@undefineds.co/xpod 0.3.58 → 0.3.61

package/dist/api/handlers/NetworkSettingsHandler.js

@@ -0,0 +1,511 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerNetworkSettingsRoutes = registerNetworkSettingsRoutes;
+exports.createDeploymentNetworkSettingsAuthorizer = createDeploymentNetworkSettingsAuthorizer;
+exports.createAddressReaders = createAddressReaders;
+exports.createDdnsStatusReader = createDdnsStatusReader;
+exports.createDnsStatusReader = createDnsStatusReader;
+exports.createTunnelStatusReader = createTunnelStatusReader;
+exports.createPublicAddressReader = createPublicAddressReader;
+exports.createCertificateCapability = createCertificateCapability;
+exports.redactSecretText = redactSecretText;
+const node_os_1 = require("node:os");
+const global_logger_factory_1 = require("global-logger-factory");
+function registerNetworkSettingsRoutes(server, options) {
+    const logger = options.logger ?? (0, global_logger_factory_1.getLoggerFor)('NetworkSettingsHandler');
+    const authorizer = options.authorizer ?? createDeploymentNetworkSettingsAuthorizer();
+    server.get('/api/network/settings/status', async (request, response) => {
+        if (!await requireNetworkPermission(request, response, authorizer, 'read')) {
+            return;
+        }
+        try {
+            sendJson(response, 200, await readNetworkStatus(options, logger));
+        }
+        catch (error) {
+            logger.error(`Failed to read network settings status: ${redactSecretText(error)}`);
+            sendJson(response, 500, { error: 'Failed to read network settings status' });
+        }
+    });
+    server.post('/api/network/settings/diagnose', async (request, response) => {
+        if (!await requireNetworkPermission(request, response, authorizer, 'read')) {
+            return;
+        }
+        try {
+            const diagnostics = options.diagnostics ?? buildDefaultDiagnostics(options, logger);
+            const checks = await Promise.all(diagnostics.map((check) => runDiagnostic(check, logger)));
+            sendJson(response, 200, { checks });
+        }
+        catch (error) {
+            logger.error(`Failed to run network diagnostics: ${redactSecretText(error)}`);
+            sendJson(response, 500, { error: 'Failed to run network diagnostics' });
+        }
+    });
+    if (options.certificateRenewer) {
+        server.post('/api/network/settings/certificate/renew', async (request, response) => {
+            if (!await requireNetworkPermission(request, response, authorizer, 'write')) {
+                return;
+            }
+            try {
+                if (!await isCertificateRenewalAvailable(options.certificateRenewer, logger)) {
+                    sendJson(response, 503, {
+                        error: 'Certificate renewal is unavailable',
+                        code: 'certificate_renewal_unavailable',
+                    });
+                    return;
+                }
+                const result = await options.certificateRenewer.renew();
+                sendJson(response, 200, { success: true, status: result?.status ?? 'renewed' });
+            }
+            catch (error) {
+                logger.warn(`Failed to renew network certificate: ${redactSecretText(error)}`);
+                const renewalError = normalizeRenewalError(error);
+                sendJson(response, renewalError.statusCode, {
+                    error: renewalError.message,
+                    code: renewalError.code,
+                });
+            }
+        });
+    }
+}
+function createDeploymentNetworkSettingsAuthorizer(options) {
+    return {
+        canRead: async (auth) => hasDeploymentNetworkScope(auth, 'network:read')
+            || hasDeploymentNetworkScope(auth, 'network:write')
+            || await isDeploymentOwnerOrAdmin(auth, options),
+        canWrite: async (auth) => hasDeploymentNetworkScope(auth, 'network:write')
+            || await isDeploymentOwnerOrAdmin(auth, options),
+    };
+}
+function createAddressReaders(input) {
+    const endpoint = () => normalizeEndpoint(resolveValue(input.endpoint)) ?? '';
+    return {
+        localAddresses: () => uniqueUrls([
+            endpoint(),
+            input.port ? `http://127.0.0.1:${input.port}/` : undefined,
+        ].filter((value) => Boolean(value)).filter(isLoopbackEndpoint)),
+        lanAddresses: () => {
+            const port = input.port ?? readPort(endpoint());
+            if (!port)
+                return [];
+            return readLanIpAddresses().map((host) => `http://${host}:${port}/`);
+        },
+        publicAddresses: () => uniqueUrls(input.publicUrls?.map(normalizeEndpoint).filter(Boolean) ?? []),
+    };
+}
+function createDdnsStatusReader(ddnsManager) {
+    if (!hasFunction(ddnsManager, 'getStatus')) {
+        return undefined;
+    }
+    return {
+        read: async () => {
+            const status = ddnsManager.getStatus();
+            if (!status.allocated) {
+                return { supported: true, status: 'pending' };
+            }
+            return { supported: true, status: status.mode === 'unknown' ? 'allocated' : status.mode ?? 'allocated' };
+        },
+    };
+}
+function createDnsStatusReader(input) {
+    const ddnsReader = createDdnsStatusReader(input.ddnsManager);
+    if (ddnsReader) {
+        return ddnsReader;
+    }
+    if (input.dnsProvider || input.dnsCoordinator) {
+        return {
+            read: async () => ({ supported: true, status: 'configured' }),
+        };
+    }
+    return undefined;
+}
+function createTunnelStatusReader(tunnelProvider) {
+    if (!hasFunction(tunnelProvider, 'getStatus')) {
+        return undefined;
+    }
+    return {
+        read: async () => {
+            const status = tunnelProvider.getStatus();
+            if (status.connected) {
+                return { supported: true, status: 'active' };
+            }
+            if (status.running) {
+                return { supported: true, status: 'starting' };
+            }
+            if (status.error) {
+                return { supported: true, status: 'error' };
+            }
+            return { supported: true, status: 'inactive' };
+        },
+    };
+}
+function createPublicAddressReader(options) {
+    return () => uniqueUrls([
+        ...(options.configuredUrls ?? []),
