1B;EAEQG,sBAAsBA,CAAA,EAAG;IAC/B,OAAO,IAAAE,YAAI,EAAC,IAAI,CAAC/F,SAAS,CAAC4B,KAAK,CAACoE,IAAI,EAAE,kBAAkB,CAAC;EAC5D;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACUxD,yBAAyBA,CAAA,EAAe;IAC9C,MAAMyD,OAAO,GAAG,IAAIC,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1D,OAAO,CAACrC,GAAY,EAAEC,GAAa,EAAEqC,IAAkB,KAAK;MAC1D,MAAMC,UAAU,GAAGvC,GAAG,CAACJ,OAAO,CAAC4C,IAAI,IAAI,EAAE;MACzC;MACA;MACA;MACA,MAAMC,KAAK,GAAGF,UAAU,CAACE,KAAK,CAAC,wBAAwB,CAAC;MACxD,MAAMD,IAAI,GAAGC,KAAK,GAAG,CAACA,KAAK,CAAC,CAAC,CAAC,IAAIA,KAAK,CAAC,CAAC,CAAC,EAAEC,WAAW,CAAC,CAAC,GAAG,EAAE;MAC9D,IAAI,CAACN,OAAO,CAACO,GAAG,CAACH,IAAI,CAAC,EAAE;QACtB,IAAI,CAACpG,MAAM,CAACwB,KAAK,CAAC,kDAAkD2E,UAAU,EAAE,CAAC;QACjFtC,GAAG,CAAC2C,MAAM,CAAC,GAAG,CAAC,CAACzC,GAAG,CAAC,CAAC;QACrB;MACF;MACA,OAAOmC,IAAI,CAAC,CAAC;IACf,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACUtD,oBAAoBA,CAAA,EAAe;IACzC,OAAO,CAACgB,GAAY,EAAEC,GAAa,EAAEqC,IAAkB,KAAK;MAC1D,IAAItC,GAAG,CAAC6C,MAAM,KAAK,SAAS,EAAE,OAAOP,IAAI,CAAC,CAAC;MAC3C;MACA;MACA,IAAItC,GAAG,CAACmC,IAAI,KAAK,cAAc,EAAE,OAAOG,IAAI,CAAC,CAAC;MAE9C,MAAMQ,QAAQ,GAAGC,gBAAgB,CAAC/C,GAAG,CAACJ,OAAO,CAACoD,aAAa,CAAC;MAC5D,IAAIC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAChB,WAAW,IAAIa,QAAQ,KAAK,IAAI,CAACb,WAAW;MAEpE,IAAI,CAACgB,UAAU,IAAI,IAAI,CAAChB,WAAW,IAAIjC,GAAG,CAAC6C,MAAM,KAAK,KAAK,EAAE;QAC3D,MAAMK,QAAQ,GAAGlD,GAAG,CAACmD,GAAG,CAACC,OAAO,CAAC,GAAG,CAAC;QACrC,IAAIF,QAAQ,IAAI,CAAC,EAAE;UACjB,MAAMG,MAAM,GAAG,IAAIC,eAAe,CAACtD,GAAG,CAACmD,GAAG,CAACI,KAAK,CAACL,QAAQ,GAAG,CAAC,CAAC,CAAC;UAC/D,IAAIG,MAAM,CAACG,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAACvB,WAAW,EAAE;YAC5CgB,UAAU,GAAG,IAAI;YACjBI,MAAM,CAACI,MAAM,CAAC,OAAO,CAAC;YACtB,MAAMC,SAAS,GAAGL,MAAM,CAAC3B,QAAQ,CAAC,CAAC;YACnC1B,GAAG,CAACmD,GAAG,GAAGnD,GAAG,CAACmD,GAAG,CAACI,KAAK,CAAC,CAAC,EAAEL,QAAQ,CAAC,IAAIQ,SAAS,GAAG,IAAIA,SAAS,EAAE,GAAG,EAAE,CAAC;UAC3E;QACF;MACF;MAEA,IAAI,CAACT,UAAU,EAAE;QACf,IAAI,CAAC7G,MAAM,CAACwB,KAAK,CAAC,mDAAmDoC,GAAG,CAACmC,IAAI,EAAE,CAAC;QAChFlC,GAAG,CAAC2C,MAAM,CAAC,GAAG,CAAC,CAACe,KAAK,CAAC;UACpB7D,KAAK,EAAE,cAAc;UACrB8D,OAAO,EACL;QACJ,CAAC,CAAC;QACF;MACF;MACA,OAAOtB,IAAI,CAAC,CAAC;IACf,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACUjB,yBAAyBA,CAAA,EAAG;IAClC,MAAMwC,YAAY,GAAGjH,OAAO,CAACkH,IAAI;;IAEjC;IACA,MAAMC,UAAU,GAAG,IAAI,CAACC,cAAc,CAACH,YAAY,CAAC;IACpD,IAAI,CAACzH,MAAM,CAACwB,KAAK,CACf,4BAA4BhB,OAAO,CAACqH,GAAG,iBAAiBJ,YAAY,qBAAqBE,UAAU,EACrG,CAAC;;IAED;IACA,IAAInH,OAAO,CAACsH,QAAQ,KAAK,OAAO,EAAE;MAChC;IACF;IAEA,MAAMC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5B,MAAMC,UAAU,GAAGC,WAAW,CAAC,MAAM;MACnC,MAAMC,WAAW,GAAG1H,OAAO,CAACkH,IAAI;MAChC;MACA,IAAIQ,WAAW,KAAK,CAAC,IAAIT,YAAY,KAAK,CAAC,EAAE;QAC3C,IAAI,CAACzH,MAAM,CAACwB,KAAK,CACf,gCAAgCiG,YAAY,KAAKE,UAAU,oEAC7D,CAAC;QACDQ,aAAa,CAACH,UAAU,CAAC;QACzBxH,OAAO,CAAC4H,IAAI,CAAC,CAAC,CAAC;MACjB;IACF,CAAC,EAAEL,aAAa,CAAC;;IAEjB;IACAC,UAAU,CAACK,KAAK,CAAC,CAAC;EACpB;;EAEA;AACF;AACA;EACUT,cAAcA,CAACC,GAAW,EAAU;IAC1C,IAAI;MACF,IAAIrH,OAAO,CAACsH,QAAQ,KAAK,OAAO,EAAE;QAChC;QACA,MAAMQ,SAAS,GAAG,sDAAsDT,GAAG,+CAA+C;QAC1H,MAAMU,MAAM,GAAG,IAAAC,yBAAQ,EAAC,uCAAuCF,SAAS,GAAG,EAAE;UAC3EG,QAAQ,EAAE,MAAM;UAChBC,OAAO,EAAE;QACX,CAAC,CAAC;QACF,OAAOH,MAAM,CAACI,IAAI,CAAC,CAAC,IAAI,SAAS;MACnC,CAAC,MAAM;QACL;QACA,MAAMJ,MAAM,GAAG,IAAAC,yBAAQ,EAAC,qBAAqBX,GAAG,EAAE,EAAE;UAAEY,QAAQ,EAAE,MAAM;UAAEC,OAAO,EAAE;QAAK,CAAC,CAAC;QACxF,OAAOH,MAAM,CAACI,IAAI,CAAC,CAAC,IAAI,SAAS;MACnC;IACF,CAAC,CAAC,MAAM;MACN,OAAO,mCAAmC;IAC5C;EACF;EAEA,MAAMzG,aAAaA,CAAA,EAAG;IACpB,MAAM0G,YAAY,GAAG,IAAI,CAAC,CAAC;IAC3B,MAAMC,YAAY,GAAGnD,iBAAM,CAACoD,SAAS,CAACF,YAAY,EAAE,IAAI,CAAC;IACzD,MAAM3G,IAAI,GAAG,MAAM8G,sBAAI,CAACC,OAAO,CAACH,YAAY,EAAE,KAAK,CAAC;IACpD,OAAO5G,IAAI;EACb;EAEA,MAAMgH,mBAAmBA,CAAA,EAAgC;IACvD,MAAM/D,QAAQ,GAAG,IAAI,CAACC,qBAAqB,CAAC,CAAC;IAC7C,IAAI;MACF,MAAM+D,WAAW,GAAG,MAAM9D,kBAAE,CAAC+D,QAAQ,CAACjE,QAAQ,EAAE,MAAM,CAAC;MACvD,OAAOkE,QAAQ,CAACF,WAAW,EAAE,EAAE,CAAC;IAClC,CAAC,CAAC,OAAOvF,GAAQ,EAAE;MACjB,IAAIA,GAAG,CAAC0F,IAAI,KAAK,QAAQ,EAAE;QACzB,OAAOC,SAAS;MAClB;MACA,MAAM3F,GAAG;IACX;EACF;EAEQwB,qBAAqBA,CAAA,EAAG;IAC9B,OAAO,IAAAW,YAAI,EAAC,IAAI,CAAC/F,SAAS,CAAC4B,KAAK,CAACoE,IAAI,EAAE,iBAAiB,CAAC;EAC3D;EA