@undefineds.co/xpod 0.3.45 → 0.3.48

package/dist/api/chatkit/schema.d.ts

@@ -26,9 +26,7 @@ export declare const Chat: import("@undefineds.co/drizzle-solid/dist/core/schema
 }>>;
 export declare const Thread: import("@undefineds.co/drizzle-solid/dist/core/schema").PodTableWithColumns<import("@undefineds.co/drizzle-solid/dist/core/schema").ResolvedColumns<{
     id: import("@undefineds.co/drizzle-solid/dist/core/schema").PodStringColumn<false, false>;
-    scope: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"uri", null, false, false>;
-    chat: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"uri", null, false, false>;
-    task: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"uri", null, false, false>;
+    parent: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"uri", null, true, false>;
     title: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     status: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, true, true>;
     starred: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"boolean", null, false, true>;

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.d.ts

@@ -1,6 +1,6 @@
 import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
 export interface AutoDetectIdentityProviderHandlerOptions {
-    /** 外部 IdP 的基础 URL，如果提供则启用 Local SP mode. */
+    /** External account authority used by Cloud+Local provisioning metadata. */
     oidcIssuer?: string;
     /** Message used when no source handler is available. */
     message?: string;
@@ -10,10 +10,10 @@ export interface AutoDetectIdentityProviderHandlerOptions {
 /**
  * Auto-detect Identity Provider Handler
  *
- * Local SP mode still needs the local `/.account/*` surface: CSS keeps the
- * OIDC interaction and the scoped WebID picker here, while token validation can
- * trust the configured external issuer. Disabling this surface makes LinX fall
- * back to the Cloud issuer and lets Cloud Pods leak into a Local login flow.
+ * This handler only keeps CSS identity/account pages wired when they are
+ * intentionally opened on this server. It does not make Local SP the token
+ * issuer for Cloud+Local. LinX Cloud+Local login uses Cloud as OIDC issuer and
+ * carries provision scope so storage selection stays bound to the selected SP.
  */
 export declare class AutoDetectIdentityProviderHandler extends HttpHandler {
     private readonly logger;
@@ -23,14 +23,12 @@ export declare class AutoDetectIdentityProviderHandler extends HttpHandler {
     constructor(options?: AutoDetectIdentityProviderHandlerOptions);
     /**
      * 判断是否处理请求
-     * - Local SP mode: delegate local account/consent routes to source Handler
-     * - Standard mode: delegate to source Handler
+     * - Cloud+Local/standard/standalone: delegate account routes to source Handler
      */
     canHandle(input: HttpHandlerInput): Promise<void>;
     /**
      * 处理请求
-     * - Local SP mode: delegate to source Handler so consent remains scoped by SP
-     * - Standard mode: delegate to source Handler
+     * - Cloud+Local/standard/standalone: delegate to source Handler
      */
     handle(input: HttpHandlerInput): Promise<void>;
     /**

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.js

@@ -6,10 +6,10 @@ const community_server_1 = require("@solid/community-server");
 /**
  * Auto-detect Identity Provider Handler
  *
- * Local SP mode still needs the local `/.account/*` surface: CSS keeps the
- * OIDC interaction and the scoped WebID picker here, while token validation can
- * trust the configured external issuer. Disabling this surface makes LinX fall
- * back to the Cloud issuer and lets Cloud Pods leak into a Local login flow.
+ * This handler only keeps CSS identity/account pages wired when they are
+ * intentionally opened on this server. It does not make Local SP the token
+ * issuer for Cloud+Local. LinX Cloud+Local login uses Cloud as OIDC issuer and
+ * carries provision scope so storage selection stays bound to the selected SP.
  */
 class AutoDetectIdentityProviderHandler extends community_server_1.HttpHandler {
     constructor(options = {}) {
@@ -19,7 +19,7 @@ class AutoDetectIdentityProviderHandler extends community_server_1.HttpHandler {
         this.message = options.message ?? 'No source IdentityProviderHandler configured';
         this.source = options.source;
         if (this.oidcIssuer) {
-            this.logger.info(`Local SP mode enabled: account and consent routes stay local, external issuer: ${this.oidcIssuer}`);
+            this.logger.info(`Cloud+Local storage mode enabled: external token issuer ${this.oidcIssuer}`);
         }
         else {
             this.logger.info('Standard mode enabled: delegating identity routes to source IdentityProviderHandler');
@@ -27,8 +27,7 @@ class AutoDetectIdentityProviderHandler extends community_server_1.HttpHandler {
     }
     /**
      * 判断是否处理请求
-     * - Local SP mode: delegate local account/consent routes to source Handler
-     * - Standard mode: delegate to source Handler
+     * - Cloud+Local/standard/standalone: delegate account routes to source Handler
      */
     async canHandle(input) {
         const url = input.request.url ?? '';
@@ -45,8 +44,7 @@ class AutoDetectIdentityProviderHandler extends community_server_1.HttpHandler {
     }
     /**
      * 处理请求
-     * - Local SP mode: delegate to source Handler so consent remains scoped by SP
-     * - Standard mode: delegate to source Handler
+     * - Cloud+Local/standard/standalone: delegate to source Handler
      */
     async handle(input) {
         if (this.source) {

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"AutoDetectIdentityProviderHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectIdentityProviderHandler.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AACrD,8DAIiC;AAWjC;;;;;;;GAOG;AACH,MAAa,iCAAkC,SAAQ,8BAAW;IAMhE,YAAY,UAAoD,EAAE;QAChE,KAAK,EAAE,CAAC;QANO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAO3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,8CAA8C,CAAC;QACjF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kFAAkF,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,KAAuB;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAEpC,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,0CAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,GAAW;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YACjC,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,SAAS,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AA5ED,8EA4EC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n} from '@solid/community-server';\n\nexport interface AutoDetectIdentityProviderHandlerOptions {\n  /** 外部 IdP 的基础 URL，如果提供则启用 Local SP mode. */\n  oidcIssuer?: string;\n  /** Message used when no source handler is available. */\n  message?: string;\n  /** CSS IdentityProviderHandler that owns account, consent and WebID selection routes. */\n  source?: HttpHandler;\n}\n\n/**\n * Auto-detect Identity Provider Handler\n *\n * Local SP mode still needs the local `/.account/*` surface: CSS keeps the\n * OIDC interaction and the scoped WebID picker here, while token validation can\n * trust the configured external issuer. Disabling this surface makes LinX fall\n * back to the Cloud issuer and lets Cloud Pods leak into a Local login flow.\n */\nexport class AutoDetectIdentityProviderHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly oidcIssuer?: string;\n  private readonly message: string;\n  private readonly source?: HttpHandler;\n\n  constructor(options: AutoDetectIdentityProviderHandlerOptions = {}) {\n    super();\n    this.oidcIssuer = options.oidcIssuer;\n    this.message = options.message ?? 'No source IdentityProviderHandler configured';\n    this.source = options.source;\n\n    if (this.oidcIssuer) {\n      this.logger.info(`Local SP mode enabled: account and consent routes stay local, external issuer: ${this.oidcIssuer}`);\n    } else {\n      this.logger.info('Standard mode enabled: delegating identity routes to source IdentityProviderHandler');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - Local SP mode: delegate local account/consent routes to source Handler\n   * - Standard mode: delegate to source Handler\n   */\n  public override async canHandle(input: HttpHandlerInput): Promise<void> {\n    const url = input.request.url ?? '';\n\n    // 检查是否是 IdP 路径\n    if (!this.isIdpPath(url)) {\n      throw new NotImplementedHttpError('Not an IdP request');\n    }\n\n    if (this.source) {\n      await this.source.canHandle(input);\n    } else {\n      throw new NotImplementedHttpError(this.message);\n    }\n  }\n\n  /**\n   * 处理请求\n   * - Local SP mode: delegate to source Handler so consent remains scoped by SP\n   * - Standard mode: delegate to source Handler\n   */\n  public override async handle(input: HttpHandlerInput): Promise<void> {\n    if (this.source) {\n      await this.source.handle(input);\n    } else {\n      throw new NotImplementedHttpError(this.message);\n    }\n  }\n\n  /**\n   * 检查是否是 IdP 路径\n   */\n  private isIdpPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/idp/') ||\n      pathname.startsWith('/.account/') ||\n      pathname === '/register' ||\n      pathname === '/login' ||\n      pathname === '/logout'\n    );\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      return url.split('?')[0];\n    }\n  }\n}\n"]}
+{"version":3,"file":"AutoDetectIdentityProviderHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectIdentityProviderHandler.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AACrD,8DAIiC;AAWjC;;;;;;;GAOG;AACH,MAAa,iCAAkC,SAAQ,8BAAW;IAMhE,YAAY,UAAoD,EAAE;QAChE,KAAK,EAAE,CAAC;QANO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAO3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,8CAA8C,CAAC;QACjF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;OAGG;IACa,KAAK,CAAC,SAAS,CAAC,KAAuB;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAEpC,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,0CAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;OAGG;IACa,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,GAAW;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YACjC,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,SAAS,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AA1ED,8EA0EC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n} from '@solid/community-server';\n\nexport interface AutoDetectIdentityProviderHandlerOptions {\n  /** External account authority used by Cloud+Local provisioning metadata. */\n  oidcIssuer?: string;\n  /** Message used when no source handler is available. */\n  message?: string;\n  /** CSS IdentityProviderHandler that owns account, consent and WebID selection routes. */\n  source?: HttpHandler;\n}\n\n/**\n * Auto-detect Identity Provider Handler\n *\n * This handler only keeps CSS identity/account pages wired when they are\n * intentionally opened on this server. It does not make Local SP the token\n * issuer for Cloud+Local. LinX Cloud+Local login uses Cloud as OIDC issuer and\n * carries provision scope so storage selection stays bound to the selected SP.\n */\nexport class AutoDetectIdentityProviderHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly oidcIssuer?: string;\n  private readonly message: string;\n  private readonly source?: HttpHandler;\n\n  constructor(options: AutoDetectIdentityProviderHandlerOptions = {}) {\n    super();\n    this.oidcIssuer = options.oidcIssuer;\n    this.message = options.message ?? 'No source IdentityProviderHandler configured';\n    this.source = options.source;\n\n    if (this.oidcIssuer) {\n      this.logger.info(`Cloud+Local storage mode enabled: external token issuer ${this.oidcIssuer}`);\n    } else {\n      this.logger.info('Standard mode enabled: delegating identity routes to source IdentityProviderHandler');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - Cloud+Local/standard/standalone: delegate account routes to source Handler\n   */\n  public override async canHandle(input: HttpHandlerInput): Promise<void> {\n    const url = input.request.url ?? '';\n\n    // 检查是否是 IdP 路径\n    if (!this.isIdpPath(url)) {\n      throw new NotImplementedHttpError('Not an IdP request');\n    }\n\n    if (this.source) {\n      await this.source.canHandle(input);\n    } else {\n      throw new NotImplementedHttpError(this.message);\n    }\n  }\n\n  /**\n   * 处理请求\n   * - Cloud+Local/standard/standalone: delegate to source Handler\n   */\n  public override async handle(input: HttpHandlerInput): Promise<void> {\n    if (this.source) {\n      await this.source.handle(input);\n    } else {\n      throw new NotImplementedHttpError(this.message);\n    }\n  }\n\n  /**\n   * 检查是否是 IdP 路径\n   */\n  private isIdpPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/idp/') ||\n      pathname.startsWith('/.account/') ||\n      pathname === '/register' ||\n      pathname === '/login' ||\n      pathname === '/logout'\n    );\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      return url.split('?')[0];\n    }\n  }\n}\n"]}