+        readDdnsPublicUrl(options.ddnsManager),
+        readTunnelEndpoint(options.tunnelProvider),
+        readTunnelStatusEndpoint(options.tunnelProvider),
+    ].map(normalizeEndpoint).filter(Boolean));
+}
+function createCertificateCapability(...candidates) {
+    for (const candidate of candidates) {
+        const tlsStatusReader = createCertificateStatusReader(candidate);
+        const certificateRenewer = createCertificateRenewer(candidate);
+        if (tlsStatusReader || certificateRenewer) {
+            return {
+                ...(tlsStatusReader ? { tlsStatusReader } : {}),
+                ...(certificateRenewer ? { certificateRenewer } : {}),
+            };
+        }
+    }
+    return undefined;
+}
+async function readNetworkStatus(options, logger) {
+    const [tls, dns, tunnel] = await Promise.all([
+        safeReadCapability(options.tlsStatusReader, { supported: false, status: 'unsupported' }, 'TLS', logger),
+        safeReadCapability(options.dnsStatusReader, { supported: false, status: 'unsupported' }, 'DNS', logger),
+        safeReadCapability(options.tunnelStatusReader, { supported: false, status: 'unsupported' }, 'Tunnel', logger),
+    ]);
+    return {
+        endpoint: normalizeEndpoint(resolveValue(options.endpoint)) ?? '',
+        addresses: {
+            local: safeAddressList(options.localAddresses, logger),
+            lan: safeAddressList(options.lanAddresses, logger),
+            public: safeAddressList(options.publicAddresses, logger),
+        },
+        tls,
+        dns,
+        tunnel,
+        actions: {
+            diagnose: true,
+            renewCertificate: await isCertificateRenewalAvailable(options.certificateRenewer, logger),
+        },
+    };
+}
+async function isCertificateRenewalAvailable(renewer, logger) {
+    if (!renewer) {
+        return false;
+    }
+    if (!renewer.isAvailable) {
+        return true;
+    }
+    try {
+        return Boolean(await renewer.isAvailable());
+    }
+    catch (error) {
+        logger.warn(`Failed to read certificate renewal availability: ${redactSecretText(error)}`);
+        return false;
+    }
+}
+async function safeReadCapability(reader, fallback, label, logger) {
+    if (!reader) {
+        return fallback;
+    }
+    try {
+        return await reader.read();
+    }
+    catch (error) {
+        logger.warn(`Failed to read ${label} status: ${redactSecretText(error)}`);
+        return { ...fallback, supported: true, status: 'error' };
+    }
+}
+function safeAddressList(reader, logger) {
+    if (!reader)
+        return [];
+    try {
+        return uniqueUrls(reader().map(normalizeEndpoint).filter(Boolean));
+    }
+    catch (error) {
+        logger.warn(`Failed to read network addresses: ${redactSecretText(error)}`);
+        return [];
+    }
+}
+function buildDefaultDiagnostics(options, logger) {
+    return [
+        {
+            id: 'endpoint',
+            label: 'Endpoint',
+            run: async () => {
+                const endpoint = normalizeEndpoint(resolveValue(options.endpoint));
+                return endpoint ? { status: 'ok', detail: endpoint } : { status: 'unsupported', detail: 'endpoint_unavailable' };
+            },
+        },
+        {
+            id: 'tls',
+            label: 'TLS',
+            run: async () => capabilityToDiagnostic(await safeReadCapability(options.tlsStatusReader, { supported: false, status: 'unsupported' }, 'TLS', logger)),
+        },
+        {
+            id: 'dns',
+            label: 'DNS',
+            run: async () => capabilityToDiagnostic(await safeReadCapability(options.dnsStatusReader, { supported: false, status: 'unsupported' }, 'DNS', logger)),
+        },
+        {
+            id: 'tunnel',
+            label: 'Tunnel',
+            run: async () => capabilityToDiagnostic(await safeReadCapability(options.tunnelStatusReader, { supported: false, status: 'unsupported' }, 'Tunnel', logger)),
+        },
+    ];
+}
+async function runDiagnostic(check, logger) {
+    try {
+        const result = await check.run();
+        if (typeof result === 'string') {
+            return { id: check.id, label: check.label, status: result };
+        }
+        return {
+            id: check.id,
+            label: check.label,
+            status: result.status,
+            ...(result.detail ? { detail: redactSecretText(result.detail) } : {}),
+        };
+    }
+    catch (error) {
+        logger.warn(`Network diagnostic ${check.id} failed: ${redactSecretText(error)}`);
+        return { id: check.id, label: check.label, status: 'error', detail: redactSecretText(error) };
+    }
+}
+function capabilityToDiagnostic(capability) {
+    if (!capability.supported) {
+        return { status: 'unsupported', detail: capability.status };
+    }
+    if (capability.status === 'active' || capability.status === 'valid' || capability.status === 'synced' || capability.status === 'direct') {
+        return { status: 'ok', detail: capability.status };
+    }
+    if (capability.status === 'error') {
+        return { status: 'error', detail: capability.status };
+    }
+    return { status: 'warning', detail: capability.status };
+}
+async function requireNetworkPermission(request, response, authorizer, mode) {
+    if (!request.auth) {
+        sendJson(response, 401, { error: 'Authentication required' });
+        return false;
+    }
+    const allowed = mode === 'read'
+        ? await authorizer.canRead(request.auth)
+        : await authorizer.canWrite(request.auth);
+    if (!allowed) {
+        sendJson(response, 403, { error: `Missing required permission: network:${mode}` });
+        return false;
+    }
+    return true;
+}
+function hasDeploymentNetworkScope(auth, scope) {
+    const scopes = readAuthScopes(auth);
+    if (scopes.includes(scope)) {
+        return true;
+    }
+    return false;
+}
+function readAuthScopes(auth) {
+    if (auth.type === 'service') {
+        return auth.scopes;
+    }
+    if (auth.type === 'solid' && auth.viaGatewayApiKey === true) {
+        return auth.scopes ?? [];
+    }
+    return [];
+}
+async function isDeploymentOwnerOrAdmin(auth, options) {
+    if (auth.type !== 'solid' || !options) {
+        return false;
+    }
+    const roles = (await options.accountRoleRepository?.findByWebId(auth.webId))?.roles ?? [];
