npm - @undefineds.co/xpod - Versions diffs - 0.3.70 → 0.3.71-rc.13 - Mend

@undefineds.co/xpod 0.3.70 → 0.3.71-rc.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (172) hide show

package/dist/api/handlers/AiGatewayManagementHandler.js CHANGED Viewed

@@ -2,30 +2,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAiGatewayManagementRoutes = registerAiGatewayManagementRoutes;
 const readBoundedJsonBody_1 = require("../http/readBoundedJsonBody");
-const GatewayPrincipal_1 = require("../ai-gateway/auth/GatewayPrincipal");
-const GatewayApiKey_1 = require("../ai-gateway/auth/GatewayApiKey");
-const GatewayApiKeyAuthenticator_1 = require("../ai-gateway/auth/GatewayApiKeyAuthenticator");
 const AiConnectionServiceAccess_1 = require("../ai-gateway/service-access/AiConnectionServiceAccess");
 const AiClientConfigurationService_1 = require("../service/AiClientConfigurationService");
 function registerAiGatewayManagementRoutes(server, options) {
-    const now = options.now ?? (() => new Date());
-    const createKeyId = options.keyId ?? ((owner) => (options.repository.createKeyId?.(owner, options.deployment) ?? (0, GatewayApiKey_1.createGatewayKeyId)()));
     const jsonBodyLimitBytes = options.jsonBodyLimitBytes ?? 64 * 1024;
     server.get('/api/applets/service-access/ai-connection', async (request, response) => {
         if (!authorizeProviderConnect(request, response)) {
             return;
         }
-        if (!options.servicePrincipal) {
-            sendJson(response, 503, { error: 'AI Connection service identity is unavailable' });
-            return;
-        }
-        const service = await options.servicePrincipal.getServicePrincipal();
         const descriptor = (0, AiConnectionServiceAccess_1.createAiConnectionServiceAccess)({
             ownerWebId: request.auth.webId,
-            serviceWebId: service.webId,
+            serviceWebId: request.auth.webId,
         });
         const invocation = options.aiConnectionInvocationKeyIssuer
-            ? await options.aiConnectionInvocationKeyIssuer.issue({ auth: request.auth })
+            ? await options.aiConnectionInvocationKeyIssuer.issueClientConfiguration({ auth: request.auth })
             : undefined;
         sendJson(response, 200, {
             ...descriptor,
@@ -33,88 +23,6 @@ function registerAiGatewayManagementRoutes(server, options) {
             ...(invocation ? { invocation } : {}),
         });
     });
-    server.post('/api/ai/gateway/keys', async (request, response) => {
-        if (!authorizeGatewayKeyManagement(request, response)) {
-            return;
-        }
-        const bodyResult = await (0, readBoundedJsonBody_1.readBoundedJsonBody)(request, { limitBytes: jsonBodyLimitBytes });
-        if (!bodyResult.ok) {
-            sendJson(response, bodyResult.status, { error: bodyResult.error });
-            return;
-        }
-        const body = bodyResult.value;
-        if (!body || typeof body !== 'object' || Array.isArray(body)) {
-            sendJson(response, 400, { error: 'Request body must be a JSON object' });
-            return;
-        }
-        const payload = body;
-        const owner = (0, GatewayPrincipal_1.ownerWebIdForGatewayKeyManagement)(request.auth, payload.owner);
-        if (!owner) {
-            sendJson(response, 400, { error: 'Gateway key owner WebID is required' });
-            return;
-        }
-        const scopes = normalizeScopes(payload.scopes);
-        if (!scopes) {
-            sendJson(response, 400, { error: 'scopes must be a non-empty string array' });
-            return;
-        }
-        const expiresAt = normalizeOptionalDate(payload.expiresAt);
-        if (payload.expiresAt !== undefined && !expiresAt) {
-            sendJson(response, 400, { error: 'expiresAt must be an ISO date string' });
-            return;
-        }
-        const issued = await (0, GatewayApiKey_1.createGatewayApiKey)({
-            deployment: options.deployment,
-            keyId: createKeyId(owner),
-        });
-        const createdAt = now();
-        const record = await options.repository.create({
-            ...issued.record,
-            owner,
-            scopes,
-            createdAt,
-            expiresAt,
-            name: normalizeOptionalString(payload.name),
-        }, { auth: request.auth });
-        sendJson(response, 201, {
-            key: issued.plaintext,
-            record: publicRecord(record),
-        });
-    });
-    server.get('/api/ai/gateway/keys', async (request, response) => {
-        if (!authorizeGatewayKeyManagement(request, response)) {
-            return;
-        }
-        const owner = ownerForList(request);
-        if (!owner) {
-            sendJson(response, 400, { error: 'Gateway key owner WebID is required' });
-            return;
-        }
-        const records = await options.repository.listByOwner(owner, { auth: request.auth });
-        sendJson(response, 200, {
-            data: records.map(publicRecord),
-        });
-    });
-    server.delete('/api/ai/gateway/keys/:keyId', async (request, response, params) => {
-        if (!authorizeGatewayKeyManagement(request, response)) {
-            return;
-        }
-        const keyId = decodeURIComponent(params.keyId);
-        const existing = await options.repository.findById(keyId);
-        if (!existing) {
-            sendJson(response, 404, { error: 'Gateway key not found' });
-            return;
-        }
-        const owner = ownerForList(request);
-        if (!owner || existing.owner !== owner) {
-            sendJson(response, 403, { error: 'Cannot revoke a gateway key owned by another WebID' });
-            return;
-        }
-        const revoked = await options.repository.revoke(keyId, now(), { auth: request.auth });
-        sendJson(response, 200, {
-            record: revoked ? publicRecord(revoked) : undefined,
-        });
-    });
     server.get('/api/ai/connections/providers', async (request, response) => {
         if (!authorizeProviderConnect(request, response)) {
             return;
@@ -294,6 +202,7 @@ function registerAiGatewayManagementRoutes(server, options) {
                 provider: params.provider,
                 credentialIri: normalizeOptionalString(url.searchParams.get('credentialIri')),
                 refresh: false,
+                auth: request.auth,
             });
             sendJson(response, 200, result);
         }
@@ -320,6 +229,7 @@ function registerAiGatewayManagementRoutes(server, options) {
                 provider: params.provider,
                 credentialIri: normalizeOptionalString(body.credentialIri),
                 refresh: true,
+                auth: request.auth,
             });
             sendJson(response, 200, result);
         }
@@ -328,13 +238,6 @@ function registerAiGatewayManagementRoutes(server, options) {
         }
     });
 }
-function authorizeGatewayKeyManagement(request, response) {
-    return authorizeManagementCaller(request, response, {
-        gatewayKeyPrincipalError: 'Gateway API keys cannot manage gateway keys',
-        nonSolidPrincipalError: 'Insufficient permissions',
-        allowServiceGatewayKeyManagement: true,
-    });
-}
 function authorizeManagementCaller(request, response, options) {
     const auth = request.auth;
     if (!auth) {
@@ -342,13 +245,6 @@ function authorizeManagementCaller(request, response, options) {
         return false;
     }
     if (auth.type === 'solid' && auth.webId) {
-        if ((0, GatewayPrincipal_1.isGatewayApiKeyPrincipal)(auth) && !(0, GatewayPrincipal_1.isInternalGatewayInvocationPrincipal)(auth)) {
-            sendJson(response, 403, { error: options.gatewayKeyPrincipalError });
-            return false;
-        }
-        return true;
-    }
-    if (options.allowServiceGatewayKeyManagement && (0, GatewayPrincipal_1.canManageGatewayKeys)(auth)) {
         return true;
     }
     sendJson(response, 403, { error: options.nonSolidPrincipalError });
@@ -367,13 +263,11 @@ function authorizeCurrentSolidManagement(request, response, options) {
 }
 function authorizeProviderConnect(request, response) {
     return authorizeCurrentSolidManagement(request, response, {
-        gatewayKeyPrincipalError: 'Gateway API keys cannot manage provider Connect state',
         nonSolidPrincipalError: 'Provider Connect requires the current Solid identity',
     });
 }
 function authorizeProviderQuota(request, response) {
     return authorizeCurrentSolidManagement(request, response, {
-        gatewayKeyPrincipalError: 'Gateway API keys cannot manage provider quota state',
         nonSolidPrincipalError: 'Provider quota requires the current Solid identity',
     });
 }
@@ -416,56 +310,12 @@ async function readJsonObject(request, response, limitBytes) {
     }
     return body;
 }
-function ownerForList(request) {
-    if (request.auth?.type === 'solid') {
-        return request.auth.webId;
-    }
-    const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
-    return url.searchParams.get('owner') ?? undefined;
-}
-function normalizeScopes(value) {
-    if (value === undefined) {
-        return [...GatewayApiKeyAuthenticator_1.DEFAULT_GATEWAY_API_KEY_SCOPES];
-    }
-    if (!Array.isArray(value) || value.length === 0) {
-        return undefined;
-    }
-    const scopes = value
-        .map((item) => typeof item === 'string' ? item.trim() : '')
-        .filter(Boolean);
-    if (scopes.length !== value.length) {
-        return undefined;
-    }
-    return [...new Set(scopes)];
-}
-function normalizeOptionalDate(value) {
-    if (value === undefined || value === null || value === '') {
-        return undefined;
-    }
-    if (typeof value !== 'string') {
-        return undefined;
-    }
-    const parsed = new Date(value);
-    return Number.isNaN(parsed.getTime()) ? undefined : parsed;
-}
 function normalizeOptionalString(value) {
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
 function stringBody(value) {
     return typeof value === 'string' ? value : '';
 }
-function publicRecord(record) {
-    return {
-        id: record.id,
-        owner: record.owner,
-        scopes: record.scopes,
-        createdAt: record.createdAt.toISOString(),
-        expiresAt: record.expiresAt?.toISOString(),
-        lastUsedAt: record.lastUsedAt?.toISOString(),
-        revokedAt: record.revokedAt?.toISOString(),
-        name: record.name,
-    };
-}
 function publicCredentialRecord(record) {
     return {
         id: record.id,

package/dist/api/handlers/AiGatewayManagementHandler.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AiGatewayManagementHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/AiGatewayManagementHandler.ts"],"names":[],"mappings":";;AAiDA,8EAsVC;AApYD,qEAAkE;AAClE,0EAK6C;AAE7C,oEAI0C;AAK1C,8FAA+F;AAO/F,sGAAyG;AAEzG,0FAGiD;AAiBjD,SAAgB,iCAAiC,CAC/C,MAAiB,EACjB,OAA0C;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,CACvD,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,IAAA,kCAAkB,GAAE,CACpF,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,GAAG,IAAI,CAAC;IAEnE,MAAM,CAAC,GAAG,CAAC,2CAA2C,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAClF,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,IAAA,2DAA+B,EAAC;YACjD,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YAC9B,YAAY,EAAE,OAAO,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,CAAC,+BAA+B;YACxD,CAAC,CAAC,MAAM,OAAO,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7E,CAAC,CAAC,SAAS,CAAC;QACd,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,GAAG,UAAU;YACb,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,IAAA,yEAA0C,GAAE;YACpG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC9D,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAmB,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,KAAK,GAAG,IAAA,oDAAiC,EAAC,OAAO,CAAC,IAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAmB,EAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;SAC1B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7C,GAAG,MAAM,CAAC,MAAM;YAChB,KAAK;YACL,MAAM;YACN,SAAS;YACT,SAAS;YACT,IAAI,EAAE,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC;SAC5C,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC7D,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC/E,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACvC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SACpD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACtE,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC;YACnD,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACnG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACpG,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC;YACxC,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,IAAI;YACnB,yBAAyB,EAAE,OAAO,IAAI,CAAC,yBAAyB,KAAK,QAAQ;gBAC3E,CAAC,CAAC,IAAI,CAAC,yBAAyB;gBAChC,CAAC,CAAC,SAAS;YACb,IAAI,EAAE,OAAO,CAAC,IAAI;SACS,CAAC,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,+DAA+D,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC9G,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzF,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC;YACzC,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YAClD,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC9G,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC;YACjD,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,MAAM;YACN,YAAY,EAAE,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxD,IAAI,EAAE,OAAO,CAAC,IAAI;SACW,CAAC,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAClG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACrG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,6CAA6C,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC/F,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,sDAAsD,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC9F,kFAAkF;QAClF,8EAA8E;QAC9E,8DAA8D;QAC9D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,KAAK,EAAE,2EAA2E;SACnF,CAAC,CAAC;IACL,