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld

@@ -12,7 +12,7 @@
       "extends": [
         "css:dist/server/HttpHandler.jsonld#HttpHandler"
       ],
-      "comment": "Auto-detect Identity Provider Handler  Local SP mode still needs the local `/.account/*` surface: CSS keeps the OIDC interaction and the scoped WebID picker here, while token validation can trust the configured external issuer. Disabling this surface makes LinX fall back to the Cloud issuer and lets Cloud Pods leak into a Local login flow.",
+      "comment": "Auto-detect Identity Provider Handler  This handler only keeps CSS identity/account pages wired when they are intentionally opened on this server. It does not make Local SP the token issuer for Cloud+Local. LinX Cloud+Local login uses Cloud as OIDC issuer and carries provision scope so storage selection stays bound to the selected SP.",
       "parameters": [
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_oidcIssuer",
@@ -25,7 +25,7 @@
               }
             ]
           },
-          "comment": "外部 IdP 的基础 URL，如果提供则启用 Local SP mode."
+          "comment": "External account authority used by Cloud+Local provisioning metadata."
         },
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_message",

package/dist/identity/oidc/AutoDetectOidcHandler.d.ts

@@ -1,22 +1,20 @@
 import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
 export interface AutoDetectOidcHandlerOptions {
-    /** External account authority used by Local SP mode. It must not provide local OIDC JWKS. */
+    /** External account authority used by Cloud+Local provisioning metadata. */
     oidcIssuer?: string;
     /** Explanation used when this handler declines OIDC routes. */
     message?: string;
-    /** @deprecated Local OIDC routes must pass through to CSS; this value is ignored. */
+    /** @deprecated This handler does not cache or proxy OIDC metadata. */
     cacheMs?: number;
 }
 /**
  * Auto-detect OIDC Handler
  *
- * 自动检测运行模式：
- * - 如果配置了 oidcIssuer -> Local SP 模式：OIDC discovery/token/JWKS 仍全部由本地 CSS 处理
- * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
- *
- * 注意：Local SP 模式不能禁用本地 account/consent。OIDC 交互页面和
- * scoped WebID picker 必须继续由本地 CSS 提供。Cloud 只作为账号密码校验和
- * Cloud WebID/profile 权威；本地 CSS 颁发的 token 必须由本地 JWKS 验证。
+ * This component does not make Local SP the Cloud+Local OIDC issuer.
+ * Cloud+Local clients obtain tokens from the configured Cloud issuer; Local is
+ * only the storage/provision target. OIDC routes that still exist on this CSS
+ * instance are passed through to the normal CSS handler for same-origin or
+ * Standalone compatibility.
  *
  * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler
  */
@@ -27,8 +25,8 @@ export declare class AutoDetectOidcHandler extends HttpHandler {
     constructor(options?: AutoDetectOidcHandlerOptions);
     /**
      * 判断是否处理请求
-     * - Local SP 模式：所有 OIDC 请求透传给 CSS 本地 OIDC handler
-     * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）
+     * - Cloud+Local: do not handle OIDC here; clients use the Cloud issuer
+     * - Standard/Standalone: pass through to the configured CSS OIDC handler
      */
     canHandle({ request }: HttpHandlerInput): Promise<void>;
     /**

package/dist/identity/oidc/AutoDetectOidcHandler.js

@@ -6,13 +6,11 @@ const community_server_1 = require("@solid/community-server");
 /**
  * Auto-detect OIDC Handler
  *
- * 自动检测运行模式：
- * - 如果配置了 oidcIssuer -> Local SP 模式：OIDC discovery/token/JWKS 仍全部由本地 CSS 处理
- * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
- *
- * 注意：Local SP 模式不能禁用本地 account/consent。OIDC 交互页面和
- * scoped WebID picker 必须继续由本地 CSS 提供。Cloud 只作为账号密码校验和
- * Cloud WebID/profile 权威；本地 CSS 颁发的 token 必须由本地 JWKS 验证。
+ * This component does not make Local SP the Cloud+Local OIDC issuer.
+ * Cloud+Local clients obtain tokens from the configured Cloud issuer; Local is
+ * only the storage/provision target. OIDC routes that still exist on this CSS
+ * instance are passed through to the normal CSS handler for same-origin or
+ * Standalone compatibility.
  *
  * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler
  */
@@ -21,9 +19,9 @@ class AutoDetectOidcHandler extends community_server_1.HttpHandler {
         super();
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
         this.oidcIssuer = options.oidcIssuer;
-        this.message = options.message ?? 'OIDC route handled by local CSS OIDC handler';
+        this.message = options.message ?? 'OIDC route passed through to CSS OIDC handler';
         if (this.oidcIssuer) {
-            this.logger.info(`Local SP mode enabled, account issuer: ${this.oidcIssuer}; OIDC routes pass through to local CSS`);
+            this.logger.info(`Cloud+Local storage mode enabled, token issuer: ${this.oidcIssuer}; OIDC routes pass through to CSS`);
         }
         else {
             this.logger.info('Standard mode enabled, OIDC requests will pass through');
@@ -31,8 +29,8 @@ class AutoDetectOidcHandler extends community_server_1.HttpHandler {
     }
     /**
      * 判断是否处理请求
-     * - Local SP 模式：所有 OIDC 请求透传给 CSS 本地 OIDC handler
-     * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）
+     * - Cloud+Local: do not handle OIDC here; clients use the Cloud issuer
+     * - Standard/Standalone: pass through to the configured CSS OIDC handler
      */
     async canHandle({ request }) {
         const url = request.url ?? '';

package/dist/identity/oidc/AutoDetectOidcHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"AutoDetectOidcHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectOidcHandler.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AACrD,8DAIiC;AAWjC;;;;;;;;;;;;GAYG;AACH,MAAa,qBAAsB,SAAQ,8BAAW;IAKpD,YAAY,UAAwC,EAAE;QACpD,KAAK,EAAE,CAAC;QALO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAM3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,8CAA8C,CAAC;QAEjF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,UAAU,yCAAyC,CAAC,CAAC;QACvH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAE9B,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACa,KAAK,CAAC,MAAM;QAC1B,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,QAAQ,KAAK,mCAAmC;YAChD,QAAQ,KAAK,yCAAyC;YACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAhED,sDAgEC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n} from '@solid/community-server';\n\nexport interface AutoDetectOidcHandlerOptions {\n  /** External account authority used by Local SP mode. It must not provide local OIDC JWKS. */\n  oidcIssuer?: string;\n  /** Explanation used when this handler declines OIDC routes. */\n  message?: string;\n  /** @deprecated Local OIDC routes must pass through to CSS; this value is ignored. */\n  cacheMs?: number;\n}\n\n/**\n * Auto-detect OIDC Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 oidcIssuer -> Local SP 模式：OIDC discovery/token/JWKS 仍全部由本地 CSS 处理\n * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）\n *\n * 注意：Local SP 模式不能禁用本地 account/consent。OIDC 交互页面和\n * scoped WebID picker 必须继续由本地 CSS 提供。Cloud 只作为账号密码校验和\n * Cloud WebID/profile 权威；本地 CSS 颁发的 token 必须由本地 JWKS 验证。\n *\n * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler\n */\nexport class AutoDetectOidcHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly oidcIssuer?: string;\n  private readonly message: string;\n\n  constructor(options: AutoDetectOidcHandlerOptions = {}) {\n    super();\n    this.oidcIssuer = options.oidcIssuer;\n    this.message = options.message ?? 'OIDC route handled by local CSS OIDC handler';\n\n    if (this.oidcIssuer) {\n      this.logger.info(`Local SP mode enabled, account issuer: ${this.oidcIssuer}; OIDC routes pass through to local CSS`);\n    } else {\n      this.logger.info('Standard mode enabled, OIDC requests will pass through');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - Local SP 模式：所有 OIDC 请求透传给 CSS 本地 OIDC handler\n   * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n\n    // 检查是否是 OIDC 路径\n    if (!this.isOidcPath(url)) {\n      throw new NotImplementedHttpError('Not an OIDC request');\n    }\n\n    throw new NotImplementedHttpError(this.message);\n  }\n\n  /**\n   * 处理请求：该 handler 只用于显式透传，不应实际处理 OIDC 请求。\n   */\n  public override async handle(): Promise<void> {\n    throw new NotImplementedHttpError(this.message);\n  }\n\n  /**\n   * 检查是否是 OIDC 路径\n   */\n  private isOidcPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/.oidc/') ||\n      pathname === '/.well-known/openid-configuration' ||\n      pathname === '/.well-known/oauth-authorization-server' ||\n      pathname.startsWith('/idp/')\n    );\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      // 如果解析失败，直接返回 url（可能是相对路径）\n      return url.split('?')[0];\n    }\n  }\n}\n"]}
+{"version":3,"file":"AutoDetectOidcHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectOidcHandler.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AACrD,8DAIiC;AAWjC;;;;;;;;;;GAUG;AACH,MAAa,qBAAsB,SAAQ,8BAAW;IAKpD,YAAY,UAAwC,EAAE;QACpD,KAAK,EAAE,CAAC;QALO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAM3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,+CAA+C,CAAC;QAElF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,IAAI,CAAC,UAAU,mCAAmC,CAAC,CAAC;QAC1H,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAE9B,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACa,KAAK,CAAC,MAAM;QAC1B,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,QAAQ,KAAK,mCAAmC;YAChD,QAAQ,KAAK,yCAAyC;YACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAhED,sDAgEC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n} from '@solid/community-server';\n\nexport interface AutoDetectOidcHandlerOptions {\n  /** External account authority used by Cloud+Local provisioning metadata. */\n  oidcIssuer?: string;\n  /** Explanation used when this handler declines OIDC routes. */\n  message?: string;\n  /** @deprecated This handler does not cache or proxy OIDC metadata. */\n  cacheMs?: number;\n}\n\n/**\n * Auto-detect OIDC Handler\n *\n * This component does not make Local SP the Cloud+Local OIDC issuer.\n * Cloud+Local clients obtain tokens from the configured Cloud issuer; Local is\n * only the storage/provision target. OIDC routes that still exist on this CSS\n * instance are passed through to the normal CSS handler for same-origin or\n * Standalone compatibility.\n *\n * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler\n */\nexport class AutoDetectOidcHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly oidcIssuer?: string;\n  private readonly message: string;\n\n  constructor(options: AutoDetectOidcHandlerOptions = {}) {\n    super();\n    this.oidcIssuer = options.oidcIssuer;\n    this.message = options.message ?? 'OIDC route passed through to CSS OIDC handler';\n\n    if (this.oidcIssuer) {\n      this.logger.info(`Cloud+Local storage mode enabled, token issuer: ${this.oidcIssuer}; OIDC routes pass through to CSS`);\n    } else {\n      this.logger.info('Standard mode enabled, OIDC requests will pass through');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - Cloud+Local: do not handle OIDC here; clients use the Cloud issuer\n   * - Standard/Standalone: pass through to the configured CSS OIDC handler\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n\n    // 检查是否是 OIDC 路径\n    if (!this.isOidcPath(url)) {\n      throw new NotImplementedHttpError('Not an OIDC request');\n    }\n\n    throw new NotImplementedHttpError(this.message);\n  }\n\n  /**\n   * 处理请求：该 handler 只用于显式透传，不应实际处理 OIDC 请求。\n   */\n  public override async handle(): Promise<void> {\n    throw new NotImplementedHttpError(this.message);\n  }\n\n  /**\n   * 检查是否是 OIDC 路径\n   */\n  private isOidcPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/.oidc/') ||\n      pathname === '/.well-known/openid-configuration' ||\n      pathname === '/.well-known/oauth-authorization-server' ||\n      pathname.startsWith('/idp/')\n    );\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      // 如果解析失败，直接返回 url（可能是相对路径）\n      return url.split('?')[0];\n    }\n  }\n}\n"]}