4BA,aAAawD,QAAQA,CAAC,CACpBC,GAAG,EACHzJ,SAAS,EACT0J,UAAU,EACVxJ,OAAO,EACPC,OAAO,EACPwJ,QAAQ,EACRC,KAAK,EACLxJ,SAAS,EACTyJ,QAAQ,EACRC,QAAQ,EACRC,YAAY,EACZ1J,QAAQ,EACR2J,gBAAgB,EAChBC,SAAS,EACTC,MAAM,EACNC,MAAM,EACNC,WAAW,EACXC,WAAW,EACXC,IAAI,EACJC,KAAK,EACL3I,KAAK,EACLhB,SAAS,EACT4J,MAAM,CAyBP,EAAE;IACD,MAAMvK,MAAM,GAAGyJ,UAAU,CAACe,YAAY,CAACC,4BAAe,CAAC1J,EAAE,CAAC;IAC1D,MAAM2J,SAAS,GAAG,IAAI7K,aAAa,CAACE,SAAS,EAAEC,MAAM,EAAEC,OAAO,EAAEC,OAAO,EAAEC,SAAS,EAAEC,QAAQ,CAAC;IAC7FoJ,GAAG,CAACmB,QAAQ,CAAC,KAAIC,mBAAS,EAACF,SAAS,CAAC,CAAC;IAEtC,MAAMG,SAAS,GAAG,KAAIC,sBAAS,EAC7B/K,SAAS,EACT2J,QAAQ,EACRC,KAAK,EACLxJ,SAAS,EACTyJ,QAAQ,EACRC,QAAQ,EACRC,YAAY,EACZC,gBAAgB,EAChBC,SAAS,EACTC,MAAM,EACNC,MAAM,EACNC,WAAW,EACXC,WAAW,EACXC,IAAI,EACJC,KAAK,EACL3I,KAAK,EACLhB,SAAS,EACT4J,MAAM,EACNvK,MACF,CAAC;IACD,MAAM+K,QAAQ,GAAG,KAAIC,gBAAQ,EAAChL,MAAM,EAAEwJ,GAAG,EAAEqB,SAAS,CAAC;IACrD,MAAMI,WAAW,GAAG,KAAIC,qBAAW,EAAClL,MAAM,EAAEwJ,GAAG,EAAEqB,SAAS,CAAC;IAC3D,MAAMM,QAAQ,GAAG,KAAIC,eAAQ,EAACpL,MAAM,EAAE6K,SAAS,CAAC;IAChD,MAAMQ,cAAc,GAAG,KAAIC,2BAAc,EAACtL,MAAM,EAAEwJ,GAAG,CAAC;IACtD;IACA,IAAIzJ,SAAS,EAAE;MACbE,OAAO,CAAC0K,QAAQ,CAAC,CAACI,QAAQ,EAAEE,WAAW,EAAEE,QAAQ,EAAEE,cAAc,CAAC,CAAC;IACrE;IAEA,OAAOX,SAAS;EAClB;AACF;AAACa,OAAA,CAAA1L,aAAA,GAAAA,aAAA;AAAAlB,eAAA,CA1eYkB,aAAa,kBA2XF,CACpB2L,gBAAS,EACTC,4BAAe,EACfC,sBAAY,EACZC,yBAAa,EACbC,wBAAa,EACbC,0BAAc,EACdC,oBAAW,EACXC,wBAAa,EACbC,sBAAY,EACZC,0BAAc,EACdC,kCAAkB,EAClBC,0BAAc,EACdC,0CAAsB,EACtBC,4BAAe,EACfC,sBAAY,EACZC,sBAAY,EACZC,gCAAiB,EACjBC,gCAAiB,EACjBC,kBAAU,EACVC,oBAAW,EACXC,qBAAW,EACXC,4BAAe,EACfC,sBAAY,CACb;AAAAnO,eAAA,CAnZUkB,aAAa,aAoZPkN,kBAAW;AAwF9BtC,4BAAe,CAACuC,UAAU,CAACnN,aAAa,CAAC;;AAEzC;AACA;AACA;AACA;AACA;AACA,SAAS8G,gBAAgBA,CAACsG,MAA0B,EAAsB;EACxE,IAAI,CAACA,MAAM,EAAE,OAAO3D,SAAS;EAC7B,MAAMjD,KAAK,GAAG4G,MAAM,CAAC5G,KAAK,CAAC,yBAAyB,CAAC;EACrD,OAAOA,KAAK,GAAG,CAAC,CAAC;AACnB;AAAC,IAAA6G,QAAA,GAAA3B,OAAA,CAAA7M,OAAA,GAEcmB,aAAa","ignoreList":[]}

package/dist/cli-raw.route.js

@@ -25,6 +25,13 @@ function _path() {
   };
   return data;
 }
+function _tty() {
+  const data = require("tty");
+  _tty = function () {
+    return data;
+  };
+  return data;
+}
 function _chalk() {
   const data = _interopRequireDefault(require("chalk"));
   _chalk = function () {
@@ -57,6 +64,20 @@ function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e
 function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
 function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == typeof i ? i : i + ""; }
 function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != typeof i) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
+/**
+ * Strict allowlist of TTY device paths. Anything not matching is rejected
+ * before we attempt to open it. Combined with an `isatty` check on the
+ * opened fd, this blocks block devices, /proc files, and symlink-redirected
+ * targets.
+ *
+ *   /dev/tty            current process's controlling tty
+ *   /dev/ttyXXXNN       e.g. /dev/ttys000 (macOS), /dev/ttyS0 (Linux)
+ *   /dev/pts/N          pseudo-terminal slaves on Linux
+ *   /dev/ptmx           pseudo-terminal master
+ *   /dev/console        system console
+ */
+const TTY_PATH_RE = /^\/dev\/(tty[a-zA-Z0-9]*|pts\/\d+|ptmx|console)$/;
+
 /**
  * example usage:
  * post to http://localhost:3000/api/cli
@@ -92,13 +113,12 @@ class CLIRawRoute {
         }
       }
 
-      // Validate ttyPath parameter to prevent path traversal
-      if (ttyPath) {
-        // ttyPath should be a legitimate terminal device path (e.g., /dev/ttys000, /dev/pts/0)
-        // Validate it's a device path and doesn't contain traversal sequences
-        if (ttyPath.includes('..') || !(ttyPath.startsWith('/dev/') || ttyPath.startsWith('/proc/'))) {
-          throw new Error(`Invalid ttyPath parameter. Must be a legitimate terminal device path.`);
-        }
+      // Validate ttyPath against a strict allowlist. The earlier check (string
+      // prefix /dev/ or /proc/) was too permissive — it allowed /dev/sda,
+      // /proc/sysrq-trigger, etc. After opening we also verify the fd is a
+      // TTY (catches symlinks pointing outside the allowlist).