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAErB,MAAM,CAAC,GAAG,CAAC,kDAAkD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACjG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACvC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;gBACzB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7E,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACnG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACvC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;gBACzB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC1D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B,CACpC,OAA6B,EAC7B,QAAwB;IAExB,OAAO,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE;QAClD,wBAAwB,EAAE,6CAA6C;QACvE,sBAAsB,EAAE,0BAA0B;QAClD,gCAAgC,EAAE,IAAI;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA6B,EAC7B,QAAwB,EACxB,OAIC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,IAAI,IAAA,2CAAwB,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,uDAAoC,EAAC,IAAI,CAAC,EAAE,CAAC;YAClF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,gCAAgC,IAAI,IAAA,uCAAoB,EAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,+BAA+B,CACtC,OAA6B,EAC7B,QAAwB,EACxB,OAGC;IAED,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,QAAwB;IAExB,OAAO,+BAA+B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACxD,wBAAwB,EAAE,uDAAuD;QACjF,sBAAsB,EAAE,sDAAsD;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA6B,EAC7B,QAAwB;IAExB,OAAO,+BAA+B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACxD,wBAAwB,EAAE,qDAAqD;QAC/E,sBAAsB,EAAE,oDAAoD;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA0C,EAC1C,QAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA0C,EAC1C,QAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,QAAwB,EAAE,KAAc;IAC9D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,4BAA4B,EAAE,CAAC;QAC7C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAA6B,EAC7B,QAAwB,EACxB,UAAkB;IAElB,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAmB,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,OAA6B;IACjD,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACzF,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,2DAA8B,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK;SACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B;IAClD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;QAC1C,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE;QAC5C,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;QAC1C,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAa/B;IACC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,YAAY;QACZ,OAAO;QACP,iBAAiB;QACjB,UAAU;KACX,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACvE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\nimport { readBoundedJsonBody } from '../http/readBoundedJsonBody';\nimport {\n canManageGatewayKeys,\n isInternalGatewayInvocationPrincipal,\n isGatewayApiKeyPrincipal,\n ownerWebIdForGatewayKeyManagement,\n} from '../ai-gateway/auth/GatewayPrincipal';\nimport type { SolidAuthContext } from '../auth/AuthContext';\nimport {\n createGatewayApiKey,\n createGatewayKeyId,\n type GatewayDeployment,\n} from '../ai-gateway/auth/GatewayApiKey';\nimport type {\n GatewayAccessKeyRecord,\n GatewayAccessKeyRepository,\n} from '../ai-gateway/auth/GatewayApiKeyAuthenticator';\nimport { DEFAULT_GATEWAY_API_KEY_SCOPES } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';\nimport type {\n CompleteApiKeyInput,\n ConnectBeginInput,\n ProviderConnectService,\n} from '../ai-gateway/connect';\nimport type { ProviderQuotaService } from '../ai-gateway/quota';\nimport { createAiConnectionServiceAccess } from '../ai-gateway/service-access/AiConnectionServiceAccess';\nimport type { AiConnectionInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionInvocationKeyIssuer';\nimport {\n type AiClientConfigurationCapabilityDescriptor,\n unavailableAiClientConfigurationCapability,\n} from '../service/AiClientConfigurationService';\n\nexport interface AiGatewayManagementHandlerOptions {\n repository: GatewayAccessKeyRepository;\n deployment: GatewayDeployment;\n connectService?: ProviderConnectService;\n quotaService?: ProviderQuotaService;\n servicePrincipal?: {\n getServicePrincipal(): Promise<{ webId: string }>;\n };\n aiClientConfiguration?: AiClientConfigurationCapabilityDescriptor;\n aiConnectionInvocationKeyIssuer?: Pick<AiConnectionInvocationKeyIssuer, 'issue'>;\n now?: () => Date;\n keyId?: (owner: string) => string;\n jsonBodyLimitBytes?: number;\n}\n\nexport function registerAiGatewayManagementRoutes(\n server: ApiServer,\n options: AiGatewayManagementHandlerOptions,\n): void {\n const now = options.now ?? (() => new Date());\n const createKeyId = options.keyId ?? ((owner: string) => (\n options.repository.createKeyId?.(owner, options.deployment) ?? createGatewayKeyId()\n ));\n const jsonBodyLimitBytes = options.jsonBodyLimitBytes ?? 64 * 1024;\n\n server.get('/api/applets/service-access/ai-connection', async (request, response) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n if (!options.servicePrincipal) {\n sendJson(response, 503, { error: 'AI Connection service identity is unavailable' });\n return;\n }\n const service = await options.servicePrincipal.getServicePrincipal();\n const descriptor = createAiConnectionServiceAccess({\n ownerWebId: request.auth.webId,\n serviceWebId: service.webId,\n });\n const invocation = options.aiConnectionInvocationKeyIssuer\n ? await options.aiConnectionInvocationKeyIssuer.issue({ auth: request.auth })\n : undefined;\n sendJson(response, 200, {\n ...descriptor,\n aiClientConfiguration: options.aiClientConfiguration ?? unavailableAiClientConfigurationCapability(),\n ...(invocation ? { invocation } : {}),\n });\n });\n\n server.post('/api/ai/gateway/keys', async (request, response) => {\n if (!authorizeGatewayKeyManagement(request, response)) {\n return;\n }\n\n const bodyResult = await readBoundedJsonBody(request, { limitBytes: jsonBodyLimitBytes });\n if (!bodyResult.ok) {\n sendJson(response, bodyResult.status, { error: bodyResult.error });\n return;\n }\n const body = bodyResult.value;\n if (!body \|\| typeof body !== 'object' \|\| Array.isArray(body)) {\n sendJson(response, 400, { error: 'Request body must be a JSON object' });\n return;\n }\n const payload = body as Record<string, unknown>;\n const owner = ownerWebIdForGatewayKeyManagement(request.auth!, payload.owner);\n if (!owner) {\n sendJson(response, 400, { error: 'Gateway key owner WebID is required' });\n return;\n }\n const scopes = normalizeScopes(payload.scopes);\n if (!scopes) {\n sendJson(response, 400, { error: 'scopes must be a non-empty string array' });\n return;\n }\n const expiresAt = normalizeOptionalDate(payload.expiresAt);\n if (payload.expiresAt !== undefined && !expiresAt) {\n sendJson(response, 400, { error: 'expiresAt must be an ISO date string' });\n return;\n }\n\n const issued = await createGatewayApiKey({\n deployment: options.deployment,\n keyId: createKeyId(owner),\n });\n const createdAt = now();\n const record = await options.repository.create({\n ...issued.record,\n owner,\n scopes,\n createdAt,\n expiresAt,\n name: normalizeOptionalString(payload.name),\n }, { auth: request.auth });\n\n sendJson(response, 201, {\n key: issued.plaintext,\n record: publicRecord(record),\n });\n });\n\n server.get('/api/ai/gateway/keys', async (request, response) => {\n if (!authorizeGatewayKeyManagement(request, response)) {\n return;\n }\n\n const owner = ownerForList(request);\n if (!owner) {\n sendJson(response, 400, { error: 'Gateway key owner WebID is required' });\n return;\n }\n const records = await options.repository.listByOwner(owner, { auth: request.auth });\n sendJson(response, 200, {\n data: records.map(publicRecord),\n });\n });\n\n server.delete('/api/ai/gateway/keys/:keyId', async (request, response, params) => {\n if (!authorizeGatewayKeyManagement(request, response)) {\n return;\n }\n\n const keyId = decodeURIComponent(params.keyId);\n const existing = await options.repository.findById(keyId);\n if (!existing) {\n sendJson(response, 404, { error: 'Gateway key not found' });\n return;\n }\n const owner = ownerForList(request);\n if (!owner \|\| existing.owner !== owner) {\n sendJson(response, 403, { error: 'Cannot revoke a gateway key owned by another WebID' });\n return;\n }\n const revoked = await options.repository.revoke(keyId, now(), { auth: request.auth });\n sendJson(response, 200, {\n record: revoked ? publicRecord(revoked) : undefined,\n });\n });\n\n server.get('/api/ai/connections/providers', async (request, response) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const providers = await connectService.listProviders({\n webId: request.auth!.webId,\n deployment: options.deployment,\n auth: request.auth,\n });\n sendJson(response, 200, {\n data: publicConnectResult(providers),\n });\n });\n\n server.post('/api/ai/gateway/providers/:provider/connect/begin', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const mode = typeof body.mode === 'string' ? body.mode : undefined;\n if (mode !== 'browserAssistedApiKey' && mode !== 'deviceCodeOAuth' && mode !== 'connectUnsupported') {\n sendJson(response, 400, { error: 'mode must be a supported Connect mode' });\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const result = await connectService.begin({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n requestedMode: mode,\n expectedCredentialVersion: typeof body.expectedCredentialVersion === 'number'\n ? body.expectedCredentialVersion\n : undefined,\n auth: request.auth,\n } satisfies ConnectBeginInput);\n sendJson(response, 200, publicConnectResult(result));\n });\n\n server.get('/api/ai/gateway/providers/:provider/connect/status/:attemptId', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const result = await connectService.status({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n attemptId: decodeURIComponent(params.attemptId),\n state: url.searchParams.get('state') ?? '',\n signature: url.searchParams.get('signature') ?? '',\n auth: request.auth,\n });\n sendJson(response, 200, publicConnectResult(result));\n });\n\n server.post('/api/ai/gateway/providers/:provider/connect/complete-api-key', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const apiKey = normalizeOptionalString(body.apiKey);\n if (!apiKey) {\n sendJson(response, 400, { error: 'apiKey is required' });\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const result = await connectService.completeApiKey({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n attemptId: stringBody(body.attemptId),\n state: stringBody(body.state),\n signature: stringBody(body.signature),\n apiKey,\n accountLabel: normalizeOptionalString(body.accountLabel),\n auth: request.auth,\n } satisfies CompleteApiKeyInput);\n sendJson(response, 200, publicConnectResult(result));\n });\n\n server.post('/api/ai/gateway/providers/:provider/connect/poll', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const result = await connectService.pollDevice({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n attemptId: stringBody(body.attemptId),\n state: stringBody(body.state),\n signature: stringBody(body.signature),\n auth: request.auth,\n });\n sendJson(response, 200, publicConnectResult(result));\n });\n\n server.post('/api/ai/gateway/providers/:provider/connect/refresh', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const record = await connectService.refresh({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n auth: request.auth,\n });\n sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });\n });\n\n server.delete('/api/ai/gateway/providers/:provider/connect', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const record = await connectService.disconnect({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n auth: request.auth,\n });\n sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });\n });\n\n server.get('/api/ai/gateway/providers/:provider/connect/callback', async (_request, response) => {\n // This endpoint is intentionally public only for signed one-time OAuth callbacks.\n // Browser-assisted API key completion is never accepted here because API keys\n // must be submitted through the authenticated management API.\n sendJson(response, 405, {\n error: 'Public Connect callback is unsupported for current provider Connect modes',\n });\n }, { public: true });\n\n server.get('/api/ai/gateway/providers/:provider/quota/status', async (request, response, params) => {\n if (!authorizeProviderQuota(request, response)) {\n return;\n }\n const quotaService = requireQuotaService(options, response);\n if (!quotaService) {\n return;\n }\n const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n try {\n const result = await quotaService.status({\n webId: request.auth.webId,\n deployment: options.deployment,\n provider: params.provider,\n credentialIri: normalizeOptionalString(url.searchParams.get('credentialIri')),\n refresh: false,\n });\n sendJson(response, 200, result);\n } catch (error) {\n sendQuotaError(response, error);\n }\n });\n\n server.post('/api/ai/gateway/providers/:provider/quota/refresh', async (request, response, params) => {\n if (!authorizeProviderQuota(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const quotaService = requireQuotaService(options, response);\n if (!quotaService) {\n return;\n }\n try {\n const result = await quotaService.status({\n webId: request.auth.webId,\n deployment: options.deployment,\n provider: params.provider,\n credentialIri: normalizeOptionalString(body.credentialIri),\n refresh: true,\n });\n sendJson(response, 200, result);\n } catch (error) {\n sendQuotaError(response, error);\n }\n });\n}\n\nfunction authorizeGatewayKeyManagement(\n request: AuthenticatedRequest,\n response: ServerResponse,\n): boolean {\n return authorizeManagementCaller(request, response, {\n gatewayKeyPrincipalError: 'Gateway API keys cannot manage gateway keys',\n nonSolidPrincipalError: 'Insufficient permissions',\n allowServiceGatewayKeyManagement: true,\n });\n}\n\nfunction authorizeManagementCaller(\n request: AuthenticatedRequest,\n response: ServerResponse,\n options: {\n gatewayKeyPrincipalError: string;\n nonSolidPrincipalError: string;\n allowServiceGatewayKeyManagement?: boolean;\n },\n): boolean {\n const auth = request.auth;\n if (!auth) {\n sendJson(response, 401, { error: 'Authentication required' });\n return false;\n }\n if (auth.type === 'solid' && auth.webId) {\n if (isGatewayApiKeyPrincipal(auth) && !isInternalGatewayInvocationPrincipal(auth)) {\n sendJson(response, 403, { error: options.gatewayKeyPrincipalError });\n return false;\n }\n return true;\n }\n if (options.allowServiceGatewayKeyManagement && canManageGatewayKeys(auth)) {\n return true;\n }\n sendJson(response, 403, { error: options.nonSolidPrincipalError });\n return false;\n}\n\nfunction authorizeCurrentSolidManagement(\n request: AuthenticatedRequest,\n response: ServerResponse,\n options: {\n gatewayKeyPrincipalError: string;\n nonSolidPrincipalError: string;\n },\n): request is AuthenticatedRequest & { auth: SolidAuthContext } {\n if (!authorizeManagementCaller(request, response, options)) {\n return false;\n }\n const auth = request.auth;\n if (!auth \|\| auth.type !