package/dist/identity/oidc/AutoDetectOidcHandler.jsonld

@@ -12,7 +12,7 @@
       "extends": [
         "css:dist/server/HttpHandler.jsonld#HttpHandler"
       ],
-      "comment": "Auto-detect OIDC Handler  自动检测运行模式： - 如果配置了 oidcIssuer -> Local SP 模式：OIDC discovery/token/JWKS 仍全部由本地 CSS 处理 - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）  注意：Local SP 模式不能禁用本地 account/consent。OIDC 交互页面和 scoped WebID picker 必须继续由本地 CSS 提供。Cloud 只作为账号密码校验和 Cloud WebID/profile 权威；本地 CSS 颁发的 token 必须由本地 JWKS 验证。  使用方式：在 HTTP pipeline 中替换默认的 OidcHandler",
+      "comment": "Auto-detect OIDC Handler  This component does not make Local SP the Cloud+Local OIDC issuer. Cloud+Local clients obtain tokens from the configured Cloud issuer; Local is only the storage/provision target. OIDC routes that still exist on this CSS instance are passed through to the normal CSS handler for same-origin or Standalone compatibility.  使用方式：在 HTTP pipeline 中替换默认的 OidcHandler",
       "parameters": [
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_oidcIssuer",
@@ -25,7 +25,7 @@
               }
             ]
           },
-          "comment": "External account authority used by Local SP mode. It must not provide local OIDC JWKS."
+          "comment": "External account authority used by Cloud+Local provisioning metadata."
         },
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_message",

package/dist/main.js

@@ -224,7 +224,7 @@ async function startRuntime(options) {
     logger.info(`  - API (internal): http://localhost:${apiPort}`);
     const supervisor = new supervisor_1.Supervisor();
     const cssBinary = require.resolve('@solid/community-server/bin/server.js');
-    const cssModuleRoot = path_1.default.dirname(require.resolve('@solid/community-server/package.json'));
+    const cssModuleRoot = runtime_1.PACKAGE_ROOT;
     const externalOidcIssuer = (0, oidc_issuer_1.resolveExternalOidcIssuer)(process.env);
     const authMode = (0, AuthMode_1.resolveAuthModeFromEnv)(process.env);
     if (externalOidcIssuer) {

