@vtechcom/hexcore 2.0.0-beta.1

package/dist/cli/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":";;;AACA;;GAEG;AACH,sCAAoD;AACpD,4CAA0D;AAE1D,KAAK,UAAU,IAAI;IACf,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACD,MAAM,GAAG,IAAA,mBAAU,GAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,oBAAW,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAY,EAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,IAAA,wBAAY,EAAC,MAAM,CAAC,CAAC,CAAC;IAElC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;QACjB,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC;QACtC,CAAC,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC;QACtC,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC9B,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;KACxD,EAAE,CAAC;QACA,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;IACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/cli/hexcore.js

@@ -0,0 +1,435 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * `hexcore` — the whole product as one command.
+ *
+ * The shape this exists to make possible is `npm i -g hexcore && hexcore`: one
+ * process serving the API and the UI, configured from a browser, with nothing
+ * to edit by hand. Everything it needs was already true — the web app builds to
+ * static files and `SERVE_WEB` has always been able to serve them — but the
+ * pieces were assembled by a person following a README.
+ *
+ * Two things had to change for a *global* command, and both are about `.env`
+ * being read from the current directory:
+ *
+ *  - configuration now also comes from `<home>/config.json` (see settings.ts),
+ *    so `hexcore` behaves the same wherever it is run from;
+ *  - `STATE_DIR` no longer defaults to `./.hexcore`, which would have made
+ *    `cd` somewhere else look like every head had disappeared.
+ *
+ * Commands that only touch files — init, config, reset, clean — deliberately do
+ * NOT import the Nest application. They have to work when the server cannot
+ * start, which is exactly when someone reaches for them.
+ */
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:readline/promises");
+const node_process_1 = require("node:process");
+const node_os_1 = require("node:os");
+const promises_2 = require("node:fs/promises");
+const settings_1 = require("../settings");
+/**
+ * `config.ts` is imported lazily, never at the top of this file.
+ *
+ * It snapshots `process.env` in its module body — that snapshot is what lets
+ * `hexcore config` distinguish an exported variable from a `.env` one — so
+ * importing it here would freeze the environment before `start()` has set
+ * SERVE_WEB. The symptom was precise and confusing: the server came up, served
+ * the API, and 404'd the UI it had shipped with.
+ */
+const config = () => import('../config.js');
+const c = {
+    bold: (s) => `\x1b[1m${s}\x1b[0m`,
+    dim: (s) => `\x1b[2m${s}\x1b[0m`,
+    red: (s) => `\x1b[31m${s}\x1b[0m`,
+    green: (s) => `\x1b[32m${s}\x1b[0m`,
+    yellow: (s) => `\x1b[33m${s}\x1b[0m`,
+    cyan: (s) => `\x1b[36m${s}\x1b[0m`,
+};
+const USAGE = `
+${c.bold('hexcore')} — boot and operate Hydra Heads on Cardano
+
+  ${c.cyan('hexcore')}                 start the control-plane and the web UI
+  ${c.cyan('hexcore start')}           the same, said explicitly
+  ${c.cyan('hexcore init')}            configure from the terminal instead of the browser
+  ${c.cyan('hexcore config')}          show every setting and which layer it came from
+  ${c.cyan('hexcore doctor')}          check Docker, chain access and permissions
+  ${c.cyan('hexcore reset')}           forget the configuration; heads and keys are kept
+  ${c.cyan('hexcore clean')}           delete every head and its containers; keys are kept
+  ${c.cyan('hexcore clean --all')}     delete everything, including keys
+
+${c.bold('Options')}
+  --port <n>              listen on this port          (default 4000)
+  --host <addr>           bind to this address         (default 0.0.0.0)
+  --no-web                serve the API only
+  --yes                   skip the confirmation prompt on clean
+  --version, --help
+
+${c.dim(`Configuration lives in ${(0, settings_1.settingsPath)()}, and an environment variable or a`)}
+${c.dim('.env in the current directory still wins over it. `hexcore config` says which.')}
+`;
+async function main() {
+    const argv = process.argv.slice(2);
+    const flags = new Set(argv.filter(a => a.startsWith('-')));
+    const command = argv.find(a => !a.startsWith('-')) ?? 'start';
+    if (flags.has('--help') || flags.has('-h') || command === 'help') {
+        console.log(USAGE);
+        return 0;
+    }
+    if (flags.has('--version') || flags.has('-v')) {
+        console.log(version());
+        return 0;
+    }
+    switch (command) {
+        case 'start':
+            return start(argv, flags);
+        case 'init':
+            return init();
+        case 'config':
+            return showConfig();
+        case 'doctor':
+            return doctor();
+        case 'reset':
+            return reset(flags);
+        case 'clean':
+            return clean(flags);
+        default:
+            console.error(`Unknown command "${command}".\n${USAGE}`);
+            return 1;
+    }
+}
+// ------------------------------------------------------------------- start
+async function start(argv, flags) {
+    /**
+     * Defaults applied BEFORE the app module is loaded, since config.ts reads
+     * the environment at import time. They are written only when the operator
+     * has not already said otherwise — an explicit SERVE_WEB=false must win
+     * over the CLI's preference for serving the UI.
