@undefineds.co/xpod 0.3.58 → 0.3.61

package/dist/api/container/types.d.ts

@@ -6,6 +6,7 @@
 import type { ApiServer } from '../ApiServer';
 import type { AuthMiddleware } from '../middleware/AuthMiddleware';
 import type { Authenticator } from '../auth/Authenticator';
+import type { GatewayAccessKeyRepository } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';
 import type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';
 import type { ServiceTokenRepositoryPort } from '../../identity/drizzle/ServiceTokenRepository';
 import type { VercelChatService } from '../service/VercelChatService';
@@ -13,22 +14,42 @@ import type { SubdomainService } from '../../subdomain/SubdomainService';
 import type { SubdomainClient } from '../../subdomain/SubdomainClient';
 import type { DnsProvider } from '../../dns/DnsProvider';
 import type { TunnelProvider } from '../../tunnel/TunnelProvider';
+import type { ActiveTunnelProvider, TunnelProfile } from '../../tunnel/TunnelProfiles';
+import type { AcmeCertificateManager } from '../../edge/acme/AcmeCertificateManager';
+import type { ClusterCertificateManager } from '../../edge/acme/ClusterCertificateManager';
+import type { EdgeNodeCertificateCapabilityBridge } from '../../edge/EdgeNodeCertificateCapabilityBridge';
 import type { IdentityDatabase } from '../../identity/drizzle/db';
 import type { DdnsRepository } from '../../identity/drizzle/DdnsRepository';
 import type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';
+import type { AccountRoleRepository } from '../../identity/drizzle/AccountRoleRepository';
 import type { ChatKitService, AiProvider } from '../chatkit';
 import type { StoreContext } from '../chatkit/store';
 import type { PodChatKitStore } from '../chatkit/pod-store';
 import type { RuntimeHost } from '../../runtime/host/types';
 import type { ProviderRegistry, EmbeddingService } from '../../ai/service';
 import type { VectorService } from '../service/VectorService';
+import type { RdfSearchIndexingService } from '../service/RdfSearchIndexingService';
+import type { RdfStorageStatsService } from '../service/RdfStorageStatsService';
 import type { InngestRunExecutionBackend } from '../runs/InngestRunExecutionBackend';
+import type { RunContextRetriever } from '../runs/RunExecutionBackend';
 import type { EmbeddedInngestRuntimeConfig } from '../runs/EmbeddedInngestService';
 import type { RunAuthContextRegistry } from '../runs/RunAuthContextRegistry';
 import type { TaskAuthBindingService, TaskService, InngestTaskScheduler } from '../tasks';
 import type { PodMatrixStore } from '../matrix';
 import type { ClientReconcilerCoordinator, ServerGroupReconcilerService } from '../reconciler';
 import type { AuthMode } from '../../authorization/AuthMode';
+import type { RdfEngineLike } from '../../storage/rdf';
+import type { CredentialVault } from '../ai-gateway/credentials/CredentialVault';
+import type { ProviderConnectService } from '../ai-gateway/connect';
+import type { ProviderQuotaService } from '../ai-gateway/quota';
+import type { AiGatewayService, GatewayCredentialStore } from '../ai-gateway/AiGatewayService';
+import type { ProviderRuntimeRegistry } from '../ai-gateway/providers/ProviderRuntimeRegistry';
+import type { ProviderRegistry as GatewayProviderRegistry } from '../ai-gateway/providers/ProviderRegistry';
+import type { SessionAffinityStore } from '../ai-gateway/routing/SessionAffinityStore';
+import type { AiConnectionInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionInvocationKeyIssuer';
+import type { InvocationTokenCodec } from '../ai-gateway/auth/InvocationTokenCodec';
+import type { ClientCredentialsInternalPodAccessTokenProvider } from '../ai-gateway/auth/ClientCredentialsInternalPodAccessTokenProvider';
+import type { AiClientConfigurationService } from '../service/AiClientConfigurationService';
 /**
  * 容器配置
  */
@@ -49,6 +70,10 @@ export interface ApiContainerConfig {
     rdfIndexPath?: string;
     /** 数据库连接 URL */
     databaseUrl: string;
+    /** RDF/SPARQL facts database connection URL. */
+    sparqlEndpoint?: string;
+    /** Route SPARQL reads through an installed native SPARQL provider. */
+    rdfNativeSparqlEnabled?: boolean;
     /** Redis connection URL, used by embedded infrastructure such as Inngest in cloud mode. */
     redisUrl?: string;
     /** Embedded Inngest runtime configuration. */
@@ -69,6 +94,36 @@ export interface ApiContainerConfig {
     corsOrigins: string[];
     /** CSS Token 端点 */
     cssTokenEndpoint: string;
+    solidBaseUrl?: string;
+    /** Gateway locator encryption secret. Internal platform secret; not a user/provider AI credential. */
+    gatewayLocatorSecret?: string;
+    gatewayLocatorKeyId?: string;
+    gatewayPreviousLocatorSecrets?: Array<{
+        kid: string;
+        secret: string;
+    }>;
+    /** Internal service client used to read user-owned private Pod gateway-key hashes. */
+    gatewayInternalClientId?: string;
+    gatewayInternalClientSecret?: string;
+    /** Runtime-generated secret used only between GatewayProxy and the internal API server for admin ingress evidence. */
+    gatewayAdminProxyAuthSecret?: string;
+    /** AI Provider Connect is disabled by default for backwards-compatible startup. */
+    aiGatewayConnectEnabled?: boolean;
+    /** Local filesystem host capability for AI coding-client configuration. Disabled unless explicitly injected. */
+    aiClientConfiguration?: {
+        enabled: boolean;
+        homeDir: string;
+        backupRoot?: string;
+        authority: 'local-filesystem';
+    };
+    /** Platform signing secret for short-lived provider Connect attempts. */
+    aiGatewayConnectSigningSecret?: string;
+    /** Xpod/Moonshot-issued Kimi device-code OAuth client id. Never reuse official CLI ids. */
+    aiGatewayKimiClientId?: string;
+    /** Generic Pod SecretCell credential vault factory, configured by Xpod operations. */
+    secretCellCredentialVaultFactory?: () => CredentialVault;
+    /** Explicit provider endpoint overrides for controlled deployments and local E2E fixtures. */
+    aiGatewayProviderBaseUrls?: Partial<Record<'openai', string>>;
     /** 子域名功能配置 (cloud 模式) */
     subdomain?: {
         /** 节点域名根域名 (如 undefineds.site)，有值即启用子域名功能 */
@@ -84,8 +139,28 @@ export interface ApiContainerConfig {
     nodeId?: string;
     /** 节点 Token (local 托管式，调用 Cloud API 的认证) */
     nodeToken?: string;
+    /** Local SP service token（Cloud 回调 Local、Local 服务级 API 的唯一服务凭据） */
+    serviceToken?: string;
+    /** 已签发的 provisionCode（Local 首次注册/刷新后持久化恢复） */
+    provisionCode?: string;
+    /** Local canonical public URL（通常来自 CSS_BASE_URL，也可从 setup 恢复） */
+    publicUrl?: string;
+    /** Cloud 分配或用户指定的 SP 域名 */
+    spDomain?: string;
+    /** Local setup/provision 状态文件路径 */
+    localSetupPath?: string;
+    /** Local setup/provision 状态文件中的 provider key */
+    localSetupProviderId?: string;
     /** OIDC Issuer URL (local 托管式，使用 Cloud IdP) */
     oidcIssuer?: string;
+    /** Active tunnel provider after resolving profile selection. */
+    tunnelProvider?: ActiveTunnelProvider;
+    /** Recorded tunnel profiles. Only tunnelActiveProfileId/activeTunnelProfile takes effect at runtime. */
+    tunnelProfiles?: TunnelProfile[];
+    /** Selected tunnel profile id. */
+    tunnelActiveProfileId?: string;
+    /** Selected tunnel profile. */
+    activeTunnelProfile?: TunnelProfile;
     /** Cloudflare Tunnel Token (local 托管式/自管式，启动 cloudflared) */
     cloudflareTunnelToken?: string;
     /** SakuraFRP Tunnel Token (SAKURA_TUNNEL_TOKEN；local 托管式/自管式，启动 frpc) */
@@ -115,11 +190,26 @@ export interface ApiContainerCradle {
     authenticator: Authenticator;
     nodeRepo: EdgeNodeRepository;
     serviceTokenRepo: ServiceTokenRepositoryPort;
+    gatewayInternalPodAccess: ClientCredentialsInternalPodAccessTokenProvider;
+    gatewayAccessKeyRepository: GatewayAccessKeyRepository;
+    invocationTokenCodec: InvocationTokenCodec;
+    aiConnectionInvocationKeyIssuer: AiConnectionInvocationKeyIssuer;
+    aiClientConfigurationService?: AiClientConfigurationService;
+    providerConnectService: ProviderConnectService;
+    providerQuotaService?: ProviderQuotaService;
+    gatewayProviderRegistry: GatewayProviderRegistry;
+    gatewayCredentialStore: GatewayCredentialStore;
+    gatewayRuntimeRegistry: ProviderRuntimeRegistry;
+    gatewaySessionAffinityStore: SessionAffinityStore;
+    aiGatewayService: AiGatewayService;
     chatService: VercelChatService;
     chatKitStore: PodChatKitStore;
     chatKitAiProvider: AiProvider;
     inngestRuntimeConfig: EmbeddedInngestRuntimeConfig | undefined;
     runAuthContextRegistry: RunAuthContextRegistry;
+    rdfEngine: RdfEngineLike | undefined;
+    runContextRetriever: RunContextRetriever<StoreContext> | undefined;
+    rdfSearchIndexingService: RdfSearchIndexingService | undefined;
     runExecutionBackend: InngestRunExecutionBackend;
     taskAuthBindingService: TaskAuthBindingService<StoreContext>;
     taskService: TaskService<StoreContext>;
@@ -131,8 +221,10 @@ export interface ApiContainerCradle {
     providerRegistry: ProviderRegistry;
     embeddingService: EmbeddingService;
     vectorService: VectorService;
+    rdfStorageStatsService: RdfStorageStatsService;
     ddnsRepo?: DdnsRepository;
     podLookupRepo?: PodLookupRepository;
+    accountRoleRepo?: AccountRoleRepository;
     dnsProvider?: DnsProvider;
     dnsCoordinator?: EdgeNodeDnsCoordinator;
     healthProbeService?: EdgeNodeHealthProbeService;
@@ -143,4 +235,8 @@ export interface ApiContainerCradle {
     subdomainClient?: SubdomainClient;
     ddnsManager?: DdnsManager;
     localTunnelProvider?: TunnelProvider;
+    edgeNodeCertificateCapabilityBridge?: EdgeNodeCertificateCapabilityBridge;
+    certificateManager?: unknown;
+    acmeCertificateManager?: AcmeCertificateManager;
+    clusterCertificateManager?: ClusterCertificateManager;
 }