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;;;;;AACA,6CAA2C;AAC3C,mCAAoC;AACpC,iDAAsC;AACtC,4CAAoB;AACpB,gDAAwB;AACxB,iEAA6E;AAC7E,kDAA0B;AAC1B,2CAAwC;AACxC,uCAAoE;AACpE,uDAAsH;AACtH,uDAAkE;AAClE,uDAAkE;AAClE,mFAAgF;AAChF,6CAA0C;AAiC1C,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,IAAI,MAAM,GAAG,IAAA,oCAAY,EAAC,MAAM,CAAC,CAAC;AAClC,MAAM,cAAc,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW;IACjF,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;AAErB,SAAS,UAAU;IACjB,MAAM,aAAa,GAAG,IAAI,qDAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,EAAE;QAC3F,QAAQ,EAAE,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;QAC1D,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAA,8CAAsB,EAAC,aAAa,CAAC,CAAC;IACtC,MAAM,GAAG,IAAA,oCAAY,EAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,GAAG,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;IACtD,OAAO,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAkB,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAyB,CAAC;QAClH,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe;IACzC,IAAI,CAAC;QACH,iGAAiG;QACjG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE;YAChF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,OAAe;IACrC,IAAI,CAAC;QACH,4GAA4G;QAC5G,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE;YAChF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC;QACnD,OAAO,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,OAAe;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE;YAChF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC;QACnD,OAAO,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEpC,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,OAAO,IAAI,GAAG,IAAI,GAAG;QAC9B,MAAM,EAAE;YACN,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAClC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC1B,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;SAC3B;QACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB;IAC7C,UAAU,EAAE,CAAC;IACb,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,eAAe,CAAC;QAC5C,WAAW,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAEzC,IAAI,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,mBAAmB,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,UAAU,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAsB,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEnG,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,UAAU,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAElG,gFAAgF;IAChF,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,YAAY,CAAC;IAE9C,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnC,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,KAAK,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;IAChE,MAAM,CAAC,IAAI,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,IAAI,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,IAAI,uBAAU,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,CAAC;IAC5F,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,6BAA6B,kBAAkB,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IAEnD,MAAM,gBAAgB,GAAG,IAAA,yCAA2B,EAAC;QACnD,UAAU;QACV,WAAW;QACX,QAAQ;QACR,kBAAkB;KACnB,CAAC,CAAC;IAEH,UAAU,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,IAAA,0BAAY,EAAC;YACjB,SAAS;YACT,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,aAAa;YACb,OAAO;YACP,OAAO;YACP,kBAAkB;SACnB,CAAC;QACF,GAAG,EAAE,gBAAgB,CAAC,GAAG;QACzB,GAAG,EAAE,IAAA,8BAAgB,EAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC;KACtE,CAAC,CAAC;IAEH,kDAAkD;IAClD,oDAAoD;IACpD,2CAA2C;IAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC;YACE,IAAI;YACJ,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC;YAClD,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;SACvC;QACH,CAAC,CAAC,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAE7C,UAAU,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,IAAA,8BAAgB,EAAC;YACpB,OAAO;YACP,QAAQ;YACR,OAAO;YACP,OAAO;YACP,YAAY;YACZ,QAAQ;YACR,kBAAkB;SACnB,CAAC;KACH,CAAC,CAAC;IAEH,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;YAC3C,IAAI,QAAQ,KAAK,WAAW;gBAAE,OAAO,WAAW,CAAC;YACjD,IAAI,QAAQ,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YACrC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,KAAK,GAAG,IAAI,sBAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC7D,UAAU,EAAE,IAAI;QAChB,OAAO;KACR,CAAC,CAAC;IACH,KAAK,CAAC,UAAU,CAAC;QACf,GAAG,EAAE,oBAAoB,OAAO,EAAE;QAClC,GAAG,EAAE,oBAAoB,OAAO,EAAE;KACnC,CAAC,CAAC;IAEH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC5B,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IAEpB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAkB,EAAE;QACvC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAElB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAE/C,gFAAgF;QAChF,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAE3B,6DAA6D;QAC7D,IAAI,eAAe,EAAE,CAAC;YACpB,WAAW,CAAC,eAAe,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,eAAe,CAAC;QAC9C,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC3D,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,KAAK,OAAO,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,iBAAiB,CAAC;QAChB,aAAa,EAAE,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI;QACJ,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QACrC,OAAO,EAAE,eAAe;QACxB,UAAU;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAC,MAAc,EAAiB,EAAE;QACtD,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,oBAAoB,CAAC,CAAC;QACpD,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,MAAM,GAAG,KAAK;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG;YACd,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,CAAC;YACP,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,KAAK;QACpB,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACtC,OAAO,EAAE,UAAU,EAAE;KACtB,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,MAAM,GAAG,KAAK;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAiB;YAC5B,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM;gBACf,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,MAAM;aACZ;YACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,SAAS,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK;IAC5E,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAEnD,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,KAAK;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,wCAAwC,SAAS,KAAK;KAChE,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,IAAA,iBAAO,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,CAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAErF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAA,eAAK,EAAC,OAAO,CAAC;aAC9B,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAE,OAAO,EAAE,OAAO,CAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aACtG,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;aACvG,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;aAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aAC1F,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;aACpE,IAAI,EAAE;aACN,KAAK,EAAE,CAAC;QAEX,IAAI,CAAC;YACH,MAAM,YAAY,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAqC;gBAChD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,IAAA,eAAK,EAAC,OAAO,CAAC;SACjB,UAAU,CAAC,MAAM,CAAC;SAClB,OAAO,CACN,KAAK,EACL,kBAAkB,EAClB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACL,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAE,OAAO,EAAE,OAAO,CAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACtG,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;SACvG,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SAC1F,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,EACvE,KAAK,EAAC,IAAI,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,YAAY,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAqC;gBAChD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF;SACA,OAAO,CACN,QAAQ,EACR,qBAAqB,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACL,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAClF,KAAK,EAAC,IAAI,EAAE,EAAE;QACZ,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC,CACF;SACA,OAAO,CACN,QAAQ,EACR,qBAAqB,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACL,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAClF,KAAK,EAAC,IAAI,EAAE,EAAE;QACZ,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC,CACF;SACA,OAAO,CACN,MAAM,EACN,sBAAsB,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACL,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SAC/E,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;SAClG,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAClF,KAAK,EAAC,IAAI,EAAE,EAAE;QACZ,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC,CACF;SACA,aAAa,CAAC,CAAC,CAAC;SAChB,MAAM,EAAE;SACR,IAAI,EAAE;SACN,UAAU,EAAE,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport './runtime/configure-drizzle-solid';\nimport { createHash } from 'crypto';\nimport { spawn } from 'child_process';\nimport fs from 'fs';\nimport path from 'path';\nimport { setGlobalLoggerFactory, getLoggerFor } from 'global-logger-factory';\nimport yargs from 'yargs';\nimport { hideBin } from 'yargs/helpers';\nimport { GatewayProxy, getFreePort, PACKAGE_ROOT } from './runtime';\nimport { buildApiChildEnv, buildCssArgs, buildCssChildEnv, createCssChildRuntimeConfig } from './runtime/css-process';\nimport { resolveExternalOidcIssuer } from './runtime/oidc-issuer';\nimport { resolveAuthModeFromEnv } from './authorization/AuthMode';\nimport { ConfigurableLoggerFactory } from './logging/ConfigurableLoggerFactory';\nimport { Supervisor } from './supervisor';\n\ninterface RuntimeRecord {\n  schemaVersion: '1.0';\n  pid: number;\n  mode: 'local' | 'cloud';\n  port: number;\n  baseUrl: string;\n  publicUrl?: string;\n  envPath?: string;\n  configPath: string;\n  startTime: string;\n}\n\ninterface HealthReport {\n  schemaVersion: '1.0';\n  healthy: boolean;\n  checks: {\n    gateway: 'pass' | 'fail';\n    css: 'pass' | 'fail';\n    api: 'pass' | 'fail';\n  };\n  timestamp: string;\n}\n\ninterface RunOptions {\n  mode?: 'local' | 'cloud';\n  config?: string;\n  env?: string;\n  port?: number;\n  host?: string;\n}\n\nconst EXIT_OK = 0;\nconst EXIT_NOT_RUNNING = 10;\nconst EXIT_CONFIG_ERROR = 20;\nconst EXIT_INTERNAL_ERROR = 50;\n\nlet logger = getLoggerFor('Main');\nconst childJsRuntime = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'\n  ? (process.env.XPOD_NODE_BINARY ?? 'node')\n  : process.execPath;\n\nfunction initLogger(): void {\n  const loggerFactory = new ConfigurableLoggerFactory(process.env.CSS_LOGGING_LEVEL || 'info', {\n    fileName: path.join(process.cwd(), 'logs/xpod-%DATE%.log'),\n    showLocation: true,\n  });\n  setGlobalLoggerFactory(loggerFactory);\n  logger = getLoggerFor('Main');\n}\n\nfunction loadEnvFile(envPath: string): void {\n  if (!fs.existsSync(envPath)) {\n    throw new Error(`Env file not found: ${envPath}`);\n  }\n\n  const content = fs.readFileSync(envPath, 'utf-8');\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    if ((value.startsWith('\"') && value.endsWith('\"')) ||\n        (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1);\n    }\n\n    // Only set if not already defined — CLI / parent env takes precedence.