== 'solid' \|\| !auth.webId) {\n sendJson(response, 403, { error: 'Insufficient permissions' });\n return false;\n }\n return true;\n}\n\nfunction authorizeProviderConnect(\n request: AuthenticatedRequest,\n response: ServerResponse,\n): request is AuthenticatedRequest & { auth: Extract<NonNullable<AuthenticatedRequest['auth']>, { type: 'solid' }> } {\n return authorizeCurrentSolidManagement(request, response, {\n gatewayKeyPrincipalError: 'Gateway API keys cannot manage provider Connect state',\n nonSolidPrincipalError: 'Provider Connect requires the current Solid identity',\n });\n}\n\nfunction authorizeProviderQuota(\n request: AuthenticatedRequest,\n response: ServerResponse,\n): request is AuthenticatedRequest & { auth: Extract<NonNullable<AuthenticatedRequest['auth']>, { type: 'solid' }> } {\n return authorizeCurrentSolidManagement(request, response, {\n gatewayKeyPrincipalError: 'Gateway API keys cannot manage provider quota state',\n nonSolidPrincipalError: 'Provider quota requires the current Solid identity',\n });\n}\n\nfunction requireConnectService(\n options: AiGatewayManagementHandlerOptions,\n response: ServerResponse,\n): ProviderConnectService \| undefined {\n if (!options.connectService) {\n sendJson(response, 503, { error: 'AI provider Connect service is not configured' });\n return undefined;\n }\n return options.connectService;\n}\n\nfunction requireQuotaService(\n options: AiGatewayManagementHandlerOptions,\n response: ServerResponse,\n): ProviderQuotaService \| undefined {\n if (!options.quotaService) {\n sendJson(response, 503, { error: 'AI provider quota service is not configured' });\n return undefined;\n }\n return options.quotaService;\n}\n\nfunction sendQuotaError(response: ServerResponse, error: unknown): void {\n const message = error instanceof Error ? error.message : String(error);\n if (message === 'quota_credential_not_found') {\n sendJson(response, 404, { error: 'Provider credential not found for current identity' });\n return;\n }\n if (message.startsWith('quota_adapter_not_found:')) {\n sendJson(response, 404, { error: 'Provider quota adapter not found' });\n return;\n }\n sendJson(response, 500, { error: 'Provider quota lookup failed' });\n}\n\nasync function readJsonObject(\n request: AuthenticatedRequest,\n response: ServerResponse,\n limitBytes: number,\n): Promise<Record<string, unknown> \| undefined> {\n const bodyResult = await readBoundedJsonBody(request, { limitBytes });\n if (!bodyResult.ok) {\n sendJson(response, bodyResult.status, { error: bodyResult.error });\n return undefined;\n }\n const body = bodyResult.value;\n if (!body \|\| typeof body !== 'object' \|\| Array.isArray(body)) {\n sendJson(response, 400, { error: 'Request body must be a JSON object' });\n return undefined;\n }\n return body as Record<string, unknown>;\n}\n\nfunction ownerForList(request: AuthenticatedRequest): string \| undefined {\n if (request.auth?.type === 'solid') {\n return request.auth.webId;\n }\n const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n return url.searchParams.get('owner') ?? undefined;\n}\n\nfunction normalizeScopes(value: unknown): string[] \| undefined {\n if (value === undefined) {\n return [...DEFAULT_GATEWAY_API_KEY_SCOPES];\n }\n if (!Array.isArray(value) \|\| value.length === 0) {\n return undefined;\n }\n const scopes = value\n .map((item) => typeof item === 'string' ? item.trim() : '')\n .filter(Boolean);\n if (scopes.length !== value.length) {\n return undefined;\n }\n return [...new Set(scopes)];\n}\n\nfunction normalizeOptionalDate(value: unknown): Date \| undefined {\n if (value === undefined \|\| value === null \|\| value === '') {\n return undefined;\n }\n if (typeof value !== 'string') {\n return undefined;\n }\n const parsed = new Date(value);\n return Number.isNaN(parsed.getTime()) ? undefined : parsed;\n}\n\nfunction normalizeOptionalString(value: unknown): string \| undefined {\n return typeof value === 'string' && value.trim() ? value.trim() : undefined;\n}\n\nfunction stringBody(value: unknown): string {\n return typeof value === 'string' ? value : '';\n}\n\nfunction publicRecord(record: GatewayAccessKeyRecord): Record<string, unknown> {\n return {\n id: record.id,\n owner: record.owner,\n scopes: record.scopes,\n createdAt: record.createdAt.toISOString(),\n expiresAt: record.expiresAt?.toISOString(),\n lastUsedAt: record.lastUsedAt?.toISOString(),\n revokedAt: record.revokedAt?.toISOString(),\n name: record.name,\n };\n}\n\nfunction publicCredentialRecord(record: {\n id: string;\n credentialIri: string;\n webId: string;\n provider: string;\n deployment: string;\n authMode: string;\n status: string;\n accountLabel?: string;\n expiresAt?: Date;\n version?: number;\n reauthRequired?: boolean;\n metadata?: Record<string, unknown>;\n}): Record<string, unknown> {\n return {\n id: record.id,\n credentialIri: record.credentialIri,\n provider: record.provider,\n authMode: record.authMode,\n status: record.status,\n accountLabel: record.accountLabel,\n expiresAt: record.expiresAt?.toISOString(),\n version: record.version,\n reauthRequired: record.reauthRequired,\n };\n}\n\nfunction publicConnectResult(value: unknown): unknown {\n if (Array.isArray(value)) {\n return value.map(publicConnectResult);\n }\n if (!value \|\| typeof value !== 'object' \|\| value instanceof Date) {\n return value;\n }\n return Object.fromEntries(\n Object.entries(value as Record<string, unknown>)\n .filter(([key]) => ![\n 'deployment',\n 'webId',\n 'encryptedSecret',\n 'metadata',\n ].includes(key))\n .map(([key, item]) => [key, publicConnectResult(item)]),\n );\n}\n\nfunction sendJson(response: ServerResponse, status: number, data: unknown): void {\n response.statusCode = status;\n response.setHeader('Content-Type', 'application/json');\n response.end(JSON.stringify(data));\n}\n"]}
1	+ {"version":3,"file":"AiGatewayManagementHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/AiGatewayManagementHandler.ts"],"names":[],"mappings":";;AA6BA,8EAqPC;AA/QD,qEAAkE;AASlE,sGAAyG;AAEzG,0FAGiD;AAYjD,SAAgB,iCAAiC,CAC/C,MAAiB,EACjB,OAA0C;IAE1C,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,GAAG,IAAI,CAAC;IAEnE,MAAM,CAAC,GAAG,CAAC,2CAA2C,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAClF,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,IAAA,2DAA+B,EAAC;YACjD,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YAC9B,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SACjC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,CAAC,+BAA+B;YACxD,CAAC,CAAC,MAAM,OAAO,CAAC,+BAA+B,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAChG,CAAC,CAAC,SAAS,CAAC;QACd,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,GAAG,UAAU;YACb,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,IAAA,yEAA0C,GAAE;YACpG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACtE,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC;YACnD,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACnG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACpG,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC;YACxC,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,IAAI;YACnB,yBAAyB,EAAE,OAAO,IAAI,CAAC,yBAAyB,KAAK,QAAQ;gBAC3E,CAAC,CAAC,IAAI,CAAC,yBAAyB;gBAChC,CAAC,CAAC,SAAS;YACb,IAAI,EAAE,OAAO,CAAC,IAAI;SACS,CAAC,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,+DAA+D,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC9G,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzF,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC;YACzC,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YAClD,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC9G,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC;YACjD,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,MAAM;YACN,YAAY,EAAE,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxD,IAAI,EAAE,OAAO,CAAC,IAAI;SACW,CAAC,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAClG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACrG,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,6CAA6C,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC/F,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,IAAK,CAAC,KAAK;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,sDAAsD,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC9F,kFAAkF;QAClF,8EAA8E;QAC9E,8DAA8D;QAC9D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,KAAK,EAAE,2EAA2E;SACnF,CAAC,CAAC;IACL,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAErB,MAAM,CAAC,GAAG,CAAC,kDAAkD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACjG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACvC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;gBACzB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7E,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACnG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACvC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;gBACzB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC1D,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA6B,EAC7B,QAAwB,EACxB,OAEC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,+BAA+B,CACtC,OAA6B,EAC7B,QAAwB,EACxB,OAEC;IAED,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA6B,EAC7B,QAAwB;IAExB,OAAO,+BAA+B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACxD,sBAAsB,EAAE,sDAAsD;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA6B,EAC7B,QAAwB;IAExB,OAAO,+BAA+B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACxD,sBAAsB,EAAE,oDAAoD;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA0C,EAC1C,QAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA0C,EAC1C,QAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,QAAwB,EAAE,KAAc;IAC9D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,4BAA4B,EAAE,CAAC;QAC7C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAA6B,EAC7B,QAAwB,EACxB,UAAkB;IAElB,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAmB,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAAC,MAa/B;IACC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,YAAY;QACZ,OAAO;QACP,iBAAiB;QACjB,UAAU;KACX,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACvE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\nimport { readBoundedJsonBody } from '../http/readBoundedJsonBody';\nimport type { SolidAuthContext } from '../auth/AuthContext';\nimport type { GatewayDeployment } from '../ai-gateway/auth/InvocationTokenCodec';\nimport type {\n CompleteApiKeyInput,\n ConnectBeginInput,\n ProviderConnectService,\n} from '../ai-gateway/connect';\nimport type { ProviderQuotaService } from '../ai-gateway/quota';\nimport { createAiConnectionServiceAccess } from '../ai-gateway/service-access/AiConnectionServiceAccess';\nimport type { AiConnectionInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionInvocationKeyIssuer';\nimport {\n type AiClientConfigurationCapabilityDescriptor,\n unavailableAiClientConfigurationCapability,\n} from '../service/AiClientConfigurationService';\n\nexport interface AiGatewayManagementHandlerOptions {\n deployment: GatewayDeployment;\n connectService?: ProviderConnectService;\n quotaService?: ProviderQuotaService;\n aiClientConfiguration?: AiClientConfigurationCapabilityDescriptor;\n aiConnectionInvocationKeyIssuer?: Pick<AiConnectionInvocationKeyIssuer, 'issueClientConfiguration'>;\n now?: () => Date;\n jsonBodyLimitBytes?: number;\n}\n\nexport function registerAiGatewayManagementRoutes(\n server: ApiServer,\n options: AiGatewayManagementHandlerOptions,\n): void {\n const jsonBodyLimitBytes = options.jsonBodyLimitBytes ?? 64 * 1024;\n\n server.get('/api/applets/service-access/ai-connection', async (request, response) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const descriptor = createAiConnectionServiceAccess({\n ownerWebId: request.auth.webId,\n serviceWebId: request.auth.webId,\n });\n const invocation = options.aiConnectionInvocationKeyIssuer\n ? await options.aiConnectionInvocationKeyIssuer.issueClientConfiguration({ auth: request.auth })\n : undefined;\n sendJson(response, 200, {\n ...descriptor,\n aiClientConfiguration: options.aiClientConfiguration ?? unavailableAiClientConfigurationCapability(),\n ...(invocation ? { invocation } : {}),\n });\n });\n\n server.get('/api/ai/connections/providers', async (request, response) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const providers = await connectService.listProviders({\n webId: request.auth!.webId,\n deployment: options.deployment,\n auth: request.auth,\n });\n sendJson(response, 200, {\n data: publicConnectResult(providers),\n });\n });\n\n server.post('/api/ai/gateway/providers/:provider/connect/begin', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const mode = typeof body.mode === 'string' ? body.mode : undefined;\n if (mode !== 'browserAssistedApiKey' && mode !