package/dist/api/container/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/container/types.ts"],"names":[],"mappings":";AAAA;;;;GAIG","sourcesContent":["/**\n * API Container 依赖类型定义\n *\n * 定义容器中注册的所有服务接口\n */\n\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthMiddleware } from '../middleware/AuthMiddleware';\nimport type { Authenticator } from '../auth/Authenticator';\nimport type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';\nimport type { ServiceTokenRepositoryPort } from '../../identity/drizzle/ServiceTokenRepository';\nimport type { VercelChatService } from '../service/VercelChatService';\nimport type { SubdomainService } from '../../subdomain/SubdomainService';\nimport type { SubdomainClient } from '../../subdomain/SubdomainClient';\nimport type { DnsProvider } from '../../dns/DnsProvider';\nimport type { TunnelProvider } from '../../tunnel/TunnelProvider';\nimport type { IdentityDatabase } from '../../identity/drizzle/db';\nimport type { DdnsRepository } from '../../identity/drizzle/DdnsRepository';\nimport type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';\nimport type { ChatKitService, AiProvider } from '../chatkit';\nimport type { StoreContext } from '../chatkit/store';\nimport type { PodChatKitStore } from '../chatkit/pod-store';\nimport type { RuntimeHost } from '../../runtime/host/types';\nimport type { ProviderRegistry, EmbeddingService } from '../../ai/service';\nimport type { VectorService } from '../service/VectorService';\nimport type { InngestRunExecutionBackend } from '../runs/InngestRunExecutionBackend';\nimport type { EmbeddedInngestRuntimeConfig } from '../runs/EmbeddedInngestService';\nimport type { RunAuthContextRegistry } from '../runs/RunAuthContextRegistry';\nimport type { TaskAuthBindingService, TaskService, InngestTaskScheduler } from '../tasks';\nimport type { PodMatrixStore } from '../matrix';\nimport type { ClientReconcilerCoordinator, ServerGroupReconcilerService } from '../reconciler';\nimport type { AuthMode } from '../../authorization/AuthMode';\n\n/**\n * 容器配置\n */\nexport interface ApiContainerConfig {\n  /** 运行模式: cloud 持有密钥, local 调用远程 */\n  edition: 'cloud' | 'local';\n\n  /** API Server 端口 */\n  port: number;\n\n  /** API Server 主机 */\n  host: string;\n\n  /** API Server Unix socket 路径 */\n  socketPath?: string;\n\n  /** Runtime host implementation */\n  runtimeHost?: RuntimeHost;\n\n  /** Solid authorization mode used by CSS and SP-local Pod provisioning. */\n  authMode: AuthMode;\n\n  /** RDF term-id index used by CSS LDP structured reads. */\n  rdfIndexPath?: string;\n\n  /** 数据库连接 URL */\n  databaseUrl: string;\n\n  /** Redis connection URL, used by embedded infrastructure such as Inngest in cloud mode. */\n  redisUrl?: string;\n\n  /** Embedded Inngest runtime configuration. */\n  inngest?: {\n    enabled: boolean;\n    mode?: 'managed' | 'spawn';\n    port?: number;\n    host?: string;\n    baseUrl?: string;\n    eventKey?: string;\n    signingKey?: string;\n    binaryPath?: string;\n    sqliteDir?: string;\n  };\n\n  /** Resolved runtime config passed from API bootstrap after starting/locating Inngest. */\n  inngestRuntimeConfig?: EmbeddedInngestRuntimeConfig;\n\n  /** CORS 允许的源 */\n  corsOrigins: string[];\n\n  /** CSS Token 端点 */\n  cssTokenEndpoint: string;\n\n  /** 子域名功能配置 (cloud 模式) */\n  subdomain?: {\n    /** 节点域名根域名 (如 undefineds.site)，有值即启用子域名功能 */\n    baseStorageDomain?: string;\n    cloudflareAccountId?: string;\n    cloudflareApiToken?: string;\n    tencentDnsSecretId?: string;\n    tencentDnsSecretKey?: string;\n  };\n\n  /** Cloud API 端点 (local 托管式，调用 cloud 的子域名 API) */\n  cloudApiEndpoint?: string;\n\n  /** 节点 ID (local 托管式) */\n  nodeId?: string;\n\n  /** 节点 Token (local 托管式，调用 Cloud API 的认证) */\n  nodeToken?: string;\n\n  /** OIDC Issuer URL (local 托管式，使用 Cloud IdP) */\n  oidcIssuer?: string;\n\n  /** Cloudflare Tunnel Token (local 托管式/自管式，启动 cloudflared) */\n  cloudflareTunnelToken?: string;\n\n  /** SakuraFRP Tunnel Token (SAKURA_TUNNEL_TOKEN；local 托管式/自管式，启动 frpc) */\n  sakuraTunnelToken?: string;\n\n  /** ngrok authtoken (local only; not sent to Cloud). */\n  ngrokAuthToken?: string;\n\n  /** Fixed ngrok endpoint/custom domain, e.g. https://example.ngrok-free.dev. */\n  ngrokUrl?: string;\n\n  /** ngrok executable path. */\n  ngrokPath?: string;\n\n  /** 是否接受 Edge 节点注册 (cloud 模式) */\n  edgeNodesEnabled?: boolean;\n}\n\nimport { EdgeNodeDnsCoordinator } from '../../edge/EdgeNodeDnsCoordinator';\nimport { EdgeNodeHealthProbeService } from '../../edge/EdgeNodeHealthProbeService';\nimport { EdgeNodeCapabilityDetector } from '../../edge/EdgeNodeCapabilityDetector';\nimport { LocalNetworkManager } from '../../edge/LocalNetworkManager';\nimport { DdnsManager } from '../../edge/DdnsManager';\n\n/**\n * 容器中注册的所有服务\n */\nexport interface ApiContainerCradle {\n  // 配置\n  config: ApiContainerConfig;\n\n  // 核心服务\n  db: IdentityDatabase;\n  apiServer: ApiServer;\n  authMiddleware: AuthMiddleware;\n  authenticator: Authenticator;\n\n  // 仓库\n  nodeRepo: EdgeNodeRepository;\n  serviceTokenRepo: ServiceTokenRepositoryPort;\n\n  // 业务服务\n  chatService: VercelChatService;\n\n  // ChatKit 服务 (OpenAI ChatKit 协议)\n  chatKitStore: PodChatKitStore;\n  chatKitAiProvider: AiProvider;\n  inngestRuntimeConfig: EmbeddedInngestRuntimeConfig | undefined;\n  runAuthContextRegistry: RunAuthContextRegistry;\n  runExecutionBackend: InngestRunExecutionBackend;\n  taskAuthBindingService: TaskAuthBindingService<StoreContext>;\n  taskService: TaskService<StoreContext>;\n  inngestTaskScheduler: InngestTaskScheduler<StoreContext>;\n  chatKitService: ChatKitService<StoreContext>;\n  matrixStore: PodMatrixStore;\n  clientReconcilerCoordinator: ClientReconcilerCoordinator;\n  serverGroupReconcilerService: ServerGroupReconcilerService;\n  providerRegistry: ProviderRegistry;\n  embeddingService: EmbeddingService;\n  vectorService: VectorService;\n\n  // Cloud 模式: 身份服务\n  ddnsRepo?: DdnsRepository;\n  podLookupRepo?: PodLookupRepository;\n\n  // 子域名相关 (可选，按 edition 注册)\n  // Cloud 模式 或 Local 自管模式\n  dnsProvider?: DnsProvider;\n  dnsCoordinator?: EdgeNodeDnsCoordinator;\n  healthProbeService?: EdgeNodeHealthProbeService;\n  capabilityDetector?: EdgeNodeCapabilityDetector;\n  localNetworkManager?: LocalNetworkManager;\n\n  tunnelProvider?: TunnelProvider;\n  subdomainService?: SubdomainService;\n  // Local 托管式\n  subdomainClient?: SubdomainClient;\n  // Local 托管式 DDNS 管理\n  ddnsManager?: DdnsManager;\n  // Local 托管式/自管式 (启动 cloudflared)\n  localTunnelProvider?: TunnelProvider;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/container/types.ts"],"names":[],"mappings":";AAAA;;;;GAIG","sourcesContent":["/**\n * API Container 依赖类型定义\n *\n * 定义容器中注册的所有服务接口\n */\n\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthMiddleware } from '../middleware/AuthMiddleware';\nimport type { Authenticator } from '../auth/Authenticator';\nimport type { GatewayAccessKeyRepository } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';\nimport type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';\nimport type { ServiceTokenRepositoryPort } from '../../identity/drizzle/ServiceTokenRepository';\nimport type { VercelChatService } from '../service/VercelChatService';\nimport type { SubdomainService } from '../../subdomain/SubdomainService';\nimport type { SubdomainClient } from '../../subdomain/SubdomainClient';\nimport type { DnsProvider } from '../../dns/DnsProvider';\nimport type { TunnelProvider } from '../../tunnel/TunnelProvider';\nimport type { ActiveTunnelProvider, TunnelProfile } from '../../tunnel/TunnelProfiles';\nimport type { AcmeCertificateManager } from '../../edge/acme/AcmeCertificateManager';\nimport type { ClusterCertificateManager } from '../../edge/acme/ClusterCertificateManager';\nimport type { EdgeNodeCertificateCapabilityBridge } from '../../edge/EdgeNodeCertificateCapabilityBridge';\nimport type { IdentityDatabase } from '../../identity/drizzle/db';\nimport type { DdnsRepository } from '../../identity/drizzle/DdnsRepository';\nimport type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';\nimport type { AccountRoleRepository } from '../../identity/drizzle/AccountRoleRepository';\nimport type { ChatKitService, AiProvider } from '../chatkit';\nimport type { StoreContext } from '../chatkit/store';\nimport type { PodChatKitStore } from '../chatkit/pod-store';\nimport type { RuntimeHost } from '../../runtime/host/types';\nimport type { ProviderRegistry, EmbeddingService } from '../../ai/service';\nimport type { VectorService } from '../service/VectorService';\nimport type { RdfSearchIndexingService } from '../service/RdfSearchIndexingService';\nimport type { RdfStorageStatsService } from '../service/RdfStorageStatsService';\nimport type { InngestRunExecutionBackend } from '../runs/InngestRunExecutionBackend';\nimport type { RunContextRetriever } from '../runs/RunExecutionBackend';\nimport type { EmbeddedInngestRuntimeConfig } from '../runs/EmbeddedInngestService';\nimport type { RunAuthContextRegistry } from '../runs/RunAuthContextRegistry';\nimport type { TaskAuthBindingService, TaskService, InngestTaskScheduler } from '../tasks';\nimport type { PodMatrixStore } from '../matrix';\nimport type { ClientReconcilerCoordinator, ServerGroupReconcilerService } from '../reconciler';\nimport type { AuthMode } from '../../authorization/AuthMode';\nimport type { RdfEngineLike } from '../../storage/rdf';\nimport type { CredentialVault } from '../ai-gateway/credentials/CredentialVault';\nimport type { ProviderConnectService } from '../ai-gateway/connect';\nimport type { ProviderQuotaService } from '../ai-gateway/quota';\nimport type { AiGatewayService, GatewayCredentialStore } from '../ai-gateway/AiGatewayService';\nimport type { ProviderRuntimeRegistry } from '../ai-gateway/providers/ProviderRuntimeRegistry';\nimport type { ProviderRegistry as GatewayProviderRegistry } from '../ai-gateway/providers/ProviderRegistry';\nimport type { SessionAffinityStore } from '../ai-gateway/routing/SessionAffinityStore';\nimport type { AiConnectionInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionInvocationKeyIssuer';\nimport type { InvocationTokenCodec } from '../ai-gateway/auth/InvocationTokenCodec';\nimport type { ClientCredentialsInternalPodAccessTokenProvider } from '../ai-gateway/auth/ClientCredentialsInternalPodAccessTokenProvider';\nimport type { AiClientConfigurationService } from '../service/AiClientConfigurationService';\n\n/**\n * 容器配置\n */\nexport interface ApiContainerConfig {\n  /** 运行模式: cloud 持有密钥, local 调用远程 */\n  edition: 'cloud' | 'local';\n\n  /** API Server 端口 */\n  port: number;\n\n  /** API Server 主机 */\n  host: string;\n\n  /** API Server Unix socket 路径 */\n  socketPath?: string;\n\n  /** Runtime host implementation */\n  runtimeHost?: RuntimeHost;\n\n  /** Solid authorization mode used by CSS and SP-local Pod provisioning. */\n  authMode: AuthMode;\n\n  /** RDF term-id index used by CSS LDP structured reads. */\n  rdfIndexPath?: string;\n\n  /** 数据库连接 URL */\n  databaseUrl: string;\n\n  /** RDF/SPARQL facts database connection URL. */\n  sparqlEndpoint?: string;\n\n  /** Route SPARQL reads through an installed native SPARQL provider. */\n  rdfNativeSparqlEnabled?: boolean;\n\n  /** Redis connection URL, used by embedded infrastructure such as Inngest in cloud mode. */\n  redisUrl?: string;\n\n  /** Embedded Inngest runtime configuration. */\n  inngest?: {\n    enabled: boolean;\n    mode?: 'managed' | 'spawn';\n    port?: number;\n    host?: string;\n    baseUrl?: string;\n    eventKey?: string;\n    signingKey?: string;\n    binaryPath?: string;\n    sqliteDir?: string;\n  };\n\n  /** Resolved runtime config passed from API bootstrap after starting/locating Inngest. */\n  inngestRuntimeConfig?: EmbeddedInngestRuntimeConfig;\n\n  /** CORS 允许的源 */\n  corsOrigins: string[];\n\n  /** CSS Token 端点 */\n  cssTokenEndpoint: string;\n  solidBaseUrl?: string;\n\n  /** Gateway locator encryption secret. Internal platform secret; not a user/provider AI credential. */\n  gatewayLocatorSecret?: string;\n  gatewayLocatorKeyId?: string;\n  gatewayPreviousLocatorSecrets?: Array<{ kid: string; secret: string }>;\n\n  /** Internal service client used to read user-owned private Pod gateway-key hashes. */\n  gatewayInternalClientId?: string;\n  gatewayInternalClientSecret?: string;\n\n  /** Runtime-generated secret used only between GatewayProxy and the internal API server for admin ingress evidence. */\n  gatewayAdminProxyAuthSecret?: string;\n\n  /** AI Provider Connect is disabled by default for backwards-compatible startup. */\n  aiGatewayConnectEnabled?: boolean;\n  /** Local filesystem host capability for AI coding-client configuration. Disabled unless explicitly injected. */\n  aiClientConfiguration?: {\n    enabled: boolean;\n    homeDir: string;\n    backupRoot?: string;\n    authority: 'local-filesystem';\n  };\n  /** Platform signing secret for short-lived provider Connect attempts. */\n  aiGatewayConnectSigningSecret?: string;\n  /** Xpod/Moonshot-issued Kimi device-code OAuth client id. Never reuse official CLI ids. */\n  aiGatewayKimiClientId?: string;\n  /** Generic Pod SecretCell credential vault factory, configured by Xpod operations. */\n  secretCellCredentialVaultFactory?: () => CredentialVault;\n  /** Explicit provider endpoint overrides for controlled deployments and local E2E fixtures. */\n  aiGatewayProviderBaseUrls?: Partial<Record<'openai', string>>;\n\n  /** 子域名功能配置 (cloud 模式) */\n  subdomain?: {\n    /** 节点域名根域名 (如 undefineds.site)，有值即启用子域名功能 */\n    baseStorageDomain?: string;\n    cloudflareAccountId?: string;\n    cloudflareApiToken?: string;\n    tencentDnsSecretId?: string;\n    tencentDnsSecretKey?: string;\n  };\n\n  /** Cloud API 端点 (local 托管式，调用 cloud 的子域名 API) */\n  cloudApiEndpoint?: string;\n\n  /** 节点 ID (local 托管式) */\n  nodeId?: string;\n\n  /** 节点 Token (local 托管式，调用 Cloud API 的认证) */\n  nodeToken?: string;\n\n  /** Local SP service token（Cloud 回调 Local、Local 服务级 API 的唯一服务凭据） */\n  serviceToken?: string;\n\n  /** 已签发的 provisionCode（Local 首次注册/刷新后持久化恢复） */\n  provisionCode?: string;\n\n  /** Local canonical public URL（通常来自 CSS_BASE_URL，也可从 setup 恢复） */\n  publicUrl?: string;\n\n  /** Cloud 分配或用户指定的 SP 域名 */\n  spDomain?: string;\n\n  /** Local setup/provision 状态文件路径 */\n  localSetupPath?: string;\n\n  /** Local setup/provision 状态文件中的 provider key */\n  localSetupProviderId?: string;\n\n  /** OIDC Issuer URL (local 托管式，使用 Cloud IdP) */\n  oidcIssuer?: string;\n\n  /** Active tunnel provider after resolving profile selection. */\n  tunnelProvider?: ActiveTunnelProvider;\n\n  /** Recorded tunnel profiles. Only tunnelActiveProfileId/activeTunnelProfile takes effect at runtime. */\n  tunnelProfiles?: TunnelProfile[];\n\n  /** Selected tunnel profile id. */\n  tunnelActiveProfileId?: string;\n\n  /** Selected tunnel profile. */\n  activeTunnelProfile?: TunnelProfile;\n\n  /** Cloudflare Tunnel Token (local 托管式/自管式，启动 cloudflared) */\n  cloudflareTunnelToken?: string;\n\n  /** SakuraFRP Tunnel Token (SAKURA_TUNNEL_TOKEN；local 托管式/自管式，启动 frpc) */\n  sakuraTunnelToken?: string;\n\n  /** ngrok authtoken (local only; not sent to Cloud). */\n  ngrokAuthToken?: string;\n\n  /** Fixed ngrok endpoint/custom domain, e.g. https://example.ngrok-free.dev. */\n  ngrokUrl?: string;\n\n  /** ngrok executable path. */\n  ngrokPath?: string;\n\n  /** 是否接受 Edge 节点注册 (cloud 模式) */\n  edgeNodesEnabled?: boolean;\n}\n\nimport { EdgeNodeDnsCoordinator } from '../../edge/EdgeNodeDnsCoordinator';\nimport { EdgeNodeHealthProbeService } from '../../edge/EdgeNodeHealthProbeService';\nimport { EdgeNodeCapabilityDetector } from '../../edge/EdgeNodeCapabilityDetector';\nimport { LocalNetworkManager } from '../../edge/LocalNetworkManager';\nimport { DdnsManager } from '../../edge/DdnsManager';\n\n/**\n * 容器中注册的所有服务\n */\nexport interface ApiContainerCradle {\n  // 配置\n  config: ApiContainerConfig;\n\n  // 核心服务\n  db: IdentityDatabase;\n  apiServer: ApiServer;\n  authMiddleware: AuthMiddleware;\n  authenticator: Authenticator;\n\n  // 仓库\n  nodeRepo: EdgeNodeRepository;\n  serviceTokenRepo: ServiceTokenRepositoryPort;\n  gatewayInternalPodAccess: ClientCredentialsInternalPodAccessTokenProvider;\n  gatewayAccessKeyRepository: GatewayAccessKeyRepository;\n  invocationTokenCodec: InvocationTokenCodec;\n  aiConnectionInvocationKeyIssuer: AiConnectionInvocationKeyIssuer;\n  aiClientConfigurationService?: AiClientConfigurationService;\n  providerConnectService: ProviderConnectService;\n  providerQuotaService?: ProviderQuotaService;\n  gatewayProviderRegistry: GatewayProviderRegistry;\n  gatewayCredentialStore: GatewayCredentialStore;\n  gatewayRuntimeRegistry: ProviderRuntimeRegistry;\n  gatewaySessionAffinityStore: SessionAffinityStore;\n  aiGatewayService: AiGatewayService;\n\n  // 业务服务\n  chatService: VercelChatService;\n\n  // ChatKit 服务 (OpenAI ChatKit 协议)\n  chatKitStore: PodChatKitStore;\n  chatKitAiProvider: AiProvider;\n  inngestRuntimeConfig: EmbeddedInngestRuntimeConfig | undefined;\n  runAuthContextRegistry: RunAuthContextRegistry;\n  rdfEngine: RdfEngineLike | undefined;\n  runContextRetriever: RunContextRetriever<StoreContext> | undefined;\n  rdfSearchIndexingService: RdfSearchIndexingService | undefined;\n  runExecutionBackend: InngestRunExecutionBackend;\n  taskAuthBindingService: TaskAuthBindingService<StoreContext>;\n  taskService: TaskService<StoreContext>;\n  inngestTaskScheduler: InngestTaskScheduler<StoreContext>;\n  chatKitService: ChatKitService<StoreContext>;\n  matrixStore: PodMatrixStore;\n  clientReconcilerCoordinator: ClientReconcilerCoordinator;\n  serverGroupReconcilerService: ServerGroupReconcilerService;\n  providerRegistry: ProviderRegistry;\n  embeddingService: EmbeddingService;\n  vectorService: VectorService;\n  rdfStorageStatsService: RdfStorageStatsService;\n\n  // Cloud 模式: 身份服务\n  ddnsRepo?: DdnsRepository;\n  podLookupRepo?: PodLookupRepository;\n  accountRoleRepo?: AccountRoleRepository;\n\n  // 子域名相关 (可选，按 edition 注册)\n  // Cloud 模式 或 Local 自管模式\n  dnsProvider?: DnsProvider;\n  dnsCoordinator?: EdgeNodeDnsCoordinator;\n  healthProbeService?: EdgeNodeHealthProbeService;\n  capabilityDetector?: EdgeNodeCapabilityDetector;\n  localNetworkManager?: LocalNetworkManager;\n\n  tunnelProvider?: TunnelProvider;\n  subdomainService?: SubdomainService;\n  // Local 托管式\n  subdomainClient?: SubdomainClient;\n  // Local 托管式 DDNS 管理\n  ddnsManager?: DdnsManager;\n  // Local 托管式/自管式 (启动 cloudflared)\n  localTunnelProvider?: TunnelProvider;\n\n  // Optional runtime certificate managers. Routes only enable TLS status/renewal\n  // when one of these services is explicitly registered by the active profile.\n  edgeNodeCertificateCapabilityBridge?: EdgeNodeCertificateCapabilityBridge;\n  certificateManager?: unknown;\n  acmeCertificateManager?: AcmeCertificateManager;\n  clusterCertificateManager?: ClusterCertificateManager;\n}\n"]}

package/dist/api/handlers/AdminHandler.d.ts

@@ -3,6 +3,7 @@
  * Provides configuration management, restart functionality, and log streaming
  */
 import type { ApiServer } from '../ApiServer';
+import type { AuthenticatedRequest } from '../middleware/AuthMiddleware';
 interface EnvConfig {
     [key: string]: string;
 }
@@ -12,10 +13,32 @@ export interface SanitizedEnvRead {
         configured: boolean;
     }>;
 }
-export declare const ALLOWED_ADMIN_CONFIG_KEYS: readonly ["XPOD_DEPLOY_MODE", "CSS_ROOT_FILE_PATH", "CSS_BASE_URL", "XPOD_TUNNEL_PROVIDER", "XPOD_TUNNEL_PUBLIC_URL", "CLOUDFLARE_TUNNEL_TOKEN", "SAKURA_TUNNEL_TOKEN", "NGROK_AUTHTOKEN", "NGROK_URL", "FRP_TUNNEL_TOKEN", "FRP_TUNNEL_URL", "XPOD_HTTPS_MODE", "XPOD_HTTPS_CERT_PATH", "XPOD_HTTPS_KEY_PATH", "XPOD_CLOUD_API_ENDPOINT", "XPOD_NODE_ID", "XPOD_SP_DOMAIN", "XPOD_NODE_TOKEN", "XPOD_SERVICE_TOKEN", "CSS_PORT", "CSS_SPARQL_ENDPOINT", "CSS_IDENTITY_DB_URL", "CSS_LOGGING_LEVEL", "CSS_SHOW_STACK_TRACE"];
+export declare const ALLOWED_ADMIN_CONFIG_KEYS: readonly ["XPOD_DEPLOY_MODE", "CSS_ROOT_FILE_PATH", "CSS_BASE_URL", "XPOD_TUNNEL_PROVIDER", "XPOD_TUNNEL_ACTIVE_PROFILE_ID", "XPOD_TUNNEL_PROFILES", "XPOD_TUNNEL_PUBLIC_URL", "CLOUDFLARE_TUNNEL_URL", "SAKURA_TUNNEL_URL", "CLOUDFLARE_TUNNEL_TOKEN", "SAKURA_TUNNEL_TOKEN", "NGROK_AUTHTOKEN", "NGROK_URL", "FRP_TUNNEL_TOKEN", "FRP_TUNNEL_URL", "XPOD_HTTPS_MODE", "XPOD_HTTPS_CERT_PATH", "XPOD_HTTPS_KEY_PATH", "XPOD_CLOUD_API_ENDPOINT", "XPOD_PUBLIC_API_URL", "XPOD_PUBLIC_REGISTRY_URL", "CSS_ALLOWED_HOSTS", "CSS_BASE_STORAGE_DOMAIN", "CSS_CLUSTER_INGRESS_DOMAIN", "XPOD_NODE_ID", "XPOD_SP_DOMAIN", "XPOD_NODE_TOKEN", "XPOD_SERVICE_TOKEN", "CSS_PORT", "CSS_SPARQL_ENDPOINT", "CSS_IDENTITY_DB_URL", "CSS_LOGGING_LEVEL", "CSS_SHOW_STACK_TRACE"];
 export declare function isAdminSecretEnvKey(key: string): boolean;
 export declare function sanitizeEnvForRead(env: EnvConfig): SanitizedEnvRead;
 export declare function createAllowedAdminConfigPatch(input: EnvConfig): EnvConfig;
 export declare function sanitizeLogMessage(message: string, env: EnvConfig): string;
-export declare function registerAdminRoutes(server: ApiServer): void;
+export interface AdminAuthorizerOptions {
+    internalAdminAuthSecret?: string;
+}
+export declare function isAdminMutationAllowed(req: AuthenticatedRequest, options?: AdminAuthorizerOptions): boolean;
+export declare function createAdminServicesCapabilities(req: AuthenticatedRequest, options?: AdminAuthorizerOptions): {
+    services: {
+        lifecycle: {
+            restart: {
+                supported: boolean;
+                reason?: string;
+            };
+        };
+        configuration: {
+            write: {
+                supported: boolean;
+                reason?: string;
+            };
+        };
+    };
+};
+export interface AdminRoutesOptions extends AdminAuthorizerOptions {
+}
+export declare function registerAdminRoutes(server: ApiServer, options?: AdminRoutesOptions): void;
 export {};

package/dist/api/handlers/AdminHandler.js

@@ -12,12 +12,16 @@ exports.isAdminSecretEnvKey = isAdminSecretEnvKey;
 exports.sanitizeEnvForRead = sanitizeEnvForRead;
 exports.createAllowedAdminConfigPatch = createAllowedAdminConfigPatch;
 exports.sanitizeLogMessage = sanitizeLogMessage;
+exports.isAdminMutationAllowed = isAdminMutationAllowed;
+exports.createAdminServicesCapabilities = createAdminServicesCapabilities;
 exports.registerAdminRoutes = registerAdminRoutes;
+const node_crypto_1 = require("node:crypto");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const fs_2 = require("fs");
 const readline_1 = require("readline");
 const runtime_1 = require("../../runtime");
+const GatewayAdminProxyAuth_1 = require("../../runtime/GatewayAdminProxyAuth");
 const CONFIG_DIR = path_1.default.resolve(runtime_1.PACKAGE_ROOT, 'config');
 function getEnvFilePath() {
     const envPath = process.env.XPOD_ENV_PATH;
@@ -31,7 +35,11 @@ exports.ALLOWED_ADMIN_CONFIG_KEYS = [
     'CSS_ROOT_FILE_PATH',
     'CSS_BASE_URL',
     'XPOD_TUNNEL_PROVIDER',
+    'XPOD_TUNNEL_ACTIVE_PROFILE_ID',
+    'XPOD_TUNNEL_PROFILES',
     'XPOD_TUNNEL_PUBLIC_URL',
+    'CLOUDFLARE_TUNNEL_URL',
+    'SAKURA_TUNNEL_URL',
     'CLOUDFLARE_TUNNEL_TOKEN',
     'SAKURA_TUNNEL_TOKEN',
     'NGROK_AUTHTOKEN',
@@ -42,6 +50,11 @@ exports.ALLOWED_ADMIN_CONFIG_KEYS = [
     'XPOD_HTTPS_CERT_PATH',
     'XPOD_HTTPS_KEY_PATH',
     'XPOD_CLOUD_API_ENDPOINT',
+    'XPOD_PUBLIC_API_URL',
+    'XPOD_PUBLIC_REGISTRY_URL',
+    'CSS_ALLOWED_HOSTS',
+    'CSS_BASE_STORAGE_DOMAIN',
+    'CSS_CLUSTER_INGRESS_DOMAIN',
     'XPOD_NODE_ID',
     'XPOD_SP_DOMAIN',
     'XPOD_NODE_TOKEN',
@@ -111,18 +124,34 @@ function sanitizeLogEntry(entry, env) {
         message: sanitizeLogMessage(entry.message, env),
     };
 }
-function isLocalAdminHost(req) {
+function safeTokenEquals(actual, expected) {
+    const actualHash = (0, node_crypto_1.createHash)('sha256').update(actual).digest();
+    const expectedHash = (0, node_crypto_1.createHash)('sha256').update(expected).digest();
+    return (0, node_crypto_1.timingSafeEqual)(actualHash, expectedHash);
+}
+function isAdminMutationAllowed(req, options = {}) {
     const configuredToken = process.env.XPOD_ADMIN_TOKEN;
     const providedToken = req.headers['x-xpod-admin-token'] ??