+     */
+    if (process.env.SERVE_WEB === undefined) {
+        process.env.SERVE_WEB = flags.has('--no-web') ? 'false' : 'true';
+    }
+    const port = valueOf(argv, '--port');
+    if (port)
+        process.env.PORT = port;
+    const host = valueOf(argv, '--host');
+    if (host)
+        process.env.HOST = host;
+    const { bootstrap } = (await import('../main.js'));
+    await bootstrap();
+    // Resolve nothing: the server owns the process from here.
+    return new Promise(() => undefined);
+}
+function valueOf(argv, flag) {
+    const index = argv.indexOf(flag);
+    if (index >= 0 && argv[index + 1] && !argv[index + 1].startsWith('-'))
+        return argv[index + 1];
+    const inline = argv.find(a => a.startsWith(`${flag}=`));
+    return inline?.slice(flag.length + 1);
+}
+// -------------------------------------------------------------------- init
+/**
+ * The terminal path through setup.
+ *
+ * The browser wizard is the one most people should use — docs/PRODUCT.md names
+ * non-technical operators as a first-class audience and they should not have to
+ * answer questions in a shell. This exists for the machine with no browser
+ * pointed at it: a server, a CI job, a container build.
+ */
+async function init() {
+    console.log(`\n${c.bold('Hexcore setup')}\n${'─'.repeat(40)}\n`);
+    const rl = (0, promises_1.createInterface)({ input: node_process_1.stdin, output: node_process_1.stdout });
+    try {
+        const existing = (0, settings_1.readSettings)();
+        if (existing.setupCompletedAt) {
+            const answer = (await rl.question(`${c.yellow('Already configured.')} Reconfigure? [y/N] `)).trim();
+            if (answer.toLowerCase() !== 'y') {
+                console.log('\nLeft as it was.\n');
+                return 0;
+            }
+        }
+        const network = (await rl.question(`Cardano network — preprod, preview, mainnet ${c.dim('[preprod]')}: `))
+            .trim()
+            .toLowerCase() || 'preprod';
+        if (!['preprod', 'preview', 'mainnet'].includes(network)) {
+            console.error(c.red(`\n"${network}" is not a Cardano network.\n`));
+            return 1;
+        }
+        console.log(c.dim('\n  offline       needs nothing; the head simulates its own layer 1'));
+        console.log(c.dim('  blockfrost    needs a free API key from blockfrost.io'));
+        console.log(c.dim('  cardano-node  needs a socket from a node you already run\n'));
+        const backend = (await rl.question(`Chain backend ${c.dim('[offline]')}: `)).trim().toLowerCase() || 'offline';
+        if (!['offline', 'blockfrost', 'cardano-node'].includes(backend)) {
+            console.error(c.red(`\n"${backend}" is not a chain backend.\n`));
+            return 1;
+        }
+        const env = {
+            CARDANO_NETWORK: network,
+            CHAIN_BACKEND: backend,
+        };
+        if (backend === 'blockfrost') {
+            const key = (await rl.question(`Blockfrost project id ${c.dim(`(starts with "${network}")`)}: `)).trim();
+            // Checked here rather than left to the server: a mismatched key
+            // does not fail loudly, it produces a head that never observes its
+            // own init transaction.