\n    if (process.env[key] === undefined) {\n      process.env[key] = value;\n    }\n  }\n}\n\nfunction ensureTrailingSlash(url: string): string {\n  return url.endsWith('/') ? url : `${url}/`;\n}\n\nfunction resolveInstanceKey(envPath?: string): string {\n  if (!envPath) {\n    return 'default';\n  }\n  const abs = path.resolve(envPath);\n  return createHash('sha256').update(abs).digest('hex').slice(0, 12);\n}\n\nfunction getRuntimeFilePath(envPath?: string): string {\n  const dir = path.join(process.cwd(), '.xpod/runtime');\n  return path.join(dir, `${resolveInstanceKey(envPath)}.json`);\n}\n\nfunction saveRuntimeRecord(record: RuntimeRecord): void {\n  const filePath = getRuntimeFilePath(record.envPath);\n  fs.mkdirSync(path.dirname(filePath), { recursive: true });\n  fs.writeFileSync(filePath, JSON.stringify(record, null, 2), 'utf-8');\n}\n\nfunction loadRuntimeRecord(envPath?: string): RuntimeRecord | undefined {\n  const filePath = getRuntimeFilePath(envPath);\n  if (!fs.existsSync(filePath)) {\n    return undefined;\n  }\n\n  try {\n    return JSON.parse(fs.readFileSync(filePath, 'utf-8')) as RuntimeRecord;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction deleteRuntimeRecord(envPath?: string): void {\n  const filePath = getRuntimeFilePath(envPath);\n  if (fs.existsSync(filePath)) {\n    fs.unlinkSync(filePath);\n  }\n}\n\nfunction isProcessRunning(pid?: number): boolean {\n  if (!pid || pid <= 0) {\n    return false;\n  }\n\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction getVersion(): string {\n  try {\n    const pkg = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf-8')) as { version?: string };\n    return pkg.version ?? 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n\nasync function checkGateway(baseUrl: string): Promise<boolean> {\n  try {\n    // Gateway internal endpoints are exposed under /service/* (legacy /_gateway/* has been removed).\n    const res = await fetch(new URL('/service/status', ensureTrailingSlash(baseUrl)), {\n      signal: AbortSignal.timeout(3000),\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\nasync function checkCss(baseUrl: string): Promise<boolean> {\n  try {\n    // Prefer supervisor status rather than probing CSS routes which can fail on identifier-space/host mismatch.\n    const res = await fetch(new URL('/service/status', ensureTrailingSlash(baseUrl)), {\n      signal: AbortSignal.timeout(3000),\n    });\n    if (!res.ok) {\n      return false;\n    }\n    const items = (await res.json()) as Array<{ name?: string; status?: string }>;\n    const css = items.find((it) => it?.name === 'css');\n    return css?.status === 'running';\n  } catch {\n    return false;\n  }\n}\nasync function checkApi(baseUrl: string): Promise<boolean> {\n  try {\n    const res = await fetch(new URL('/service/status', ensureTrailingSlash(baseUrl)), {\n      signal: AbortSignal.timeout(3000),\n    });\n    if (!res.ok) {\n      return false;\n    }\n    const items = (await res.json()) as Array<{ name?: string; status?: string }>;\n    const api = items.find((it) => it?.name === 'api');\n    return api?.status === 'running';\n  } catch {\n    return false;\n  }\n}\nasync function buildHealth(baseUrl: string): Promise<HealthReport> {\n  const gateway = await checkGateway(baseUrl);\n  const css = await checkCss(baseUrl);\n  const api = await checkApi(baseUrl);\n\n  return {\n    schemaVersion: '1.0',\n    healthy: gateway && css && api,\n    checks: {\n      gateway: gateway ? 'pass' : 'fail',\n      css: css ? 'pass' : 'fail',\n      api: api ? 'pass' : 'fail',\n    },\n    timestamp: new Date().toISOString(),\n  };\n}\n\nfunction outputJson(payload: unknown): void {\n  process.stdout.write(`${JSON.stringify(payload)}\\n`);\n}\n\nfunction exitForCliError(error: unknown): never {\n  const message = error instanceof Error ? error.message : String(error);\n  console.error(`Failed to start: ${message}`);\n  if (message.includes('Env file not found:') || message.includes('Config file not found:')) {\n    process.exit(EXIT_CONFIG_ERROR);\n  }\n  process.exit(EXIT_INTERNAL_ERROR);\n}\n\nasync function startRuntime(options: RunOptions): Promise<void> {\n  initLogger();\n  const resolvedEnvPath = options.env ? path.resolve(options.env) : undefined;\n  if (resolvedEnvPath) {\n    process.env.XPOD_ENV_PATH = resolvedEnvPath;\n    loadEnvFile(resolvedEnvPath);\n  }\n\n  const requestedPort = options.port !== undefined ? Number(options.port) : Number.NaN;\n  const mainPort = Number.isFinite(requestedPort)\n    ? requestedPort\n    : parseInt(process.env.XPOD_PORT ?? process.env.PORT ?? '3000', 10);\n  const host = options.host ?? '127.0.0.1';\n\n  let configPath = path.join(PACKAGE_ROOT, 'config/local.json');\n  if (options.config) {\n    configPath = options.config;\n  } else if (options.mode) {\n    configPath = path.join(PACKAGE_ROOT, `config/${options.mode}.json`);\n  }\n\n  if (!fs.existsSync(configPath)) {\n    throw new Error(`Config file not found: ${configPath}`);\n  }\n\n  const mode: 'local' | 'cloud' = options.mode ?? (configPath.includes('cloud') ? 'cloud' : 'local');\n\n  const baseUrl = ensureTrailingSlash(process.env.CSS_BASE_URL || `http://${host}:${mainPort}`);\n  const cssPort = await getFreePort(mainPort + 1, host);\n  const apiPort = await getFreePort(cssPort + 1, host);\n  const runtimeRoot = path.join(process.cwd(), '.xpod/runtime/legacy-css');\n  const rdfIndexPath = process.env.CSS_RDF_INDEX_PATH || path.join(runtimeRoot, 'rdf-index.sqlite');\n\n  // Make sure GatewayProxy has access to the effective baseUrl for host rewrites.\n  process.env.CSS_BASE_URL = baseUrl;\n  process.env.CSS_RDF_INDEX_PATH = rdfIndexPath;\n\n  logger.info('Orchestration Plan:');\n  logger.info(`  - Main Entry: ${baseUrl} (${host}:${mainPort})`);\n  logger.info(`  - CSS (internal): http://localhost:${cssPort}`);\n  logger.info(`  - API (internal): http://localhost:${apiPort}`);\n\n  const supervisor = new Supervisor();\n  const cssBinary = require.resolve('@solid/community-server/bin/server.js');\n  const cssModuleRoot = path.dirname(require.resolve('@solid/community-server/package.json'));\n  const externalOidcIssuer = resolveExternalOidcIssuer(process.env);\n  const authMode = resolveAuthModeFromEnv(process.env);\n  if (externalOidcIssuer) {\n    logger.info(`  - SP mode external IdP: ${externalOidcIssuer}`);\n  }\n  logger.info(`  - Authorization mode: ${authMode}`);\n\n  const cssRuntimeConfig = createCssChildRuntimeConfig({\n    configPath,\n    runtimeRoot,\n    authMode,\n    externalOidcIssuer,\n  });\n\n  supervisor.register({\n    name: 'css',\n    command: childJsRuntime,\n    args: buildCssArgs({\n      cssBinary,\n      configPath: cssRuntimeConfig.configPath,\n      cssModuleRoot,\n      cssPort,\n      baseUrl,\n      externalOidcIssuer,\n    }),\n    cwd: cssRuntimeConfig.cwd,\n    env: buildCssChildEnv(baseUrl, cssPort, externalOidcIssuer, authMode),\n  });\n\n  // API server: resolve the entry point dynamically\n  // In dev (ts-node): use ts-node to run the .ts file\n  // In production: use the compiled .js file\n  const isDevMode = __filename.endsWith('.ts');\n  const apiArgs = isDevMode\n    ? [\n        '-r',\n        require.resolve('ts-node/register/transpile-only'),\n        path.join(__dirname, 'api', 'main.ts'),\n      ]\n    : [path.join(__dirname, 'api', 'main.js')];\n\n  supervisor.register({\n    name: 'api',\n    command: childJsRuntime,\n    args: apiArgs,\n    env: buildApiChildEnv({\n      apiPort,\n      mainPort,\n      cssPort,\n      baseUrl,\n      rdfIndexPath,\n      authMode,\n      externalOidcIssuer,\n    }),\n  });\n\n  // Bind host: use CLI --host value; if not explicitly set, derive from the public Base URL.\n  // In local dev/sandboxed environments, binding 0.0.0.0 can fail with EPERM.\n  const bindHost = options.host || (() => {\n    try {\n      const hostname = new URL(baseUrl).hostname;\n      if (hostname === 'localhost') return '127.0.0.1';\n      if (hostname === '::1') return '::1';\n      if (hostname.startsWith('127.')) return hostname;\n    } catch {\n      // ignore\n    }\n    return '0.0.0.0';\n  })();\n\n  const proxy = new GatewayProxy(mainPort, supervisor, bindHost, {\n    exitOnStop: true,\n    baseUrl,\n  });\n  proxy.setTargets({\n    css: `http://localhost:${cssPort}`,\n    api: `http://localhost:${apiPort}`,\n  });\n\n  await supervisor.startAll();\n  await proxy.start();\n\n  let restarting = false;\n  const restart = async(): Promise<void> => {\n    if (restarting) {\n      return;\n    }\n    restarting = true;\n\n    logger.info('Received SIGUSR1, restarting...');\n\n    // Remove runtime record first so status does not point at a process going down.\n    deleteRuntimeRecord(resolvedEnvPath);\n\n    try {\n      await proxy.stop();\n    } catch (err) {\n      logger.warn(`Failed to stop gateway server: ${String(err)}`);\n    }\n\n    await supervisor.stopAll();\n\n    // Reload env from file (dashboard writes into the env file).\n    if (resolvedEnvPath) {\n      loadEnvFile(resolvedEnvPath);\n      process.env.XPOD_ENV_PATH = resolvedEnvPath;\n    }\n\n    const child = spawn(process.execPath, process.argv.slice(1), {\n      stdio: 'inherit',\n      env: process.env,\n    });\n    child.unref();\n    process.exit(EXIT_OK);\n  };\n\n  process.on('SIGUSR1', () => {\n    void restart();\n  });\n\n  saveRuntimeRecord({\n    schemaVersion: '1.0',\n    pid: process.pid,\n    mode,\n    port: mainPort,\n    baseUrl,\n    publicUrl: process.env.CSS_PUBLIC_URL,\n    envPath: resolvedEnvPath,\n    configPath,\n    startTime: new Date().toISOString(),\n  });\n\n  const shutdown = async(signal: string): Promise<void> => {\n    logger.info(`Received ${signal}, shutting down...