         req.headers.authorization?.replace(/^Bearer\s+/i, '');
-    if (configuredToken && providedToken === configuredToken) {
+    if (configuredToken &&
+        typeof providedToken === 'string' &&
+        safeTokenEquals(providedToken, configuredToken)) {
         return true;
     }
-    const host = String(req.headers.host ?? '').split(':')[0].toLowerCase();
-    return host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';
+    const peerLoopback = (0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(req.socket.remoteAddress);
+    const proxyMarker = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
+        headers: req.headers,
+        secret: options.internalAdminAuthSecret,
+        method: req.method,
+        url: req.url,
+    });
+    if (proxyMarker.present) {
+        return peerLoopback && proxyMarker.valid && proxyMarker.originalClientLoopback;
+    }
+    return peerLoopback;
 }
-function assertAdminMutationAllowed(req, res) {
-    if (isLocalAdminHost(req)) {
+function assertAdminMutationAllowed(req, res, options) {
+    if (isAdminMutationAllowed(req, options)) {
         return true;
     }
     sendJson(res, 403, {
@@ -131,6 +160,26 @@ function assertAdminMutationAllowed(req, res) {
     });
     return false;
 }
+function createAdminServicesCapabilities(req, options = {}) {
+    const adminMutationSupported = isAdminMutationAllowed(req, options);
+    const adminMutationReason = adminMutationSupported ? undefined : 'requires_loopback_or_admin_token';
+    return {
+        services: {
+            lifecycle: {
+                restart: {
+                    supported: adminMutationSupported,
+                    ...(adminMutationReason ? { reason: adminMutationReason } : {}),
+                },
+            },
+            configuration: {
+                write: {
+                    supported: adminMutationSupported,
+                    ...(adminMutationReason ? { reason: adminMutationReason } : {}),
+                },
+            },
+        },
+    };
+}
 /**
  * Read .env.local file and parse it
  */
@@ -264,10 +313,10 @@ function parseJsonBody(req) {
         req.on('error', reject);
     });
 }
-function registerAdminRoutes(server) {
+function registerAdminRoutes(server, options = {}) {
     const logger = console;
     // GET /api/admin/status - Get xpod status
-    const statusHandler = async (_req, res) => {
+    const statusHandler = async (req, res) => {
         try {
             const envFilePath = getEnvFilePath();
             const env = readEnvFile(envFilePath);
@@ -283,6 +332,7 @@ function registerAdminRoutes(server) {
                     CSS_PORT: env.CSS_PORT || process.env.CSS_PORT,
                 },
                 configs,
+                capabilities: createAdminServicesCapabilities(req, options),
             });
         }
         catch (error) {
@@ -308,7 +358,7 @@ function registerAdminRoutes(server) {
     // PUT /api/admin/config - Update configuration
     const updateConfigHandler = async (req, res) => {
         try {
-            if (!assertAdminMutationAllowed(req, res)) {
+            if (!assertAdminMutationAllowed(req, res, options)) {
                 return;
             }
             // Parse body from raw request
@@ -341,7 +391,7 @@ function registerAdminRoutes(server) {
     // POST /api/admin/restart - Trigger xpod restart
     const restartHandler = async (req, res) => {
         try {
-            if (!assertAdminMutationAllowed(req, res)) {
+            if (!assertAdminMutationAllowed(req, res, options)) {
                 return;
             }
             const ppid = process.ppid;

package/dist/api/handlers/AdminHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"AdminHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/AdminHandler.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAwEH,kDAeC;AAED,gDAaC;AAED,sEAYC;AAMD,gDAUC;AAsKD,kDAmYC;AAxqBD,4CAAoB;AACpB,gDAAwB;AACxB,2BAAgD;AAChD,uCAA2C;AAC3C,2CAA6C;AAE7C,MAAM,UAAU,GAAG,cAAI,CAAC,OAAO,CAAC,sBAAY,EAAE,QAAQ,CAAC,CAAC;AAExD,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,OAAO,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC;AAwBY,QAAA,yBAAyB,GAAG;IACvC,kBAAkB;IAClB,oBAAoB;IACpB,cAAc;IACd,sBAAsB;IACtB,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,yBAAyB;IACzB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,UAAU;IACV,qBAAqB;IACrB,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;CACd,CAAC;AAEX,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAS,iCAAyB,CAAC,CAAC;AAEhF,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/B,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;QACpC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAAc;IAC/C,MAAM,SAAS,GAAc,EAAE,CAAC;IAChC,MAAM,OAAO,GAA4C,EAAE,CAAC;IAE5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAgB;IAC5D,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAe,EAAE,GAAc;IAChE,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;SACvE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,aAAa,GAAG,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAe,EAAE,GAAc;IACvD,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAyB;IACjD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACrD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,eAAe,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,CAAC;AAC5F,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAyB,EAAE,GAAmB;IAChF,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,4FAA4F;KACrG,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,gBAAgB;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,MAAiB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,yDAAyD;QACzD,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,eAAe;IACtB,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAEhF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AAEH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,SAAS,GAAG;QAChB,mCAAmC;QACnC,wBAAwB;KACzB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAqB,CAAC;gBACjD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC3B,IAAI,EAAE,EAAE,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,EAAE,EAAE,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAyB;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAAiB;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC;IAEvB,0CAA0C;IAC1C,MAAM,aAAa,GAAiB,KAAK,EACvC,IAA0B,EAC1B,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,MAAM,EAAE,SAAS;gBACjB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACxB,GAAG,EAAE;oBACH,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;oBAC1D,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;oBAC1D,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;iBAC/C;gBACD,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,oDAAoD;IACpD,MAAM,gBAAgB,GAAiB,KAAK,EAC1C,IAA0B,EAC1B,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,GAAG,kBAAkB,CAAC,GAAG,CAAC;gBAC1B,WAAW,EAAE,eAAe,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;YACjD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;IAEF,+CAA+C;IAC/C,MAAM,mBAAmB,GAAiB,KAAK,EAC7C,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,8BAA8B;YAC9B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAEtC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,EAAE,CAAC;gBAE3C,0CAA0C;gBAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;wBACnC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAED,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAClC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YAC9C,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IAEF,iDAAiD;IACjD,MAAM,cAAc,GAAiB,KAAK,EACxC,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,mDAAmD,IAAI,GAAG,CAAC,CAAC;YAEvE,0CAA0C;YAC1C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,mDAAmD;aAC7D,CAAC,CAAC;YAEH,wDAAwD;YACxD,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;IAEF,yCAAyC;IACzC,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,MAAM,cAAc,GAAG,IAAI,CAAC;IAE5B,6BAA6B;IAC7B,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtE,SAAS,MAAM,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe;QAC5D,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;SACxB,CAAC;QACF,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,SAAS,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACtC,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAAU,EAAE,GAAG,IAAW,EAAW,EAAE;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,mBAAmB,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAAU,EAAE,GAAG,IAAW,EAAW,EAAE;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,mBAAmB,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,wCAAwC;IACxC,MAAM,cAAc,GAAiB,KAAK,EACxC,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;YAE1C,IAAI,IAAI,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;YAE1B,gBAAgB;YAChB,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC7B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC/B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YACnD,CAAC;YAED,qBAAqB;YACrB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IAEF,mDAAmD;IACnD,MAAM,iBAAiB,GAAiB,KAAK,EAC3C,IAA0B,EAC1B,GAAmB,EACnB,EAAE;QACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;QAEH,oBAAoB;QACpB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC;QACnC,IAAI,GAAG,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAEjI,6BAA6B;QAC7B,IAAI,YAAY,GAAG,SAAS,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,IAAI,SAAS,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;gBACpC,GAAG,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;gBACpC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvF,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC5E,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC;YAClC,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,oBAAoB;QACpB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,qDAAqD;IACrD,MAAM,iBAAiB,GAAiB,KAAK,EAC3C,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;YAE1C,gCAAgC;YAChC,MAAM,QAAQ,GAAG;gBACf,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC;gBACnD,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC;gBAChD,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;gBACvC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;aAC5C,CAAC;YAEF,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,YAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrB,OAAO,GAAG,CAAC,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,oBAAoB;YACpB,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAA,aAAQ,EAAC,OAAO,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,IAAA,qBAAgB,EAAC,OAAO,EAAE;gBACvC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,GAAG,CAAC,EAAE,aAAa;gBAC1D,GAAG,EAAE,KAAK,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,EAAE,GAAG,IAAA,0BAAe,EAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;YACzC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IAGF,qFAAqF;IACrF,MAAM,WAAW,GAAiB,KAAK,EACrC,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAE5G,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;YAEjC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE;oBACR,OAAO;oBACP,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B;iBACpE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE;oBACR,OAAO;oBACP,MAAM,EAAE,sBAAsB;iBAC/B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,EAAE;oBACR,OAAO;oBACP,MAAM,EAAE,2BAA2B;iBACpC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,0CAA0C;YAC1C,MAAM,WAAW,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;wBACjB,MAAM,EAAE,SAAS;wBACjB,IAAI,EAAE,IAAI;wBACV,OAAO;wBACP,MAAM,EAAE,mBAAmB;qBAC5B,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,EAAE,GAAG,QAAQ,KAAK,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;oBAC5B,IAAI,EAAE,EAAE;oBACR,OAAO;oBACP,MAAM,EAAE,EAAE;wBACR,CAAC,CAAC,gCAAgC;wBAClC,CAAC,CAAC,kCAAkC;iBACvC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,IAAI;oBACV,OAAO;oBACP,MAAM,EAAE,6BAA6B;iBACtC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE;gBACR,OAAO;gBACP,MAAM,EAAE,8BAA8B;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACtD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;IAEF,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AACpD,CAAC","sourcesContent":["/**\n * Admin API Handler\n * Provides configuration management, restart functionality, and log streaming\n */\n\nimport type { ServerResponse } from 'node:http';\nimport type { ApiServer, RouteHandler } from '../ApiServer';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\nimport fs from 'fs';\nimport path from 'path';\nimport { createReadStream, statSync } from 'fs';\nimport { createInterface } from 'readline';\nimport { PACKAGE_ROOT } from '../../runtime';\n\nconst CONFIG_DIR = path.resolve(PACKAGE_ROOT, 'config');\n\nfunction