== 'deviceCodeOAuth' && mode !== 'connectUnsupported') {\n sendJson(response, 400, { error: 'mode must be a supported Connect mode' });\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const result = await connectService.begin({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n requestedMode: mode,\n expectedCredentialVersion: typeof body.expectedCredentialVersion === 'number'\n ? body.expectedCredentialVersion\n : undefined,\n auth: request.auth,\n } satisfies ConnectBeginInput);\n sendJson(response, 200, publicConnectResult(result));\n });\n\n server.get('/api/ai/gateway/providers/:provider/connect/status/:attemptId', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const result = await connectService.status({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n attemptId: decodeURIComponent(params.attemptId),\n state: url.searchParams.get('state') ?? '',\n signature: url.searchParams.get('signature') ?? '',\n auth: request.auth,\n });\n sendJson(response, 200, publicConnectResult(result));\n });\n\n server.post('/api/ai/gateway/providers/:provider/connect/complete-api-key', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const apiKey = normalizeOptionalString(body.apiKey);\n if (!apiKey) {\n sendJson(response, 400, { error: 'apiKey is required' });\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const result = await connectService.completeApiKey({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n attemptId: stringBody(body.attemptId),\n state: stringBody(body.state),\n signature: stringBody(body.signature),\n apiKey,\n accountLabel: normalizeOptionalString(body.accountLabel),\n auth: request.auth,\n } satisfies CompleteApiKeyInput);\n sendJson(response, 200, publicConnectResult(result));\n });\n\n server.post('/api/ai/gateway/providers/:provider/connect/poll', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const result = await connectService.pollDevice({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n attemptId: stringBody(body.attemptId),\n state: stringBody(body.state),\n signature: stringBody(body.signature),\n auth: request.auth,\n });\n sendJson(response, 200, publicConnectResult(result));\n });\n\n server.post('/api/ai/gateway/providers/:provider/connect/refresh', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const record = await connectService.refresh({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n auth: request.auth,\n });\n sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });\n });\n\n server.delete('/api/ai/gateway/providers/:provider/connect', async (request, response, params) => {\n if (!authorizeProviderConnect(request, response)) {\n return;\n }\n const connectService = requireConnectService(options, response);\n if (!connectService) {\n return;\n }\n const record = await connectService.disconnect({\n webId: request.auth!.webId,\n deployment: options.deployment,\n provider: params.provider,\n auth: request.auth,\n });\n sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });\n });\n\n server.get('/api/ai/gateway/providers/:provider/connect/callback', async (_request, response) => {\n // This endpoint is intentionally public only for signed one-time OAuth callbacks.\n // Browser-assisted API key completion is never accepted here because API keys\n // must be submitted through the authenticated management API.\n sendJson(response, 405, {\n error: 'Public Connect callback is unsupported for current provider Connect modes',\n });\n }, { public: true });\n\n server.get('/api/ai/gateway/providers/:provider/quota/status', async (request, response, params) => {\n if (!authorizeProviderQuota(request, response)) {\n return;\n }\n const quotaService = requireQuotaService(options, response);\n if (!quotaService) {\n return;\n }\n const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n try {\n const result = await quotaService.status({\n webId: request.auth.webId,\n deployment: options.deployment,\n provider: params.provider,\n credentialIri: normalizeOptionalString(url.searchParams.get('credentialIri')),\n refresh: false,\n auth: request.auth,\n });\n sendJson(response, 200, result);\n } catch (error) {\n sendQuotaError(response, error);\n }\n });\n\n server.post('/api/ai/gateway/providers/:provider/quota/refresh', async (request, response, params) => {\n if (!authorizeProviderQuota(request, response)) {\n return;\n }\n const body = await readJsonObject(request, response, jsonBodyLimitBytes);\n if (!body) {\n return;\n }\n const quotaService = requireQuotaService(options, response);\n if (!quotaService) {\n return;\n }\n try {\n const result = await quotaService.status({\n webId: request.auth.webId,\n deployment: options.deployment,\n provider: params.provider,\n credentialIri: normalizeOptionalString(body.credentialIri),\n refresh: true,\n auth: request.auth,\n });\n sendJson(response, 200, result);\n } catch (error) {\n sendQuotaError(response, error);\n }\n });\n}\n\nfunction authorizeManagementCaller(\n request: AuthenticatedRequest,\n response: ServerResponse,\n options: {\n nonSolidPrincipalError: string;\n },\n): boolean {\n const auth = request.auth;\n if (!auth) {\n sendJson(response, 401, { error: 'Authentication required' });\n return false;\n }\n if (auth.type === 'solid' && auth.webId) {\n return true;\n }\n sendJson(response, 403, { error: options.nonSolidPrincipalError });\n return false;\n}\n\nfunction authorizeCurrentSolidManagement(\n request: AuthenticatedRequest,\n response: ServerResponse,\n options: {\n nonSolidPrincipalError: string;\n },\n): request is AuthenticatedRequest & { auth: SolidAuthContext } {\n if (!authorizeManagementCaller(request, response, options)) {\n return false;\n }\n const auth = request.auth;\n if (!auth \|\| auth.type !== 'solid' \|\| !auth.webId) {\n sendJson(response, 403, { error: 'Insufficient permissions' });\n return false;\n }\n return true;\n}\n\nfunction authorizeProviderConnect(\n request: AuthenticatedRequest,\n response: ServerResponse,\n): request is AuthenticatedRequest & { auth: Extract<NonNullable<AuthenticatedRequest['auth']>, { type: 'solid' }> } {\n return authorizeCurrentSolidManagement(request, response, {\n nonSolidPrincipalError: 'Provider Connect requires the current Solid identity',\n });\n}\n\nfunction authorizeProviderQuota(\n request: AuthenticatedRequest,\n response: ServerResponse,\n): request is AuthenticatedRequest & { auth: Extract<NonNullable<AuthenticatedRequest['auth']>, { type: 'solid' }> } {\n return authorizeCurrentSolidManagement(request, response, {\n nonSolidPrincipalError: 'Provider quota requires the current Solid identity',\n });\n}\n\nfunction requireConnectService(\n options: AiGatewayManagementHandlerOptions,\n response: ServerResponse,\n): ProviderConnectService \| undefined {\n if (!options.connectService) {\n sendJson(response, 503, { error: 'AI provider Connect service is not configured' });\n return undefined;\n }\n return options.connectService;\n}\n\nfunction requireQuotaService(\n options: AiGatewayManagementHandlerOptions,\n response: ServerResponse,\n): ProviderQuotaService \| undefined {\n if (!options.quotaService) {\n sendJson(response, 503, { error: 'AI provider quota service is not configured' });\n return undefined;\n }\n return options.quotaService;\n}\n\nfunction sendQuotaError(response: ServerResponse, error: unknown): void {\n const message = error instanceof Error ? error.message : String(error);\n if (message === 'quota_credential_not_found') {\n sendJson(response, 404, { error: 'Provider credential not found for current identity' });\n return;\n }\n if (message.startsWith('quota_adapter_not_found:')) {\n sendJson(response, 404, { error: 'Provider quota adapter not found' });\n return;\n }\n sendJson(response, 500, { error: 'Provider quota lookup failed' });\n}\n\nasync function readJsonObject(\n request: AuthenticatedRequest,\n response: ServerResponse,\n limitBytes: number,\n): Promise<Record<string, unknown> \| undefined> {\n const bodyResult = await readBoundedJsonBody(request, { limitBytes });\n if (!bodyResult.ok) {\n sendJson(response, bodyResult.status, { error: bodyResult.error });\n return undefined;\n }\n const body = bodyResult.value;\n if (!body \|\| typeof body !== 'object' \|\| Array.isArray(body)) {\n sendJson(response, 400, { error: 'Request body must be a JSON object' });\n return undefined;\n }\n return body as Record<string, unknown>;\n}\n\nfunction normalizeOptionalString(value: unknown): string \| undefined {\n return typeof value === 'string' && value.trim() ? value.trim() : undefined;\n}\n\nfunction stringBody(value: unknown): string {\n return typeof value === 'string' ? value : '';\n}\n\nfunction publicCredentialRecord(record: {\n id: string;\n credentialIri: string;\n webId: string;\n provider: string;\n deployment: string;\n authMode: string;\n status: string;\n accountLabel?: string;\n expiresAt?: Date;\n version?: number;\n reauthRequired?: boolean;\n metadata?: Record<string, unknown>;\n}): Record<string, unknown> {\n return {\n id: record.id,\n credentialIri: record.credentialIri,\n provider: record.provider,\n authMode: record.authMode,\n status: record.status,\n accountLabel: record.accountLabel,\n expiresAt: record.expiresAt?.toISOString(),\n version: record.version,\n reauthRequired: record.reauthRequired,\n };\n}\n\nfunction publicConnectResult(value: unknown): unknown {\n if (Array.isArray(value)) {\n return value.map(publicConnectResult);\n }\n if (!value \|\| typeof value !== 'object' \|\| value instanceof Date) {\n return value;\n }\n return Object.fromEntries(\n Object.entries(value as Record<string, unknown>)\n .filter(([key]) => ![\n 'deployment',\n 'webId',\n 'encryptedSecret',\n 'metadata',\n ].includes(key))\n .map(([key, item]) => [key, publicConnectResult(item)]),\n );\n}\n\nfunction sendJson(response: ServerResponse, status: number, data: unknown): void {\n response.statusCode = status;\n response.setHeader('Content-Type', 'application/json');\n response.end(JSON.stringify(data));\n}\n"]}

package/dist/api/handlers/NetworkSettingsHandler.js CHANGED Viewed

@@ -301,9 +301,6 @@ function readAuthScopes(auth) {
     if (auth.type === 'service') {
         return auth.scopes;
     }
-    if (auth.type === 'solid' && auth.viaGatewayApiKey === true) {
-        return auth.scopes ?? [];
-    }
     return [];
 }
 async function isDeploymentOwnerOrAdmin(auth, options) {

package/dist/api/handlers/NetworkSettingsHandler.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"NetworkSettingsHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/NetworkSettingsHandler.ts"],"names":[],"mappings":";;AA6FA,sEA0DC;AAED,8FAUC;AAED,oDAkBC;AAED,wDAiBC;AAED,sDAeC;AAED,4DAmBC;AAED,8DAOC;AAED,kEAYC;AAqYD,4CAsBC;AAjqBD,qCAA4C;AAC5C,iEAAqD;AA2FrD,SAAgB,6BAA6B,CAAC,MAAiB,EAAE,OAAsC;IACrG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,oCAAY,EAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yCAAyC,EAAE,CAAC;IAErF,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrE,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxE,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3F,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACjF,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC5E,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,6BAA6B,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC;oBAC7E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;wBACtB,KAAK,EAAE,oCAAoC;wBAC3C,IAAI,EAAE,iCAAiC;qBACxC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAmB,CAAC,KAAK,EAAE,CAAC;gBACzD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,wCAAwC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC/E,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAClD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,EAAE;oBAC1C,KAAK,EAAE,YAAY,CAAC,OAAO;oBAC3B,IAAI,EAAE,YAAY,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAgB,yCAAyC,CACvD,OAAkD;IAElD,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,cAAc,CAAC;eACnE,yBAAyB,CAAC,IAAI,EAAE,eAAe,CAAC;eAChD,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC;QAClD,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,eAAe,CAAC;eACrE,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAIpC;IACC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;YAC/B,QAAQ,EAAE;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChF,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YACrB,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,eAAe,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,IAAI,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,WAAoB;IACzD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAInC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAChD,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QAC3G,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAIrC;IACC,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,wBAAwB,CAAC,cAAuB;IAC9D,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAgE,CAAC;YACxG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACjD,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CAAC,OAA0C;IAClF,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACjC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;QACtC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QAC1C,wBAAwB,CAAC,OAAO,CAAC,cAAc,CAAC;KACjD,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAG,UAAqB;IAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,eAAe,IAAI,kBAAkB,EAAE,CAAC;YAC1C,OAAO;gBACL,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAsC,EACtC,MAA+D;IAE/D,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,kBAAkB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC;QACvG,kBAAkB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC;QACvG,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC;KAC9G,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;QACjE,SAAS,EAAE;YACT,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;YACtD,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC;YAClD,