+      if (ttyPath && !TTY_PATH_RE.test(ttyPath)) {
+        throw new Error(`Invalid ttyPath parameter. Must be a TTY device under /dev/.`);
       }
       // there are 3 methods to interact with bit-server: 1) SSE, 2) TTY, 3) PTY. See server-commander.ts for more info.
       const isSSE = !ttyPath && !isPty;
@@ -106,16 +126,23 @@ class CLIRawRoute {
       // save the original process.stdout.write method
       const originalStdoutWrite = process.stdout.write;
       const originalStderrWrite = process.stderr.write;
+      let fileHandle;
       if (ttyPath) {
-        const fileHandle = await _fsExtra().default.open(ttyPath, 'w');
+        fileHandle = await _fsExtra().default.open(ttyPath, 'w');
+        if (!(0, _tty().isatty)(fileHandle)) {
+          await _fsExtra().default.close(fileHandle);
+          fileHandle = undefined;
+          throw new Error(`Invalid ttyPath parameter. Path is not a TTY.`);
+        }
+        const ttyFd = fileHandle;
         // @ts-ignore monkey patch the process stdout write method
         process.stdout.write = (chunk, encoding, callback) => {
-          _fsExtra().default.writeSync(fileHandle, chunk.toString());
+          _fsExtra().default.writeSync(ttyFd, chunk.toString());
           return originalStdoutWrite.call(process.stdout, chunk, encoding, callback);
         };
         // @ts-ignore monkey patch the process stderr write method
         process.stderr.write = (chunk, encoding, callback) => {
-          _fsExtra().default.writeSync(fileHandle, chunk.toString());
+          _fsExtra().default.writeSync(ttyFd, chunk.toString());
           return originalStderrWrite.call(process.stdout, chunk, encoding, callback);
         };
       }
@@ -175,6 +202,13 @@ class CLIRawRoute {
         if (ttyPath) {
           process.stdout.write = originalStdoutWrite;
           process.stderr.write = originalStderrWrite;
+          if (fileHandle !== undefined) {
+            try {
+              await _fsExtra().default.close(fileHandle);
+            } catch (err) {
+              this.logger.debug(`cli-raw: failed to close tty fd: ${err.message}`);
+            }
+          }
         }
         if (isSSE) {
           delete process.env.BIT_CLI_SERVER_NO_TTY;

package/dist/cli-raw.route.js.map

@@ -1 +1 @@
-{"version":3,"names":["_cli","data","require","_fsExtra","_interopRequireDefault","_path","_chalk","_legacy","_harmonyModules","_legacy2","e","__esModule","default","_defineProperty","r","t","_toPropertyKey","Object","defineProperty","value","enumerable","configurable","writable","i","_toPrimitive","Symbol","toPrimitive","call","TypeError","String","Number","CLIRawRoute","constructor","logger","cli","apiForIDE","req","res","command","pwd","envBitFeatures","ttyPath","isPty","body","debug","resolvedPwd","path","resolve","currentDir","process","cwd","startsWith","Error","includes","isSSE","originalStdoutWrite","stdout","write","originalStderrWrite","stderr","fileHandle","fs","open","chunk","encoding","callback","writeSync","toString","env","BIT_CLI_SERVER_NO_TTY","loader","shouldSendServerEvents","currentLogger","levelFromArgv","getLevelFromArgv","legacyLogger","switchToConsoleLogger","switchToSSELogger","currentBitFeatures","BIT_FEATURES","shouldReloadFeatureToggle","reloadFeatureToggle","randomNumber","Math","floor","random","commandStr","join","cmdStrLog","logStartCmdHistory","isDaemon","enableChalk","cliParser","CLIParser","commands","groups","onCommandStartSlot","commandRunner","parse","result","runCommand","logFinishCmdHistory","clearStatusLine","json","err","YargsExitWorkaround","helpMsg","exitCode","error","status","jsonp","message","chalk","level","switchToLogger","exports"],"sources":["cli-raw.route.ts"],"sourcesContent":["import type { CLIMain } from '@teambit/cli';\nimport { CLIParser, YargsExitWorkaround } from '@teambit/cli';\nimport fs from 'fs-extra';\nimport path from 'path';\nimport chalk from 'chalk';\nimport type { Route, Request, Response } from '@teambit/express';\nimport type { Logger } from '@teambit/logger';\nimport { logger as legacyLogger, getLevelFromArgv } from '@teambit/legacy.logger';\nimport { reloadFeatureToggle } from '@teambit/harmony.modules.feature-toggle';\nimport { loader } from '@teambit/legacy.loader';\nimport type { APIForIDE } from './api-for-ide';\n\n/**\n * example usage:\n * post to http://localhost:3000/api/cli\n * with the following json as the body\n *\n{\n    \"command\": [\"tag comp1 --build\"]\n}\n */\nexport class CLIRawRoute implements Route {\n  constructor(\n    private logger: Logger,\n    private cli: CLIMain,\n    private apiForIDE: APIForIDE\n  ) {}\n\n  method = 'post';\n  route = '/cli-raw';\n\n  middlewares = [\n    async (req: Request, res: Response) => {\n      const { command, pwd, envBitFeatures, ttyPath, isPty } = req.body;\n      this.logger.debug(`cli-raw server: got request for ${command}`);\n\n      // Validate pwd parameter to prevent path traversal\n      if (pwd) {\n        const resolvedPwd = path.resolve(pwd);\n        const currentDir = process.cwd();\n        if (!resolvedPwd.startsWith(currentDir)) {\n          throw new Error(`Invalid pwd parameter. bit-server: ${currentDir}, pwd: ${pwd}`);\n        }\n      }\n\n      // Validate ttyPath parameter to prevent path traversal\n      if (ttyPath) {\n        // ttyPath should be a legitimate terminal device path (e.g., /dev/ttys000, /dev/pts/0)\n        // Validate it's a device path and doesn't contain traversal sequences\n        if (ttyPath.includes('..') || !