getEnvFilePath(): string {\n  const envPath = process.env.XPOD_ENV_PATH;\n  if (envPath && envPath.trim()) {\n    return path.resolve(envPath);\n  }\n  return path.resolve(process.cwd(), '.env.local');\n}\n\ninterface ConfigFile {\n  name: string;\n  path: string;\n  exists: boolean;\n}\n\ninterface EnvConfig {\n  [key: string]: string;\n}\n\ninterface LogEntry {\n  timestamp: string;\n  level: string;\n  source: string;\n  message: string;\n}\n\nexport interface SanitizedEnvRead {\n  env: EnvConfig;\n  secrets: Record<string, { configured: boolean }>;\n}\n\nexport const ALLOWED_ADMIN_CONFIG_KEYS = [\n  'XPOD_DEPLOY_MODE',\n  'CSS_ROOT_FILE_PATH',\n  'CSS_BASE_URL',\n  'XPOD_TUNNEL_PROVIDER',\n  'XPOD_TUNNEL_PUBLIC_URL',\n  'CLOUDFLARE_TUNNEL_TOKEN',\n  'SAKURA_TUNNEL_TOKEN',\n  'NGROK_AUTHTOKEN',\n  'NGROK_URL',\n  'FRP_TUNNEL_TOKEN',\n  'FRP_TUNNEL_URL',\n  'XPOD_HTTPS_MODE',\n  'XPOD_HTTPS_CERT_PATH',\n  'XPOD_HTTPS_KEY_PATH',\n  'XPOD_CLOUD_API_ENDPOINT',\n  'XPOD_NODE_ID',\n  'XPOD_SP_DOMAIN',\n  'XPOD_NODE_TOKEN',\n  'XPOD_SERVICE_TOKEN',\n  'CSS_PORT',\n  'CSS_SPARQL_ENDPOINT',\n  'CSS_IDENTITY_DB_URL',\n  'CSS_LOGGING_LEVEL',\n  'CSS_SHOW_STACK_TRACE',\n] as const;\n\nconst ALLOWED_ADMIN_CONFIG_KEY_SET = new Set<string>(ALLOWED_ADMIN_CONFIG_KEYS);\n\nexport function isAdminSecretEnvKey(key: string): boolean {\n  const normalized = key.toUpperCase();\n  if (normalized.endsWith('_KEY_PATH') || normalized.endsWith('_CERT_PATH')) {\n    return false;\n  }\n  return (\n    normalized.includes('AUTHTOKEN') ||\n    normalized.endsWith('_TOKEN') ||\n    normalized.endsWith('_SECRET') ||\n    normalized.endsWith('_API_KEY') ||\n    normalized.includes('PASSWORD') ||\n    normalized.includes('CLIENT_SECRET') ||\n    normalized.endsWith('_DB_URL') ||\n    normalized.includes('DATABASE_URL')\n  );\n}\n\nexport function sanitizeEnvForRead(env: EnvConfig): SanitizedEnvRead {\n  const sanitized: EnvConfig = {};\n  const secrets: Record<string, { configured: boolean }> = {};\n\n  for (const [key, value] of Object.entries(env)) {\n    if (isAdminSecretEnvKey(key)) {\n      secrets[key] = { configured: Boolean(value) };\n      continue;\n    }\n    sanitized[key] = value;\n  }\n\n  return { env: sanitized, secrets };\n}\n\nexport function createAllowedAdminConfigPatch(input: EnvConfig): EnvConfig {\n  const patch: EnvConfig = {};\n  for (const [key, value] of Object.entries(input)) {\n    if (!ALLOWED_ADMIN_CONFIG_KEY_SET.has(key)) {\n      continue;\n    }\n    if (isAdminSecretEnvKey(key) && !value) {\n      continue;\n    }\n    patch[key] = value;\n  }\n  return patch;\n}\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\nexport function sanitizeLogMessage(message: string, env: EnvConfig): string {\n  let sanitized = message;\n  const secretEntries = Object.entries(env)\n    .filter(([key, value]) => isAdminSecretEnvKey(key) && value.length >= 6)\n    .sort((a, b) => b[1].length - a[1].length);\n\n  for (const [key, value] of secretEntries) {\n    sanitized = sanitized.replace(new RegExp(escapeRegExp(value), 'g'), `[redacted:${key}]`);\n  }\n  return sanitized;\n}\n\nfunction sanitizeLogEntry(entry: LogEntry, env: EnvConfig): LogEntry {\n  return {\n    ...entry,\n    message: sanitizeLogMessage(entry.message, env),\n  };\n}\n\nfunction isLocalAdminHost(req: AuthenticatedRequest): boolean {\n  const configuredToken = process.env.XPOD_ADMIN_TOKEN;\n  const providedToken = req.headers['x-xpod-admin-token'] ??\n    req.headers.authorization?.replace(/^Bearer\\s+/i, '');\n  if (configuredToken && providedToken === configuredToken) {\n    return true;\n  }\n\n  const host = String(req.headers.host ?? '').split(':')[0].toLowerCase();\n  return host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';\n}\n\nfunction assertAdminMutationAllowed(req: AuthenticatedRequest, res: ServerResponse): boolean {\n  if (isLocalAdminHost(req)) {\n    return true;\n  }\n  sendJson(res, 403, {\n    error: 'Forbidden',\n    detail: 'Runtime config writes and restart are allowed only from loopback or with XPOD_ADMIN_TOKEN.',\n  });\n  return false;\n}\n\n/**\n * Read .env.local file and parse it\n */\nfunction readEnvFile(filePath: string): EnvConfig {\n  const config: EnvConfig = {};\n  if (!fs.existsSync(filePath)) {\n    return config;\n  }\n  const content = fs.readFileSync(filePath, 'utf-8');\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    // Remove quotes\n    if ((value.startsWith('\"') && value.endsWith('\"')) ||\n        (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1);\n    }\n    config[key] = value;\n  }\n  return config;\n}\n\n/**\n * Write .env.local file\n */\nfunction writeEnvFile(filePath: string, config: EnvConfig): void {\n  const lines: string[] = [];\n  for (const [key, value] of Object.entries(config)) {\n    // Quote values that contain spaces or special characters\n    const needsQuotes = /[\\s\"'=]/.test(value);\n    const quotedValue = needsQuotes ? `\"${value}\"` : value;\n    lines.push(`${key}=${quotedValue}`);\n  }\n  fs.writeFileSync(filePath, lines.join('\\n') + '\\n');\n}\n\n/**\n * List available config files\n */\nfunction listConfigFiles(): ConfigFile[] {\n  const files: ConfigFile[] = [];\n  const configFiles = ['local.json', 'cloud.json', 'main.json', 'xpod.base.json'];\n\n  for (const name of configFiles) {\n    const filePath = path.join(CONFIG_DIR, name);\n    files.push({\n      name,\n      path: filePath,\n      exists: fs.existsSync(filePath),\n    });\n  }\n  return files;\n}\n\n/**\n * Send JSON response helper\n */\n\nfunction isPrivateIp(host: string): boolean {\n  if (host === 'localhost' || host === '::1') return true;\n  if (host.startsWith('127.')) return true;\n  if (host.startsWith('10.')) return true;\n  if (host.startsWith('192.168.')) return true;\n  const m = host.match(/^172\\.(\\d+)\\./);\n  if (m) {\n    const second = Number(m[1]);\n    if (second >= 16 && second <= 31) return true;\n  }\n  return false;\n}\n\nasync function fetchPublicIp(): Promise<string | null> {\n  const endpoints = [\n    'https://api.ipify.org?format=json',\n    'https://ifconfig.me/ip',\n  ];\n\n  for (const url of endpoints) {\n    try {\n      const res = await fetch(url, { signal: AbortSignal.timeout(3000) });\n      if (!res.ok) {\n        continue;\n      }\n      const contentType = res.headers.get('content-type') || '';\n      if (contentType.includes('application/json')) {\n        const json = await res.json() as { ip?: string };\n        const ip = json.ip?.trim();\n        if (ip) {\n          return ip;\n        }\n      } else {\n        const ip = (await res.text()).trim();\n        if (ip) {\n          return ip;\n        }\n      }\n    } catch {\n      // ignore and try next endpoint\n    }\n  }\n\n  return null;\n}\n\nfunction sendJson(res: ServerResponse, status: number, data: unknown): void {\n  res.statusCode = status;\n  res.setHeader('Content-Type', 'application/json');\n  res.end(JSON.stringify(data));\n}\n\n/**\n * Parse JSON body from request\n */\nfunction parseJsonBody(req: AuthenticatedRequest): Promise<{ env?: EnvConfig }> {\n  return new Promise((resolve, reject) => {\n    let body = '';\n    req.on('data', (chunk: Buffer) => {\n      body += chunk.toString();\n    });\n    req.on('end', () => {\n      try {\n        resolve(body ? JSON.parse(body) : {});\n      } catch (err) {\n        reject(err);\n      }\n    });\n    req.on('error', reject);\n  });\n}\n\nexport function registerAdminRoutes(server: ApiServer): void {\n  const logger = console;\n\n  // GET /api/admin/status - Get xpod status\n  const statusHandler: RouteHandler = async (\n    _req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const envFilePath = getEnvFilePath();\n      const env = readEnvFile(envFilePath);\n      const configs = listConfigFiles();\n\n      sendJson(res, 200, {\n        status: 'running',\n        pid: process.pid,\n        ppid: process.ppid,\n        uptime: process.uptime(),\n        env: {\n          CSS_BASE_URL: env.CSS_BASE_URL || process.env.CSS_BASE_URL,\n          XPOD_EDITION: env.XPOD_EDITION || process.env.XPOD_EDITION,\n          CSS_PORT: env.CSS_PORT || process.env.CSS_PORT,\n        },\n        configs,\n      });\n    } catch (error) {\n      logger.error('[Admin] Status error:', error);\n      sendJson(res, 500, { error: 'Failed to get status' });\n    }\n  };\n\n  // GET /api/admin/config - Get current configuration\n  const getConfigHandler: RouteHandler = async (\n    _req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const envFilePath = getEnvFilePath();\n      const env = readEnvFile(envFilePath);\n      sendJson(res, 200, {\n        ...sanitizeEnvForRead(env),\n        configFiles: listConfigFiles(),\n      });\n    } catch (error) {\n      logger.error('[Admin] Get config error:', error);\n      sendJson(res, 500, { error: 'Failed to read configuration' });\n    }\n  };\n\n  // PUT /api/admin/config - Update configuration\n  const updateConfigHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      if (!assertAdminMutationAllowed(req, res)) {\n        return;\n      }\n      // Parse body from raw request\n      const body = await parseJsonBody(req);\n\n      if (body.env) {\n        // Merge with existing config\n        const envFilePath = getEnvFilePath();\n        const currentEnv = readEnvFile(envFilePath);\n        const patch = createAllowedAdminConfigPatch(body.env);\n        const newEnv = { ...currentEnv, ...patch };\n\n        // Remove keys set to null or empty string\n        for (const [key, value] of Object.entries(newEnv)) {\n          if (value === null || value === '') {\n            delete newEnv[key];\n          }\n        }\n\n        writeEnvFile(envFilePath, newEnv);\n        logger.log('[Admin] Configuration updated');\n      }\n\n      sendJson(res, 200, {\n        success: true,\n        message: 'Configuration updated. Restart required for changes to take effect.',\n      });\n    } catch (error) {\n      logger.error('[Admin] Update config error:', error);\n      sendJson(res, 500, { error: 'Failed to update configuration' });\n    }\n  };\n\n  // POST /api/admin/restart - Trigger xpod restart\n  const restartHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      if (!assertAdminMutationAllowed(req, res)) {\n        return;\n      }\n      const ppid = process.ppid;\n\n      if (!ppid) {\n        sendJson(res, 500, { error: 'Cannot determine parent process' });\n        return;\n      }\n\n      logger.log(`[Admin] Sending SIGUSR1 to parent process (pid: ${ppid})`);\n\n      // Send response before triggering restart\n      sendJson(res, 200, {\n        success: true,\n        message: 'Restart signal sent. Server will restart shortly.',\n      });\n\n      // Give time for response to be sent, then signal parent\n      setTimeout(() => {\n        try {\n          process.kill(ppid, 'SIGUSR1');\n        } catch (err) {\n          logger.error('[Admin] Failed to send restart signal:', err);\n        }\n      }, 100);\n    } catch (error) {\n      logger.error('[Admin] Restart error:', error);\n      sendJson(res, 500, { error: 'Failed to trigger restart' });\n    }\n  };\n\n  // Log buffer for recent logs (in-memory)\n  const logBuffer: LogEntry[] = [];\n  const MAX_LOG_BUFFER = 1000;\n\n  // Capture stdout/stderr logs\n  const originalStdoutWrite = process.stdout.write.bind(process.stdout);\n  const originalStderrWrite = process.stderr.write.bind(process.stderr);\n\n  function addLog(level: string, source: string, message: string): void {\n    const entry = {\n      timestamp: new Date().toISOString(),\n      level,\n      source,\n      message: message.trim(),\n    };\n    logBuffer.push(entry);\n    if (logBuffer.length > MAX_LOG_BUFFER) {\n      logBuffer.shift();\n    }\n  }\n\n  // Intercept stdout\n  process.stdout.write = (chunk: any, ...args: any[]): boolean => {\n    const message = chunk.toString();\n    addLog('info', 'xpod', message);\n    return originalStdoutWrite(chunk, ...args);\n  };\n\n  // Intercept stderr\n  process.stderr.write = (chunk: any, ...args: any[]): boolean => {\n    const message = chunk.toString();\n    addLog('error', 'xpod', message);\n    return originalStderrWrite(chunk, ...args);\n  };\n\n  // GET /api/admin/logs - Get recent logs\n  const getLogsHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const url = new URL(req.url || '', `http://${req.headers.host}`);\n      const limit = parseInt(url.searchParams.get('limit') || '100', 10);\n      const level = url.searchParams.get('level');\n      const source = url.searchParams.get('source');\n      const env = readEnvFile(getEnvFilePath());\n\n      let logs = [...logBuffer];\n\n      // Apply filters\n      if (level && level !