+    return roles.includes('admin') || (options.deployment === 'local' && roles.includes('owner'));
+}
+function sendJson(response, status, data) {
+    response.statusCode = status;
+    response.setHeader('Content-Type', 'application/json');
+    response.end(JSON.stringify(data));
+}
+function resolveValue(value) {
+    return typeof value === 'function' ? value() : value;
+}
+function normalizeEndpoint(value) {
+    if (!value?.trim())
+        return undefined;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:')
+            return undefined;
+        return url.toString().replace(/\/+$/u, '') + '/';
+    }
+    catch {
+        return undefined;
+    }
+}
+function uniqueUrls(values) {
+    return Array.from(new Set(values.filter(Boolean)));
+}
+function isLoopbackEndpoint(value) {
+    try {
+        const host = new URL(value).hostname;
+        return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+    }
+    catch {
+        return false;
+    }
+}
+function readPort(endpoint) {
+    if (!endpoint)
+        return undefined;
+    try {
+        const url = new URL(endpoint);
+        if (url.port)
+            return Number.parseInt(url.port, 10);
+        return url.protocol === 'https:' ? 443 : 80;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readLanIpAddresses() {
+    const result = [];
+    for (const entries of Object.values((0, node_os_1.networkInterfaces)())) {
+        for (const entry of entries ?? []) {
+            if (entry.family === 'IPv4' && !entry.internal) {
+                result.push(entry.address);
+            }
+        }
+    }
+    return result;
+}
+function readDdnsPublicUrl(ddnsManager) {
+    if (!hasFunction(ddnsManager, 'getStatus')) {
+        return undefined;
+    }
+    const status = ddnsManager.getStatus();
+    if (status.baseUrl) {
+        return status.baseUrl;
+    }
+    if (status.allocated && status.fqdn) {
+        return `https://${status.fqdn}/`;
+    }
+    return undefined;
+}
+function readTunnelEndpoint(tunnelProvider) {
+    if (!hasFunction(tunnelProvider, 'getEndpoint')) {
+        return undefined;
+    }
+    const endpoint = tunnelProvider.getEndpoint();
+    return typeof endpoint === 'string' ? endpoint : undefined;
+}
+function readTunnelStatusEndpoint(tunnelProvider) {
+    if (!hasFunction(tunnelProvider, 'getStatus')) {
+        return undefined;
+    }
+    const status = tunnelProvider.getStatus();
+    return typeof status.endpoint === 'string' ? status.endpoint : undefined;
+}
+function createCertificateStatusReader(candidate) {
+    const statusMethod = [
+        'readCertificateStatus',
+        'getCertificateStatus',
+        'readTlsStatus',
+        'getTlsStatus',
+    ].find((method) => hasFunction(candidate, method));
+    if (!statusMethod) {
+        return undefined;
+    }
+    return {
+        read: async () => normalizeCertificateStatus(await candidate[statusMethod]()),
+    };
+}
+function createCertificateRenewer(candidate) {
+    const renewMethod = [
+        'renewCertificate',
+        'renew',
+        'ensureCertificate',
+    ].find((method) => hasFunction(candidate, method));
+    if (!renewMethod) {
+        return undefined;
+    }
+    return {
+        renew: async () => {
+            return await candidate[renewMethod]();
+        },
+        ...(hasFunction(candidate, 'isAvailable') ? {
+            isAvailable: async () => Boolean(await candidate.isAvailable()),
+        } : {}),
+    };
+}
+function normalizeRenewalError(error) {
+    if (error && typeof error === 'object') {
+        const record = error;
+        const statusCode = typeof record.statusCode === 'number' ? record.statusCode : undefined;
+        const code = typeof record.code === 'string' ? record.code : undefined;
+        const message = error instanceof Error ? error.message : undefined;
+        if (statusCode && code) {
+            return {
+                statusCode,
+                code,
+                message: message ?? 'Certificate renewal failed',
+            };
+        }
+    }
+    return {
+        statusCode: 500,
+        code: 'certificate_renewal_failed',
+        message: 'Failed to renew network certificate',
+    };
+}
+function normalizeCertificateStatus(value) {
+    if (typeof value === 'string') {
+        return { supported: true, status: value };
+    }
+    if (!value || typeof value !== 'object') {
+        return { supported: true, status: 'configured' };
+    }
+    const record = value;
+    const nestedCertificate = record.certificate && typeof record.certificate === 'object'
+        ? record.certificate
+        : undefined;
+    const status = typeof record.status === 'string' ? record.status : 'configured';
+    const expiresAt = normalizeIsoDate(record.expiresAt ?? nestedCertificate?.expiresAt);
+    return {
+        supported: record.supported === false ? false : true,
+        status,
+        ...(expiresAt ? { expiresAt } : {}),
+    };
+}
+function normalizeIsoDate(value) {
+    if (value instanceof Date && Number.isFinite(value.getTime())) {
+        return value.toISOString();
+    }
+    if (typeof value === 'string') {
+        const date = new Date(value);
+        return Number.isFinite(date.getTime()) ? date.toISOString() : value;
+    }
+    if (typeof value === 'number') {
+        const date = new Date(value);
+        return Number.isFinite(date.getTime()) ? date.toISOString() : undefined;
+    }
+    return undefined;
+}
+function hasFunction(value, key) {
+    return Boolean(value && typeof value === 'object' && typeof value[key] === 'function');
+}
+function redactSecretText(value) {
+    const raw = value instanceof Error ? value.message : String(value);
+    const containsSensitiveValue = [
+        /\b(?:authorization|proxy-authorization)\s*[:=]\s*(?:bearer|dpop|basic)?\s*[^,\s;]+/iu,
+        /\bdpop\s*[:=]\s*[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)?/iu,
+        /\b(?:bearer|dpop)\s+[A-Za-z0-9._~+/=-]{8,}/iu,
+        /\b(?:cookie|set-cookie)\s*[:=]\s*[^,\n]+/iu,
+        /\b(?:token|secret|password|passwd|api[_-]?key|authorization|credential|clientSecret|client_secret)\s*[=:]\s*[^,\s;]+/iu,
+        /(?:[?#&]|\b)(?:access_token|refresh_token|id_token|token_type)\s*=\s*[^&#\s;,]+/iu,
+        /[?&]code=[^&#\s]+/iu,
+        /\b(?:oauth|oidc|auth(?:orization)?|callback)\b[^,\n]*\bcode\s*[=:]\s*[^,\s;&]+/iu,