(ttyPath.startsWith('/dev/') || ttyPath.startsWith('/proc/'))) {\n          throw new Error(`Invalid ttyPath parameter. Must be a legitimate terminal device path.`);\n        }\n      }\n      // there are 3 methods to interact with bit-server: 1) SSE, 2) TTY, 3) PTY. See server-commander.ts for more info.\n      const isSSE = !ttyPath && !isPty;\n\n      // save the original process.stdout.write method\n      const originalStdoutWrite = process.stdout.write;\n      const originalStderrWrite = process.stderr.write;\n\n      if (ttyPath) {\n        const fileHandle = await fs.open(ttyPath, 'w');\n        // @ts-ignore monkey patch the process stdout write method\n        process.stdout.write = (chunk, encoding, callback) => {\n          fs.writeSync(fileHandle, chunk.toString());\n          return originalStdoutWrite.call(process.stdout, chunk, encoding, callback);\n        };\n        // @ts-ignore monkey patch the process stderr write method\n        process.stderr.write = (chunk, encoding, callback) => {\n          fs.writeSync(fileHandle, chunk.toString());\n          return originalStderrWrite.call(process.stdout, chunk, encoding, callback);\n        };\n      }\n      if (isSSE) {\n        process.env.BIT_CLI_SERVER_NO_TTY = 'true';\n        loader.shouldSendServerEvents = true;\n      }\n\n      let currentLogger;\n      const levelFromArgv = getLevelFromArgv(command);\n      if (levelFromArgv) {\n        currentLogger = legacyLogger.logger;\n        if (ttyPath || isPty) {\n          legacyLogger.switchToConsoleLogger(levelFromArgv);\n        }\n        if (isSSE) {\n          legacyLogger.switchToSSELogger(levelFromArgv);\n        }\n      }\n\n      const currentBitFeatures = process.env.BIT_FEATURES;\n      const shouldReloadFeatureToggle = currentBitFeatures !== envBitFeatures;\n      if (shouldReloadFeatureToggle) {\n        process.env.BIT_FEATURES = envBitFeatures;\n        reloadFeatureToggle();\n      }\n\n      const randomNumber = Math.floor(Math.random() * 10000); // helps to distinguish between commands in the log\n      const commandStr = command.join(' ');\n      const cmdStrLog = `${randomNumber} ${commandStr}`;\n      await this.apiForIDE.logStartCmdHistory(cmdStrLog);\n      legacyLogger.isDaemon = true;\n      enableChalk();\n      const cliParser = new CLIParser(this.cli.commands, this.cli.groups, this.cli.onCommandStartSlot);\n      try {\n        const commandRunner = await cliParser.parse(command);\n        const result = await commandRunner.runCommand(true);\n        await this.apiForIDE.logFinishCmdHistory(cmdStrLog, 0);\n        this.logger.clearStatusLine();\n        res.json(result);\n      } catch (err: any) {\n        this.logger.clearStatusLine();\n        if (err instanceof YargsExitWorkaround) {\n          res.json({ data: err.helpMsg, exitCode: err.exitCode });\n        } else {\n          this.logger.error(`cli-raw server: got an error for ${commandStr}`, err);\n          await this.apiForIDE.logFinishCmdHistory(cmdStrLog, 1);\n          res.status(500);\n          res.jsonp({\n            message: err.message,\n            error: err,\n          });\n        }\n      } finally {\n        // important! at this stage, don't write to stdout/stderr anymore, e.g. don't do \"this.logger.clearStatusLine()\"\n        // because the socket (for pty) is already closed.\n        if (ttyPath) {\n          process.stdout.write = originalStdoutWrite;\n          process.stderr.write = originalStderrWrite;\n        }\n        if (isSSE) {\n          delete process.env.BIT_CLI_SERVER_NO_TTY;\n          loader.shouldSendServerEvents = false;\n        }\n        // change chalk back to false, otherwise, the IDE will have colors. (this is a global setting)\n        chalk.level = 0;\n        if (shouldReloadFeatureToggle) {\n          process.env.BIT_FEATURES = currentBitFeatures;\n          reloadFeatureToggle();\n        }\n        if (currentLogger) {\n          legacyLogger.switchToLogger(currentLogger);\n        }\n      }\n    },\n  ];\n}\n\n/**\n * because this gets called from the express server, which gets spawn from a script, chalk defaults to false.\n * only when calling this route from the terminal, we want colors. on the IDE, we don't want colors.\n */\nfunction enableChalk() {\n  chalk.level = 3;\n}\n"],"mappings":";;;;;;AACA,SAAAA,KAAA;EAAA,MAAAC,IAAA,GAAAC,OAAA;EAAAF,IAAA,YAAAA,CAAA;IAAA,OAAAC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAE,SAAA;EAAA,MAAAF,IAAA,GAAAG,sBAAA,CAAAF,OAAA;EAAAC,QAAA,YAAAA,CAAA;IAAA,OAAAF,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAI,MAAA;EAAA,MAAAJ,IAAA,GAAAG,sBAAA,CAAAF,OAAA;EAAAG,KAAA,YAAAA,CAAA;IAAA,OAAAJ,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAK,OAAA;EAAA,MAAAL,IAAA,GAAAG,sBAAA,CAAAF,OAAA;EAAAI,MAAA,YAAAA,CAAA;IAAA,OAAAL,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAGA,SAAAM,QAAA;EAAA,MAAAN,IAAA,GAAAC,OAAA;EAAAK,OAAA,YAAAA,CAAA;IAAA,OAAAN,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAO,gBAAA;EAAA,MAAAP,IAAA,GAAAC,OAAA;EAAAM,eAAA,YAAAA,CAAA;IAAA,OAAAP,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAQ,SAAA;EAAA,MAAAR,IAAA,GAAAC,OAAA;EAAAO,QAAA,YAAAA,CAAA;IAAA,OAAAR,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAAgD,SAAAG,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAAA,SAAAG,gBAAAH,CAAA,EAAAI,CAAA,EAAAC,CAAA,YAAAD,CAAA,GAAAE,cAAA,CAAAF,CAAA,MAAAJ,CAAA,GAAAO,MAAA,CAAAC,cAAA,CAAAR,CAAA,EAAAI,CAAA,IAAAK,KAAA,EAAAJ,CAAA,EAAAK,UAAA,MAAAC,YAAA,MAAAC,QAAA,UAAAZ,CAAA,CAAAI,CAAA,IAAAC,CAAA,EAAAL,CAAA;AAAA,SAAAM,eAAAD,CAAA,QAAAQ,CAAA,GAAAC,YAAA,CAAAT,CAAA,uCAAAQ,CAAA,GAAAA,CAAA,GAAAA,CAAA;AAAA,SAAAC,aAAAT,CAAA,EAAAD,CAAA,2BAAAC,CAAA,KAAAA,CAAA,SAAAA,CAAA,MAAAL,CAAA,