`);\n    deleteRuntimeRecord(resolvedEnvPath);\n    await proxy.stop();\n    await supervisor.stopAll();\n    process.exit(EXIT_OK);\n  };\n\n  process.on('SIGTERM', () => shutdown('SIGTERM'));\n  process.on('SIGINT', () => shutdown('SIGINT'));\n}\n\nasync function commandStatus(envPath?: string, asJson = false): Promise<void> {\n  const resolvedEnvPath = envPath ? path.resolve(envPath) : undefined;\n  const runtime = loadRuntimeRecord(resolvedEnvPath);\n  if (!runtime) {\n    const payload = {\n      schemaVersion: '1.0',\n      running: false,\n      ready: false,\n      baseUrl: '',\n      port: 0,\n      mode: 'local',\n      version: getVersion(),\n    };\n    if (asJson) {\n      outputJson(payload);\n    } else {\n      console.log('xpod is not running');\n    }\n    process.exit(EXIT_NOT_RUNNING);\n  }\n\n  const running = isProcessRunning(runtime.pid);\n  const health = running ? await buildHealth(runtime.baseUrl) : undefined;\n\n  const payload = {\n    schemaVersion: '1.0',\n    running,\n    ready: Boolean(health?.healthy),\n    baseUrl: runtime.baseUrl,\n    publicUrl: runtime.publicUrl,\n    port: runtime.port,\n    mode: runtime.mode,\n    pid: running ? runtime.pid : undefined,\n    version: getVersion(),\n  };\n\n  if (asJson) {\n    outputJson(payload);\n  } else {\n    console.log(payload);\n  }\n\n  process.exit(running ? EXIT_OK : EXIT_NOT_RUNNING);\n}\n\nasync function commandHealth(envPath?: string, asJson = false): Promise<void> {\n  const resolvedEnvPath = envPath ? path.resolve(envPath) : undefined;\n  const runtime = loadRuntimeRecord(resolvedEnvPath);\n  if (!runtime || !isProcessRunning(runtime.pid)) {\n    const payload: HealthReport = {\n      schemaVersion: '1.0',\n      healthy: false,\n      checks: {\n        gateway: 'fail',\n        css: 'fail',\n        api: 'fail',\n      },\n      timestamp: new Date().toISOString(),\n    };\n\n    if (asJson) {\n      outputJson(payload);\n    } else {\n      console.log(payload);\n    }\n    process.exit(EXIT_NOT_RUNNING);\n  }\n\n  const payload = await buildHealth(runtime.baseUrl);\n  if (asJson) {\n    outputJson(payload);\n  } else {\n    console.log(payload);\n  }\n  process.exit(payload.healthy ? EXIT_OK : EXIT_INTERNAL_ERROR);\n}\n\nasync function commandStop(envPath?: string, timeoutMs = 10000, asJson = false): Promise<void> {\n  const resolvedEnvPath = envPath ? path.resolve(envPath) : undefined;\n  const runtime = loadRuntimeRecord(resolvedEnvPath);\n\n  if (!runtime || !isProcessRunning(runtime.pid)) {\n    deleteRuntimeRecord(resolvedEnvPath);\n    const payload = { stopped: true, running: false };\n    if (asJson) {\n      outputJson(payload);\n    } else {\n      console.log('xpod is already stopped');\n    }\n    process.exit(EXIT_OK);\n  }\n\n  process.kill(runtime.pid, 'SIGTERM');\n  const start = Date.now();\n  while (Date.now() - start < timeoutMs) {\n    if (!isProcessRunning(runtime.pid)) {\n      deleteRuntimeRecord(resolvedEnvPath);\n      const payload = { stopped: true, pid: runtime.pid };\n      if (asJson) {\n        outputJson(payload);\n      } else {\n        console.log(`xpod stopped (pid=${runtime.pid})`);\n      }\n      process.exit(EXIT_OK);\n    }\n    await new Promise((resolve) => setTimeout(resolve, 200));\n  }\n\n  const payload = {\n    stopped: false,\n    pid: runtime.pid,\n    message: `timeout waiting for process to stop (${timeoutMs}ms)`,\n  };\n  if (asJson) {\n    outputJson(payload);\n  } else {\n    console.error(payload.message);\n  }\n  process.exit(EXIT_INTERNAL_ERROR);\n}\n\nasync function main(): Promise<void> {\n  const rawArgs = hideBin(process.argv);\n  const commandMode = [ 'run', 'status', 'health', 'stop' ].includes(rawArgs[0] ?? '');\n\n  if (!commandMode) {\n    // Backward-compatible legacy invocation: xpod --mode local --port 3000\n    const argv = await yargs(rawArgs)\n      .option('mode', { alias: 'm', type: 'string', choices: [ 'local', 'cloud' ], description: 'Run mode' })\n      .option('config', { alias: 'c', type: 'string', description: 'Path to config file (overrides --mode)' })\n      .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n      .option('port', { alias: 'p', type: 'number', description: 'Gateway port', default: 3000 })\n      .option('host', { type: 'string', description: 'Gateway bind host' })\n      .help()\n      .parse();\n\n    try {\n      await startRuntime({\n        mode: argv.mode as 'local' | 'cloud' | undefined,\n        config: argv.config,\n        env: argv.env,\n        port: argv.port,\n        host: argv.host,\n      });\n    } catch (error: unknown) {\n      exitForCliError(error);\n    }\n    return;\n  }\n\n  await yargs(rawArgs)\n    .scriptName('xpod')\n    .command(\n      'run',\n      'Run xpod runtime',\n      (y) => y\n        .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n        .option('mode', { alias: 'm', type: 'string', choices: [ 'local', 'cloud' ], description: 'Run mode' })\n        .option('config', { alias: 'c', type: 'string', description: 'Path to config file (overrides --mode)' })\n        .option('port', { alias: 'p', type: 'number', description: 'Gateway port', default: 3000 })\n        .option('host', { type: 'string', description: 'Gateway bind host' }),\n      async(argv) => {\n        try {\n          await startRuntime({\n            mode: argv.mode as 'local' | 'cloud' | undefined,\n            config: argv.config,\n            env: argv.env,\n            port: argv.port,\n            host: argv.host,\n          });\n        } catch (error: unknown) {\n          exitForCliError(error);\n        }\n      },\n    )\n    .command(\n      'status',\n      'Show runtime status',\n      (y) => y\n        .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n        .option('json', { type: 'boolean', default: false, description: 'Output JSON' }),\n      async(argv) => {\n        await commandStatus(argv.env, Boolean(argv.json));\n      },\n    )\n    .command(\n      'health',\n      'Show runtime health',\n      (y) => y\n        .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n        .option('json', { type: 'boolean', default: false, description: 'Output JSON' }),\n      async(argv) => {\n        await commandHealth(argv.env, Boolean(argv.json));\n      },\n    )\n    .command(\n      'stop',\n      'Stop runtime process',\n      (y) => y\n        .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n        .option('timeout', { type: 'number', default: 10000, description: 'Stop timeout in milliseconds' })\n        .option('json', { type: 'boolean', default: false, description: 'Output JSON' }),\n      async(argv) => {\n        await commandStop(argv.env, argv.timeout as number, Boolean(argv.json));\n      },\n    )\n    .demandCommand(1)\n    .strict()\n    .help()\n    .parseAsync();\n}\n\nmain().catch(exitForCliError);\n"]}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;;;;;AACA,6CAA2C;AAC3C,mCAAoC;AACpC,iDAAsC;AACtC,4CAAoB;AACpB,gDAAwB;AACxB,iEAA6E;AAC7E,kDAA0B;AAC1B,2CAAwC;AACxC,uCAAoE;AACpE,uDAAsH;AACtH,uDAAkE;AAClE,uDAAkE;AAClE,mFAAgF;AAChF,6CAA0C;AAiC1C,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,IAAI,MAAM,GAAG,IAAA,oCAAY,EAAC,MAAM,CAAC,CAAC;AAClC,MAAM,cAAc,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW;IACjF,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;AAErB,SAAS,UAAU;IACjB,MAAM,aAAa,GAAG,IAAI,qDAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,EAAE;QAC3F,QAAQ,EAAE,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;QAC1D,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAA,8CAAsB,EAAC,aAAa,CAAC,CAAC;IACtC,MAAM,GAAG,IAAA,oCAAY,EAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,GAAG,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;IACtD,OAAO,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAkB,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAyB,CAAC;QAClH,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe;IACzC,IAAI,CAAC;QACH,iGAAiG;QACjG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE;YAChF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,OAAe;IACrC,IAAI,CAAC;QACH,4GAA4G;QAC5G,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE;YAChF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC;QACnD,OAAO,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,OAAe;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE;YAChF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC;QACnD,OAAO,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEpC,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,OAAO,IAAI,GAAG,IAAI,GAAG;QAC9B,MAAM,EAAE;YACN,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAClC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC1B,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;SAC3B;QACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB;IAC7C,UAAU,EAAE,CAAC;IACb,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,eAAe,CAAC;QAC5C,WAAW,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAEzC,IAAI,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,mBAAmB,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,UAAU,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAsB,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEnG,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,UAAU,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAElG,gFAAgF;IAChF,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,YAAY,CAAC;IAE9C,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnC,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,KAAK,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;IAChE,MAAM,CAAC,IAAI,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,IAAI,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,IAAI,uBAAU,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,sBAAY,CAAC;IACnC,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,6BAA6B,kBAAkB,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IAEnD,MAAM,gBAAgB,GAAG,IAAA,yCAA2B,EAAC;QACnD,UAAU;QACV,WAAW;QACX,QAAQ;QACR,kBAAkB;KACnB,CAAC,CAAC;IAEH,UAAU,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,IAAA,0BAAY,EAAC;YACjB,SAAS;YACT,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,aAAa;YACb,OAAO;YACP,OAAO;YACP,kBAAkB;SACnB,CAAC;QACF,GAAG,EAAE,gBAAgB,CAAC,GAAG;QACzB,GAAG,EAAE,IAAA,8BAAgB,EAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC;KACtE,CAAC,CAAC;IAEH,kDAAkD;IAClD,oDAAoD;IACpD,2CAA2C;IAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC;YACE,IAAI;YACJ,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC;YAClD,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;SACvC;QACH,CAAC,CAAC,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAE7C,UAAU,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,IAAA,8BAAgB,EAAC;YACpB,OAAO;YACP,QAAQ;YACR,OAAO;YACP,OAAO;YACP,YAAY;YACZ,QAAQ;YACR,kBAAkB;SACnB,CAAC;KACH,CAAC,CAAC;IAEH,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;YAC3C,IAAI,QAAQ,KAAK,WAAW;gBAAE,OAAO,WAAW,CAAC;YACjD,IAAI,QAAQ,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YACrC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,KAAK,GAAG,IAAI,sBAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC7D,UAAU,EAAE,IAAI;QAChB,OAAO;KACR,CAAC,CAAC;IACH,KAAK,CAAC,UAAU,CAAC;QACf,GAAG,EAAE,oBAAoB,OAAO,EAAE;QAClC,GAAG,EAAE,oBAAoB,OAAO,EAAE;KACnC,CAAC,CAAC;IAEH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC5B,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IAEpB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAkB,EAAE;QACvC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAElB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAE/C,gFAAgF;QAChF,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAE3B,6DAA6D;QAC7D,IAAI,eAAe,EAAE,CAAC;YACpB,WAAW,CAAC,eAAe,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,eAAe,CAAC;QAC9C,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC3D,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,KAAK,OAAO,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,iBAAiB,CAAC;QAChB,aAAa,EAAE,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI;QACJ,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QACrC,OAAO,EAAE,eAAe;QACxB,UAAU;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAC,MAAc,EAAiB,EAAE;QACtD,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,oBAAoB,CAAC,CAAC;QACpD,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,MAAM,GAAG,KAAK;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG;YACd,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,CAAC;YACP,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,KAAK;QACpB,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACtC,OAAO,EAAE,UAAU,EAAE;KACtB,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,MAAM,GAAG,KAAK;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAiB;YAC5B,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM;gBACf,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,MAAM;aACZ;YACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,SAAS,