+        /\bcode\s*[=:]\s*[^,\s;&]+[^,\n]*\b(?:oauth|oidc|auth(?:orization)?|callback)\b/iu,
+        /\bxpod_(?:gw|inv)_[A-Za-z0-9._-]+/iu,
+        /-----BEGIN [A-Z ]*PRIVATE KEY-----/u,
+        /"d"\s*:\s*"[^"]{8,}"/u,
+        /\b(?:postgres|postgresql|mysql|redis|mongodb|sqlite):\/\/[^,\s]+/iu,
+        /\bfile:\/\/\/[^\s,;]+/iu,
+        /(?:^|\s)\/(?:Users|home|var|tmp|private|etc)\/[^\s,;]+/iu,
+        /\b[A-Za-z]:[\\/][^\s,;]+/u,
+        /\\\\[^\\\s,;]+\\[^\\\s,;]+\\[^\s,;]+/u,
+    ].some((pattern) => pattern.test(raw));
+    return containsSensitiveValue ? '[redacted]' : raw;
+}
+//# sourceMappingURL=NetworkSettingsHandler.js.map

package/dist/api/handlers/NetworkSettingsHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetworkSettingsHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/NetworkSettingsHandler.ts"],"names":[],"mappings":";;AA6FA,sEA0DC;AAED,8FAUC;AAED,oDAkBC;AAED,wDAiBC;AAED,sDAeC;AAED,4DAmBC;AAED,8DAOC;AAED,kEAYC;AAqYD,4CAsBC;AAjqBD,qCAA4C;AAC5C,iEAAqD;AA2FrD,SAAgB,6BAA6B,CAAC,MAAiB,EAAE,OAAsC;IACrG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,oCAAY,EAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yCAAyC,EAAE,CAAC;IAErF,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrE,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxE,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3F,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACjF,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC5E,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,6BAA6B,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC;oBAC7E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;wBACtB,KAAK,EAAE,oCAAoC;wBAC3C,IAAI,EAAE,iCAAiC;qBACxC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAmB,CAAC,KAAK,EAAE,CAAC;gBACzD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,wCAAwC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC/E,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAClD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,EAAE;oBAC1C,KAAK,EAAE,YAAY,CAAC,OAAO;oBAC3B,IAAI,EAAE,YAAY,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAgB,yCAAyC,CACvD,OAAkD;IAElD,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,cAAc,CAAC;eACnE,yBAAyB,CAAC,IAAI,EAAE,eAAe,CAAC;eAChD,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC;QAClD,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,eAAe,CAAC;eACrE,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAIpC;IACC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;YAC/B,QAAQ,EAAE;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChF,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YACrB,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,eAAe,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,IAAI,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,WAAoB;IACzD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAInC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAChD,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QAC3G,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAIrC;IACC,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,wBAAwB,CAAC,cAAuB;IAC9D,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAgE,CAAC;YACxG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACjD,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CAAC,OAA0C;IAClF,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACjC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;QACtC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QAC1C,wBAAwB,CAAC,OAAO,CAAC,cAAc,CAAC;KACjD,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAG,UAAqB;IAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,eAAe,IAAI,kBAAkB,EAAE,CAAC;YAC1C,OAAO;gBACL,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAsC,EACtC,MAA+D;IAE/D,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,kBAAkB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC;QACvG,kBAAkB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC;QACvG,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC;KAC9G,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;QACjE,SAAS,EAAE;YACT,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;YACtD,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC;YAClD,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;SACzD;QACD,GAAG;QACH,GAAG;QACH,MAAM;QACN,OAAO,EAAE;YACP,QAAQ,EAAE,IAAI;YACd,gBAAgB,EAAE,MAAM,6BAA6B,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC;SAC1F;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,OAAuC,EACvC,MAA+D;IAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,oDAAoD,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAA8C,EAC9C,QAAW,EACX,KAAa,EACb,MAA+D;IAE/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,YAAY,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAAoC,EACpC,MAA+D;IAE/D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,qCAAqC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAsC,EACtC,MAA+D;IAE/D,OAAO;QACL;YACE,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,UAAU;YACjB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;YACnH,CAAC;SACF;QACD;YACE,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,eAAe,EACvB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,KAAK,EACL,MAAM,CACP,CAAC;SACH;QACD;YACE,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,eAAe,EACvB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,KAAK,EACL,MAAM,CACP,CAAC;SACH;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,kBAAkB,EAC1B,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,QAAQ,EACR,MAAM,CACP,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAA6B,EAC7B,MAA+D;IAE/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,EAAE,YAAY,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,UAA4B;IAC1D,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAA6B,EAC7B,QAAwB,EACxB,UAAqC,EACrC,IAAsB;IAEtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM;QAC7B,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAiB,EAAE,KAAuC;IAC3F,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,IAAiB,EACjB,OAA6D;IAE7D,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,qBAAqB,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC1F,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACvE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,KAAsD;IAC1E,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAgB;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QACrC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAA4B;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAA,2BAAiB,GAAE,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAoB;IAC7C,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAA8D,CAAC;IACnG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,WAAW,MAAM,CAAC,IAAI,GAAG,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,cAAuB;IACjD,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAAC,cAAuB;IACvD,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAA2B,CAAC;IACnE,OAAO,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAkB;IACvD,MAAM,YAAY,GAAG;QACnB,uBAAuB;QACvB,sBAAsB;QACtB,eAAe;QACf,cAAc;KACf,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,0BAA0B,CAC1C,MAAO,SAA2C,CAAC,YAAY,CAAC,EAAE,CACnE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAkB;IAClD,MAAM,WAAW,GAAG;QAClB,kBAAkB;QAClB,OAAO;QACP,mBAAmB;KACpB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,OAAO,MAAO,SAA2C,CAAC,WAAW,CAAC,EAAqC,CAAC;QAC9G,CAAC;QACD,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YAC1C,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,MAAO,SAA2C,CAAC,WAAW,EAAE,CAAC;SACnG,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,UAAU;gBACV,IAAI;gBACJ,OAAO,EAAE,OAAO,IAAI,4BAA4B;aACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qCAAqC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACpF,CAAC,CAAC,MAAM,CAAC,WAAsC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IAChF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACpD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAmB,KAAc,EAAE,GAAM;IAC3D,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAA4B,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,CAAC;AACjH,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,sBAAsB,GAAG;QAC7B,sFAAsF;QACtF,uEAAuE;QACvE,8CAA8C;QAC9C,4CAA4C;QAC5C,wHAAwH;QACxH,mFAAmF;QACnF,qBAAqB;QACrB,kFAAkF;QAClF,kFAAkF;QAClF,qCAAqC;QACrC,qCAAqC;QACrC,uBAAuB;QACvB,oEAAoE;QACpE,yBAAyB;QACzB,0DAA0D;QAC1D,2BAA2B;QAC3B,uCAAuC;KACxC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,sBAAsB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;AACrD,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport { networkInterfaces } from 'node:os';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthContext } from '../auth/AuthContext';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\n\nexport interface NetworkSettingsStatus {\n  endpoint: string;\n  addresses: {\n    local: string[];\n    lan: string[];\n    public: string[];\n  };\n  tls: CapabilityStatus & { expiresAt?: string };\n  dns: CapabilityStatus;\n  tunnel: CapabilityStatus;\n  actions: {\n    diagnose: true;\n    renewCertificate: boolean;\n  };\n}\n\nexport interface CapabilityStatus {\n  supported: boolean;\n  status: string;\n}\n\nexport type DiagnosticStatus = 'ok' | 'warning' | 'error' | 'unsupported';\n\nexport interface NetworkDiagnosticCheckResult {\n  id: string;\n  label: string;\n  status: DiagnosticStatus;\n  detail?: string;\n}\n\nexport interface NetworkDiagnosticCheck {\n  id: string;\n  label: string;\n  run(): Promise<Omit<NetworkDiagnosticCheckResult, 'id' | 'label'> | DiagnosticStatus>;\n}\n\nexport interface NetworkCapabilityReader<T extends CapabilityStatus = CapabilityStatus> {\n  read(): Promise<T>;\n}\n\nexport interface CertificateRenewer {\n  renew(): Promise<CertificateRenewalResult | void>;\n  isAvailable?(): boolean | Promise<boolean>;\n}\n\nexport interface CertificateRenewalResult {\n  status: 'renewed' | 'unchanged';\n}\n\nexport interface NetworkSettingsAuthorizer {\n  canRead(auth: AuthContext): boolean | Promise<boolean>;\n  canWrite(auth: AuthContext): boolean | Promise<boolean>;\n}\n\nexport interface NetworkSettingsIdentityAuthorizerOptions {\n  deployment: 'cloud' | 'local';\n  accountRoleRepository?: {\n    findByWebId(webId: string): Promise<{ roles?: string[] } | undefined>;\n  };\n}\n\nexport interface CertificateCapability {\n  tlsStatusReader?: NetworkCapabilityReader<NetworkSettingsStatus['tls']>;\n  certificateRenewer?: CertificateRenewer;\n}\n\nexport interface NetworkPublicAddressReaderOptions {\n  configuredUrls?: Array<string | undefined>;\n  ddnsManager?: unknown;\n  tunnelProvider?: unknown;\n}\n\nexport interface NetworkSettingsHandlerOptions {\n  endpoint: string | (() => string | undefined);\n  localAddresses?: () => string[];\n  lanAddresses?: () => string[];\n  publicAddresses?: () => string[];\n  tlsStatusReader?: NetworkCapabilityReader<NetworkSettingsStatus['tls']>;\n  dnsStatusReader?: NetworkCapabilityReader;\n  tunnelStatusReader?: NetworkCapabilityReader;\n  certificateRenewer?: CertificateRenewer;\n  diagnostics?: NetworkDiagnosticCheck[];\n  authorizer?: NetworkSettingsAuthorizer;\n  logger?: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>;\n}\n\nexport function registerNetworkSettingsRoutes(server: ApiServer, options: NetworkSettingsHandlerOptions): void {\n  const logger = options.logger ?? getLoggerFor('NetworkSettingsHandler');\n  const authorizer = options.authorizer ?? createDeploymentNetworkSettingsAuthorizer();\n\n  server.get('/api/network/settings/status', async (request, response) => {\n    if (!await requireNetworkPermission(request, response, authorizer, 'read')) {\n      return;\n    }\n\n    try {\n      sendJson(response, 200, await readNetworkStatus(options, logger));\n    } catch (error) {\n      logger.error(`Failed to read network settings status: ${redactSecretText(error)}`);\n      sendJson(response, 500, { error: 'Failed to read network settings status' });\n    }\n  });\n\n  server.post('/api/network/settings/diagnose', async (request, response) => {\n    if (!await requireNetworkPermission(request, response, authorizer, 'read')) {\n      return;\n    }\n\n    try {\n      const diagnostics = options.diagnostics ?? buildDefaultDiagnostics(options, logger);\n      const checks = await Promise.all(diagnostics.map((check) => runDiagnostic(check, logger)));\n      sendJson(response, 200, { checks });\n    } catch (error) {\n      logger.error(`Failed to run network diagnostics: ${redactSecretText(error)}`);\n      sendJson(response, 500, { error: 'Failed to run network diagnostics' });\n    }\n  });\n\n  if (options.certificateRenewer) {\n    server.post('/api/network/settings/certificate/renew', async (request, response) => {\n      if (!await requireNetworkPermission(request, response, authorizer, 'write')) {\n        return;\n      }\n\n      try {\n        if (!await isCertificateRenewalAvailable(options.certificateRenewer, logger)) {\n          sendJson(response, 503, {\n            error: 'Certificate renewal is unavailable',\n            code: 'certificate_renewal_unavailable',\n          });\n          return;\n        }\n        const result = await options.certificateRenewer!.renew();\n        sendJson(response, 200, { success: true, status: result?.status ?? 