GAAAK,CAAA,CAAAU,MAAA,CAAAC,WAAA,kBAAAhB,CAAA,QAAAa,CAAA,GAAAb,CAAA,CAAAiB,IAAA,CAAAZ,CAAA,EAAAD,CAAA,uCAAAS,CAAA,SAAAA,CAAA,YAAAK,SAAA,yEAAAd,CAAA,GAAAe,MAAA,GAAAC,MAAA,EAAAf,CAAA;AAGhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMgB,WAAW,CAAkB;EACxCC,WAAWA,CACDC,MAAc,EACdC,GAAY,EACZC,SAAoB,EAC5B;IAAA,KAHQF,MAAc,GAAdA,MAAc;IAAA,KACdC,GAAY,GAAZA,GAAY;IAAA,KACZC,SAAoB,GAApBA,SAAoB;IAAAtB,eAAA,iBAGrB,MAAM;IAAAA,eAAA,gBACP,UAAU;IAAAA,eAAA,sBAEJ,CACZ,OAAOuB,GAAY,EAAEC,GAAa,KAAK;MACrC,MAAM;QAAEC,OAAO;QAAEC,GAAG;QAAEC,cAAc;QAAEC,OAAO;QAAEC;MAAM,CAAC,GAAGN,GAAG,CAACO,IAAI;MACjE,IAAI,CAACV,MAAM,CAACW,KAAK,CAAC,mCAAmCN,OAAO,EAAE,CAAC;;MAE/D;MACA,IAAIC,GAAG,EAAE;QACP,MAAMM,WAAW,GAAGC,eAAI,CAACC,OAAO,CAACR,GAAG,CAAC;QACrC,MAAMS,UAAU,GAAGC,OAAO,CAACC,GAAG,CAAC,CAAC;QAChC,IAAI,CAACL,WAAW,CAACM,UAAU,CAACH,UAAU,CAAC,EAAE;UACvC,MAAM,IAAII,KAAK,CAAC,sCAAsCJ,UAAU,UAAUT,GAAG,EAAE,CAAC;QAClF;MACF;;MAEA;MACA,IAAIE,OAAO,EAAE;QACX;QACA;QACA,IAAIA,OAAO,CAACY,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAEZ,OAAO,CAACU,UAAU,CAAC,OAAO,CAAC,IAAIV,OAAO,CAACU,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE;UAC5F,MAAM,IAAIC,KAAK,CAAC,uEAAuE,CAAC;QAC1F;MACF;MACA;MACA,MAAME,KAAK,GAAG,CAACb,OAAO,IAAI,CAACC,KAAK;;MAEhC;MACA,MAAMa,mBAAmB,GAAGN,OAAO,CAACO,MAAM,CAACC,KAAK;MAChD,MAAMC,mBAAmB,GAAGT,OAAO,CAACU,MAAM,CAACF,KAAK;MAEhD,IAAIhB,OAAO,EAAE;QACX,MAAMmB,UAAU,GAAG,MAAMC,kBAAE,CAACC,IAAI,CAACrB,OAAO,EAAE,GAAG,CAAC;QAC9C;QACAQ,OAAO,CAACO,MAAM,CAACC,KAAK,GAAG,CAACM,KAAK,EAAEC,QAAQ,EAAEC,QAAQ,KAAK;UACpDJ,kBAAE,CAACK,SAAS,CAACN,UAAU,EAAEG,KAAK,CAACI,QAAQ,CAAC,CAAC,CAAC;UAC1C,OAAOZ,mBAAmB,CAAC5B,IAAI,CAACsB,OAAO,CAACO,MAAM,EAAEO,KAAK,EAAEC,QAAQ,EAAEC,QAAQ,CAAC;QAC5E,CAAC;QACD;QACAhB,OAAO,CAACU,MAAM,CAACF,KAAK,GAAG,CAACM,KAAK,EAAEC,QAAQ,EAAEC,QAAQ,KAAK;UACpDJ,kBAAE,CAACK,SAAS,CAACN,UAAU,EAAEG,KAAK,CAACI,QAAQ,CAAC,CAAC,CAAC;UAC1C,OAAOT,mBAAmB,CAAC/B,IAAI,CAACsB,OAAO,CAACO,MAAM,EAAEO,KAAK,EAAEC,QAAQ,EAAEC,QAAQ,CAAC;QAC5E,CAAC;MACH;MACA,IAAIX,KAAK,EAAE;QACTL,OAAO,CAACmB,GAAG,CAACC,qBAAqB,GAAG,MAAM;QAC1CC,iBAAM,CAACC,sBAAsB,GAAG,IAAI;MACtC;MAEA,IAAIC,aAAa;MACjB,MAAMC,aAAa,GAAG,IAAAC,0BAAgB,EAACpC,OAAO,CAAC;MAC/C,IAAImC,aAAa,EAAE;QACjBD,aAAa,GAAGG,gBAAY,CAAC1C,MAAM;QACnC,IAAIQ,OAAO,IAAIC,KAAK,EAAE;UACpBiC,gBAAY,CAACC,qBAAqB,CAACH,aAAa,CAAC;QACnD;QACA,IAAInB,KAAK,EAAE;UACTqB,gBAAY,CAACE,iBAAiB,CAACJ,aAAa,CAAC;QAC/C;MACF;MAEA,MAAMK,kBAAkB,GAAG7B,OAAO,CAACmB,GAAG,CAACW,YAAY;MACnD,MAAMC,yBAAyB,GAAGF,kBAAkB,KAAKtC,cAAc;MACvE,IAAIwC,yBAAyB,EAAE;QAC7B/B,OAAO,CAACmB,GAAG,CAACW,YAAY,GAAGvC,cAAc;QACzC,IAAAyC,qCAAmB,EAAC,CAAC;MACvB;MAEA,MAAMC,YAAY,GAAGC,IAAI,CAACC,KAAK,CAACD,IAAI,CAACE,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;MACxD,MAAMC,UAAU,GAAGhD,OAAO,CAACiD,IAAI,CAAC,GAAG,CAAC;MACpC,MAAMC,SAAS,GAAG,GAAGN,YAAY,IAAII,UAAU,EAAE;MACjD,MAAM,IAAI,CAACnD,SAAS,CAACsD,kBAAkB,CAACD,SAAS,CAAC;MAClDb,gBAAY,CAACe,QAAQ,GAAG,IAAI;MAC5BC,WAAW,CAAC,CAAC;MACb,MAAMC,SAAS,GAAG,KAAIC,gBAAS,EAAC,IAAI,CAAC3D,GAAG,CAAC4D,QAAQ,EAAE,IAAI,CAAC5D,GAAG,CAAC6D,MAAM,EAAE,IAAI,CAAC7D,GAAG,CAAC8D,kBAAkB,CAAC;MAChG,IAAI;QACF,MAAMC,aAAa,GAAG,MAAML,SAAS,CAACM,KAAK,CAAC5D,OAAO,CAAC;QACpD,MAAM6D,MAAM,GAAG,MAAMF,aAAa,CAACG,UAAU,CAAC,IAAI,CAAC;QACnD,MAAM,IAAI,CAACjE,SAAS,CAACkE,mBAAmB,CAACb,SAAS,EAAE,CAAC,CAAC;QACtD,IAAI,CAACvD,MAAM,CAACqE,eAAe,CAAC,CAAC;QAC7BjE,GAAG,CAACkE,IAAI,CAACJ,MAAM,CAAC;MAClB,CAAC,CAAC,OAAOK,GAAQ,EAAE;QACjB,IAAI,CAACvE,MAAM,CAACqE,eAAe,CAAC,CAAC;QAC7B,IAAIE,GAAG,YAAYC,0BAAmB,EAAE;UACtCpE,GAAG,CAACkE,IAAI,CAAC;YAAEtG,IAAI,EAAEuG,GAAG,CAACE,OAAO;YAAEC,QAAQ,EAAEH,GAAG,CAACG;UAAS,CAAC,CAAC;QACzD,CAAC,MAAM;UACL,IAAI,CAAC1E,MAAM,CAAC2E,KAAK,CAAC,oCAAoCtB,UAAU,EAAE,EAAEkB,GAAG,CAAC;UACxE,MAAM,IAAI,CAACrE,SAAS,CAACkE,mBAAmB,CAACb,SAAS,EAAE,CAAC,CAAC;UACtDnD,GAAG,CAACwE,MAAM,CAAC,GAAG,CAAC;UACfxE,GAAG,CAACyE,KAAK,CAAC;YACRC,OAAO,EAAEP,GAAG,CAACO,OAAO;YACpBH,KAAK,EAAEJ;UACT,CAAC,CAAC;QACJ;MACF,CAAC,SAAS;QACR;QACA;QACA,IAAI/D,OAAO,EAAE;UACXQ,OAAO,CAACO,MAAM,CAACC,KAAK,GAAGF,mBAAmB;UAC1CN,OAAO,CAACU,MAAM,CAACF,KAAK,GAAGC,mBAAmB;QAC5C;QACA,IAAIJ,KAAK,EAAE;UACT,OAAOL,OAAO,CAACmB,GAAG,CAACC,qBAAqB;UACxCC,iBAAM,CAACC,sBAAsB,GAAG,KAAK;QACvC;QACA;QACAyC,gBAAK,CAACC,KAAK,GAAG,CAAC;QACf,IAAIjC,yBAAyB,EAAE;UAC7B/B,OAAO,CAACmB,GAAG,CAACW,YAAY,GAAGD,kBAAkB;UAC7C,IAAAG,qCAAmB,EAAC,CAAC;QACvB;QACA,IAAIT,aAAa,EAAE;UACjBG,gBAAY,CAACuC,cAAc,CAAC1C,aAAa,CAAC;QAC5C;MACF;IACF,CAAC,CACF;EAvHE;AAwHL;;AAEA;AACA;AACA;AACA;AAHA2C,OAAA,CAAApF,WAAA,GAAAA,WAAA;AAIA,SAAS4D,WAAWA,CAAA,EAAG;EACrBqB,gBAAK,CAACC,KAAK,GAAG,CAAC;AACjB","ignoreList":[]}
+{"version":3,"names":["_cli","data","require","_fsExtra","_interopRequireDefault","_path","_tty","_chalk","_legacy","_harmonyModules","_legacy2","e","__esModule","default","_defineProperty","r","t","_toPropertyKey","Object","defineProperty","value","enumerable","configurable","writable","i","_toPrimitive","Symbol","toPrimitive","call","TypeError","String","Number","TTY_PATH_RE","CLIRawRoute","constructor","logger","cli","apiForIDE","req","res","command","pwd","envBitFeatures","ttyPath","isPty","body","debug","resolvedPwd","path","resolve","currentDir","process","cwd","startsWith","Error","test","isSSE","originalStdoutWrite","stdout","write","originalStderrWrite","stderr","fileHandle","fs","open","isatty","close","undefined","ttyFd","chunk","encoding","callback","writeSync","toString","env","BIT_CLI_SERVER_NO_TTY","loader","shouldSendServerEvents","currentLogger","levelFromArgv","getLevelFromArgv","legacyLogger","switchToConsoleLogger","switchToSSELogger","currentBitFeatures","BIT_FEATURES","shouldReloadFeatureToggle","reloadFeatureToggle","randomNumber","Math","floor","random","commandStr","join","cmdStrLog","logStartCmdHistory","isDaemon","enableChalk","cliParser","CLIParser","commands","groups","onCommandStartSlot","commandRunner","parse","result","runCommand","logFinishCmdHistory","clearStatusLine","json","err","YargsExitWorkaround","helpMsg","exitCode","error","status","jsonp","message","chalk","level","switchToLogger","exports"],"sources":["cli-raw.route.ts"],"sourcesContent":["import