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;SACzD;QACD,GAAG;QACH,GAAG;QACH,MAAM;QACN,OAAO,EAAE;YACP,QAAQ,EAAE,IAAI;YACd,gBAAgB,EAAE,MAAM,6BAA6B,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC;SAC1F;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,OAAuC,EACvC,MAA+D;IAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,oDAAoD,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAA8C,EAC9C,QAAW,EACX,KAAa,EACb,MAA+D;IAE/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,YAAY,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAAoC,EACpC,MAA+D;IAE/D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,qCAAqC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAsC,EACtC,MAA+D;IAE/D,OAAO;QACL;YACE,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,UAAU;YACjB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;YACnH,CAAC;SACF;QACD;YACE,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,eAAe,EACvB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,KAAK,EACL,MAAM,CACP,CAAC;SACH;QACD;YACE,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,eAAe,EACvB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,KAAK,EACL,MAAM,CACP,CAAC;SACH;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,kBAAkB,EAC1B,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,QAAQ,EACR,MAAM,CACP,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAA6B,EAC7B,MAA+D;IAE/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,EAAE,YAAY,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,UAA4B;IAC1D,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAA6B,EAC7B,QAAwB,EACxB,UAAqC,EACrC,IAAsB;IAEtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM;QAC7B,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAiB,EAAE,KAAuC;IAC3F,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,IAAiB,EACjB,OAA6D;IAE7D,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,qBAAqB,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC1F,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACvE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,KAAsD;IAC1E,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAgB;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QACrC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAA4B;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAA,2BAAiB,GAAE,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAoB;IAC7C,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAA8D,CAAC;IACnG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,WAAW,MAAM,CAAC,IAAI,GAAG,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,cAAuB;IACjD,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAAC,cAAuB;IACvD,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAA2B,CAAC;IACnE,OAAO,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAkB;IACvD,MAAM,YAAY,GAAG;QACnB,uBAAuB;QACvB,sBAAsB;QACtB,eAAe;QACf,cAAc;KACf,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,0BAA0B,CAC1C,MAAO,SAA2C,CAAC,YAAY,CAAC,EAAE,CACnE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAkB;IAClD,MAAM,WAAW,GAAG;QAClB,kBAAkB;QAClB,OAAO;QACP,mBAAmB;KACpB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,OAAO,MAAO,SAA2C,CAAC,WAAW,CAAC,EAAqC,CAAC;QAC9G,CAAC;QACD,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YAC1C,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,MAAO,SAA2C,CAAC,WAAW,EAAE,CAAC;SACnG,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,UAAU;gBACV,IAAI;gBACJ,OAAO,EAAE,OAAO,IAAI,4BAA4B;aACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qCAAqC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACpF,CAAC,CAAC,MAAM,CAAC,WAAsC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IAChF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACpD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAmB,KAAc,EAAE,GAAM;IAC3D,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAA4B,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,CAAC;AACjH,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,sBAAsB,GAAG;QAC7B,sFAAsF;QACtF,uEAAuE;QACvE,8CAA8C;QAC9C,4CAA4C;QAC5C,wHAAwH;QACxH,mFAAmF;QACnF,qBAAqB;QACrB,kFAAkF;QAClF,kFAAkF;QAClF,qCAAqC;QACrC,qCAAqC;QACrC,uBAAuB;QACvB,oEAAoE;QACpE,yBAAyB;QACzB,0DAA0D;QAC1D,2BAA2B;QAC3B,uCAAuC;KACxC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,sBAAsB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;AACrD,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport { networkInterfaces } from 'node:os';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthContext } from '../auth/AuthContext';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\n\nexport interface NetworkSettingsStatus {\n endpoint: string;\n addresses: {\n local: string[];\n lan: string[];\n public: string[];\n };\n tls: CapabilityStatus & { expiresAt?: string };\n dns: CapabilityStatus;\n tunnel: CapabilityStatus;\n actions: {\n diagnose: true;\n renewCertificate: boolean;\n };\n}\n\nexport interface CapabilityStatus {\n supported: boolean;\n status: string;\n}\n\nexport type DiagnosticStatus = 'ok' \| 'warning' \| 'error' \| 'unsupported';\n\nexport interface NetworkDiagnosticCheckResult {\n id: string;\n label: string;\n status: DiagnosticStatus;\n detail?: string;\n}\n\nexport interface NetworkDiagnosticCheck {\n id: string;\n label: string;\n run(): Promise<Omit<NetworkDiagnosticCheckResult, 'id' \| 'label'> \| DiagnosticStatus>;\n}\n\nexport interface NetworkCapabilityReader<T extends CapabilityStatus = CapabilityStatus> {\n read(): Promise<T>;\n}\n\nexport interface CertificateRenewer {\n renew(): Promise<CertificateRenewalResult \| void>;\n isAvailable?(): boolean \| Promise<boolean>;\n}\n\nexport interface CertificateRenewalResult {\n status: 'renewed' \| 'unchanged';\n}\n\nexport interface NetworkSettingsAuthorizer {\n canRead(auth: AuthContext): boolean \| Promise<boolean>;\n canWrite(auth: AuthContext): boolean \| Promise<boolean>;\n}\n\nexport interface NetworkSettingsIdentityAuthorizerOptions {\n deployment: 'cloud' \| 'local';\n accountRoleRepository?: {\n findByWebId(webId: string): Promise<{ roles?: string[] } \| undefined>;\n };\n}\n\nexport interface CertificateCapability {\n tlsStatusReader?: NetworkCapabilityReader<NetworkSettingsStatus['tls']>;\n certificateRenewer?: CertificateRenewer;\n}\n\nexport interface NetworkPublicAddressReaderOptions {\n configuredUrls?: Array<string \| undefined>;\n ddnsManager?: unknown;\n tunnelProvider?: unknown;\n}\n\nexport interface NetworkSettingsHandlerOptions {\n endpoint: string \| (() => string \| undefined);\n localAddresses?: () => string[];\n lanAddresses?: () => string[];\n publicAddresses?: () => string[];\n tlsStatusReader?: NetworkCapabilityReader<NetworkSettingsStatus['tls']>;\n dnsStatusReader?: NetworkCapabilityReader;\n tunnelStatusReader?: NetworkCapabilityReader;\n certificateRenewer?: CertificateRenewer;\n diagnostics?: NetworkDiagnosticCheck[];\n authorizer?: NetworkSettingsAuthorizer;\n logger?: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>;\n}\n\nexport function registerNetworkSettingsRoutes(server: ApiServer, options: NetworkSettingsHandlerOptions): void {\n const logger = options.logger ?? getLoggerFor('NetworkSettingsHandler');\n const authorizer = options.authorizer ?? createDeploymentNetworkSettingsAuthorizer();\n\n server.get('/api/network/settings/status', async (request, response) => {\n if (!await requireNetworkPermission(request, response, authorizer, 'read')) {\n return;\n }\n\n try {\n sendJson(response, 200, await readNetworkStatus(options, logger));\n } catch (error) {\n logger.error(`Failed to read network settings status: ${redactSecretText(error)}`);\n sendJson(response, 500, { error: 'Failed to read network settings status' });\n }\n });\n\n server.post('/api/network/settings/diagnose', async (request, response) => {\n if (!await requireNetworkPermission(request, response, authorizer, 'read')) {\n return;\n }\n\n try {\n const diagnostics = options.diagnostics ?? buildDefaultDiagnostics(options, logger);\n const checks = await Promise.all(diagnostics.map((check) => runDiagnostic(check, logger)));\n sendJson(response, 200, { checks });\n } catch (error) {\n logger.error(`Failed to run network diagnostics: ${redactSecretText(error)}`);\n sendJson(response, 500, { error: 'Failed to run network diagnostics' });\n }\n });\n\n if (options.certificateRenewer) {\n server.post('/api/network/settings/certificate/renew', async (request, response) => {\n if (!await requireNetworkPermission(request, response, authorizer, 'write')) {\n return;\n }\n\n try {\n if (!await isCertificateRenewalAvailable(options.certificateRenewer, logger)) {\n sendJson(response, 503, {\n error: 'Certificate renewal is unavailable',\n code: 'certificate_renewal_unavailable',\n });\n return;\n }\n const result = await options.certificateRenewer!.renew();\n sendJson(response, 200, { success: true, status: result?.status ?? 'renewed' });\n } catch (error) {\n logger.warn(`Failed to renew network certificate: ${redactSecretText(error)}`);\n const renewalError = normalizeRenewalError(error);\n sendJson(response, renewalError.statusCode, {\n error: renewalError.message,\n code: renewalError.code,\n });\n }\n });\n }\n}\n\nexport function createDeploymentNetworkSettingsAuthorizer(\n options?: NetworkSettingsIdentityAuthorizerOptions,\n): NetworkSettingsAuthorizer {\n return {\n canRead: async (auth) => hasDeploymentNetworkScope(auth, 'network:read')\n \|\| hasDeploymentNetworkScope(auth, 'network:write')\n \|\| await isDeploymentOwnerOrAdmin(auth, options),\n canWrite: async (auth) => hasDeploymentNetworkScope(auth, 'network:write')\n \|\| await isDeploymentOwnerOrAdmin(auth, options),\n };\n}\n\nexport function createAddressReaders(input: {\n endpoint: string \| (() => string \| undefined);\n port?: number;\n publicUrls?: Array<string \| undefined>;\n}): Pick<NetworkSettingsHandlerOptions, 'localAddresses' \| 'lanAddresses' \| 'publicAddresses'> {\n const endpoint = () => normalizeEndpoint(resolveValue(input.endpoint)) ?? '';\n return {\n localAddresses: () => uniqueUrls([\n endpoint(),\n input.port ? `http://127.0.0.1:${input.port}/` : undefined,\n ].filter((value): value is string => Boolean(value)).filter(isLoopbackEndpoint)),\n lanAddresses: () => {\n const port = input.port ?? readPort(endpoint());\n if (!port) return [];\n return readLanIpAddresses().map((host) => `http://${host}:${port}/`);\n },\n publicAddresses: () => uniqueUrls(input.publicUrls?.map(normalizeEndpoint).filter(Boolean) as string[] ?? []),\n };\n}\n\nexport function createDdnsStatusReader(ddnsManager: unknown): NetworkCapabilityReader \| undefined {\n if (!hasFunction(ddnsManager, 'getStatus')) {\n return undefined;\n }\n return {\n read: async () => {\n const status = ddnsManager.getStatus() as {\n allocated?: boolean;\n mode?: string;\n tunnelProvider?: string;\n };\n if (!status.allocated) {\n return { supported: true, status: 'pending' };\n }\n return { supported: true, status: status.mode === 'unknown' ? 'allocated' : status.mode ?? 'allocated' };\n },\n };\n}\n\nexport function createDnsStatusReader(input: {\n ddnsManager?: unknown;\n dnsProvider?: unknown;\n dnsCoordinator?: unknown;\n}): NetworkCapabilityReader \| undefined {\n const ddnsReader = createDdnsStatusReader(input.ddnsManager);\n if (ddnsReader) {\n return ddnsReader;\n }\n if (input.dnsProvider \|\| input.dnsCoordinator) {\n return {\n read: async () => ({ supported: true, status: 'configured' }),\n };\n }\n return undefined;\n}\n\nexport function createTunnelStatusReader(tunnelProvider: unknown): NetworkCapabilityReader \| undefined {\n if (!hasFunction(tunnelProvider, 'getStatus')) {\n return undefined;\n }\n return {\n read: async () => {\n const status = tunnelProvider.getStatus() as { running?: boolean; connected?: boolean; error?: string };\n if (status.connected) {\n return { supported: true, status: 'active' };\n }\n if (status.running) {\n return { supported: true, status: 'starting' };\n }\n if (status.error) {\n return { supported: true, status: 'error' };\n }\n return { supported: true, status: 'inactive' };\n },\n };\n}\n\nexport function createPublicAddressReader(options: NetworkPublicAddressReaderOptions): () => string[] {\n return () => uniqueUrls([\n ...(options.configuredUrls ?? []),\n readDdnsPublicUrl(options.ddnsManager),\n readTunnelEndpoint(options.tunnelProvider),\n readTunnelStatusEndpoint(options.tunnelProvider),\n ].map(normalizeEndpoint).filter(Boolean) as string[]);\n}\n\nexport function createCertificateCapability(...candidates: unknown[]): CertificateCapability \| undefined {\n for (const candidate of candidates) {\n const tlsStatusReader = createCertificateStatusReader(candidate);\n const certificateRenewer = createCertificateRenewer(candidate);\n if (tlsStatusReader \|\| certificateRenewer) {\n return {\n ...(tlsStatusReader ? { tlsStatusReader } : {}),\n ...