'renewed' });\n      } catch (error) {\n        logger.warn(`Failed to renew network certificate: ${redactSecretText(error)}`);\n        const renewalError = normalizeRenewalError(error);\n        sendJson(response, renewalError.statusCode, {\n          error: renewalError.message,\n          code: renewalError.code,\n        });\n      }\n    });\n  }\n}\n\nexport function createDeploymentNetworkSettingsAuthorizer(\n  options?: NetworkSettingsIdentityAuthorizerOptions,\n): NetworkSettingsAuthorizer {\n  return {\n    canRead: async (auth) => hasDeploymentNetworkScope(auth, 'network:read')\n      || hasDeploymentNetworkScope(auth, 'network:write')\n      || await isDeploymentOwnerOrAdmin(auth, options),\n    canWrite: async (auth) => hasDeploymentNetworkScope(auth, 'network:write')\n      || await isDeploymentOwnerOrAdmin(auth, options),\n  };\n}\n\nexport function createAddressReaders(input: {\n  endpoint: string | (() => string | undefined);\n  port?: number;\n  publicUrls?: Array<string | undefined>;\n}): Pick<NetworkSettingsHandlerOptions, 'localAddresses' | 'lanAddresses' | 'publicAddresses'> {\n  const endpoint = () => normalizeEndpoint(resolveValue(input.endpoint)) ?? '';\n  return {\n    localAddresses: () => uniqueUrls([\n      endpoint(),\n      input.port ? `http://127.0.0.1:${input.port}/` : undefined,\n    ].filter((value): value is string => Boolean(value)).filter(isLoopbackEndpoint)),\n    lanAddresses: () => {\n      const port = input.port ?? readPort(endpoint());\n      if (!port) return [];\n      return readLanIpAddresses().map((host) => `http://${host}:${port}/`);\n    },\n    publicAddresses: () => uniqueUrls(input.publicUrls?.map(normalizeEndpoint).filter(Boolean) as string[] ?? []),\n  };\n}\n\nexport function createDdnsStatusReader(ddnsManager: unknown): NetworkCapabilityReader | undefined {\n  if (!hasFunction(ddnsManager, 'getStatus')) {\n    return undefined;\n  }\n  return {\n    read: async () => {\n      const status = ddnsManager.getStatus() as {\n        allocated?: boolean;\n        mode?: string;\n        tunnelProvider?: string;\n      };\n      if (!status.allocated) {\n        return { supported: true, status: 'pending' };\n      }\n      return { supported: true, status: status.mode === 'unknown' ? 'allocated' : status.mode ?? 'allocated' };\n    },\n  };\n}\n\nexport function createDnsStatusReader(input: {\n  ddnsManager?: unknown;\n  dnsProvider?: unknown;\n  dnsCoordinator?: unknown;\n}): NetworkCapabilityReader | undefined {\n  const ddnsReader = createDdnsStatusReader(input.ddnsManager);\n  if (ddnsReader) {\n    return ddnsReader;\n  }\n  if (input.dnsProvider || input.dnsCoordinator) {\n    return {\n      read: async () => ({ supported: true, status: 'configured' }),\n    };\n  }\n  return undefined;\n}\n\nexport function createTunnelStatusReader(tunnelProvider: unknown): NetworkCapabilityReader | undefined {\n  if (!hasFunction(tunnelProvider, 'getStatus')) {\n    return undefined;\n  }\n  return {\n    read: async () => {\n      const status = tunnelProvider.getStatus() as { running?: boolean; connected?: boolean; error?: string };\n      if (status.connected) {\n        return { supported: true, status: 'active' };\n      }\n      if (status.running) {\n        return { supported: true, status: 'starting' };\n      }\n      if (status.error) {\n        return { supported: true, status: 'error' };\n      }\n      return { supported: true, status: 'inactive' };\n    },\n  };\n}\n\nexport function createPublicAddressReader(options: NetworkPublicAddressReaderOptions): () => string[] {\n  return () => uniqueUrls([\n    ...(options.configuredUrls ?? []),\n    readDdnsPublicUrl(options.ddnsManager),\n    readTunnelEndpoint(options.tunnelProvider),\n    readTunnelStatusEndpoint(options.tunnelProvider),\n  ].map(normalizeEndpoint).filter(Boolean) as string[]);\n}\n\nexport function createCertificateCapability(...candidates: unknown[]): CertificateCapability | undefined {\n  for (const candidate of candidates) {\n    const tlsStatusReader = createCertificateStatusReader(candidate);\n    const certificateRenewer = createCertificateRenewer(candidate);\n    if (tlsStatusReader || certificateRenewer) {\n      return {\n        ...(tlsStatusReader ? { tlsStatusReader } : {}),\n        ...(certificateRenewer ? { certificateRenewer } : {}),\n      };\n    }\n  }\n  return undefined;\n}\n\nasync function readNetworkStatus(\n  options: NetworkSettingsHandlerOptions,\n  logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>,\n): Promise<NetworkSettingsStatus> {\n  const [tls, dns, tunnel] = await Promise.all([\n    safeReadCapability(options.tlsStatusReader, { supported: false, status: 'unsupported' }, 'TLS', logger),\n    safeReadCapability(options.dnsStatusReader, { supported: false, status: 'unsupported' }, 'DNS', logger),\n    safeReadCapability(options.tunnelStatusReader, { supported: false, status: 'unsupported' }, 'Tunnel', logger),\n  ]);\n  return {\n    endpoint: normalizeEndpoint(resolveValue(options.endpoint)) ?? '',\n    addresses: {\n      local: safeAddressList(options.localAddresses, logger),\n      lan: safeAddressList(options.lanAddresses, logger),\n      public: safeAddressList(options.publicAddresses, logger),\n    },\n    tls,\n    dns,\n    tunnel,\n    actions: {\n      diagnose: true,\n      renewCertificate: await isCertificateRenewalAvailable(options.certificateRenewer, logger),\n    },\n  };\n}\n\nasync function isCertificateRenewalAvailable(\n  renewer: CertificateRenewer | undefined,\n  logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>,\n): Promise<boolean> {\n  if (!renewer) {\n    return false;\n  }\n  if (!renewer.isAvailable) {\n    return true;\n  }\n  try {\n    return Boolean(await renewer.isAvailable());\n  } catch (error) {\n    logger.warn(`Failed to read certificate renewal availability: ${redactSecretText(error)}`);\n    return false;\n  }\n}\n\nasync function safeReadCapability<T extends CapabilityStatus>(\n  reader: NetworkCapabilityReader<T> | undefined,\n  fallback: T,\n  label: string,\n  logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>,\n): Promise<T> {\n  if (!reader) {\n    return fallback;\n  }\n  try {\n    return await reader.read();\n  } catch (error) {\n    logger.warn(`Failed to read ${label} status: ${redactSecretText(error)}`);\n    return { ...fallback, supported: true, status: 'error' };\n  }\n}\n\nfunction safeAddressList(\n  reader: (() => string[]) | undefined,\n  logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>,\n): string[] {\n  if (!reader) return [];\n  try {\n    return uniqueUrls(reader().map(normalizeEndpoint).filter(Boolean) as string[]);\n  } catch (error) {\n    logger.warn(`Failed to read network addresses: ${redactSecretText(error)}`);\n    return [];\n  }\n}\n\nfunction buildDefaultDiagnostics(\n  options: NetworkSettingsHandlerOptions,\n  logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>,\n): NetworkDiagnosticCheck[] {\n  return [\n    {\n      id: 'endpoint',\n      label: 'Endpoint',\n      run: async () => {\n        const endpoint = normalizeEndpoint(resolveValue(options.endpoint));\n        return endpoint ? { status: 'ok', detail: endpoint } : { status: 'unsupported', detail: 'endpoint_unavailable' };\n      },\n    },\n    {\n      id: 'tls',\n      label: 'TLS',\n      run: async () => capabilityToDiagnostic(await safeReadCapability(\n        options.tlsStatusReader,\n        { supported: false, status: 'unsupported' },\n        'TLS',\n        logger,\n      )),\n    },\n    {\n      id: 'dns',\n      label: 'DNS',\n      run: async () => capabilityToDiagnostic(await safeReadCapability(\n        options.dnsStatusReader,\n        { supported: false, status: 'unsupported' },\n        'DNS',\n        logger,\n      )),\n    },\n    {\n      id: 'tunnel',\n      label: 'Tunnel',\n      run: async () => capabilityToDiagnostic(await safeReadCapability(\n        options.tunnelStatusReader,\n        { supported: false, status: 'unsupported' },\n        'Tunnel',\n        logger,\n      )),\n    },\n  ];\n}\n\nasync function runDiagnostic(\n  check: NetworkDiagnosticCheck,\n  logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>,\n): Promise<NetworkDiagnosticCheckResult> {\n  try {\n    const result = await check.run();\n    if (typeof result === 'string') {\n      return { id: check.id, label: check.label, status: result };\n    }\n    return {\n      id: check.id,\n      label: check.label,\n      status: result.status,\n      ...(result.detail ? { detail: redactSecretText(result.detail) } : {}),\n    };\n  } catch (error) {\n    logger.warn(`Network diagnostic ${check.id} failed: ${redactSecretText(error)}`);\n    return { id: check.id, label: check.label, status: 'error', detail: redactSecretText(error) };\n  }\n}\n\nfunction capabilityToDiagnostic(capability: CapabilityStatus): Omit<NetworkDiagnosticCheckResult, 'id' | 'label'> {\n  if (!capability.supported) {\n    return { status: 'unsupported', detail: capability.status };\n  }\n  if (capability.status === 'active' || capability.status === 'valid' || capability.status === 'synced' || capability.status === 'direct') {\n    return { status: 'ok', detail: capability.status };\n  }\n  if (capability.status === 'error') {\n    return { status: 'error', detail: capability.status };\n  }\n  return { status: 'warning', detail: capability.status };\n}\n\nasync function requireNetworkPermission(\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n  authorizer: NetworkSettingsAuthorizer,\n  mode: 'read' | 'write',\n): Promise<boolean> {\n  if (!request.auth) {\n    sendJson(response, 401, { error: 'Authentication required' });\n    return false;\n  }\n  const allowed = mode === 'read'\n    ? await authorizer.canRead(request.auth)\n    : await authorizer.canWrite(request.auth);\n  if (!allowed) {\n    sendJson(response, 403, { error: `Missing required permission: network:${mode}` });\n    return false;\n  }\n  return true;\n}\n\nfunction hasDeploymentNetworkScope(auth: AuthContext, scope: 'network:read' | 'network:write'): boolean {\n  const scopes = readAuthScopes(auth);\n  if (scopes.includes(scope)) {\n    return true;\n  }\n  return false;\n}\n\nfunction readAuthScopes(auth: AuthContext): string[] {\n  if (auth.type === 'service') {\n    return auth.scopes;\n  }\n  if (auth.type === 'solid' && auth.viaGatewayApiKey === true) {\n    return auth.scopes ?? [];\n  }\n  return [];\n}\n\nasync function isDeploymentOwnerOrAdmin(\n  auth: AuthContext,\n  options: NetworkSettingsIdentityAuthorizerOptions | undefined,\n): Promise<boolean> {\n  if (auth.type !== 'solid' || !options) {\n    return false;\n  }\n\n  const roles = (await options.accountRoleRepository?.findByWebId(auth.webId))?.roles ?? [];\n  return roles.includes('admin') || (options.deployment === 'local' && roles.includes('owner'));\n}\n\nfunction sendJson(response: ServerResponse, status: number, data: unknown): void {\n  response.statusCode = status;\n  response.setHeader('Content-Type', 'application/json');\n  response.end(JSON.stringify(data));\n}\n\nfunction resolveValue(value: string | (() => string | undefined) | undefined): string | undefined {\n  return typeof value === 'function' ? value() : value;\n}\n\nfunction normalizeEndpoint(value: string | undefined): string | undefined {\n  if (!value?.trim()) return undefined;\n  try {\n    const url = new URL(value);\n    if (url.protocol !== 'http:' && url.protocol !== 'https:') return undefined;\n    return url.toString().replace(/\\/+$/u, '') + '/';\n  } catch {\n    return undefined;\n  }\n}\n\nfunction uniqueUrls(values: string[]): string[] {\n  return Array.from(new Set(values.filter(Boolean)));\n}\n\nfunction isLoopbackEndpoint(value: string): boolean {\n  try {\n    const host = new URL(value).hostname;\n    return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';\n  } catch {\n    return false;\n  }\n}\n\nfunction readPort(endpoint: string | undefined): number | undefined {\n  if (!endpoint) return undefined;\n  try {\n    const url = new URL(endpoint);\n    if (url.port) return Number.parseInt(url.port, 10);\n    return url.protocol === 'https:' ? 