type { CLIMain } from '@teambit/cli';\nimport { CLIParser, YargsExitWorkaround } from '@teambit/cli';\nimport fs from 'fs-extra';\nimport path from 'path';\nimport { isatty } from 'tty';\nimport chalk from 'chalk';\nimport type { Route, Request, Response } from '@teambit/express';\nimport type { Logger } from '@teambit/logger';\nimport { logger as legacyLogger, getLevelFromArgv } from '@teambit/legacy.logger';\nimport { reloadFeatureToggle } from '@teambit/harmony.modules.feature-toggle';\nimport { loader } from '@teambit/legacy.loader';\nimport type { APIForIDE } from './api-for-ide';\n\n/**\n * Strict allowlist of TTY device paths. Anything not matching is rejected\n * before we attempt to open it. Combined with an `isatty` check on the\n * opened fd, this blocks block devices, /proc files, and symlink-redirected\n * targets.\n *\n *   /dev/tty            current process's controlling tty\n *   /dev/ttyXXXNN       e.g. /dev/ttys000 (macOS), /dev/ttyS0 (Linux)\n *   /dev/pts/N          pseudo-terminal slaves on Linux\n *   /dev/ptmx           pseudo-terminal master\n *   /dev/console        system console\n */\nconst TTY_PATH_RE = /^\\/dev\\/(tty[a-zA-Z0-9]*|pts\\/\\d+|ptmx|console)$/;\n\n/**\n * example usage:\n * post to http://localhost:3000/api/cli\n * with the following json as the body\n *\n{\n    \"command\": [\"tag comp1 --build\"]\n}\n */\nexport class CLIRawRoute implements Route {\n  constructor(\n    private logger: Logger,\n    private cli: CLIMain,\n    private apiForIDE: APIForIDE\n  ) {}\n\n  method = 'post';\n  route = '/cli-raw';\n\n  middlewares = [\n    async (req: Request, res: Response) => {\n      const { command, pwd, envBitFeatures, ttyPath, isPty } = req.body;\n      this.logger.debug(`cli-raw server: got request for ${command}`);\n\n      // Validate pwd parameter to prevent path traversal\n      if (pwd) {\n        const resolvedPwd = path.resolve(pwd);\n        const currentDir = process.cwd();\n        if (!resolvedPwd.startsWith(currentDir)) {\n          throw new Error(`Invalid pwd parameter. bit-server: ${currentDir}, pwd: ${pwd}`);\n        }\n      }\n\n      // Validate ttyPath against a strict allowlist. The earlier check (string\n      // prefix /dev/ or /proc/) was too permissive — it allowed /dev/sda,\n      // /proc/sysrq-trigger, etc. After opening we also verify the fd is a\n      // TTY (catches symlinks pointing outside the allowlist).\n      if (ttyPath && !TTY_PATH_RE.test(ttyPath)) {\n        throw new Error(`Invalid ttyPath parameter. Must be a TTY device under /dev/.`);\n      }\n      // there are 3 methods to interact with bit-server: 1) SSE, 2) TTY, 3) PTY. See server-commander.ts for more info.\n      const isSSE = !ttyPath && !isPty;\n\n      // save the original process.stdout.write method\n      const originalStdoutWrite = process.stdout.write;\n      const originalStderrWrite = process.stderr.write;\n\n      let fileHandle: number | undefined;\n      if (ttyPath) {\n        fileHandle = await fs.open(ttyPath, 'w');\n        if (!isatty(fileHandle)) {\n          await fs.close(fileHandle);\n          fileHandle = undefined;\n          throw new Error(`Invalid ttyPath parameter. Path is not a TTY.`);\n        }\n        const ttyFd = fileHandle;\n        // @ts-ignore monkey patch the process stdout write method\n        process.stdout.write = (chunk, encoding, callback) => {\n          fs.writeSync(ttyFd, chunk.toString());\n          return originalStdoutWrite.call(process.stdout, chunk, encoding, callback);\n        };\n        // @ts-ignore monkey patch the process stderr write method\n        process.stderr.write = (chunk, encoding, callback) => {\n          fs.writeSync(ttyFd, chunk.toString());\n          return originalStderrWrite.call(process.stdout, chunk, encoding, callback);\n        };\n      }\n      if (isSSE) {\n        process.env.BIT_CLI_SERVER_NO_TTY = 'true';\n        loader.shouldSendServerEvents = true;\n      }\n\n      let currentLogger;\n      const levelFromArgv = getLevelFromArgv(command);\n      if (levelFromArgv) {\n        currentLogger = legacyLogger.logger;\n        if (ttyPath || isPty) {\n          legacyLogger.switchToConsoleLogger(levelFromArgv);\n        }\n        if (isSSE) {\n          legacyLogger.switchToSSELogger(levelFromArgv);\n        }\n      }\n\n      const currentBitFeatures = process.env.BIT_FEATURES;\n      const shouldReloadFeatureToggle = currentBitFeatures !== envBitFeatures;\n      if (shouldReloadFeatureToggle) {\n        process.env.BIT_FEATURES = envBitFeatures;\n        reloadFeatureToggle();\n      }\n\n      const randomNumber = Math.floor(Math.random() * 10000); // helps to distinguish between commands in the log\n      const commandStr = command.join(' ');\n      const cmdStrLog = `${randomNumber} ${commandStr}`;\n      await this.apiForIDE.logStartCmdHistory(cmdStrLog);\n      legacyLogger.isDaemon = true;\n      enableChalk();\n      const cliParser = new CLIParser(this.cli.commands, this.cli.groups, this.cli.onCommandStartSlot);\n      try {\n        const commandRunner = await cliParser.parse(command);\n        const result = await commandRunner.runCommand(true);\n        await this.apiForIDE.logFinishCmdHistory(cmdStrLog, 0);\n        this.logger.clearStatusLine();\n        res.json(result);\n      } catch (err: any) {\n        this.logger.clearStatusLine();\n        if (err instanceof YargsExitWorkaround) {\n          res.json({ data: err.helpMsg, exitCode: err.exitCode });\n        } else {\n          this.logger.error(`cli-raw server: got an error for ${commandStr}`, err);\n          await this.apiForIDE.logFinishCmdHistory(cmdStrLog, 1);\n          res.status(500);\n          res.jsonp({\n            message: err.message,\n            error: err,\n          });\n        }\n      } finally {\n        // important! at this stage, don't write to stdout/stderr anymore, e.g. don't do \"this.logger.clearStatusLine()\"\n        // because the socket (for pty) is already closed.