+            if (!key.startsWith(network)) {
+                console.error(c.red(`\nThat key is not for ${network} — it must start with "${network}".\n`));
+                return 1;
+            }
+            env.BLOCKFROST_PROJECT_ID = key;
+        }
+        if (backend === 'cardano-node') {
+            const socket = (await rl.question('Path to the cardano-node socket: ')).trim();
+            if (!socket) {
+                console.error(c.red('\nThe cardano-node backend needs a socket path.\n'));
+                return 1;
+            }
+            env.CARDANO_NODE_SOCKET = socket;
+        }
+        const username = (await rl.question(`Admin username ${c.dim('[admin]')}: `)).trim() || 'admin';
+        env.ADMIN_USERNAME = username;
+        const password = (await rl.question(`Admin password ${c.dim('[generate one]')}: `)).trim();
+        (0, settings_1.writeSettings)({ version: 1, setupCompletedAt: new Date().toISOString(), env });
+        if (password) {
+            // Imported lazily: this pulls in the Nest decorators, and every
+            // other path through init has no use for them.
+            const { hashPassword } = await import('../auth.js');
+            await writeAdminSecret(username, hashPassword(password));
+        }
+        console.log(`\n${c.green('✔')} Wrote ${(0, settings_1.settingsPath)()}`);
+        console.log(`\n${c.bold('Next:')}  ${c.cyan('hexcore')}\n`);
+        if (!password)
+            console.log(c.dim('A password will be generated and printed once on first start.\n'));
+        return 0;
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Write the admin hash into secrets.json without booting the app.
+ *
+ * Deliberately merges rather than overwrites: the file also holds the JWT
+ * secret, and replacing it would sign every existing session out — including,
+ * on a reconfigure, the operator running this.
+ */
+async function writeAdminSecret(username, passwordHash) {
+    const { mkdirSync, readFileSync, writeFileSync } = await import('node:fs');
+    const { dirname } = await import('node:path');
+    const { loadConfig } = await config();
+    const path = loadConfig().secretsPath;
+    let secrets = {};
+    if ((0, node_fs_1.existsSync)(path)) {
+        try {
+            secrets = JSON.parse(readFileSync(path, 'utf8'));
+        }
+        catch {
+            secrets = {};
+        }
+    }
+    if (!secrets.jwtSecret) {
+        const { randomBytes } = await import('node:crypto');
+        secrets.jwtSecret = randomBytes(32).toString('hex');
+    }
+    secrets.adminUsername = username;
+    secrets.adminPasswordHash = passwordHash;
+    delete secrets.generatedPassword;
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(secrets, null, 2), { encoding: 'utf8', mode: 0o600 });
+}
+// ------------------------------------------------------------------ config
+/**
+ * Every setting and the layer it came from.
+ *
+ * The failure mode of layered configuration is not a wrong value, it is a value
+ * nobody can explain — "I set that in config.json and it is not taking effect"
+ * has exactly one useful answer, which is "an environment variable is shadowing
+ * it". This prints that answer.
+ */
+async function showConfig() {
+    const { describeProvenance, loadConfig, ConfigError } = await config();
+    let resolved;
+    try {
+        resolved = loadConfig();
+    }
+    catch (err) {
+        if (err instanceof ConfigError) {
+            console.error(`\n${c.red(err.message)}\n`);
+            return 1;
+        }
+        throw err;
+    }
+    console.log(`\n${c.bold('Where things are')}`);
+    console.log(`  ${'home'.padEnd(16)} ${(0, settings_1.hexcoreHome)()}`);
+    console.log(`  ${'settings'.padEnd(16)} ${(0, node_fs_1.existsSync)((0, settings_1.settingsPath)()) ? (0, settings_1.settingsPath)() : c.dim('(none yet)')}`);
+    console.log(`  ${'state'.padEnd(16)} ${resolved.stateDir}`);
+    console.log(`  ${'database'.padEnd(16)} ${resolved.dbPath}`);
+    console.log(`\n${c.bold('Settings')}  ${c.dim('value  ← where it came from')}`);
+    for (const entry of describeProvenance()) {
+        // A credential's value is never printed, here or over the API. Whether
+        // one is set is the useful part and is not a secret.