443 : 80;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readLanIpAddresses(): string[] {\n  const result: string[] = [];\n  for (const entries of Object.values(networkInterfaces())) {\n    for (const entry of entries ?? []) {\n      if (entry.family === 'IPv4' && !entry.internal) {\n        result.push(entry.address);\n      }\n    }\n  }\n  return result;\n}\n\nfunction readDdnsPublicUrl(ddnsManager: unknown): string | undefined {\n  if (!hasFunction(ddnsManager, 'getStatus')) {\n    return undefined;\n  }\n  const status = ddnsManager.getStatus() as { allocated?: boolean; fqdn?: string; baseUrl?: string };\n  if (status.baseUrl) {\n    return status.baseUrl;\n  }\n  if (status.allocated && status.fqdn) {\n    return `https://${status.fqdn}/`;\n  }\n  return undefined;\n}\n\nfunction readTunnelEndpoint(tunnelProvider: unknown): string | undefined {\n  if (!hasFunction(tunnelProvider, 'getEndpoint')) {\n    return undefined;\n  }\n  const endpoint = tunnelProvider.getEndpoint();\n  return typeof endpoint === 'string' ? endpoint : undefined;\n}\n\nfunction readTunnelStatusEndpoint(tunnelProvider: unknown): string | undefined {\n  if (!hasFunction(tunnelProvider, 'getStatus')) {\n    return undefined;\n  }\n  const status = tunnelProvider.getStatus() as { endpoint?: string };\n  return typeof status.endpoint === 'string' ? status.endpoint : undefined;\n}\n\nfunction createCertificateStatusReader(candidate: unknown): NetworkCapabilityReader<NetworkSettingsStatus['tls']> | undefined {\n  const statusMethod = [\n    'readCertificateStatus',\n    'getCertificateStatus',\n    'readTlsStatus',\n    'getTlsStatus',\n  ].find((method) => hasFunction(candidate, method));\n  if (!statusMethod) {\n    return undefined;\n  }\n  return {\n    read: async () => normalizeCertificateStatus(\n      await (candidate as Record<string, () => unknown>)[statusMethod](),\n    ),\n  };\n}\n\nfunction createCertificateRenewer(candidate: unknown): CertificateRenewer | undefined {\n  const renewMethod = [\n    'renewCertificate',\n    'renew',\n    'ensureCertificate',\n  ].find((method) => hasFunction(candidate, method));\n  if (!renewMethod) {\n    return undefined;\n  }\n  return {\n    renew: async () => {\n      return await (candidate as Record<string, () => unknown>)[renewMethod]() as CertificateRenewalResult | void;\n    },\n    ...(hasFunction(candidate, 'isAvailable') ? {\n      isAvailable: async () => Boolean(await (candidate as Record<string, () => unknown>).isAvailable()),\n    } : {}),\n  };\n}\n\nfunction normalizeRenewalError(error: unknown): { statusCode: number; code: string; message: string } {\n  if (error && typeof error === 'object') {\n    const record = error as Record<string, unknown>;\n    const statusCode = typeof record.statusCode === 'number' ? record.statusCode : undefined;\n    const code = typeof record.code === 'string' ? record.code : undefined;\n    const message = error instanceof Error ? error.message : undefined;\n    if (statusCode && code) {\n      return {\n        statusCode,\n        code,\n        message: message ?? 'Certificate renewal failed',\n      };\n    }\n  }\n  return {\n    statusCode: 500,\n    code: 'certificate_renewal_failed',\n    message: 'Failed to renew network certificate',\n  };\n}\n\nfunction normalizeCertificateStatus(value: unknown): NetworkSettingsStatus['tls'] {\n  if (typeof value === 'string') {\n    return { supported: true, status: value };\n  }\n  if (!value || typeof value !== 'object') {\n    return { supported: true, status: 'configured' };\n  }\n  const record = value as Record<string, unknown>;\n  const nestedCertificate = record.certificate && typeof record.certificate === 'object'\n    ? record.certificate as Record<string, unknown>\n    : undefined;\n  const status = typeof record.status === 'string' ? record.status : 'configured';\n  const expiresAt = normalizeIsoDate(record.expiresAt ?? nestedCertificate?.expiresAt);\n  return {\n    supported: record.supported === false ? false : true,\n    status,\n    ...(expiresAt ? { expiresAt } : {}),\n  };\n}\n\nfunction normalizeIsoDate(value: unknown): string | undefined {\n  if (value instanceof Date && Number.isFinite(value.getTime())) {\n    return value.toISOString();\n  }\n  if (typeof value === 'string') {\n    const date = new Date(value);\n    return Number.isFinite(date.getTime()) ? date.toISOString() : value;\n  }\n  if (typeof value === 'number') {\n    const date = new Date(value);\n    return Number.isFinite(date.getTime()) ? date.toISOString() : undefined;\n  }\n  return undefined;\n}\n\nfunction hasFunction<T extends string>(value: unknown, key: T): value is Record<T, (...args: never[]) => unknown> {\n  return Boolean(value && typeof value === 'object' && typeof (value as Record<T, unknown>)[key] === 'function');\n}\n\nexport function redactSecretText(value: unknown): string {\n  const raw = value instanceof Error ? value.message : String(value);\n  const containsSensitiveValue = [\n    /\\b(?:authorization|proxy-authorization)\\s*[:=]\\s*(?:bearer|dpop|basic)?\\s*[^,\\s;]+/iu,\n    /\\bdpop\\s*[:=]\\s*[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?/iu,\n    /\\b(?:bearer|dpop)\\s+[A-Za-z0-9._~+/=-]{8,}/iu,\n    /\\b(?:cookie|set-cookie)\\s*[:=]\\s*[^,\\n]+/iu,\n    /\\b(?:token|secret|password|passwd|api[_-]?key|authorization|credential|clientSecret|client_secret)\\s*[=:]\\s*[^,\\s;]+/iu,\n    /(?:[?#&]|\\b)(?:access_token|refresh_token|id_token|token_type)\\s*=\\s*[^&#\\s;,]+/iu,\n    /[?&]code=[^&#\\s]+/iu,\n    /\\b(?:oauth|oidc|auth(?:orization)?|callback)\\b[^,\\n]*\\bcode\\s*[=:]\\s*[^,\\s;&]+/iu,\n    /\\bcode\\s*[=:]\\s*[^,\\s;&]+[^,\\n]*\\b(?:oauth|oidc|auth(?:orization)?|callback)\\b/iu,\n    /\\bxpod_(?:gw|inv)_[A-Za-z0-9._-]+/iu,\n    /-----BEGIN [A-Z ]*PRIVATE KEY-----/u,\n    /\"d\"\\s*:\\s*\"[^\"]{8,}\"/u,\n    /\\b(?:postgres|postgresql|mysql|redis|mongodb|sqlite):\\/\\/[^,\\s]+/iu,\n    /\\bfile:\\/\\/\\/[^\\s,;]+/iu,\n    /(?:^|\\s)\\/(?:Users|home|var|tmp|private|etc)\\/[^\\s,;]+/iu,\n    /\\b[A-Za-z]:[\\\\/][^\\s,;]+/u,\n    /\\\\\\\\[^\\\\\\s,;]+\\\\[^\\\\\\s,;]+\\\\[^\\s,;]+/u,\n  ].some((pattern) => pattern.test(raw));\n  return containsSensitiveValue ? '[redacted]' : raw;\n}\n"]}