\n        if (ttyPath) {\n          process.stdout.write = originalStdoutWrite;\n          process.stderr.write = originalStderrWrite;\n          if (fileHandle !== undefined) {\n            try {\n              await fs.close(fileHandle);\n            } catch (err) {\n              this.logger.debug(`cli-raw: failed to close tty fd: ${(err as Error).message}`);\n            }\n          }\n        }\n        if (isSSE) {\n          delete process.env.BIT_CLI_SERVER_NO_TTY;\n          loader.shouldSendServerEvents = false;\n        }\n        // change chalk back to false, otherwise, the IDE will have colors. (this is a global setting)\n        chalk.level = 0;\n        if (shouldReloadFeatureToggle) {\n          process.env.BIT_FEATURES = currentBitFeatures;\n          reloadFeatureToggle();\n        }\n        if (currentLogger) {\n          legacyLogger.switchToLogger(currentLogger);\n        }\n      }\n    },\n  ];\n}\n\n/**\n * because this gets called from the express server, which gets spawn from a script, chalk defaults to false.\n * only when calling this route from the terminal, we want colors. on the IDE, we don't want colors.\n */\nfunction enableChalk() {\n  chalk.level = 3;\n}\n"],"mappings":";;;;;;AACA,SAAAA,KAAA;EAAA,MAAAC,IAAA,GAAAC,OAAA;EAAAF,IAAA,YAAAA,CAAA;IAAA,OAAAC,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAE,SAAA;EAAA,MAAAF,IAAA,GAAAG,sBAAA,CAAAF,OAAA;EAAAC,QAAA,YAAAA,CAAA;IAAA,OAAAF,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAI,MAAA;EAAA,MAAAJ,IAAA,GAAAG,sBAAA,CAAAF,OAAA;EAAAG,KAAA,YAAAA,CAAA;IAAA,OAAAJ,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAK,KAAA;EAAA,MAAAL,IAAA,GAAAC,OAAA;EAAAI,IAAA,YAAAA,CAAA;IAAA,OAAAL,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAM,OAAA;EAAA,MAAAN,IAAA,GAAAG,sBAAA,CAAAF,OAAA;EAAAK,MAAA,YAAAA,CAAA;IAAA,OAAAN,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAGA,SAAAO,QAAA;EAAA,MAAAP,IAAA,GAAAC,OAAA;EAAAM,OAAA,YAAAA,CAAA;IAAA,OAAAP,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAQ,gBAAA;EAAA,MAAAR,IAAA,GAAAC,OAAA;EAAAO,eAAA,YAAAA,CAAA;IAAA,OAAAR,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AACA,SAAAS,SAAA;EAAA,MAAAT,IAAA,GAAAC,OAAA;EAAAQ,QAAA,YAAAA,CAAA;IAAA,OAAAT,IAAA;EAAA;EAAA,OAAAA,IAAA;AAAA;AAAgD,SAAAG,uBAAAO,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAAA,SAAAG,gBAAAH,CAAA,EAAAI,CAAA,EAAAC,CAAA,YAAAD,CAAA,GAAAE,cAAA,CAAAF,CAAA,MAAAJ,CAAA,GAAAO,MAAA,CAAAC,cAAA,CAAAR,CAAA,EAAAI,CAAA,IAAAK,KAAA,EAAAJ,CAAA,EAAAK,UAAA,MAAAC,YAAA,MAAAC,QAAA,UAAAZ,CAAA,CAAAI,CAAA,IAAAC,CAAA,EAAAL,CAAA;AAAA,SAAAM,eAAAD,CAAA,QAAAQ,CAAA,GAAAC,YAAA,CAAAT,CAAA,uCAAAQ,CAAA,GAAAA,CAAA,GAAAA,CAAA;AAAA,SAAAC,aAAAT,CAAA,EAAAD,CAAA,2BAAAC,CAAA,KAAAA,CAAA,SAAAA,CAAA,MAAAL,CAAA,GAAAK,CAAA,CAAAU,MAAA,CAAAC,WAAA,kBAAAhB,CAAA,QAAAa,CAAA,GAAAb,CAAA,CAAAiB,IAAA,CAAAZ,CAAA,EAAAD,CAAA,uCAAAS,CAAA,SAAAA,CAAA,YAAAK,SAAA,yEAAAd,CAAA,GAAAe,MAAA,GAAAC,MAAA,EAAAf,CAAA;AAGhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMgB,WAAW,GAAG,kDAAkD;;AAEtE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,WAAW,CAAkB;EACxCC,WAAWA,CACDC,MAAc,EACdC,GAAY,EACZC,SAAoB,EAC5B;IAAA,KAHQF,MAAc,GAAdA,MAAc;IAAA,KACdC,GAAY,GAAZA,GAAY;IAAA,KACZC,SAAoB,GAApBA,SAAoB;IAAAvB,eAAA,iBAGrB,MAAM;IAAAA,eAAA,gBACP,UAAU;IAAAA,eAAA,sBAEJ,CACZ,OAAOwB,GAAY,EAAEC,GAAa,KAAK;MACrC,MAAM;QAAEC,OAAO;QAAEC,GAAG;QAAEC,cAAc;QAAEC,OAAO;QAAEC;MAAM,CAAC,GAAGN,GAAG,CAACO,IAAI;MACjE,IAAI,CAACV,MAAM,CAACW,KAAK,CAAC,mCAAmCN,OAAO,EAAE,CAAC;;MAE/D;MACA,IAAIC,GAAG,EAAE;QACP,MAAMM,WAAW,GAAGC,eAAI,CAACC,OAAO,CAACR,GAAG,CAAC;QACrC,MAAMS,UAAU,GAAGC,OAAO,CAACC,GAAG,CAAC,CAAC;QAChC,IAAI,CAACL,WAAW,CAACM,UAAU,CAACH,UAAU,CAAC,EAAE;UACvC,MAAM,IAAII,KAAK,CAAC,sCAAsCJ,UAAU,UAAUT,GAAG,EAAE,CAAC;QAClF;MACF;;MAEA;MACA;MACA;MACA;MACA,IAAIE,OAAO,IAAI,CAACX,WAAW,CAACuB,IAAI,CAACZ,OAAO,CAAC,EAAE;QACzC,MAAM,IAAIW,KAAK,CAAC,8DAA8D,CAAC;MACjF;MACA;MACA,MAAME,KAAK,GAAG,CAACb,OAAO,IAAI,CAACC,KAAK;;MAEhC;MACA,MAAMa,mBAAmB,GAAGN,OAAO,CAACO,MAAM,CAACC,KAAK;MAChD,MAAMC,mBAAmB,GAAGT,OAAO,CAACU,MAAM,CAACF,KAAK;MAEhD,IAAIG,UAA8B;MAClC,IAAInB,OAAO,EAAE;QACXmB,UAAU,GAAG,MAAMC,kBAAE,CAACC,IAAI,CAACrB,OAAO,EAAE,GAAG,CAAC;QACxC,IAAI,CAAC,IAAAsB,aAAM,EAACH,UAAU,CAAC,EAAE;UACvB,MAAMC,kBAAE,CAACG,KAAK,CAACJ,UAAU,CAAC;UAC1BA,UAAU,GAAGK,SAAS;UACtB,MAAM,IAAIb,KAAK,CAAC,+CAA+C,CAAC;QAClE;QACA,MAAMc,KAAK,GAAGN,UAAU;QACxB;QACAX,OAAO,CAACO,MAAM,CAACC,KAAK,GAAG,CAACU,KAAK,EAAEC,QAAQ,EAAEC,QAAQ,KAAK;UACpDR,kBAAE,CAACS,SAAS,CAACJ,KAAK,EAAEC,KAAK,CAACI,QAAQ,CAAC,CAAC,CAAC;UACrC,OAAOhB,mBAAmB,CAAC7B,IAAI,CAACuB,OAAO,CAACO,MAAM,EAAEW,KAAK,EAAEC,QAAQ,EAAEC,QAAQ,CAAC;QAC5E,CAAC;QACD;QACApB,OAAO,CAACU,MAAM,CAACF,KAAK,GAAG,CAACU,KAAK,EAAEC,QAAQ,EAAEC,QAAQ,KAAK;UACpDR,kBAAE,CAACS,SAAS,CAACJ,KAAK,EAAEC,KAAK,CAACI,QAAQ,CAAC,CAAC,CAAC;UACrC,OAAOb,mBAAmB,CAAChC,IAAI,CAACuB,OAAO,CAACO,MAAM,EAAEW,KAAK,EAAEC,QAAQ,EAAEC,QAAQ,CAAC;QAC5E,CAAC;MACH;MACA,IAAIf,KAAK,EAAE;QACTL,OAAO,CAACuB,GAAG,CAACC,qBAAqB,GAAG,MAAM;QAC1