+        const plain = entry.secret ? (entry.value ? '(set)' : '(not set)') : (entry.value ?? '—');
+        // Padded before colouring: escape codes are characters to padEnd and
+        // nothing to a terminal, so colouring first shreds the column.
+        const padded = plain.padEnd(46);
+        const shown = entry.secret || entry.value === null ? c.dim(padded) : padded;
+        const source = entry.source === 'default' ? c.dim(entry.source) : c.cyan(entry.source);
+        console.log(`  ${entry.key.padEnd(24)} ${shown} ← ${source}`);
+    }
+    console.log(`\n${c.dim('environment > .env in this directory > settings file > built-in default')}\n`);
+    return 0;
+}
+// ------------------------------------------------------------------ doctor
+async function doctor() {
+    const { formatReport, runPreflight } = await import('../preflight.js');
+    const { loadConfig, ConfigError } = await config();
+    let resolved;
+    try {
+        resolved = loadConfig();
+    }
+    catch (err) {
+        if (err instanceof ConfigError) {
+            console.error(`\n${c.red(err.message)}\n`);
+            return 1;
+        }
+        throw err;
+    }
+    const report = await runPreflight(resolved);
+    console.log(formatReport(report));
+    return report.some((r) => r.status === 'fail' && r.fatal) ? 1 : 0;
+}
+// ------------------------------------------------------------- reset/clean
+async function reset(flags) {
+    if (!flags.has('--yes')) {
+        const ok = await confirm(`This forgets the configuration in ${(0, settings_1.settingsPath)()}.\n` +
+            `Heads, keys and persistence are ${c.bold('kept')}. Continue?`);
+        if (!ok)
+            return 1;
+    }
+    (0, settings_1.clearSettings)();
+    console.log(`\n${c.green('✔')} Configuration cleared. Run ${c.cyan('hexcore')} to set it up again.\n`);
+    return 0;
+}
+/**
+ * Delete heads, and optionally everything.
+ *
+ * The two scopes are far apart on purpose. Without `--all` this removes
+ * containers and head state and leaves the key material alone, which is the
+ * "my test heads are a mess" case. With it, the Cardano signing keys go too —
+ * and those control addresses that may hold funds and exist nowhere else, so no
+ * amount of care afterwards gets them back.
+ */
+async function clean(flags) {
+    const all = flags.has('--all');
+    const { loadConfig } = await config();
+    const resolved = loadConfig();
+    const home = (0, settings_1.hexcoreHome)();
+    if (!flags.has('--yes')) {
+        const what = all
+            ? `${c.red('EVERYTHING')}:\n` +
+                `  • every head and its containers\n` +
+                `  • ${c.red('the Cardano signing keys')} — any address holding funds becomes unreachable\n` +
+                `  • ${resolved.stateDir}\n` +
+                `  • ${home}`
+            : `every head, its containers and its persistence.\n` +
+                `  Keys are ${c.bold('kept')}, so funded addresses survive.`;
+        console.log(`\nThis deletes ${what}\n`);
+        const ok = await confirm(all ? `Type the machine name (${c.bold((0, node_os_1.hostname)())}) to confirm` : 'Continue?', {
+            phrase: all ? (0, node_os_1.hostname)() : undefined,
+        });
+        if (!ok)
+            return 1;
+    }
+    const removed = await removeManagedContainers();
+    console.log(`  removed ${removed} container(s)`);
+    if (all) {
+        await (0, promises_2.rm)(resolved.stateDir, { recursive: true, force: true });
+        await (0, promises_2.rm)(home, { recursive: true, force: true });
+        console.log(`\n${c.green('✔')} Hexcore is gone. Run ${c.cyan('hexcore')} to start over.\n`);
+        return 0;
+    }
+    // Heads live in the database and under the state dir; the keys sit beside
+    // them, so the two are removed separately rather than by dropping the root.