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK;IAC5E,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAEnD,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,KAAK;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,wCAAwC,SAAS,KAAK;KAChE,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,IAAA,iBAAO,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,CAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAErF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAA,eAAK,EAAC,OAAO,CAAC;aAC9B,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAE,OAAO,EAAE,OAAO,CAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aACtG,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;aACvG,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;aAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aAC1F,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;aACpE,IAAI,EAAE;aACN,KAAK,EAAE,CAAC;QAEX,IAAI,CAAC;YACH,MAAM,YAAY,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAqC;gBAChD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,IAAA,eAAK,EAAC,OAAO,CAAC;SACjB,UAAU,CAAC,MAAM,CAAC;SAClB,OAAO,CACN,KAAK,EACL,kBAAkB,EAClB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACL,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAE,OAAO,EAAE,OAAO,CAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACtG,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;SACvG,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SAC1F,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,EACvE,KAAK,EAAC,IAAI,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,YAAY,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAqC;gBAChD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CACF;SACA,OAAO,CACN,QAAQ,EACR,qBAAqB,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACL,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAClF,KAAK,EAAC,IAAI,EAAE,EAAE;QACZ,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC,CACF;SACA,OAAO,CACN,QAAQ,EACR,qBAAqB,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACL,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAClF,KAAK,EAAC,IAAI,EAAE,EAAE;QACZ,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC,CACF;SACA,OAAO,CACN,MAAM,EACN,sBAAsB,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACL,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SAC/E,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;SAClG,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAClF,KAAK,EAAC,IAAI,EAAE,EAAE;QACZ,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC,CACF;SACA,aAAa,CAAC,CAAC,CAAC;SAChB,MAAM,EAAE;SACR,IAAI,EAAE;SACN,UAAU,EAAE,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport './runtime/configure-drizzle-solid';\nimport { createHash } from 'crypto';\nimport { spawn } from 'child_process';\nimport fs from 'fs';\nimport path from 'path';\nimport { setGlobalLoggerFactory, getLoggerFor } from 'global-logger-factory';\nimport yargs from 'yargs';\nimport { hideBin } from 'yargs/helpers';\nimport { GatewayProxy, getFreePort, PACKAGE_ROOT } from './runtime';\nimport { buildApiChildEnv, buildCssArgs, buildCssChildEnv, createCssChildRuntimeConfig } from './runtime/css-process';\nimport { resolveExternalOidcIssuer } from './runtime/oidc-issuer';\nimport { resolveAuthModeFromEnv } from './authorization/AuthMode';\nimport { ConfigurableLoggerFactory } from './logging/ConfigurableLoggerFactory';\nimport { Supervisor } from './supervisor';\n\ninterface RuntimeRecord {\n  schemaVersion: '1.0';\n  pid: number;\n  mode: 'local' | 'cloud';\n  port: number;\n  baseUrl: string;\n  publicUrl?: string;\n  envPath?: string;\n  configPath: string;\n  startTime: string;\n}\n\ninterface HealthReport {\n  schemaVersion: '1.0';\n  healthy: boolean;\n  checks: {\n    gateway: 'pass' | 'fail';\n    css: 'pass' | 'fail';\n    api: 'pass' | 'fail';\n  };\n  timestamp: string;\n}\n\ninterface RunOptions {\n  mode?: 'local' | 'cloud';\n  config?: string;\n  env?: string;\n  port?: number;\n  host?: string;\n}\n\nconst EXIT_OK = 0;\nconst EXIT_NOT_RUNNING = 10;\nconst EXIT_CONFIG_ERROR = 20;\nconst EXIT_INTERNAL_ERROR = 50;\n\nlet logger = getLoggerFor('Main');\nconst childJsRuntime = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'\n  ? (process.env.XPOD_NODE_BINARY ?? 'node')\n  : process.execPath;\n\nfunction initLogger(): void {\n  const loggerFactory = new ConfigurableLoggerFactory(process.env.CSS_LOGGING_LEVEL || 'info', {\n    fileName: path.join(process.cwd(), 'logs/xpod-%DATE%.log'),\n    showLocation: true,\n  });\n  setGlobalLoggerFactory(loggerFactory);\n  logger = getLoggerFor('Main');\n}\n\nfunction loadEnvFile(envPath: string): void {\n  if (!fs.existsSync(envPath)) {\n    throw new Error(`Env file not found: ${envPath}`);\n  }\n\n  const content = fs.readFileSync(envPath, 'utf-8');\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    if ((value.startsWith('\"') && value.endsWith('\"')) ||\n        (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1);\n    }\n\n    // Only set if not already defined — CLI / parent env takes precedence.\n    if (process.env[key] === undefined) {\n      process.env[key] = value;\n    }\n  }\n}\n\nfunction ensureTrailingSlash(url: string): string {\n  return url.endsWith('/') ? url : `${url}/`;\n}\n\nfunction resolveInstanceKey(envPath?: string): string {\n  if (!envPath) {\n    return 'default';\n  }\n  const abs = path.resolve(envPath);\n  return createHash('sha256').update(abs).digest('hex').slice(0, 12);\n}\n\nfunction getRuntimeFilePath(envPath?: string): string {\n  const dir = path.join(process.cwd(), '.xpod/runtime');\n  return path.join(dir, `${resolveInstanceKey(envPath)}.json`);\n}\n\nfunction saveRuntimeRecord(record: RuntimeRecord): void {\n  const filePath = getRuntimeFilePath(record.envPath);\n  fs.mkdirSync(path.dirname(filePath), { recursive: true });\n  fs.writeFileSync(filePath, JSON.stringify(record, null, 2), 'utf-8');\n}\n\nfunction loadRuntimeRecord(envPath?: string): RuntimeRecord | undefined {\n  const filePath = getRuntimeFilePath(envPath);\n  if (!fs.existsSync(filePath)) {\n    return undefined;\n  }\n\n  try {\n    return JSON.parse(fs.readFileSync(filePath, 'utf-8')) as RuntimeRecord;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction deleteRuntimeRecord(envPath?: string): void {\n  const filePath = getRuntimeFilePath(envPath);\n  if (fs.existsSync(filePath)) {\n    fs.unlinkSync(filePath);\n  }\n}\n\nfunction isProcessRunning(pid?: number): boolean {\n  if (!pid || pid <= 0) {\n    return false;\n  }\n\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction getVersion(): string {\n  try {\n    const pkg = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf-8')) as { version?: string };\n    return pkg.version ?? 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n\nasync function checkGateway(baseUrl: string): Promise<boolean> {\n  try {\n    // Gateway internal endpoints are exposed under /service/* (legacy /_gateway/* has been removed).\n    const res = await fetch(new URL('/service/status', ensureTrailingSlash(baseUrl)), {\n      signal: AbortSignal.timeout(3000),\n    });\n    return res.ok;\n  } catch {\n    return false;\n  }\n}\nasync function checkCss(baseUrl: string): Promise<boolean> {\n  try {\n    // Prefer supervisor status rather than probing CSS routes which can fail on identifier-space/host mismatch.\n    const res = await fetch(new URL('/service/status', ensureTrailingSlash(baseUrl)), {\n      signal: AbortSignal.timeout(3000),\n    });\n    if (!res.ok) {\n      return false;\n    }\n    const items = (await res.json()) as Array<{ name?: string; status?: string }>;\n    const css = items.find((it) => it?.name === 'css');\n    return css?.status === 'running';\n  } catch {\n    return false;\n  }\n}\nasync function checkApi(baseUrl: string): Promise<boolean> {\n  try {\n    const res = await fetch(new URL('/service/status', ensureTrailingSlash(baseUrl)), {\n      signal: AbortSignal.timeout(3000),\n    });\n    if (!res.ok) {\n      return false;\n    }\n    const items = (await res.json()) as Array<{ name?: string; status?: string }>;\n    const api = items.find((it) => it?.name === 'api');\n    return api?.status === 'running';\n  } catch {\n    return false;\n  }\n}\nasync function buildHealth(baseUrl: string): Promise<HealthReport> {\n  const gateway = await checkGateway(baseUrl);\n  const css = await checkCss(baseUrl);\n  const api = await checkApi(baseUrl);\n\n  return {\n    schemaVersion: '1.0',\n    healthy: gateway && css && api,\n    checks: {\n      gateway: gateway ? 'pass' : 'fail',\n      css: css ? 'pass' : 'fail',\n      api: api ? 'pass' : 'fail',\n    },\n    timestamp: new Date().toISOString(),\n  };\n}\n\nfunction outputJson(payload: unknown): void {\n  process.stdout.write(`${JSON.stringify(payload)}\\n`);\n}\n\nfunction exitForCliError(error: unknown): never {\n  const message = error instanceof Error ? error.message : String(error);\n  console.error(`Failed to start: ${message}`);\n  if (message.includes('Env file not found:') || message.includes('Config file not found:')) {\n    process.exit(EXIT_CONFIG_ERROR);\n  }\n  process.exit(EXIT_INTERNAL_ERROR);\n}\n\nasync function startRuntime(options: RunOptions): Promise<void> {\n  initLogger();\n  const resolvedEnvPath = options.env ? path.resolve(options.env) : undefined;\n  if (resolvedEnvPath) {\n    process.env.XPOD_ENV_PATH = resolvedEnvPath;\n    loadEnvFile(resolvedEnvPath);\n  }\n\n  const requestedPort = options.port !== undefined ? Number(options.port) : Number.NaN;\n  const mainPort = Number.isFinite(requestedPort)\n    ? requestedPort\n    : parseInt(process.env.XPOD_PORT ?? process.env.PORT ?? '3000', 10);\n  const host = options.host ?? '127.0.0.1';\n\n  let configPath = path.join(PACKAGE_ROOT, 'config/local.json');\n  if (options.config) {\n    configPath = options.config;\n  } else if (options.mode) {\n    configPath = path.join(PACKAGE_ROOT, `config/${options.mode}.json`);\n  }\n\n  if (!fs.existsSync(configPath)) {\n    throw new Error(`Config file not found: ${configPath}`);\n  }\n\n  const mode: 'local' | 'cloud' = options.mode ?? (configPath.includes('cloud') ? 'cloud' : 'local');\n\n  const baseUrl = ensureTrailingSlash(process.env.CSS_BASE_URL || `http://${host}:${mainPort}`);\n  const cssPort = await getFreePort(mainPort + 1, host);\n  const apiPort = await getFreePort(cssPort + 1, host);\n  const runtimeRoot = path.join(process.cwd(), '.xpod/runtime/legacy-css');\n  const rdfIndexPath = process.env.CSS_RDF_INDEX_PATH || path.join(runtimeRoot, 'rdf-index.sqlite');\n\n  // Make sure GatewayProxy has access to the effective baseUrl for host rewrites.