(certificateRenewer ? { certificateRenewer } : {}),\n };\n }\n }\n return undefined;\n}\n\nasync function readNetworkStatus(\n options: NetworkSettingsHandlerOptions,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): Promise<NetworkSettingsStatus> {\n const [tls, dns, tunnel] = await Promise.all([\n safeReadCapability(options.tlsStatusReader, { supported: false, status: 'unsupported' }, 'TLS', logger),\n safeReadCapability(options.dnsStatusReader, { supported: false, status: 'unsupported' }, 'DNS', logger),\n safeReadCapability(options.tunnelStatusReader, { supported: false, status: 'unsupported' }, 'Tunnel', logger),\n ]);\n return {\n endpoint: normalizeEndpoint(resolveValue(options.endpoint)) ?? '',\n addresses: {\n local: safeAddressList(options.localAddresses, logger),\n lan: safeAddressList(options.lanAddresses, logger),\n public: safeAddressList(options.publicAddresses, logger),\n },\n tls,\n dns,\n tunnel,\n actions: {\n diagnose: true,\n renewCertificate: await isCertificateRenewalAvailable(options.certificateRenewer, logger),\n },\n };\n}\n\nasync function isCertificateRenewalAvailable(\n renewer: CertificateRenewer \| undefined,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): Promise<boolean> {\n if (!renewer) {\n return false;\n }\n if (!renewer.isAvailable) {\n return true;\n }\n try {\n return Boolean(await renewer.isAvailable());\n } catch (error) {\n logger.warn(`Failed to read certificate renewal availability: ${redactSecretText(error)}`);\n return false;\n }\n}\n\nasync function safeReadCapability<T extends CapabilityStatus>(\n reader: NetworkCapabilityReader<T> \| undefined,\n fallback: T,\n label: string,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): Promise<T> {\n if (!reader) {\n return fallback;\n }\n try {\n return await reader.read();\n } catch (error) {\n logger.warn(`Failed to read ${label} status: ${redactSecretText(error)}`);\n return { ...fallback, supported: true, status: 'error' };\n }\n}\n\nfunction safeAddressList(\n reader: (() => string[]) \| undefined,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): string[] {\n if (!reader) return [];\n try {\n return uniqueUrls(reader().map(normalizeEndpoint).filter(Boolean) as string[]);\n } catch (error) {\n logger.warn(`Failed to read network addresses: ${redactSecretText(error)}`);\n return [];\n }\n}\n\nfunction buildDefaultDiagnostics(\n options: NetworkSettingsHandlerOptions,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): NetworkDiagnosticCheck[] {\n return [\n {\n id: 'endpoint',\n label: 'Endpoint',\n run: async () => {\n const endpoint = normalizeEndpoint(resolveValue(options.endpoint));\n return endpoint ? { status: 'ok', detail: endpoint } : { status: 'unsupported', detail: 'endpoint_unavailable' };\n },\n },\n {\n id: 'tls',\n label: 'TLS',\n run: async () => capabilityToDiagnostic(await safeReadCapability(\n options.tlsStatusReader,\n { supported: false, status: 'unsupported' },\n 'TLS',\n logger,\n )),\n },\n {\n id: 'dns',\n label: 'DNS',\n run: async () => capabilityToDiagnostic(await safeReadCapability(\n options.dnsStatusReader,\n { supported: false, status: 'unsupported' },\n 'DNS',\n logger,\n )),\n },\n {\n id: 'tunnel',\n label: 'Tunnel',\n run: async () => capabilityToDiagnostic(await safeReadCapability(\n options.tunnelStatusReader,\n { supported: false, status: 'unsupported' },\n 'Tunnel',\n logger,\n )),\n },\n ];\n}\n\nasync function runDiagnostic(\n check: NetworkDiagnosticCheck,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): Promise<NetworkDiagnosticCheckResult> {\n try {\n const result = await check.run();\n if (typeof result === 'string') {\n return { id: check.id, label: check.label, status: result };\n }\n return {\n id: check.id,\n label: check.label,\n status: result.status,\n ...(result.detail ? { detail: redactSecretText(result.detail) } : {}),\n };\n } catch (error) {\n logger.warn(`Network diagnostic ${check.id} failed: ${redactSecretText(error)}`);\n return { id: check.id, label: check.label, status: 'error', detail: redactSecretText(error) };\n }\n}\n\nfunction capabilityToDiagnostic(capability: CapabilityStatus): Omit<NetworkDiagnosticCheckResult, 'id' \| 'label'> {\n if (!capability.supported) {\n return { status: 'unsupported', detail: capability.status };\n }\n if (capability.status === 'active' \|\| capability.status === 'valid' \|\| capability.status === 'synced' \|\| capability.status === 'direct') {\n return { status: 'ok', detail: capability.status };\n }\n if (capability.status === 'error') {\n return { status: 'error', detail: capability.status };\n }\n return { status: 'warning', detail: capability.status };\n}\n\nasync function requireNetworkPermission(\n request: AuthenticatedRequest,\n response: ServerResponse,\n authorizer: NetworkSettingsAuthorizer,\n mode: 'read' \| 'write',\n): Promise<boolean> {\n if (!request.auth) {\n sendJson(response, 401, { error: 'Authentication required' });\n return false;\n }\n const allowed = mode === 'read'\n ? await authorizer.canRead(request.auth)\n : await authorizer.canWrite(request.auth);\n if (!allowed) {\n sendJson(response, 403, { error: `Missing required permission: network:${mode}` });\n return false;\n }\n return true;\n}\n\nfunction hasDeploymentNetworkScope(auth: AuthContext, scope: 'network:read' \| 'network:write'): boolean {\n const scopes = readAuthScopes(auth);\n if (scopes.includes(scope)) {\n return true;\n }\n return false;\n}\n\nfunction readAuthScopes(auth: AuthContext): string[] {\n if (auth.type === 'service') {\n return auth.scopes;\n }\n if (auth.type === 'solid' && auth.viaGatewayApiKey === true) {\n return auth.scopes ?? [];\n }\n return [];\n}\n\nasync function isDeploymentOwnerOrAdmin(\n auth: AuthContext,\n options: NetworkSettingsIdentityAuthorizerOptions \| undefined,\n): Promise<boolean> {\n if (auth.type !== 'solid' \|\| !options) {\n return false;\n }\n\n const roles = (await options.accountRoleRepository?.findByWebId(auth.webId))?.roles ?? [];\n return roles.includes('admin') \|\| (options.deployment === 'local' && roles.includes('owner'));\n}\n\nfunction sendJson(response: ServerResponse, status: number, data: unknown): void {\n response.statusCode = status;\n response.setHeader('Content-Type', 'application/json');\n response.end(JSON.stringify(data));\n}\n\nfunction resolveValue(value: string \| (() => string \| undefined) \| undefined): string \| undefined {\n return typeof value === 'function' ? value() : value;\n}\n\nfunction normalizeEndpoint(value: string \| undefined): string \| undefined {\n if (!value?.trim()) return undefined;\n try {\n const url = new URL(value);\n if (url.protocol !== 'http:' && url.protocol !== 'https:') return undefined;\n return url.toString().replace(/\\/+$/u, '') + '/';\n } catch {\n return undefined;\n }\n}\n\nfunction uniqueUrls(values: string[]): string[] {\n return Array.from(new Set(values.filter(Boolean)));\n}\n\nfunction isLoopbackEndpoint(value: string): boolean {\n try {\n const host = new URL(value).hostname;\n return host === 'localhost' \|\| host === '127.0.0.1' \|\| host === '::1' \|\| host === '[::1]';\n } catch {\n return false;\n }\n}\n\nfunction readPort(endpoint: string \| undefined): number \| undefined {\n if (!endpoint) return undefined;\n try {\n const url = new URL(endpoint);\n if (url.port) return Number.parseInt(url.port, 10);\n return url.protocol === 'https:' ? 443 : 80;\n } catch {\n return undefined;\n }\n}\n\nfunction readLanIpAddresses(): string[] {\n const result: string[] = [];\n for (const entries of Object.values(networkInterfaces())) {\n for (const entry of entries ?? []) {\n if (entry.family === 'IPv4' && !entry.internal) {\n result.push(entry.address);\n }\n }\n }\n return result;\n}\n\nfunction readDdnsPublicUrl(ddnsManager: unknown): string \| undefined {\n if (!hasFunction(ddnsManager, 'getStatus')) {\n return undefined;\n }\n const status = ddnsManager.getStatus() as { allocated?: boolean; fqdn?: string; baseUrl?: string };\n if (status.baseUrl) {\n return status.baseUrl;\n }\n if (status.allocated && status.fqdn) {\n return `https://${status.fqdn}/`;\n }\n return undefined;\n}\n\nfunction readTunnelEndpoint(tunnelProvider: unknown): string \| undefined {\n if (!hasFunction(tunnelProvider, 'getEndpoint')) {\n return undefined;\n }\n const endpoint = tunnelProvider.getEndpoint();\n return typeof endpoint === 'string' ? endpoint : undefined;\n}\n\nfunction readTunnelStatusEndpoint(tunnelProvider: unknown): string \| undefined {\n if (!hasFunction(tunnelProvider, 'getStatus')) {\n return undefined;\n }\n const status = tunnelProvider.getStatus() as { endpoint?: string };\n return typeof status.endpoint === 'string' ? status.endpoint : undefined;\n}\n\nfunction createCertificateStatusReader(candidate: unknown): NetworkCapabilityReader<NetworkSettingsStatus['tls']> \| undefined {\n const statusMethod = [\n 'readCertificateStatus',\n 'getCertificateStatus',\n 'readTlsStatus',\n 'getTlsStatus',\n ].find((method) => hasFunction(candidate, method));\n if (!statusMethod) {\n return undefined;\n }\n return {\n read: async () => normalizeCertificateStatus(\n await (candidate as Record<string, () => unknown>)[statusMethod](),\n ),\n };\n}\n\nfunction createCertificateRenewer(candidate: unknown): CertificateRenewer \| undefined {\n const renewMethod = [\n 'renewCertificate',\n 'renew',\n 'ensureCertificate',\n ].find((method) => hasFunction(candidate, method));\n if (!renewMethod) {\n return undefined;\n }\n return {\n renew: async () => {\n return await (candidate as Record<string, () => unknown>)[renewMethod]() as CertificateRenewalResult \| void;\n },\n ...(hasFunction(candidate, 'isAvailable') ? {\n isAvailable: async () => Boolean(await (candidate as Record<string, () => unknown>).isAvailable()),\n } : {}),\n };\n}\n\nfunction normalizeRenewalError(error: unknown): { statusCode: number; code: string; message: string } {\n if (error && typeof error === 'object') {\n const record = error as Record<string, unknown>;\n const statusCode = typeof record.statusCode === 'number' ? record.statusCode : undefined;\n const code = typeof record.code === 'string' ? record.code : undefined;\n const message = error instanceof Error ? error.message : undefined;\n if (statusCode && code) {\n return {\n statusCode,\n code,\n message: message ?? 'Certificate renewal failed',\n };\n }\n }\n return {\n statusCode: 500,\n code: 'certificate_renewal_failed',\n message: 'Failed to renew network certificate',\n };\n}\n\nfunction normalizeCertificateStatus(value: unknown): NetworkSettingsStatus['tls'] {\n if (typeof value === 'string') {\n return { supported: true, status: value };\n }\n if (!value \|\| typeof value !== 'object') {\n return { supported: true, status: 'configured' };\n }\n const record = value as Record<string, unknown>;\n const nestedCertificate = record.certificate && typeof record.certificate === 'object'\n ? record.certificate as Record<string, unknown>\n : undefined;\n const status = typeof record.status === 'string' ? record.status : 'configured';\n const expiresAt = normalizeIsoDate(record.expiresAt ?? nestedCertificate?.expiresAt);\n return {\n supported: record.supported === false ? false : true,\n status,\n ...(expiresAt ? { expiresAt } : {}),\n };\n}\n\nfunction normalizeIsoDate(value: unknown): string \| undefined {\n if (value instanceof Date && Number.isFinite(value.getTime())) {\n return value.toISOString();\n }\n if (typeof value === 'string') {\n const date = new Date(value);\n return Number.isFinite(date.getTime()) ? date.toISOString() : value;\n }\n if (typeof value === 'number') {\n const date = new Date(value);\n return Number.isFinite(date.getTime()) ? date.toISOString() : undefined;\n }\n return undefined;\n}\n\nfunction hasFunction<T extends string>(value: unknown, key: T): value is Record<T, (...args: never[]) => unknown> {\n return Boolean(value && typeof value === 'object' && typeof (value as Record<T, unknown>)[key] === 'function');\n}\n\nexport function redactSecretText(value: unknown): string {\n const raw = value instanceof Error ? value.message : String(value);\n const containsSensitiveValue = [\n /\\b(?:authorization\|proxy-authorization)\\s[:=]\\s(?:bearer\|dpop\|basic)?\\s[^,\\s;]+/iu,\n /\\bdpop\\s[:=]\\s[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?/iu,\n /\\b(?:bearer\|dpop)\\s+[A-Za-z0-9._~+/=-]{8,}/iu,\n /\\b(?:cookie\|set-cookie)\\s[:=]\\s[^,\\n]+/iu,\n /\\b(?:token\|secret\|password\|passwd\|api[_-]?key\|authorization\|credential\|clientSecret\|client_secret)\\s[=:]\\s[^,\\s;]+/iu,\n /(?:[?#&]\|\\b)(?:access_token\|refresh_token\|id_token\|token_type)\\s=\\s[^&#\\s;,]+/iu,\n /[?&]code=[^&#\\s]+/iu,\n /\\b(?:oauth\|oidc\|auth(?:orization)?\|callback)\\b[^,\\n]\\bcode\\s[=:]\\s[^,\\s;&]+/iu,\n /\\bcode\\s[=:]\\s[^,\\s;&]+[^,\\n]\\b(?:oauth\|oidc\|auth(?:orization)?\|callback)\\b/iu,\n /\\bxpod_(?:gw\|inv)_[A-Za-z0-9._-]+/iu,\n /-----BEGIN [A-Z ]PRIVATE KEY-----/u,\n /\"d\"\\s:\\s\"[^\"]{8,}\"/u,\n /\\b(?:postgres\|postgresql\|mysql\|redis\|mongodb\|sqlite):\\/\\/[^,\\s]+/iu,\n /\\bfile:\\/\\/\\/[^\\s,;]+/iu,\n /(?:^\|\\s)\\/(?:Users\|home\|var\|tmp\|private\|etc)\\/[^\\s,;]+/iu,\n /\\b[A-Za-z]:[\\\\/][^\\s,;]+/u,\n /\\\\\\\\[^\\\\\\s,;]+\\\\[^\\\\\\s,;]+\\\\[^\\s,;]+/u,\n ].some((pattern) => pattern.test(raw));\n return containsSensitiveValue ? '[redacted]' : raw;\n}\n"]}