+    const { rmSync } = await import('node:fs');
+    rmSync(resolved.headsDir, { recursive: true, force: true });
+    rmSync(resolved.dbPath, { force: true });
+    rmSync(`${resolved.dbPath}-wal`, { force: true });
+    rmSync(`${resolved.dbPath}-shm`, { force: true });
+    console.log(`\n${c.green('✔')} Heads cleared. Settings and the admin login are unchanged.\n`);
+    return 0;
+}
+/**
+ * Remove the containers belonging to THIS installation.
+ *
+ * By label rather than by database row, because the point of `clean` is to
+ * recover from a state where the two disagree — a container whose row is
+ * already gone is exactly what gets left behind otherwise.
+ *
+ * But by `LABEL_INSTALL` and not just `LABEL_MANAGED`. More than one Hexcore on
+ * a machine is normal: a checkout being worked on and a globally installed
+ * `hexcore` share one Docker daemon, and `LABEL_MANAGED` is true of both. This
+ * function once matched on that alone, and a `clean` in a throwaway
+ * installation removed the running containers of a head in a different one.
+ *
+ * The consequence of the narrower filter is that containers created before this
+ * label existed are not matched, and `clean` leaves them alone. That is the
+ * right direction to be wrong in: they are removable by name or by the head's
+ * own Delete, and no amount of convenience is worth reaching into an
+ * installation the operator did not name.
+ */
+async function removeManagedContainers() {
+    try {
+        const { default: Docker } = await import('dockerode');
+        const { LABEL_INSTALL, LABEL_MANAGED } = await import('@hexcore/shared');
+        const { loadConfig } = await config();
+        const { installId } = await import('../settings.js');
+        const resolved = loadConfig();
+        const docker = new Docker({ socketPath: resolved.dockerSocket });
+        const containers = await docker.listContainers({
+            all: true,
+            filters: { label: [`${LABEL_MANAGED}=true`, `${LABEL_INSTALL}=${installId(resolved.stateDir)}`] },
+        });
+        for (const info of containers) {
+            await docker.getContainer(info.Id).remove({ force: true });
+        }
+        return containers.length;
+    }
+    catch (err) {
+        // Docker being unreachable must not stop the file-system half of the
+        // wipe; say so and carry on.
+        console.log(c.yellow(`  could not reach Docker (${err.message}) — containers left alone`));
+        return 0;
+    }
+}
+async function confirm(question, options = {}) {
+    const rl = (0, promises_1.createInterface)({ input: node_process_1.stdin, output: node_process_1.stdout });
+    try {
+        const answer = (await rl.question(`${question} ${options.phrase ? '' : '[y/N] '}`)).trim();
+        if (options.phrase) {
+            if (answer === options.phrase)
+                return true;
+            console.log(c.yellow('\nThat did not match. Nothing was deleted.\n'));
+            return false;
+        }
+        if (answer.toLowerCase() === 'y')
+            return true;
+        console.log(c.yellow('\nCancelled. Nothing was deleted.\n'));
+        return false;
+    }
+    finally {
+        rl.close();
+    }
+}
+function version() {
+    // Shared with the health payload and the Swagger document, so `hexcore
+    // --version` and what the server reports can never disagree.