== 'all') {\n        logs = logs.filter(log => log.level === level);\n      }\n      if (source && source !== 'all') {\n        logs = logs.filter(log => log.source === source);\n      }\n\n      // Return last N logs\n      logs = logs.slice(-limit).map((log) => sanitizeLogEntry(log, env));\n\n      sendJson(res, 200, { logs });\n    } catch (error) {\n      logger.error('[Admin] Get logs error:', error);\n      sendJson(res, 500, { error: 'Failed to get logs' });\n    }\n  };\n\n  // GET /api/admin/logs/stream - Stream logs via SSE\n  const streamLogsHandler: RouteHandler = async (\n    _req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    res.writeHead(200, {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache',\n      'Connection': 'keep-alive',\n    });\n\n    // Send initial logs\n    const lastIndex = logBuffer.length;\n    let env = readEnvFile(getEnvFilePath());\n    res.write(`data: ${JSON.stringify({ type: 'init', logs: logBuffer.slice(-100).map((log) => sanitizeLogEntry(log, env)) })}\\n\\n`);\n\n    // Send new logs every second\n    let currentIndex = lastIndex;\n    const interval = setInterval(() => {\n      if (logBuffer.length > currentIndex) {\n        env = readEnvFile(getEnvFilePath());\n        const newLogs = logBuffer.slice(currentIndex).map((log) => sanitizeLogEntry(log, env));\n        res.write(`data: ${JSON.stringify({ type: 'update', logs: newLogs })}\\n\\n`);\n        currentIndex = logBuffer.length;\n      }\n    }, 1000);\n\n    // Clean up on close\n    res.on('close', () => {\n      clearInterval(interval);\n    });\n  };\n\n  // GET /api/admin/logs/file - Read log file from disk\n  const getLogFileHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const url = new URL(req.url || '', `http://${req.headers.host}`);\n      const lines = parseInt(url.searchParams.get('lines') || '100', 10);\n      const env = readEnvFile(getEnvFilePath());\n\n      // Try common log file locations\n      const logPaths = [\n        path.resolve(process.cwd(), 'logs', 'combined.log'),\n        path.resolve(process.cwd(), 'logs', 'error.log'),\n        path.resolve(process.cwd(), 'xpod.log'),\n        path.resolve(process.cwd(), 'combined.log'),\n      ];\n\n      let logPath: string | null = null;\n      for (const p of logPaths) {\n        if (fs.existsSync(p)) {\n          logPath = p;\n          break;\n        }\n      }\n\n      if (!logPath) {\n        sendJson(res, 404, { error: 'No log file found' });\n        return;\n      }\n\n      // Read last N lines\n      const fileLogs: string[] = [];\n      const stats = statSync(logPath);\n      const stream = createReadStream(logPath, {\n        start: Math.max(0, stats.size - 1024 * 100), // Last 100KB\n        end: stats.size,\n      });\n\n      const rl = createInterface({ input: stream });\n      for await (const line of rl) {\n        fileLogs.push(line);\n      }\n\n      const lastLines = fileLogs.slice(-lines);\n      sendJson(res, 200, {\n        file: logPath,\n        lines: lastLines.map((line) => sanitizeLogMessage(line, env)),\n      });\n    } catch (error) {\n      logger.error('[Admin] Get log file error:', error);\n      sendJson(res, 500, { error: 'Failed to read log file' });\n    }\n  };\n\n\n  // GET /api/admin/public-ip - Detect outbound public IP and compare with CSS_BASE_URL\n  const ipv4Handler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const envFilePath = getEnvFilePath();\n      const env = readEnvFile(envFilePath);\n      const parsedUrl = new URL(req.url ?? '/', 'http://localhost');\n      const baseUrl = parsedUrl.searchParams.get('baseUrl') || env.CSS_BASE_URL || process.env.CSS_BASE_URL || '';\n\n      const ip = await fetchPublicIp();\n\n      if (!baseUrl) {\n        sendJson(res, 200, {\n          status: 'unknown',\n          ipv4: ip,\n          baseUrl,\n          detail: ip ? '未配置 Base URL，无法判断是否可直连。' : '未配置 Base URL，且无法获取公网 IP。',\n        });\n        return;\n      }\n\n      let hostname = '';\n      try {\n        hostname = new URL(baseUrl).hostname;\n      } catch {\n        sendJson(res, 200, {\n          status: 'unknown',\n          ipv4: ip,\n          baseUrl,\n          detail: 'Base URL 格式不合法，无法判断。',\n        });\n        return;\n      }\n\n      if (isPrivateIp(hostname)) {\n        sendJson(res, 200, {\n          status: 'fail',\n          ipv4: ip,\n          baseUrl,\n          detail: 'Base URL 为本地/内网地址，默认不可直连。',\n        });\n        return;\n      }\n\n      // If hostname is an IP, compare directly.\n      const isIpLiteral = /^\\d{1,3}(\\.\\d{1,3}){3}$/.test(hostname);\n      if (isIpLiteral) {\n        if (!ip) {\n          sendJson(res, 200, {\n            status: 'unknown',\n            ipv4: null,\n            baseUrl,\n            detail: '无法获取公网出口 IP，无法比对。',\n          });\n          return;\n        }\n        const ok = hostname === ip;\n        sendJson(res, 200, {\n          status: ok ? 'pass' : 'fail',\n          ipv4: ip,\n          baseUrl,\n          detail: ok\n            ? 'Base URL IP 与公网出口 IP 一致，默认可直连。'\n            : 'Base URL IP 与公网出口 IP 不一致，默认不可直连。',\n        });\n        return;\n      }\n\n      // Domain name: we can only do best-effort.\n      if (!ip) {\n        sendJson(res, 200, {\n          status: 'unknown',\n          ipv4: null,\n          baseUrl,\n          detail: '已配置域名，但无法获取公网出口 IP，无法进一步判断。',\n        });\n        return;\n      }\n\n      sendJson(res, 200, {\n        status: 'pass',\n        ipv4: ip,\n        baseUrl,\n        detail: '已配置域名，默认可直连（仍需确保端口映射/防火墙放行）。',\n      });\n    } catch (error) {\n      logger.error('[Admin] Public IP check error:', error);\n      sendJson(res, 500, { error: 'Failed to detect public ip' });\n    }\n  };\n\n  // Register routes - public for now (TODO: add auth for production)\n  server.get('/api/admin/status', statusHandler, { public: true });\n  server.get('/api/admin/config', getConfigHandler, { public: true });\n  server.get('/api/admin/public-ip', ipv4Handler, { public: true });\n  server.put('/api/admin/config', updateConfigHandler, { public: true });\n  server.post('/api/admin/restart', restartHandler, { public: true });\n  server.get('/api/admin/logs', getLogsHandler, { public: true });\n  server.get('/api/admin/logs/stream', streamLogsHandler, { public: true });\n  server.get('/api/admin/logs/file', getLogFileHandler, { public: true });\n\n  logger.log('[Admin] Admin API routes registered');\n}\n"]}
+{"version":3,"file":"AdminHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/AdminHandler.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAsFH,kDAeC;AAED,gDAaC;AAED,sEAYC;AAMD,gDAUC;AAmBD,wDAwBC;AAaD,0EAyBC;AA0ID,kDAoYC;AA5uBD,6CAA0D;AAC1D,4CAAoB;AACpB,gDAAwB;AACxB,2BAAgD;AAChD,uCAA2C;AAC3C,2CAA6C;AAC7C,+EAG6C;AAE7C,MAAM,UAAU,GAAG,cAAI,CAAC,OAAO,CAAC,sBAAY,EAAE,QAAQ,CAAC,CAAC;AAExD,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,OAAO,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC;AAwBY,QAAA,yBAAyB,GAAG;IACvC,kBAAkB;IAClB,oBAAoB;IACpB,cAAc;IACd,sBAAsB;IACtB,+BAA+B;IAC/B,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,yBAAyB;IACzB,qBAAqB;IACrB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,4BAA4B;IAC5B,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,UAAU;IACV,qBAAqB;IACrB,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;CACd,CAAC;AAEX,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAS,iCAAyB,CAAC,CAAC;AAEhF,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/B,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;QACpC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAAc;IAC/C,MAAM,SAAS,GAAc,EAAE,CAAC;IAChC,MAAM,OAAO,GAA4C,EAAE,CAAC;IAE5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAgB;IAC5D,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAe,EAAE,GAAc;IAChE,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;SACvE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,aAAa,GAAG,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAe,EAAE,GAAc;IACvD,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,QAAgB;IACvD,MAAM,UAAU,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAChE,MAAM,YAAY,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,OAAO,IAAA,6BAAe,EAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC;AAMD,SAAgB,sBAAsB,CAAC,GAAyB,EAAE,UAAkC,EAAE;IACpG,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACrD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACxD,IACE,eAAe;QACf,OAAO,aAAa,KAAK,QAAQ;QACjC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,+CAAuB,EAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAA,sDAA8B,EAAC;QACjD,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,OAAO,CAAC,uBAAuB;QACvC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,YAAY,IAAI,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,sBAAsB,CAAC;IACjF,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAyB,EAAE,GAAmB,EAAE,OAA+B;IACjH,IAAI,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,4FAA4F;KACrG,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,+BAA+B,CAAC,GAAyB,EAAE,UAAkC,EAAE;IAM7G,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpE,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC;IAEpG,OAAO;QACL,QAAQ,EAAE;YACR,SAAS,EAAE;gBACT,OAAO,EAAE;oBACP,SAAS,EAAE,sBAAsB;oBACjC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF;YACD,aAAa,EAAE;gBACb,KAAK,EAAE;oBACL,SAAS,EAAE,sBAAsB;oBACjC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,gBAAgB;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,MAAiB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,yDAAyD;QACzD,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,eAAe;IACtB,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAEhF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AAEH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,SAAS,GAAG;QAChB,mCAAmC;QACnC,wBAAwB;KACzB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAqB,CAAC;gBACjD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC3B,IAAI,EAAE,EAAE,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,EAAE,EAAE,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAyB;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAID,SAAgB,mBAAmB,CAAC,MAAiB,EAAE,UAA8B,EAAE;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC;IAEvB,0CAA0C;IAC1C,MAAM,aAAa,GAAiB,KAAK,EACvC,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,MAAM,EAAE,SAAS;gBACjB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACxB,GAAG,EAAE;oBACH,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;oBAC1D,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;oBAC1D,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;iBAC/C;gBACD,OAAO;gBACP,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,oDAAoD;IACpD,MAAM,gBAAgB,GAAiB,KAAK,EAC1C,IAA0B,EAC1B,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,GAAG,kBAAkB,CAAC,GAAG,CAAC;gBAC1B,WAAW,EAAE,eAAe,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;YACjD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;IAEF,+CAA+C;IAC/C,MAAM,mBAAmB,GAAiB,KAAK,EAC7C,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,8BAA8B;YAC9B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAEtC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,EAAE,CAAC;gBAE3C,0CAA0C;gBAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;wBACnC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAED,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAClC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YAC9C,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IAEF,iDAAiD;IACjD,MAAM,cAAc,GAAiB,KAAK,EACxC,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,mDAAmD,IAAI,GAAG,CAAC,CAAC;YAEvE,0CAA0C;YAC1C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,mDAAmD;aAC7D,CAAC,CAAC;YAEH,wDAAwD;YACxD,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;IAEF,yCAAyC;IACzC,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,MAAM,cAAc,GAAG,IAAI,CAAC;IAE5B,6BAA6B;IAC7B,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtE,SAAS,MAAM,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe;QAC5D,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;SACxB,CAAC;QACF,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,SAAS,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACtC,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAAU,EAAE,GAAG,IAAW,EAAW,EAAE;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,mBAAmB,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAAU,EAAE,GAAG,IAAW,EAAW,EAAE;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,mBAAmB,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,wCAAwC;IACxC,MAAM,cAAc,GAAiB,KAAK,EACxC,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;YAE1C,IAAI,IAAI,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;YAE1B,gBAAgB;YAChB,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC7B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC/B,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YACnD,CAAC;YAED,qBAAqB;YACrB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IAEF,mDAAmD;IACnD,MAAM,iBAAiB,GAAiB,KAAK,EAC3C,IAA0B,EAC1B,GAAmB,EACnB,EAAE;QACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;QAEH,oBAAoB;QACpB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC;QACnC,IAAI,GAAG,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAEjI,6BAA6B;QAC7B,IAAI,YAAY,GAAG,SAAS,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,IAAI,SAAS,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;gBACpC,GAAG,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;gBACpC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvF,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC5E,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC;YAClC,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,oBAAoB;QACpB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,qDAAqD;IACrD,MAAM,iBAAiB,GAAiB,KAAK,EAC3C,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;YAE1C,gCAAgC;YAChC,MAAM,QAAQ,GAAG;gBACf,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC;gBACnD,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC;gBAChD,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;gBACvC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;aAC5C,CAAC;YAEF,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,YAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrB,OAAO,GAAG,CAAC,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,oBAAoB;YACpB,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAA,aAAQ,EAAC,OAAO,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,IAAA,qBAAgB,EAAC,OAAO,EAAE;gBACvC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,GAAG,CAAC,EAAE,aAAa;gBAC1D,GAAG,EAAE,KAAK,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,EAAE,GAAG,IAAA,0BAAe,EAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;YACzC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IAGF,qFAAqF;IACrF,MAAM,WAAW,GAAiB,KAAK,EACrC,GAAyB,EACzB,GAAmB,EACnB,EAAE;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAE5G,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;YAEjC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE;oBACR,OAAO;oBACP,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B;iBACpE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,EAAE;oBACR,OAAO;oBACP,MAAM,EAAE,sBAAsB;iBAC/B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,EAAE;oBACR,OAAO;oBACP,MAAM,EAAE,2BAA2B;iBACpC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,0CAA0C;YAC1C,MAAM,WAAW,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;wBACjB,MAAM,EAAE,SAAS;wBACjB,IAAI,EAAE,IAAI;wBACV,OAAO;wBACP,MAAM,EAAE,mBAAmB;qBAC5B,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,EAAE,GAAG,QAAQ,KAAK,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;oBAC5B,IAAI,EAAE,EAAE;oBACR,OAAO;oBACP,MAAM,EAAE,EAAE;wBACR,CAAC,CAAC,gCAAgC;wBAClC,CAAC,CAAC,kCAAkC;iBACvC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,IAAI;oBACV,OAAO;oBACP,MAAM,EAAE,6BAA6B;iBACtC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE;gBACR,OAAO;gBACP,MAAM,EAAE,8BAA8B;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACtD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;IAEF,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AACpD,CAAC","sourcesContent":["/**\n * Admin API Handler\n * Provides configuration management, restart functionality, and log streaming\n */\n\nimport type { ServerResponse } from 'node:http';\nimport type { ApiServer, RouteHandler } from '../ApiServer';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\nimport { createHash, timingSafeEqual } from 'node:crypto';\nimport fs from 'fs';\nimport path from 'path';\nimport { createReadStream, statSync } from 'fs';\nimport { createInterface } from 'readline';\nimport { PACKAGE_ROOT } from '../../runtime';\nimport {\n  isLoopbackRemoteAddress,\n  verifyGatewayAdminProxyHeaders,\n} from '../../runtime/GatewayAdminProxyAuth';\n\nconst CONFIG_DIR = path.resolve(PACKAGE_ROOT, 'config');\n\nfunction getEnvFilePath(): string {\n  const envPath = process.env.XPOD_ENV_PATH;\n  if (envPath && envPath.trim()) {\n    return path.resolve(envPath);\n  }\n  return path.resolve(process.cwd(), '.env.local');\n}\n\ninterface ConfigFile {\n  name: string;\n  path: string;\n  exists: boolean;\n}\n\ninterface EnvConfig {\n  [key: string]: string;\n}\n\ninterface LogEntry {\n  timestamp: string;\n  level: string;\n  source: string;\n  message: string;\n}\n\nexport interface SanitizedEnvRead {\n  env: EnvConfig;\n  secrets: Record<string, { configured: boolean }>;\n}\n\nexport const ALLOWED_ADMIN_CONFIG_KEYS = [\n  'XPOD_DEPLOY_MODE',\n  'CSS_ROOT_FILE_PATH',\n  'CSS_BASE_URL',\n  'XPOD_TUNNEL_PROVIDER',\n  'XPOD_TUNNEL_ACTIVE_PROFILE_ID',\n  'XPOD_TUNNEL_PROFILES',\n  'XPOD_TUNNEL_PUBLIC_URL',\n  'CLOUDFLARE_TUNNEL_URL',\n  'SAKURA_TUNNEL_URL',\n  'CLOUDFLARE_TUNNEL_TOKEN',\n  'SAKURA_TUNNEL_TOKEN',\n  'NGROK_AUTHTOKEN',\n  'NGROK_URL',\n  'FRP_TUNNEL_TOKEN',\n  'FRP_TUNNEL_URL',\n  'XPOD_HTTPS_MODE',\n  'XPOD_HTTPS_CERT_PATH',\n  'XPOD_HTTPS_KEY_PATH',\n  'XPOD_CLOUD_API_ENDPOINT',\n  'XPOD_PUBLIC_API_URL',\n  'XPOD_PUBLIC_REGISTRY_URL',\n  'CSS_ALLOWED_HOSTS',\n  'CSS_BASE_STORAGE_DOMAIN',\n  'CSS_CLUSTER_INGRESS_DOMAIN',\n  'XPOD_NODE_ID',\n  'XPOD_SP_DOMAIN',\n  'XPOD_NODE_TOKEN',\n  'XPOD_SERVICE_TOKEN',\n  'CSS_PORT',\n  'CSS_SPARQL_ENDPOINT',\n  'CSS_IDENTITY_DB_URL',\n  'CSS_LOGGING_LEVEL',\n  'CSS_SHOW_STACK_TRACE',\n] as const;\n\nconst ALLOWED_ADMIN_CONFIG_KEY_SET = new Set<string>(ALLOWED_ADMIN_CONFIG_KEYS);\n\nexport function isAdminSecretEnvKey(key: string): boolean {\n  const normalized = key.toUpperCase();\n  if (normalized.endsWith('_KEY_PATH') || normalized.endsWith('_CERT_PATH')) {\n    return false;\n  }\n  return (\n    normalized.includes('AUTHTOKEN') ||\n    normalized.endsWith('_TOKEN') ||\n    normalized.endsWith('_SECRET') ||\n    normalized.endsWith('_API_KEY') ||\n    normalized.includes('PASSWORD') ||\n    normalized.includes('CLIENT_SECRET') ||\n    normalized.endsWith('_DB_URL') ||\n    normalized.includes('DATABASE_URL')\n  );\n}\n\nexport function sanitizeEnvForRead(env: EnvConfig): SanitizedEnvRead {\n  const sanitized: EnvConfig = {};\n  const secrets: Record<string, { configured: boolean }> = {};\n\n  for (const [key, value] of Object.entries(env)) {\n    if (isAdminSecretEnvKey(key)) {\n      secrets[key] = { configured: Boolean(value) };\n      continue;\n    }\n    sanitized[key] = value;\n  }\n\n  return { env: sanitized, secrets };\n}\n\nexport function createAllowedAdminConfigPatch(input: EnvConfig): EnvConfig {\n  const patch: EnvConfig = {};\n  for (const [key, value] of Object.entries(input)) {\n    if (!ALLOWED_ADMIN_CONFIG_KEY_SET.has(key)) {\n      continue;\n    }\n    if (isAdminSecretEnvKey(key) && !value) {\n      continue;\n    }\n    patch[key] = value;\n  }\n  return patch;\n}\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\nexport function sanitizeLogMessage(message: string, env: EnvConfig): string {\n  let sanitized = message;\n  const secretEntries = Object.entries(env)\n    .filter(([key, value]) => isAdminSecretEnvKey(key) && value.length >= 6)\n    .sort((a, b) => b[1].length - a[1].length);\n\n  for (const [key, value] of secretEntries) {\n    sanitized = sanitized.replace(new RegExp(escapeRegExp(value), 'g'), `[redacted:${key}]`);\n  }\n  return sanitized;\n}\n\nfunction sanitizeLogEntry(entry: LogEntry, env: EnvConfig): LogEntry {\n  return {\n    ...entry,\n    message: sanitizeLogMessage(entry.message, env),\n  };\n}\n\nfunction safeTokenEquals(actual: string, expected: string): boolean {\n  const actualHash = createHash('sha256').update(actual).digest();\n  const expectedHash = createHash('sha256').update(expected).digest();\n  return timingSafeEqual(actualHash, expectedHash);\n}\n\nexport interface AdminAuthorizerOptions {\n  internalAdminAuthSecret?: string;\n}\n\nexport function isAdminMutationAllowed(req: AuthenticatedRequest, options: AdminAuthorizerOptions = {}): boolean {\n  const configuredToken = process.env.XPOD_ADMIN_TOKEN;\n  const providedToken = req.headers['x-xpod-admin-token'] ??\n    req.headers.authorization?.replace(/^Bearer\\s+/i, '');\n  if (\n    configuredToken &&\n    typeof providedToken === 'string' &&\n    safeTokenEquals(providedToken, configuredToken)\n  ) {\n    return true;\n  }\n\n  const peerLoopback = isLoopbackRemoteAddress(req.socket.remoteAddress);\n  const proxyMarker = verifyGatewayAdminProxyHeaders({\n    headers: req.headers,\n    secret: options.internalAdminAuthSecret,\n    method: req.method,\n    url: req.url,\n  });\n  if (proxyMarker.present) {\n    return peerLoopback && proxyMarker.valid && proxyMarker.originalClientLoopback;\n  }\n\n  return peerLoopback;\n}\n\nfunction assertAdminMutationAllowed(req: AuthenticatedRequest, res: ServerResponse, options: AdminAuthorizerOptions): boolean {\n  if (isAdminMutationAllowed(req, options)) {\n    return true;\n  }\n  sendJson(res, 403, {\n    error: 'Forbidden',\n    detail: 'Runtime config writes and restart are allowed only from loopback or with XPOD_ADMIN_TOKEN.',\n  });\n  return false;\n}\n\nexport function createAdminServicesCapabilities(req: AuthenticatedRequest, options: AdminAuthorizerOptions = {}): {\n  services: {\n    lifecycle: { restart: { supported: boolean; reason?: string } };\n    configuration: { write: { supported: boolean; reason?: string } };\n  };\n} {\n  const adminMutationSupported = isAdminMutationAllowed(req, options);\n  const adminMutationReason = adminMutationSupported ? undefined : 'requires_loopback_or_admin_token';\n\n  return {\n    services: {\n      lifecycle: {\n        restart: {\n          supported: adminMutationSupported,\n          ...(adminMutationReason ? { reason: adminMutationReason } : {}),\n        },\n      },\n      configuration: {\n        write: {\n          supported: adminMutationSupported,\n          ...(adminMutationReason ? { reason: adminMutationReason } : {}),\n        },\n      },\n    },\n  };\n}\n\n/**\n * Read .env.local file and parse it\n */\nfunction readEnvFile(filePath: string): EnvConfig {\n  const config: EnvConfig = {};\n  if (!fs.existsSync(filePath)) {\n    return config;\n  }\n  const content = fs.readFileSync(filePath, 'utf-8');\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    // Remove quotes\n    if ((value.startsWith('\"') && value.endsWith('\"')) ||\n        (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1);\n    }\n    config[key] = value;\n  }\n  return config;\n}\n\n/**\n * Write .env.local file\n */\nfunction writeEnvFile(filePath: string, config: EnvConfig): void {\n  const lines: string[] = [];\n  for (const [key, value] of Object.entries(config)) {\n    // Quote values that contain spaces or special characters\n    const needsQuotes = /[\\s\"'=]/.test(value);\n    const quotedValue = needsQuotes ? `\"${value}\"` : value;\n    lines.push(`${key}=${quotedValue}`);\n  }\n  fs.writeFileSync(filePath, lines.join('\\n') + '\\n');\n}\n\n/**\n * List available config files\n */\nfunction listConfigFiles(): ConfigFile[] {\n  const files: ConfigFile[] = [];\n  const configFiles = ['local.json', 'cloud.json', 'main.json', 'xpod.base.json'];\n\n  for (const name of configFiles) {\n    const filePath = path.join(CONFIG_DIR, name);\n    files.push({\n      name,\n      path: filePath,\n      exists: fs.existsSync(filePath),\n    });\n  }\n  return files;\n}\n\n/**\n * Send JSON response helper\n */\n\nfunction isPrivateIp(host: string): boolean {\n  if (host === 'localhost' || host === '::1') return true;\n  if (host.startsWith('127.')) return true;\n  if (host.startsWith('10.')) return true;\n  if (host.startsWith('192.168.')) return true;\n  const m = host.match(/^172\\.