1	+ {"version":3,"file":"NetworkSettingsHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/NetworkSettingsHandler.ts"],"names":[],"mappings":";;AA6FA,sEA0DC;AAED,8FAUC;AAED,oDAkBC;AAED,wDAiBC;AAED,sDAeC;AAED,4DAmBC;AAED,8DAOC;AAED,kEAYC;AAkYD,4CAsBC;AA9pBD,qCAA4C;AAC5C,iEAAqD;AA2FrD,SAAgB,6BAA6B,CAAC,MAAiB,EAAE,OAAsC;IACrG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,oCAAY,EAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yCAAyC,EAAE,CAAC;IAErF,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrE,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxE,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3F,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACjF,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC5E,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,6BAA6B,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC;oBAC7E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;wBACtB,KAAK,EAAE,oCAAoC;wBAC3C,IAAI,EAAE,iCAAiC;qBACxC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAmB,CAAC,KAAK,EAAE,CAAC;gBACzD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,wCAAwC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC/E,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAClD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,EAAE;oBAC1C,KAAK,EAAE,YAAY,CAAC,OAAO;oBAC3B,IAAI,EAAE,YAAY,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAgB,yCAAyC,CACvD,OAAkD;IAElD,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,cAAc,CAAC;eACnE,yBAAyB,CAAC,IAAI,EAAE,eAAe,CAAC;eAChD,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC;QAClD,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,eAAe,CAAC;eACrE,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAIpC;IACC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;YAC/B,QAAQ,EAAE;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChF,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YACrB,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,eAAe,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,IAAI,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,WAAoB;IACzD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAInC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAChD,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QAC3G,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAIrC;IACC,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,wBAAwB,CAAC,cAAuB;IAC9D,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAgE,CAAC;YACxG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACjD,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CAAC,OAA0C;IAClF,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACjC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;QACtC,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QAC1C,wBAAwB,CAAC,OAAO,CAAC,cAAc,CAAC;KACjD,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAG,UAAqB;IAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,eAAe,IAAI,kBAAkB,EAAE,CAAC;YAC1C,OAAO;gBACL,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAsC,EACtC,MAA+D;IAE/D,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,kBAAkB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC;QACvG,kBAAkB,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC;QACvG,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC;KAC9G,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;QACjE,SAAS,EAAE;YACT,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;YACtD,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC;YAClD,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;SACzD;QACD,GAAG;QACH,GAAG;QACH,MAAM;QACN,OAAO,EAAE;YACP,QAAQ,EAAE,IAAI;YACd,gBAAgB,EAAE,MAAM,6BAA6B,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC;SAC1F;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,OAAuC,EACvC,MAA+D;IAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,oDAAoD,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAA8C,EAC9C,QAAW,EACX,KAAa,EACb,MAA+D;IAE/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,YAAY,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAAoC,EACpC,MAA+D;IAE/D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,qCAAqC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAsC,EACtC,MAA+D;IAE/D,OAAO;QACL;YACE,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,UAAU;YACjB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;YACnH,CAAC;SACF;QACD;YACE,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,eAAe,EACvB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,KAAK,EACL,MAAM,CACP,CAAC;SACH;QACD;YACE,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,eAAe,EACvB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,KAAK,EACL,MAAM,CACP,CAAC;SACH;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,kBAAkB,CAC9D,OAAO,CAAC,kBAAkB,EAC1B,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAC3C,QAAQ,EACR,MAAM,CACP,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAA6B,EAC7B,MAA+D;IAE/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,EAAE,YAAY,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,UAA4B;IAC1D,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAA6B,EAC7B,QAAwB,EACxB,UAAqC,EACrC,IAAsB;IAEtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM;QAC7B,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAiB,EAAE,KAAuC;IAC3F,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,IAAiB,EACjB,OAA6D;IAE7D,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,qBAAqB,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC1F,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACvE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,KAAsD;IAC1E,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAgB;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QACrC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAA4B;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAA,2BAAiB,GAAE,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAoB;IAC7C,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAA8D,CAAC;IACnG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,WAAW,MAAM,CAAC,IAAI,GAAG,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,cAAuB;IACjD,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAAC,cAAuB;IACvD,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAA2B,CAAC;IACnE,OAAO,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAkB;IACvD,MAAM,YAAY,GAAG;QACnB,uBAAuB;QACvB,sBAAsB;QACtB,eAAe;QACf,cAAc;KACf,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,0BAA0B,CAC1C,MAAO,SAA2C,CAAC,YAAY,CAAC,EAAE,CACnE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAkB;IAClD,MAAM,WAAW,GAAG;QAClB,kBAAkB;QAClB,OAAO;QACP,mBAAmB;KACpB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,OAAO,MAAO,SAA2C,CAAC,WAAW,CAAC,EAAqC,CAAC;QAC9G,CAAC;QACD,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YAC1C,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,MAAO,SAA2C,CAAC,WAAW,EAAE,CAAC;SACnG,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,UAAU;gBACV,IAAI;gBACJ,OAAO,EAAE,OAAO,IAAI,4BAA4B;aACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qCAAqC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACpF,CAAC,CAAC,MAAM,CAAC,WAAsC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IAChF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,IAAI,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACpD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAmB,KAAc,EAAE,GAAM;IAC3D,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAA4B,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,CAAC;AACjH,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,sBAAsB,GAAG;QAC7B,sFAAsF;QACtF,uEAAuE;QACvE,8CAA8C;QAC9C,4CAA4C;QAC5C,wHAAwH;QACxH,mFAAmF;QACnF,qBAAqB;QACrB,kFAAkF;QAClF,kFAAkF;QAClF,qCAAqC;QACrC,qCAAqC;QACrC,uBAAuB;QACvB,oEAAoE;QACpE,yBAAyB;QACzB,0DAA0D;QAC1D,2BAA2B;QAC3B,uCAAuC;KACxC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,sBAAsB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;AACrD,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport { networkInterfaces } from 'node:os';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthContext } from '../auth/AuthContext';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\n\nexport interface NetworkSettingsStatus {\n endpoint: string;\n addresses: {\n local: string[];\n lan: string[];\n public: string[];\n };\n tls: CapabilityStatus & { expiresAt?: string };\n dns: CapabilityStatus;\n tunnel: CapabilityStatus;\n actions: {\n diagnose: true;\n renewCertificate: boolean;\n };\n}\n\nexport interface CapabilityStatus {\n supported: boolean;\n status: string;\n}\n\nexport type DiagnosticStatus = 'ok' \| 'warning' \| 'error' \| 'unsupported';\n\nexport interface NetworkDiagnosticCheckResult {\n id: string;\n label: string;\n status: DiagnosticStatus;\n detail?: string;\n}\n\nexport interface NetworkDiagnosticCheck {\n id: string;\n label: string;\n run(): Promise<Omit<NetworkDiagnosticCheckResult, 'id' \| 'label'> \| DiagnosticStatus>;\n}\n\nexport interface NetworkCapabilityReader<T extends CapabilityStatus = CapabilityStatus> {\n read(): Promise<T>;\n}\n\nexport interface CertificateRenewer {\n renew(): Promise<CertificateRenewalResult \| void>;\n isAvailable?(): boolean \| Promise<boolean>;\n}\n\nexport interface CertificateRenewalResult {\n status: 'renewed' \| 'unchanged';\n}\n\nexport interface NetworkSettingsAuthorizer {\n canRead(auth: AuthContext): boolean \| Promise<boolean>;\n canWrite(auth: AuthContext): boolean \| Promise<boolean>;\n}\n\nexport interface NetworkSettingsIdentityAuthorizerOptions {\n deployment: 'cloud' \| 'local';\n accountRoleRepository?: {\n findByWebId(webId: string): Promise<{ roles?: string[] } \| undefined>;\n };\n}\n\nexport interface CertificateCapability {\n tlsStatusReader?: NetworkCapabilityReader<NetworkSettingsStatus['tls']>;\n certificateRenewer?: CertificateRenewer;\n}\n\nexport interface NetworkPublicAddressReaderOptions {\n configuredUrls?: Array<string \| undefined>;\n ddnsManager?: unknown;\n tunnelProvider?: unknown;\n}\n\nexport interface NetworkSettingsHandlerOptions {\n endpoint: string \| (() => string \| undefined);\n localAddresses?: () => string[];\n lanAddresses?: () => string[];\n publicAddresses?: () => string[];\n tlsStatusReader?: NetworkCapabilityReader<NetworkSettingsStatus['tls']>;\n dnsStatusReader?: NetworkCapabilityReader;\n tunnelStatusReader?: NetworkCapabilityReader;\n certificateRenewer?: CertificateRenewer;\n diagnostics?: NetworkDiagnosticCheck[];\n authorizer?: NetworkSettingsAuthorizer;\n logger?: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>;\n}\n\nexport function registerNetworkSettingsRoutes(server: ApiServer, options: NetworkSettingsHandlerOptions): void {\n const logger = options.logger ?? getLoggerFor('NetworkSettingsHandler');\n const authorizer = options.authorizer ?? createDeploymentNetworkSettingsAuthorizer();\n\n server.get('/api/network/settings/status', async (request, response) => {\n if (!await requireNetworkPermission(request, response, authorizer, 'read')) {\n return;\n }\n\n try {\n sendJson(response, 200, await readNetworkStatus(options, logger));\n } catch (error) {\n logger.error(`Failed to read network settings status: ${redactSecretText(error)}`);\n sendJson(response, 500, { error: 'Failed to read network settings status' });\n }\n });\n\n server.post('/api/network/settings/diagnose', async (request, response) => {\n if (!await requireNetworkPermission(request, response, authorizer, 'read')) {\n return;\n }\n\n try {\n const diagnostics = options.diagnostics ?? buildDefaultDiagnostics(options, logger);\n const checks = await Promise.all(diagnostics.map((check) => runDiagnostic(check, logger)));\n sendJson(response, 200, { checks });\n } catch (error) {\n logger.error(`Failed to run network diagnostics: ${redactSecretText(error)}`);\n sendJson(response, 500, { error: 'Failed to run network diagnostics' });\n }\n });\n\n if (options.certificateRenewer) {\n server.post('/api/network/settings/certificate/renew', async (request, response) => {\n if (!await requireNetworkPermission(request, response, authorizer, 'write')) {\n return;\n }\n\n try {\n if (!await isCertificateRenewalAvailable(options.certificateRenewer, logger)) {\n sendJson(response, 503, {\n error: 'Certificate renewal is unavailable',\n code: 'certificate_renewal_unavailable',\n });\n return;\n }\n const result = await options.certificateRenewer!.renew();\n sendJson(response, 200, { success: true, status: result?.status ?? 'renewed' });\n } catch (error) {\n logger.warn(`Failed to renew network certificate: ${redactSecretText(error)}`);\n const renewalError = normalizeRenewalError(error);\n sendJson(response, renewalError.statusCode, {\n error: renewalError.message,\n code: renewalError.code,\n });\n }\n });\n }\n}\n\nexport function createDeploymentNetworkSettingsAuthorizer(\n options?: NetworkSettingsIdentityAuthorizerOptions,\n): NetworkSettingsAuthorizer {\n return {\n canRead: async (auth) => hasDeploymentNetworkScope(auth, 'network:read')\n \|\| hasDeploymentNetworkScope(auth, 'network:write')\n \|\| await isDeploymentOwnerOrAdmin(auth, options),\n canWrite: async (auth) => hasDeploymentNetworkScope(auth, 'network:write')\n \|\| await isDeploymentOwnerOrAdmin(auth, options),\n };\n}\n\nexport function createAddressReaders(input: {\n endpoint: string \| (() => string \| undefined);\n port?: number;\n publicUrls?: Array<string \| undefined>;\n}): Pick<NetworkSettingsHandlerOptions, 'localAddresses' \| 'lanAddresses' \| 'publicAddresses'> {\n const endpoint = () => normalizeEndpoint(resolveValue(input.endpoint)) ?? '';\n return {\n localAddresses: () => uniqueUrls([\n endpoint(),\n input.port ? `http://127.0.0.1:${input.port}/` : undefined,\n ].filter((value): value is string => Boolean(value)).filter(isLoopbackEndpoint)),\n lanAddresses: () => {\n const port = input.port ?? readPort(endpoint());\n if (!port) return [];\n return readLanIpAddresses().map((host) => `http://${host}:${port}/`);\n },\n publicAddresses: () => uniqueUrls(input.publicUrls?.map(normalizeEndpoint).filter(Boolean) as string[] ?? []),\n };\n}\n\nexport function createDdnsStatusReader(ddnsManager: unknown): NetworkCapabilityReader \| undefined {\n if (!hasFunction(ddnsManager, 'getStatus')) {\n return undefined;\n }\n return {\n read: async () => {\n const status = ddnsManager.getStatus() as {\n allocated?: boolean;\n mode?: string;\n tunnelProvider?: string;\n };\n if (!status.allocated) {\n return { supported: true, status: 'pending' };\n }\n return { supported: true, status: status.mode === 'unknown' ? 'allocated' : status.mode ?? 'allocated' };\n },\n };\n}\n\nexport function createDnsStatusReader(input: {\n ddnsManager?: unknown;\n dnsProvider?: unknown;\n dnsCoordinator?: unknown;\n}): NetworkCapabilityReader \| undefined {\n const ddnsReader = createDdnsStatusReader(input.ddnsManager);\n if (ddnsReader) {\n return ddnsReader;\n }\n if (input.dnsProvider \|\| input.dnsCoordinator) {\n return {\n read: async () => ({ supported: true, status: 'configured' }),\n };\n }\n return undefined;\n}\n\nexport function createTunnelStatusReader(tunnelProvider: unknown): NetworkCapabilityReader \| undefined {\n if (!hasFunction(tunnelProvider, 'getStatus')) {\n return undefined;\n }\n return {\n read: async () => {\n const status = tunnelProvider.getStatus() as { running?: boolean; connected?: boolean; error?: string };\n if (status.connected) {\n return { supported: true, status: 'active' };\n }\n if (status.running) {\n return { supported: true, status: 'starting' };\n }\n if (status.error) {\n return { supported: true, status: 'error' };\n }\n return { supported: true, status: 'inactive' };\n },\n };\n}\n\nexport function createPublicAddressReader(options: NetworkPublicAddressReaderOptions): () => string[] {\n return () => uniqueUrls([\n ...