CC,iBAAM,CAACC,sBAAsB,GAAG,IAAI;MACtC;MAEA,IAAIC,aAAa;MACjB,MAAMC,aAAa,GAAG,IAAAC,0BAAgB,EAACxC,OAAO,CAAC;MAC/C,IAAIuC,aAAa,EAAE;QACjBD,aAAa,GAAGG,gBAAY,CAAC9C,MAAM;QACnC,IAAIQ,OAAO,IAAIC,KAAK,EAAE;UACpBqC,gBAAY,CAACC,qBAAqB,CAACH,aAAa,CAAC;QACnD;QACA,IAAIvB,KAAK,EAAE;UACTyB,gBAAY,CAACE,iBAAiB,CAACJ,aAAa,CAAC;QAC/C;MACF;MAEA,MAAMK,kBAAkB,GAAGjC,OAAO,CAACuB,GAAG,CAACW,YAAY;MACnD,MAAMC,yBAAyB,GAAGF,kBAAkB,KAAK1C,cAAc;MACvE,IAAI4C,yBAAyB,EAAE;QAC7BnC,OAAO,CAACuB,GAAG,CAACW,YAAY,GAAG3C,cAAc;QACzC,IAAA6C,qCAAmB,EAAC,CAAC;MACvB;MAEA,MAAMC,YAAY,GAAGC,IAAI,CAACC,KAAK,CAACD,IAAI,CAACE,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;MACxD,MAAMC,UAAU,GAAGpD,OAAO,CAACqD,IAAI,CAAC,GAAG,CAAC;MACpC,MAAMC,SAAS,GAAG,GAAGN,YAAY,IAAII,UAAU,EAAE;MACjD,MAAM,IAAI,CAACvD,SAAS,CAAC0D,kBAAkB,CAACD,SAAS,CAAC;MAClDb,gBAAY,CAACe,QAAQ,GAAG,IAAI;MAC5BC,WAAW,CAAC,CAAC;MACb,MAAMC,SAAS,GAAG,KAAIC,gBAAS,EAAC,IAAI,CAAC/D,GAAG,CAACgE,QAAQ,EAAE,IAAI,CAAChE,GAAG,CAACiE,MAAM,EAAE,IAAI,CAACjE,GAAG,CAACkE,kBAAkB,CAAC;MAChG,IAAI;QACF,MAAMC,aAAa,GAAG,MAAML,SAAS,CAACM,KAAK,CAAChE,OAAO,CAAC;QACpD,MAAMiE,MAAM,GAAG,MAAMF,aAAa,CAACG,UAAU,CAAC,IAAI,CAAC;QACnD,MAAM,IAAI,CAACrE,SAAS,CAACsE,mBAAmB,CAACb,SAAS,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC3D,MAAM,CAACyE,eAAe,CAAC,CAAC;QAC7BrE,GAAG,CAACsE,IAAI,CAACJ,MAAM,CAAC;MAClB,CAAC,CAAC,OAAOK,GAAQ,EAAE;QACjB,IAAI,CAAC3E,MAAM,CAACyE,eAAe,CAAC,CAAC;QAC7B,IAAIE,GAAG,YAAYC,0BAAmB,EAAE;UACtCxE,GAAG,CAACsE,IAAI,CAAC;YAAE5G,IAAI,EAAE6G,GAAG,CAACE,OAAO;YAAEC,QAAQ,EAAEH,GAAG,CAACG;UAAS,CAAC,CAAC;QACzD,CAAC,MAAM;UACL,IAAI,CAAC9E,MAAM,CAAC+E,KAAK,CAAC,oCAAoCtB,UAAU,EAAE,EAAEkB,GAAG,CAAC;UACxE,MAAM,IAAI,CAACzE,SAAS,CAACsE,mBAAmB,CAACb,SAAS,EAAE,CAAC,CAAC;UACtDvD,GAAG,CAAC4E,MAAM,CAAC,GAAG,CAAC;UACf5E,GAAG,CAAC6E,KAAK,CAAC;YACRC,OAAO,EAAEP,GAAG,CAACO,OAAO;YACpBH,KAAK,EAAEJ;UACT,CAAC,CAAC;QACJ;MACF,CAAC,SAAS;QACR;QACA;QACA,IAAInE,OAAO,EAAE;UACXQ,OAAO,CAACO,MAAM,CAACC,KAAK,GAAGF,mBAAmB;UAC1CN,OAAO,CAACU,MAAM,CAACF,KAAK,GAAGC,mBAAmB;UAC1C,IAAIE,UAAU,KAAKK,SAAS,EAAE;YAC5B,IAAI;cACF,MAAMJ,kBAAE,CAACG,KAAK,CAACJ,UAAU,CAAC;YAC5B,CAAC,CAAC,OAAOgD,GAAG,EAAE;cACZ,IAAI,CAAC3E,MAAM,CAACW,KAAK,CAAC,oCAAqCgE,GAAG,CAAWO,OAAO,EAAE,CAAC;YACjF;UACF;QACF;QACA,IAAI7D,KAAK,EAAE;UACT,OAAOL,OAAO,CAACuB,GAAG,CAACC,qBAAqB;UACxCC,iBAAM,CAACC,sBAAsB,GAAG,KAAK;QACvC;QACA;QACAyC,gBAAK,CAACC,KAAK,GAAG,CAAC;QACf,IAAIjC,yBAAyB,EAAE;UAC7BnC,OAAO,CAACuB,GAAG,CAACW,YAAY,GAAGD,kBAAkB;UAC7C,IAAAG,qCAAmB,EAAC,CAAC;QACvB;QACA,IAAIT,aAAa,EAAE;UACjBG,gBAAY,CAACuC,cAAc,CAAC1C,aAAa,CAAC;QAC5C;MACF;IACF,CAAC,CACF;EApIE;AAqIL;;AAEA;AACA;AACA;AACA;AAHA2C,OAAA,CAAAxF,WAAA,GAAAA,WAAA;AAIA,SAASgE,WAAWA,CAAA,EAAG;EACrBqB,gBAAK,CAACC,KAAK,GAAG,CAAC;AACjB","ignoreList":[]}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@teambit/api-server",
-  "version": "1.0.997",
+  "version": "1.0.999",
   "homepage": "https://bit.cloud/teambit/harmony/api-server",
   "main": "dist/index.js",
   "componentId": {
     "scope": "teambit.harmony",
     "name": "api-server",
-    "version": "1.0.997"
+    "version": "1.0.999"
   },
   "dependencies": {
     "filenamify": "4.2.0",
@@ -19,45 +19,45 @@
     "http-proxy-middleware": "^3.0.3",
     "chalk": "4.1.2",
     "pretty-time": "1.1.0",
-    "@teambit/application": "1.0.972",
-    "@teambit/checkout": "1.0.973",
-    "@teambit/component-compare": "1.0.972",
-    "@teambit/component-log": "1.0.972",
     "@teambit/component.modules.component-url": "0.0.187",
     "@teambit/component.modules.merge-helper": "0.0.54",
-    "@teambit/component": "1.0.972",
     "@teambit/config": "0.0.1495",
-    "@teambit/deprecation": "1.0.972",
-    "@teambit/envs": "1.0.972",
-    "@teambit/export": "1.0.972",
-    "@teambit/generator": "1.0.973",
-    "@teambit/graph": "1.0.972",
-    "@teambit/install": "1.0.972",
     "@teambit/lane-id": "0.0.312",
     "@teambit/lanes.modules.diff": "0.0.614",
-    "@teambit/lanes": "1.0.988",
     "@teambit/legacy.consumer": "0.0.111",
     "@teambit/legacy.scope": "0.0.111",
     "@teambit/legacy.utils": "0.0.34",
     "@teambit/logger": "0.0.1413",
-    "@teambit/objects": "0.0.479",
-    "@teambit/remove": "1.0.972",
-    "@teambit/schema": "1.0.972",
-    "@teambit/scope": "1.0.972",
-    "@teambit/snapping": "1.0.972",
-    "@teambit/workspace": "1.0.972",
     "@teambit/harmony": "0.4.7",
     "@teambit/cli": "0.0.1320",
     "@teambit/express": "0.0.1419",
     "@teambit/harmony.modules.send-server-sent-events": "0.0.17",
-    "@teambit/importer": "1.0.972",
     "@teambit/legacy.constants": "0.0.26",
     "@teambit/scope.network": "0.0.111",
     "@teambit/toolbox.network.get-port": "1.0.20",
-    "@teambit/watcher": "1.0.972",
     "@teambit/harmony.modules.feature-toggle": "0.0.36",
     "@teambit/legacy.loader": "0.0.18",
-    "@teambit/legacy.logger": "0.0.38"
+    "@teambit/legacy.logger": "0.0.38",
+    "@teambit/application": "1.0.973",
+    "@teambit/checkout": "1.0.974",
+    "@teambit/component-compare": "1.0.973",
+    "@teambit/component-log": "1.0.973",
+    "@teambit/component": "1.0.973",
+    "@teambit/deprecation": "1.0.973",
+    "@teambit/envs": "1.0.973",
+    "@teambit/export": "1.0.973",
+    "@teambit/generator": "1.0.974",
+    "@teambit/graph": "1.0.973",
+    "@teambit/install": "1.0.973",
+    "@teambit/lanes": "1.0.989",
+    "@teambit/objects": "0.0.480",
+    "@teambit/remove": "1.0.973",
+    "@teambit/schema": "1.0.973",
+    "@teambit/scope": "1.0.973",
+    "@teambit/snapping": "1.0.973",
+    "@teambit/workspace": "1.0.973",
+    "@teambit/importer": "1.0.973",
+    "@teambit/watcher": "1.0.973"
   },
   "devDependencies": {
     "@types/fs-extra": "9.0.7",