\n  process.env.CSS_BASE_URL = baseUrl;\n  process.env.CSS_RDF_INDEX_PATH = rdfIndexPath;\n\n  logger.info('Orchestration Plan:');\n  logger.info(`  - Main Entry: ${baseUrl} (${host}:${mainPort})`);\n  logger.info(`  - CSS (internal): http://localhost:${cssPort}`);\n  logger.info(`  - API (internal): http://localhost:${apiPort}`);\n\n  const supervisor = new Supervisor();\n  const cssBinary = require.resolve('@solid/community-server/bin/server.js');\n  const cssModuleRoot = PACKAGE_ROOT;\n  const externalOidcIssuer = resolveExternalOidcIssuer(process.env);\n  const authMode = resolveAuthModeFromEnv(process.env);\n  if (externalOidcIssuer) {\n    logger.info(`  - SP mode external IdP: ${externalOidcIssuer}`);\n  }\n  logger.info(`  - Authorization mode: ${authMode}`);\n\n  const cssRuntimeConfig = createCssChildRuntimeConfig({\n    configPath,\n    runtimeRoot,\n    authMode,\n    externalOidcIssuer,\n  });\n\n  supervisor.register({\n    name: 'css',\n    command: childJsRuntime,\n    args: buildCssArgs({\n      cssBinary,\n      configPath: cssRuntimeConfig.configPath,\n      cssModuleRoot,\n      cssPort,\n      baseUrl,\n      externalOidcIssuer,\n    }),\n    cwd: cssRuntimeConfig.cwd,\n    env: buildCssChildEnv(baseUrl, cssPort, externalOidcIssuer, authMode),\n  });\n\n  // API server: resolve the entry point dynamically\n  // In dev (ts-node): use ts-node to run the .ts file\n  // In production: use the compiled .js file\n  const isDevMode = __filename.endsWith('.ts');\n  const apiArgs = isDevMode\n    ? [\n        '-r',\n        require.resolve('ts-node/register/transpile-only'),\n        path.join(__dirname, 'api', 'main.ts'),\n      ]\n    : [path.join(__dirname, 'api', 'main.js')];\n\n  supervisor.register({\n    name: 'api',\n    command: childJsRuntime,\n    args: apiArgs,\n    env: buildApiChildEnv({\n      apiPort,\n      mainPort,\n      cssPort,\n      baseUrl,\n      rdfIndexPath,\n      authMode,\n      externalOidcIssuer,\n    }),\n  });\n\n  // Bind host: use CLI --host value; if not explicitly set, derive from the public Base URL.\n  // In local dev/sandboxed environments, binding 0.0.0.0 can fail with EPERM.\n  const bindHost = options.host || (() => {\n    try {\n      const hostname = new URL(baseUrl).hostname;\n      if (hostname === 'localhost') return '127.0.0.1';\n      if (hostname === '::1') return '::1';\n      if (hostname.startsWith('127.')) return hostname;\n    } catch {\n      // ignore\n    }\n    return '0.0.0.0';\n  })();\n\n  const proxy = new GatewayProxy(mainPort, supervisor, bindHost, {\n    exitOnStop: true,\n    baseUrl,\n  });\n  proxy.setTargets({\n    css: `http://localhost:${cssPort}`,\n    api: `http://localhost:${apiPort}`,\n  });\n\n  await supervisor.startAll();\n  await proxy.start();\n\n  let restarting = false;\n  const restart = async(): Promise<void> => {\n    if (restarting) {\n      return;\n    }\n    restarting = true;\n\n    logger.info('Received SIGUSR1, restarting...');\n\n    // Remove runtime record first so status does not point at a process going down.\n    deleteRuntimeRecord(resolvedEnvPath);\n\n    try {\n      await proxy.stop();\n    } catch (err) {\n      logger.warn(`Failed to stop gateway server: ${String(err)}`);\n    }\n\n    await supervisor.stopAll();\n\n    // Reload env from file (dashboard writes into the env file).\n    if (resolvedEnvPath) {\n      loadEnvFile(resolvedEnvPath);\n      process.env.XPOD_ENV_PATH = resolvedEnvPath;\n    }\n\n    const child = spawn(process.execPath, process.argv.slice(1), {\n      stdio: 'inherit',\n      env: process.env,\n    });\n    child.unref();\n    process.exit(EXIT_OK);\n  };\n\n  process.on('SIGUSR1', () => {\n    void restart();\n  });\n\n  saveRuntimeRecord({\n    schemaVersion: '1.0',\n    pid: process.pid,\n    mode,\n    port: mainPort,\n    baseUrl,\n    publicUrl: process.env.CSS_PUBLIC_URL,\n    envPath: resolvedEnvPath,\n    configPath,\n    startTime: new Date().toISOString(),\n  });\n\n  const shutdown = async(signal: string): Promise<void> => {\n    logger.info(`Received ${signal}, shutting down...`);\n    deleteRuntimeRecord(resolvedEnvPath);\n    await proxy.stop();\n    await supervisor.stopAll();\n    process.exit(EXIT_OK);\n  };\n\n  process.on('SIGTERM', () => shutdown('SIGTERM'));\n  process.on('SIGINT', () => shutdown('SIGINT'));\n}\n\nasync function commandStatus(envPath?: string, asJson = false): Promise<void> {\n  const resolvedEnvPath = envPath ? path.resolve(envPath) : undefined;\n  const runtime = loadRuntimeRecord(resolvedEnvPath);\n  if (!runtime) {\n    const payload = {\n      schemaVersion: '1.0',\n      running: false,\n      ready: false,\n      baseUrl: '',\n      port: 0,\n      mode: 'local',\n      version: getVersion(),\n    };\n    if (asJson) {\n      outputJson(payload);\n    } else {\n      console.log('xpod is not running');\n    }\n    process.exit(EXIT_NOT_RUNNING);\n  }\n\n  const running = isProcessRunning(runtime.pid);\n  const health = running ? await buildHealth(runtime.baseUrl) : undefined;\n\n  const payload = {\n    schemaVersion: '1.0',\n    running,\n    ready: Boolean(health?.healthy),\n    baseUrl: runtime.baseUrl,\n    publicUrl: runtime.publicUrl,\n    port: runtime.port,\n    mode: runtime.mode,\n    pid: running ? runtime.pid : undefined,\n    version: getVersion(),\n  };\n\n  if (asJson) {\n    outputJson(payload);\n  } else {\n    console.log(payload);\n  }\n\n  process.exit(running ? EXIT_OK : EXIT_NOT_RUNNING);\n}\n\nasync function commandHealth(envPath?: string, asJson = false): Promise<void> {\n  const resolvedEnvPath = envPath ? path.resolve(envPath) : undefined;\n  const runtime = loadRuntimeRecord(resolvedEnvPath);\n  if (!runtime || !isProcessRunning(runtime.pid)) {\n    const payload: HealthReport = {\n      schemaVersion: '1.0',\n      healthy: false,\n      checks: {\n        gateway: 'fail',\n        css: 'fail',\n        api: 'fail',\n      },\n      timestamp: new Date().toISOString(),\n    };\n\n    if (asJson) {\n      outputJson(payload);\n    } else {\n      console.log(payload);\n    }\n    process.exit(EXIT_NOT_RUNNING);\n  }\n\n  const payload = await buildHealth(runtime.baseUrl);\n  if (asJson) {\n    outputJson(payload);\n  } else {\n    console.log(payload);\n  }\n  process.exit(payload.healthy ? EXIT_OK : EXIT_INTERNAL_ERROR);\n}\n\nasync function commandStop(envPath?: string, timeoutMs = 10000, asJson = false): Promise<void> {\n  const resolvedEnvPath = envPath ? path.resolve(envPath) : undefined;\n  const runtime = loadRuntimeRecord(resolvedEnvPath);\n\n  if (!runtime || !isProcessRunning(runtime.pid)) {\n    deleteRuntimeRecord(resolvedEnvPath);\n    const payload = { stopped: true, running: false };\n    if (asJson) {\n      outputJson(payload);\n    } else {\n      console.log('xpod is already stopped');\n    }\n    process.exit(EXIT_OK);\n  }\n\n  process.kill(runtime.pid, 'SIGTERM');\n  const start = Date.now();\n  while (Date.now() - start < timeoutMs) {\n    if (!isProcessRunning(runtime.pid)) {\n      deleteRuntimeRecord(resolvedEnvPath);\n      const payload = { stopped: true, pid: runtime.pid };\n      if (asJson) {\n        outputJson(payload);\n      } else {\n        console.log(`xpod stopped (pid=${runtime.pid})`);\n      }\n      process.exit(EXIT_OK);\n    }\n    await new Promise((resolve) => setTimeout(resolve, 200));\n  }\n\n  const payload = {\n    stopped: false,\n    pid: runtime.pid,\n    message: `timeout waiting for process to stop (${timeoutMs}ms)`,\n  };\n  if (asJson) {\n    outputJson(payload);\n  } else {\n    console.error(payload.message);\n  }\n  process.exit(EXIT_INTERNAL_ERROR);\n}\n\nasync function main(): Promise<void> {\n  const rawArgs = hideBin(process.argv);\n  const commandMode = [ 'run', 'status', 'health', 'stop' ].includes(rawArgs[0] ?? '');\n\n  if (!commandMode) {\n    // Backward-compatible legacy invocation: xpod --mode local --port 3000\n    const argv = await yargs(rawArgs)\n      .option('mode', { alias: 'm', type: 'string', choices: [ 'local', 'cloud' ], description: 'Run mode' })\n      .option('config', { alias: 'c', type: 'string', description: 'Path to config file (overrides --mode)' })\n      .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n      .option('port', { alias: 'p', type: 'number', description: 'Gateway port', default: 3000 })\n      .option('host', { type: 'string', description: 'Gateway bind host' })\n      .help()\n      .parse();\n\n    try {\n      await startRuntime({\n        mode: argv.mode as 'local' | 'cloud' | undefined,\n        config: argv.config,\n        env: argv.env,\n        port: argv.port,\n        host: argv.host,\n      });\n    } catch (error: unknown) {\n      exitForCliError(error);\n    }\n    return;\n  }\n\n  await yargs(rawArgs)\n    .scriptName('xpod')\n    .command(\n      'run',\n      'Run xpod runtime',\n      (y) => y\n        .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n        .option('mode', { alias: 'm', type: 'string', choices: [ 'local', 'cloud' ], description: 'Run mode' })\n        .option('config', { alias: 'c', type: 'string', description: 'Path to config file (overrides --mode)' })\n        .option('port', { alias: 'p', type: 'number', description: 'Gateway port', default: 3000 })\n        .option('host', { type: 'string', description: 'Gateway bind host' }),\n      async(argv) => {\n        try {\n          await startRuntime({\n            mode: argv.mode as 'local' | 'cloud' | undefined,\n            config: argv.config,\n            env: argv.env,\n            port: argv.port,\n            host: argv.host,\n          });\n        } catch (error: unknown) {\n          exitForCliError(error);\n        }\n      },\n    )\n    .command(\n      'status',\n      'Show runtime status',\n      (y) => y\n        .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n        .option('json', { type: 'boolean', default: false, description: 'Output JSON' }),\n      async(argv) => {\n        await commandStatus(argv.env, Boolean(argv.json));\n      },\n    )\n    .command(\n      'health',\n      'Show runtime health',\n      (y) => y\n        .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n        .option('json', { type: 'boolean', default: false, description: 'Output JSON' }),\n      async(argv) => {\n        await commandHealth(argv.env, Boolean(argv.json));\n      },\n    )\n    .command(\n      'stop',\n      'Stop runtime process',\n      (y) => y\n        .option('env', { alias: 'e', type: 'string', description: 'Path to .env file' })\n        .option('timeout', { type: 'number', default: 10000, description: 'Stop timeout in milliseconds' })\n        .option('json', { type: 'boolean', default: false, description: 'Output JSON' }),\n      async(argv) => {\n        await commandStop(argv.env, argv.timeout as number, Boolean(argv.json));\n      },\n    )\n    .demandCommand(1)\n    .strict()\n    .help()\n    .parseAsync();\n}\n\nmain().catch(exitForCliError);\n"]}

package/dist/provision/LocalPodProvisioningService.js

@@ -101,9 +101,8 @@ class LocalPodProvisioningService {
     async createPod(input) {
         const podUrl = ensureTrailingSlash(new URL(`${encodeURIComponent(input.podName)}/`, this.baseUrl).toString());
         const webId = input.webId ?? buildWebIdFromIssuer(this.oidcIssuer, input.podName) ?? `${podUrl}profile/card#me`;
-        // Local storage resources are protected by the Local SP issuer even when
-        // their owner WebID is a Cloud identity.
-        const oidcIssuer = this.baseUrl;
+        // Local stores the Pod, but the owner WebID trusts the actual token issuer.
+        const oidcIssuer = this.oidcIssuer ?? this.baseUrl;
         const accountId = stableUuid(`account:${podUrl}:${webId}`);
         const podId = stableUuid(`pod:${podUrl}:${webId}`);
         const ownerId = stableUuid(`owner:${podId}:${webId}`);