(options.configuredUrls ?? []),\n readDdnsPublicUrl(options.ddnsManager),\n readTunnelEndpoint(options.tunnelProvider),\n readTunnelStatusEndpoint(options.tunnelProvider),\n ].map(normalizeEndpoint).filter(Boolean) as string[]);\n}\n\nexport function createCertificateCapability(...candidates: unknown[]): CertificateCapability \| undefined {\n for (const candidate of candidates) {\n const tlsStatusReader = createCertificateStatusReader(candidate);\n const certificateRenewer = createCertificateRenewer(candidate);\n if (tlsStatusReader \|\| certificateRenewer) {\n return {\n ...(tlsStatusReader ? { tlsStatusReader } : {}),\n ...(certificateRenewer ? { certificateRenewer } : {}),\n };\n }\n }\n return undefined;\n}\n\nasync function readNetworkStatus(\n options: NetworkSettingsHandlerOptions,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): Promise<NetworkSettingsStatus> {\n const [tls, dns, tunnel] = await Promise.all([\n safeReadCapability(options.tlsStatusReader, { supported: false, status: 'unsupported' }, 'TLS', logger),\n safeReadCapability(options.dnsStatusReader, { supported: false, status: 'unsupported' }, 'DNS', logger),\n safeReadCapability(options.tunnelStatusReader, { supported: false, status: 'unsupported' }, 'Tunnel', logger),\n ]);\n return {\n endpoint: normalizeEndpoint(resolveValue(options.endpoint)) ?? '',\n addresses: {\n local: safeAddressList(options.localAddresses, logger),\n lan: safeAddressList(options.lanAddresses, logger),\n public: safeAddressList(options.publicAddresses, logger),\n },\n tls,\n dns,\n tunnel,\n actions: {\n diagnose: true,\n renewCertificate: await isCertificateRenewalAvailable(options.certificateRenewer, logger),\n },\n };\n}\n\nasync function isCertificateRenewalAvailable(\n renewer: CertificateRenewer \| undefined,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): Promise<boolean> {\n if (!renewer) {\n return false;\n }\n if (!renewer.isAvailable) {\n return true;\n }\n try {\n return Boolean(await renewer.isAvailable());\n } catch (error) {\n logger.warn(`Failed to read certificate renewal availability: ${redactSecretText(error)}`);\n return false;\n }\n}\n\nasync function safeReadCapability<T extends CapabilityStatus>(\n reader: NetworkCapabilityReader<T> \| undefined,\n fallback: T,\n label: string,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): Promise<T> {\n if (!reader) {\n return fallback;\n }\n try {\n return await reader.read();\n } catch (error) {\n logger.warn(`Failed to read ${label} status: ${redactSecretText(error)}`);\n return { ...fallback, supported: true, status: 'error' };\n }\n}\n\nfunction safeAddressList(\n reader: (() => string[]) \| undefined,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): string[] {\n if (!reader) return [];\n try {\n return uniqueUrls(reader().map(normalizeEndpoint).filter(Boolean) as string[]);\n } catch (error) {\n logger.warn(`Failed to read network addresses: ${redactSecretText(error)}`);\n return [];\n }\n}\n\nfunction buildDefaultDiagnostics(\n options: NetworkSettingsHandlerOptions,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): NetworkDiagnosticCheck[] {\n return [\n {\n id: 'endpoint',\n label: 'Endpoint',\n run: async () => {\n const endpoint = normalizeEndpoint(resolveValue(options.endpoint));\n return endpoint ? { status: 'ok', detail: endpoint } : { status: 'unsupported', detail: 'endpoint_unavailable' };\n },\n },\n {\n id: 'tls',\n label: 'TLS',\n run: async () => capabilityToDiagnostic(await safeReadCapability(\n options.tlsStatusReader,\n { supported: false, status: 'unsupported' },\n 'TLS',\n logger,\n )),\n },\n {\n id: 'dns',\n label: 'DNS',\n run: async () => capabilityToDiagnostic(await safeReadCapability(\n options.dnsStatusReader,\n { supported: false, status: 'unsupported' },\n 'DNS',\n logger,\n )),\n },\n {\n id: 'tunnel',\n label: 'Tunnel',\n run: async () => capabilityToDiagnostic(await safeReadCapability(\n options.tunnelStatusReader,\n { supported: false, status: 'unsupported' },\n 'Tunnel',\n logger,\n )),\n },\n ];\n}\n\nasync function runDiagnostic(\n check: NetworkDiagnosticCheck,\n logger: Pick<ReturnType<typeof getLoggerFor>, 'warn' \| 'error'>,\n): Promise<NetworkDiagnosticCheckResult> {\n try {\n const result = await check.run();\n if (typeof result === 'string') {\n return { id: check.id, label: check.label, status: result };\n }\n return {\n id: check.id,\n label: check.label,\n status: result.status,\n ...(result.detail ? { detail: redactSecretText(result.detail) } : {}),\n };\n } catch (error) {\n logger.warn(`Network diagnostic ${check.id} failed: ${redactSecretText(error)}`);\n return { id: check.id, label: check.label, status: 'error', detail: redactSecretText(error) };\n }\n}\n\nfunction capabilityToDiagnostic(capability: CapabilityStatus): Omit<NetworkDiagnosticCheckResult, 'id' \| 'label'> {\n if (!capability.supported) {\n return { status: 'unsupported', detail: capability.status };\n }\n if (capability.status === 'active' \|\| capability.status === 'valid' \|\| capability.status === 'synced' \|\| capability.status === 'direct') {\n return { status: 'ok', detail: capability.status };\n }\n if (capability.status === 'error') {\n return { status: 'error', detail: capability.status };\n }\n return { status: 'warning', detail: capability.status };\n}\n\nasync function requireNetworkPermission(\n request: AuthenticatedRequest,\n response: ServerResponse,\n authorizer: NetworkSettingsAuthorizer,\n mode: 'read' \| 'write',\n): Promise<boolean> {\n if (!request.auth) {\n sendJson(response, 401, { error: 'Authentication required' });\n return false;\n }\n const allowed = mode === 'read'\n ? await authorizer.canRead(request.auth)\n : await authorizer.canWrite(request.auth);\n if (!allowed) {\n sendJson(response, 403, { error: `Missing required permission: network:${mode}` });\n return false;\n }\n return true;\n}\n\nfunction hasDeploymentNetworkScope(auth: AuthContext, scope: 'network:read' \| 'network:write'): boolean {\n const scopes = readAuthScopes(auth);\n if (scopes.includes(scope)) {\n return true;\n }\n return false;\n}\n\nfunction readAuthScopes(auth: AuthContext): string[] {\n if (auth.type === 'service') {\n return auth.scopes;\n }\n return [];\n}\n\nasync function isDeploymentOwnerOrAdmin(\n auth: AuthContext,\n options: NetworkSettingsIdentityAuthorizerOptions \| undefined,\n): Promise<boolean> {\n if (auth.type !== 'solid' \|\| !options) {\n return false;\n }\n\n const roles = (await options.accountRoleRepository?.findByWebId(auth.webId))?.roles ?? [];\n return roles.includes('admin') \|\| (options.deployment === 'local' && roles.includes('owner'));\n}\n\nfunction sendJson(response: ServerResponse, status: number, data: unknown): void {\n response.statusCode = status;\n response.setHeader('Content-Type', 'application/json');\n response.end(JSON.stringify(data));\n}\n\nfunction resolveValue(value: string \| (() => string \| undefined) \| undefined): string \| undefined {\n return typeof value === 'function' ? value() : value;\n}\n\nfunction normalizeEndpoint(value: string \| undefined): string \| undefined {\n if (!value?.trim()) return undefined;\n try {\n const url = new URL(value);\n if (url.protocol !== 'http:' && url.protocol !== 'https:') return undefined;\n return url.toString().replace(/\\/+$/u, '') + '/';\n } catch {\n return undefined;\n }\n}\n\nfunction uniqueUrls(values: string[]): string[] {\n return Array.from(new Set(values.filter(Boolean)));\n}\n\nfunction isLoopbackEndpoint(value: string): boolean {\n try {\n const host = new URL(value).hostname;\n return host === 'localhost' \|\| host === '127.0.0.1' \|\| host === '::1' \|\| host === '[::1]';\n } catch {\n return false;\n }\n}\n\nfunction readPort(endpoint: string \| undefined): number \| undefined {\n if (!endpoint) return undefined;\n try {\n const url = new URL(endpoint);\n if (url.port) return Number.parseInt(url.port, 10);\n return url.protocol === 'https:' ? 443 : 80;\n } catch {\n return undefined;\n }\n}\n\nfunction readLanIpAddresses(): string[] {\n const result: string[] = [];\n for (const entries of Object.values(networkInterfaces())) {\n for (const entry of entries ?? []) {\n if (entry.family === 'IPv4' && !entry.internal) {\n result.push(entry.address);\n }\n }\n }\n return result;\n}\n\nfunction readDdnsPublicUrl(ddnsManager: unknown): string \| undefined {\n if (!hasFunction(ddnsManager, 'getStatus')) {\n return undefined;\n }\n const status = ddnsManager.getStatus() as { allocated?: boolean; fqdn?: string; baseUrl?: string };\n if (status.baseUrl) {\n return status.baseUrl;\n }\n if (status.allocated && status.fqdn) {\n return `https://${status.fqdn}/`;\n }\n return undefined;\n}\n\nfunction readTunnelEndpoint(tunnelProvider: unknown): string \| undefined {\n if (!hasFunction(tunnelProvider, 'getEndpoint')) {\n return undefined;\n }\n const endpoint = tunnelProvider.getEndpoint();\n return typeof endpoint === 'string' ? endpoint : undefined;\n}\n\nfunction readTunnelStatusEndpoint(tunnelProvider: unknown): string \| undefined {\n if (!hasFunction(tunnelProvider, 'getStatus')) {\n return undefined;\n }\n const status = tunnelProvider.getStatus() as { endpoint?: string };\n return typeof status.endpoint === 'string' ? status.endpoint : undefined;\n}\n\nfunction createCertificateStatusReader(candidate: unknown): NetworkCapabilityReader<NetworkSettingsStatus['tls']> \| undefined {\n const statusMethod = [\n 'readCertificateStatus',\n 'getCertificateStatus',\n 'readTlsStatus',\n 'getTlsStatus',\n ].find((method) => hasFunction(candidate, method));\n if (!statusMethod) {\n return undefined;\n }\n return {\n read: async () => normalizeCertificateStatus(\n await (candidate as Record<string, () => unknown>)[statusMethod](),\n ),\n };\n}\n\nfunction createCertificateRenewer(candidate: unknown): CertificateRenewer \| undefined {\n const renewMethod = [\n 'renewCertificate',\n 'renew',\n 'ensureCertificate',\n ].find((method) => hasFunction(candidate, method));\n if (!renewMethod) {\n return undefined;\n }\n return {\n renew: async () => {\n return await (candidate as Record<string, () => unknown>)[renewMethod]() as CertificateRenewalResult \| void;\n },\n ...(hasFunction(candidate, 'isAvailable') ? {\n isAvailable: async () => Boolean(await (candidate as Record<string, () => unknown>).isAvailable()),\n } : {}),\n };\n}\n\nfunction normalizeRenewalError(error: unknown): { statusCode: number; code: string; message: string } {\n if (error && typeof error === 'object') {\n const record = error as Record<string, unknown>;\n const statusCode = typeof record.statusCode === 'number' ? record.statusCode : undefined;\n const code = typeof record.code === 'string' ? record.code : undefined;\n const message = error instanceof Error ? error.message : undefined;\n if (statusCode && code) {\n return {\n statusCode,\n code,\n message: message ?? 'Certificate renewal failed',\n };\n }\n }\n return {\n statusCode: 500,\n code: 'certificate_renewal_failed',\n message: 'Failed to renew network certificate',\n };\n}\n\nfunction normalizeCertificateStatus(value: unknown): NetworkSettingsStatus['tls'] {\n if (typeof value === 'string') {\n return { supported: true, status: value };\n }\n if (!value \|\| typeof value !== 'object') {\n return { supported: true, status: 'configured' };\n }\n const record = value as Record<string, unknown>;\n const nestedCertificate = record.certificate && typeof record.certificate === 'object'\n ? record.certificate as Record<string, unknown>\n : undefined;\n const status = typeof record.status === 'string' ? record.status : 'configured';\n const expiresAt = normalizeIsoDate(record.expiresAt ?? nestedCertificate?.expiresAt);\n return {\n supported: record.supported === false ? false : true,\n status,\n ...(expiresAt ? { expiresAt } : {}),\n };\n}\n\nfunction normalizeIsoDate(value: unknown): string \| undefined {\n if (value instanceof Date && Number.isFinite(value.getTime())) {\n return value.toISOString();\n }\n if (typeof value === 'string') {\n const date = new Date(value);\n return Number.isFinite(date.getTime()) ? date.toISOString() : value;\n }\n if (typeof value === 'number') {\n const date = new Date(value);\n return Number.isFinite(date.getTime()) ? date.toISOString() : undefined;\n }\n return undefined;\n}\n\nfunction hasFunction<T extends string>(value: unknown, key: T): value is Record<T, (...args: never[]) => unknown> {\n return Boolean(value && typeof value === 'object' && typeof (value as Record<T, unknown>)[key] === 'function');\n}\n\nexport function redactSecretText(value: unknown): string {\n const raw = value instanceof Error ? value.message : String(value);\n const containsSensitiveValue = [\n /\\b(?:authorization\|proxy-authorization)\\s[:=]\\s(?:bearer\|dpop\|basic)?\\s[^,\\s;]+/iu,\n /\\bdpop\\s[:=]\\s[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?/iu,\n /\\b(?:bearer\|dpop)\\s+[A-Za-z0-9._~+/=-]{8,}/iu,\n /\\b(?:cookie\|set-cookie)\\s[:=]\\s[^,\\n]+/iu,\n /\\b(?:token\|secret\|password\|passwd\|api[_-]?key\|authorization\|credential\|clientSecret\|client_secret)\\s[=:]\\s[^,\\s;]+/iu,\n /(?:[?#&]\|\\b)(?:access_token\|refresh_token\|id_token\|token_type)\\s=\\s[^&#\\s;,]+/iu,\n /[?&]code=[^&#\\s]+/iu,\n /\\b(?:oauth\|oidc\|auth(?:orization)?\|callback)\\b[^,\\n]\\bcode\\s[=:]\\s[^,\\s;&]+/iu,\n /\\bcode\\s[=:]\\s[^,\\s;&]+[^,\\n]\\b(?:oauth\|oidc\|auth(?:orization)?\|callback)\\b/iu,\n /\\bxpod_(?:gw\|inv)_[A-Za-z0-9._-]+/iu,\n /-----BEGIN [A-Z ]PRIVATE KEY-----/u,\n /\"d\"\\s:\\s\"[^\"]{8,}\"/u,\n /\\b(?:postgres\|postgresql\|mysql\|redis\|mongodb\|sqlite):\\/\\/[^,\\s]+/iu,\n /\\bfile:\\/\\/\\/[^\\s,;]+/iu,\n /(?:^\|\\s)\\/(?:Users\|home\|var\|tmp\|private\|etc)\\/[^\\s,;]+/iu,\n /\\b[A-Za-z]:[\\\\/][^\\s,;]+/u,\n /\\\\\\\\[^\\\\\\s,;]+\\\\[^\\\\\\s,;]+\\\\[^\\s,;]+/u,\n ].some((pattern) => pattern.test(raw));\n return containsSensitiveValue ? '[redacted]' : raw;\n}\n"]}