(\\d+)\\./);\n  if (m) {\n    const second = Number(m[1]);\n    if (second >= 16 && second <= 31) return true;\n  }\n  return false;\n}\n\nasync function fetchPublicIp(): Promise<string | null> {\n  const endpoints = [\n    'https://api.ipify.org?format=json',\n    'https://ifconfig.me/ip',\n  ];\n\n  for (const url of endpoints) {\n    try {\n      const res = await fetch(url, { signal: AbortSignal.timeout(3000) });\n      if (!res.ok) {\n        continue;\n      }\n      const contentType = res.headers.get('content-type') || '';\n      if (contentType.includes('application/json')) {\n        const json = await res.json() as { ip?: string };\n        const ip = json.ip?.trim();\n        if (ip) {\n          return ip;\n        }\n      } else {\n        const ip = (await res.text()).trim();\n        if (ip) {\n          return ip;\n        }\n      }\n    } catch {\n      // ignore and try next endpoint\n    }\n  }\n\n  return null;\n}\n\nfunction sendJson(res: ServerResponse, status: number, data: unknown): void {\n  res.statusCode = status;\n  res.setHeader('Content-Type', 'application/json');\n  res.end(JSON.stringify(data));\n}\n\n/**\n * Parse JSON body from request\n */\nfunction parseJsonBody(req: AuthenticatedRequest): Promise<{ env?: EnvConfig }> {\n  return new Promise((resolve, reject) => {\n    let body = '';\n    req.on('data', (chunk: Buffer) => {\n      body += chunk.toString();\n    });\n    req.on('end', () => {\n      try {\n        resolve(body ? JSON.parse(body) : {});\n      } catch (err) {\n        reject(err);\n      }\n    });\n    req.on('error', reject);\n  });\n}\n\nexport interface AdminRoutesOptions extends AdminAuthorizerOptions {}\n\nexport function registerAdminRoutes(server: ApiServer, options: AdminRoutesOptions = {}): void {\n  const logger = console;\n\n  // GET /api/admin/status - Get xpod status\n  const statusHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const envFilePath = getEnvFilePath();\n      const env = readEnvFile(envFilePath);\n      const configs = listConfigFiles();\n\n      sendJson(res, 200, {\n        status: 'running',\n        pid: process.pid,\n        ppid: process.ppid,\n        uptime: process.uptime(),\n        env: {\n          CSS_BASE_URL: env.CSS_BASE_URL || process.env.CSS_BASE_URL,\n          XPOD_EDITION: env.XPOD_EDITION || process.env.XPOD_EDITION,\n          CSS_PORT: env.CSS_PORT || process.env.CSS_PORT,\n        },\n        configs,\n        capabilities: createAdminServicesCapabilities(req, options),\n      });\n    } catch (error) {\n      logger.error('[Admin] Status error:', error);\n      sendJson(res, 500, { error: 'Failed to get status' });\n    }\n  };\n\n  // GET /api/admin/config - Get current configuration\n  const getConfigHandler: RouteHandler = async (\n    _req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const envFilePath = getEnvFilePath();\n      const env = readEnvFile(envFilePath);\n      sendJson(res, 200, {\n        ...sanitizeEnvForRead(env),\n        configFiles: listConfigFiles(),\n      });\n    } catch (error) {\n      logger.error('[Admin] Get config error:', error);\n      sendJson(res, 500, { error: 'Failed to read configuration' });\n    }\n  };\n\n  // PUT /api/admin/config - Update configuration\n  const updateConfigHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      if (!assertAdminMutationAllowed(req, res, options)) {\n        return;\n      }\n      // Parse body from raw request\n      const body = await parseJsonBody(req);\n\n      if (body.env) {\n        // Merge with existing config\n        const envFilePath = getEnvFilePath();\n        const currentEnv = readEnvFile(envFilePath);\n        const patch = createAllowedAdminConfigPatch(body.env);\n        const newEnv = { ...currentEnv, ...patch };\n\n        // Remove keys set to null or empty string\n        for (const [key, value] of Object.entries(newEnv)) {\n          if (value === null || value === '') {\n            delete newEnv[key];\n          }\n        }\n\n        writeEnvFile(envFilePath, newEnv);\n        logger.log('[Admin] Configuration updated');\n      }\n\n      sendJson(res, 200, {\n        success: true,\n        message: 'Configuration updated. Restart required for changes to take effect.',\n      });\n    } catch (error) {\n      logger.error('[Admin] Update config error:', error);\n      sendJson(res, 500, { error: 'Failed to update configuration' });\n    }\n  };\n\n  // POST /api/admin/restart - Trigger xpod restart\n  const restartHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      if (!assertAdminMutationAllowed(req, res, options)) {\n        return;\n      }\n      const ppid = process.ppid;\n\n      if (!ppid) {\n        sendJson(res, 500, { error: 'Cannot determine parent process' });\n        return;\n      }\n\n      logger.log(`[Admin] Sending SIGUSR1 to parent process (pid: ${ppid})`);\n\n      // Send response before triggering restart\n      sendJson(res, 200, {\n        success: true,\n        message: 'Restart signal sent. Server will restart shortly.',\n      });\n\n      // Give time for response to be sent, then signal parent\n      setTimeout(() => {\n        try {\n          process.kill(ppid, 'SIGUSR1');\n        } catch (err) {\n          logger.error('[Admin] Failed to send restart signal:', err);\n        }\n      }, 100);\n    } catch (error) {\n      logger.error('[Admin] Restart error:', error);\n      sendJson(res, 500, { error: 'Failed to trigger restart' });\n    }\n  };\n\n  // Log buffer for recent logs (in-memory)\n  const logBuffer: LogEntry[] = [];\n  const MAX_LOG_BUFFER = 1000;\n\n  // Capture stdout/stderr logs\n  const originalStdoutWrite = process.stdout.write.bind(process.stdout);\n  const originalStderrWrite = process.stderr.write.bind(process.stderr);\n\n  function addLog(level: string, source: string, message: string): void {\n    const entry = {\n      timestamp: new Date().toISOString(),\n      level,\n      source,\n      message: message.trim(),\n    };\n    logBuffer.push(entry);\n    if (logBuffer.length > MAX_LOG_BUFFER) {\n      logBuffer.shift();\n    }\n  }\n\n  // Intercept stdout\n  process.stdout.write = (chunk: any, ...args: any[]): boolean => {\n    const message = chunk.toString();\n    addLog('info', 'xpod', message);\n    return originalStdoutWrite(chunk, ...args);\n  };\n\n  // Intercept stderr\n  process.stderr.write = (chunk: any, ...args: any[]): boolean => {\n    const message = chunk.toString();\n    addLog('error', 'xpod', message);\n    return originalStderrWrite(chunk, ...args);\n  };\n\n  // GET /api/admin/logs - Get recent logs\n  const getLogsHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const url = new URL(req.url || '', `http://${req.headers.host}`);\n      const limit = parseInt(url.searchParams.get('limit') || '100', 10);\n      const level = url.searchParams.get('level');\n      const source = url.searchParams.get('source');\n      const env = readEnvFile(getEnvFilePath());\n\n      let logs = [...logBuffer];\n\n      // Apply filters\n      if (level && level !== 'all') {\n        logs = logs.filter(log => log.level === level);\n      }\n      if (source && source !== 'all') {\n        logs = logs.filter(log => log.source === source);\n      }\n\n      // Return last N logs\n      logs = logs.slice(-limit).map((log) => sanitizeLogEntry(log, env));\n\n      sendJson(res, 200, { logs });\n    } catch (error) {\n      logger.error('[Admin] Get logs error:', error);\n      sendJson(res, 500, { error: 'Failed to get logs' });\n    }\n  };\n\n  // GET /api/admin/logs/stream - Stream logs via SSE\n  const streamLogsHandler: RouteHandler = async (\n    _req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    res.writeHead(200, {\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-cache',\n      'Connection': 'keep-alive',\n    });\n\n    // Send initial logs\n    const lastIndex = logBuffer.length;\n    let env = readEnvFile(getEnvFilePath());\n    res.write(`data: ${JSON.stringify({ type: 'init', logs: logBuffer.slice(-100).map((log) => sanitizeLogEntry(log, env)) })}\\n\\n`);\n\n    // Send new logs every second\n    let currentIndex = lastIndex;\n    const interval = setInterval(() => {\n      if (logBuffer.length > currentIndex) {\n        env = readEnvFile(getEnvFilePath());\n        const newLogs = logBuffer.slice(currentIndex).map((log) => sanitizeLogEntry(log, env));\n        res.write(`data: ${JSON.stringify({ type: 'update', logs: newLogs })}\\n\\n`);\n        currentIndex = logBuffer.length;\n      }\n    }, 1000);\n\n    // Clean up on close\n    res.on('close', () => {\n      clearInterval(interval);\n    });\n  };\n\n  // GET /api/admin/logs/file - Read log file from disk\n  const getLogFileHandler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const url = new URL(req.url || '', `http://${req.headers.host}`);\n      const lines = parseInt(url.searchParams.get('lines') || '100', 10);\n      const env = readEnvFile(getEnvFilePath());\n\n      // Try common log file locations\n      const logPaths = [\n        path.resolve(process.cwd(), 'logs', 'combined.log'),\n        path.resolve(process.cwd(), 'logs', 'error.log'),\n        path.resolve(process.cwd(), 'xpod.log'),\n        path.resolve(process.cwd(), 'combined.log'),\n      ];\n\n      let logPath: string | null = null;\n      for (const p of logPaths) {\n        if (fs.existsSync(p)) {\n          logPath = p;\n          break;\n        }\n      }\n\n      if (!logPath) {\n        sendJson(res, 404, { error: 'No log file found' });\n        return;\n      }\n\n      // Read last N lines\n      const fileLogs: string[] = [];\n      const stats = statSync(logPath);\n      const stream = createReadStream(logPath, {\n        start: Math.max(0, stats.size - 1024 * 100), // Last 100KB\n        end: stats.size,\n      });\n\n      const rl = createInterface({ input: stream });\n      for await (const line of rl) {\n        fileLogs.push(line);\n      }\n\n      const lastLines = fileLogs.slice(-lines);\n      sendJson(res, 200, {\n        file: logPath,\n        lines: lastLines.map((line) => sanitizeLogMessage(line, env)),\n      });\n    } catch (error) {\n      logger.error('[Admin] Get log file error:', error);\n      sendJson(res, 500, { error: 'Failed to read log file' });\n    }\n  };\n\n\n  // GET /api/admin/public-ip - Detect outbound public IP and compare with CSS_BASE_URL\n  const ipv4Handler: RouteHandler = async (\n    req: AuthenticatedRequest,\n    res: ServerResponse,\n  ) => {\n    try {\n      const envFilePath = getEnvFilePath();\n      const env = readEnvFile(envFilePath);\n      const parsedUrl = new URL(req.url ?? '/', 'http://localhost');\n      const baseUrl = parsedUrl.searchParams.get('baseUrl') || env.CSS_BASE_URL || process.env.CSS_BASE_URL || '';\n\n      const ip = await fetchPublicIp();\n\n      if (!baseUrl) {\n        sendJson(res, 200, {\n          status: 'unknown',\n          ipv4: ip,\n          baseUrl,\n          detail: ip ? '未配置 Base URL，无法判断是否可直连。' : '未配置 Base URL，且无法获取公网 IP。',\n        });\n        return;\n      }\n\n      let hostname = '';\n      try {\n        hostname = new URL(baseUrl).hostname;\n      } catch {\n        sendJson(res, 200, {\n          status: 'unknown',\n          ipv4: ip,\n          baseUrl,\n          detail: 'Base URL 格式不合法，无法判断。',\n        });\n        return;\n      }\n\n      if (isPrivateIp(hostname)) {\n        sendJson(res, 200, {\n          status: 'fail',\n          ipv4: ip,\n          baseUrl,\n          detail: 'Base URL 为本地/内网地址，默认不可直连。',\n        });\n        return;\n      }\n\n      // If hostname is an IP, compare directly.\n      const isIpLiteral = /^\\d{1,3}(\\.\\d{1,3}){3}$/.test(hostname);\n      if (isIpLiteral) {\n        if (!ip) {\n          sendJson(res, 200, {\n            status: 'unknown',\n            ipv4: null,\n            baseUrl,\n            detail: '无法获取公网出口 IP，无法比对。',\n          });\n          return;\n        }\n        const ok = hostname === ip;\n        sendJson(res, 200, {\n          status: ok ? 'pass' : 'fail',\n          ipv4: ip,\n          baseUrl,\n          detail: ok\n            ? 'Base URL IP 与公网出口 IP 一致，默认可直连。'\n            : 'Base URL IP 与公网出口 IP 不一致，默认不可直连。',\n        });\n        return;\n      }\n\n      // Domain name: we can only do best-effort.\n      if (!ip) {\n        sendJson(res, 200, {\n          status: 'unknown',\n          ipv4: null,\n          baseUrl,\n          detail: '已配置域名，但无法获取公网出口 IP，无法进一步判断。',\n        });\n        return;\n      }\n\n      sendJson(res, 200, {\n        status: 'pass',\n        ipv4: ip,\n        baseUrl,\n        detail: '已配置域名，默认可直连（仍需确保端口映射/防火墙放行）。',\n      });\n    } catch (error) {\n      logger.error('[Admin] Public IP check error:', error);\n      sendJson(res, 500, { error: 'Failed to detect public ip' });\n    }\n  };\n\n  // Register routes - public for now (TODO: add auth for production)\n  server.get('/api/admin/status', statusHandler, { public: true });\n  server.get('/api/admin/config', getConfigHandler, { public: true });\n  server.get('/api/admin/public-ip', ipv4Handler, { public: true });\n  server.put('/api/admin/config', updateConfigHandler, { public: true });\n  server.post('/api/admin/restart', restartHandler, { public: true });\n  server.get('/api/admin/logs', getLogsHandler, { public: true });\n  server.get('/api/admin/logs/stream', streamLogsHandler, { public: true });\n  server.get('/api/admin/logs/file', getLogFileHandler, { public: true });\n\n  logger.log('[Admin] Admin API routes registered');\n}\n"]}