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require('../version.js').VERSION;
+}
+main()
+    .then(code => process.exit(code))
+    .catch((err) => {
+    console.error(c.red(`\n${err.message}\n`));
+    process.exit(1);
+});
+//# sourceMappingURL=hexcore.js.map

package/dist/cli/hexcore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hexcore.js","sourceRoot":"","sources":["../../src/cli/hexcore.ts"],"names":[],"mappings":";;;AACA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAqC;AACrC,qDAAyD;AACzD,+CAA6C;AAC7C,qCAAmC;AACnC,+CAAsC;AACtC,0CAAoG;AAGpG;;;;;;;;GAQG;AACH,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAE5C,MAAM,CAAC,GAAG;IACN,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;IACzC,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;IACxC,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS;IACzC,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS;IAC3C,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS;IAC5C,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS;CAC7C,CAAC;AAEF,MAAM,KAAK,GAAG;EACZ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;;IAEf,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACjB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;;EAE/B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;;;;;;;EAOjB,CAAC,CAAC,GAAG,CAAC,0BAA0B,IAAA,uBAAY,GAAE,oCAAoC,CAAC;EACnF,CAAC,CAAC,GAAG,CAAC,gFAAgF,CAAC;CACxF,CAAC;AAEF,KAAK,UAAU,IAAI;IACf,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;IAE9D,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC;IACb,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QACd,KAAK,OAAO;YACR,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,KAAK,MAAM;YACP,OAAO,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ;YACT,OAAO,UAAU,EAAE,CAAC;QACxB,KAAK,QAAQ;YACT,OAAO,MAAM,EAAE,CAAC;QACpB,KAAK,OAAO;YACR,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,OAAO;YACR,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB;YACI,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,CAAC;IACjB,CAAC;AACL,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,KAAK,CAAC,IAAc,EAAE,KAAkB;IACnD;;;;;OAKG;IACH,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAElC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAuC,CAAC;IACzF,MAAM,SAAS,EAAE,CAAC;IAClB,0DAA0D;IAC1D,OAAO,IAAI,OAAO,CAAS,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAE5E;;;;;;;GAOG;AACH,KAAK,UAAU,IAAI;IACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,IAAA,0BAAe,EAAC,EAAE,KAAK,EAAE,oBAAK,EAAE,MAAM,EAAE,qBAAM,EAAE,CAAC,CAAC;IAE7D,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,uBAAY,GAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpG,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBACnC,OAAO,CAAC,CAAC;YACb,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GACT,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;aACrF,IAAI,EAAE;aACN,WAAW,EAAE,IAAI,SAAS,CAAC;QACpC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,OAAO,+BAA+B,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACb,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;QAC/G,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,OAAO,6BAA6B,CAAC,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC;QACb,CAAC;QAED,MAAM,GAAG,GAAyC;YAC9C,eAAe,EAAE,OAAO;YACxB,aAAa,EAAE,OAAO;SACzB,CAAC;QAEF,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,iBAAiB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzG,gEAAgE;YAChE,mEAAmE;YACnE,wBAAwB;YACxB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,OAAO,0BAA0B,OAAO,MAAM,CAAC,CAAC,CAAC;gBAC9F,OAAO,CAAC,CAAC;YACb,CAAC;YACD,GAAG,CAAC,qBAAqB,GAAG,GAAG,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBAC1E,OAAO,CAAC,CAAC;YACb,CAAC;YACD,GAAG,CAAC,mBAAmB,GAAG,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC;QAC/F,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC9B,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3F,IAAA,wBAAa,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAE/E,IAAI,QAAQ,EAAE,CAAC;YACX,gEAAgE;YAChE,+CAA+C;YAC/C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,IAAA,uBAAY,GAAE,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;QACrG,OAAO,CAAC,CAAC;IACb,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,YAAoB;IAClE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC,WAAW,CAAC;IAEtC,IAAI,OAAO,GAA4B,EAAE,CAAC;IAC1C,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,GAAG,EAAE,CAAC;QACjB,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACpD,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;IACjC,OAAO,CAAC,iBAAiB,GAAG,YAAY,CAAC;IACzC,OAAO,OAAO,CAAC,iBAAiB,CAAC;IAEjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,4EAA4E;AAE5E;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU;IACrB,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IACvE,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACD,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC;QACb,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAA,sBAAW,GAAE,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAA,oBAAU,EAAC,IAAA,uBAAY,GAAE,CAAC,CAAC,CAAC,CAAC,IAAA,uBAAY,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/G,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IAChF,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACvC,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QAC1F,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,yEAAyE,CAAC,IAAI,CAAC,CAAC;IACvG,OAAO,CAAC,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,MAAM;IACjB,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACvE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IACnD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACD,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC;QACb,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAsC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,KAAK,CAAC,KAAkB;IACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,OAAO,CACpB,qCAAqC,IAAA,uBAAY,GAAE,KAAK;YACpD,mCAAmC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CACrE,CAAC;QACF,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,IAAA,wBAAa,GAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACvG,OAAO,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,KAAK,CAAC,KAAkB;IACnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAA,sBAAW,GAAE,CAAC;IAE3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG;YACZ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK;gBAC3B,qCAAqC;gBACrC,OAAO,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,oDAAoD;gBAC5F,OAAO,QAAQ,CAAC,QAAQ,IAAI;gBAC5B,OAAO,IAAI,EAAE;YACf,CAAC,CAAC,mDAAmD;gBACnD,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,IAAA,kBAAQ,GAAE,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE;YACrG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAA,kBAAQ,GAAE,CAAC,CAAC,CAAC,SAAS;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,eAAe,CAAC,CAAC;IAEjD,IAAI,GAAG,EAAE,CAAC;QACN,MAAM,IAAA,aAAE,EAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAA,aAAE,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC5F,OAAO,CAAC,CAAC;IACb,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC9F,OAAO,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,uBAAuB;IAClC,IAAI,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;YAC3C,GAAG,EAAE,IAAI;YACT,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,aAAa,OAAO,EAAE,GAAG,aAAa,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;SACpG,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,qEAAqE;QACrE,6BAA6B;QAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,6BAA8B,GAAa,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,UAA+B,EAAE;IACtE,MAAM,EAAE,GAAG,IAAA,0BAAe,EAAC,EAAE,KAAK,EAAE,oBAAK,EAAE,MAAM,EAAE,qBAAM,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACtE,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACjB,CAAC;YAAS,CAAC;QACP,EAAE,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACL,CAAC;AAED,SAAS,OAAO;IACZ,uEAAuE;IACvE,6DAA6D;IAC7D,8DAA8D;IAC9D,OAAQ,OAAO,CAAC,eAAe,CAAyB,CAAC,OAAO,CAAC;AACrE,CAAC;AAED,IAAI,EAAE;KACD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAChC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/common/auth.guard.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthGuard = exports.Public = exports.IS_PUBLIC = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const common_2 = require("@nestjs/common");
+const config_module_1 = require("../config.module");
+const auth_1 = require("../auth");
+exports.IS_PUBLIC = 'isPublic';
+/** Mark a route as reachable without a bearer token. */
+const Public = () => (0, common_2.SetMetadata)(exports.IS_PUBLIC, true);
+exports.Public = Public;
+/**
+ * Global guard: everything requires a bearer token unless marked @Public().
+ * Defaulting to "protected" is the inverse of v1, where each controller had to
+ * remember @UseGuards(AdminAuthGuard) and a few endpoints silently did not.
+ */
+let AuthGuard = class AuthGuard {
+    reflector;
+    auth;
+    config;
+    constructor(reflector, auth, config) {
+        this.reflector = reflector;
+        this.auth = auth;
+        this.config = config;
+    }
+    canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(exports.IS_PUBLIC, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic || !this.config.authEnabled)
+            return true;
+        const req = context.switchToHttp().getRequest();
+        const header = req.headers.authorization;
+        const token = header?.startsWith('Bearer ') ? header.slice(7) : null;
+        if (!token)
+            throw new common_1.UnauthorizedException({ code: 'UNAUTHORIZED', message: 'Missing bearer token' });
+        const payload = this.auth.verify(token);
+        if (!payload) {
+            throw new common_1.UnauthorizedException({ code: 'UNAUTHORIZED', message: 'Invalid or expired token' });
+        }
+        req.user = payload;
+        return true;
+    }
+};
+exports.AuthGuard = AuthGuard;
+exports.AuthGuard = AuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(config_module_1.APP_CONFIG)),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        auth_1.AuthService, Object])
+], AuthGuard);
+//# sourceMappingURL=auth.guard.js.map

package/dist/common/auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../src/common/auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0G;AAC1G,uCAAyC;AACzC,2CAA6C;AAE7C,oDAA8C;AAE9C,kCAAsC;AAEzB,QAAA,SAAS,GAAG,UAAU,CAAC;AAEpC,wDAAwD;AACjD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,iBAAS,EAAE,IAAI,CAAC,CAAC;AAA5C,QAAA,MAAM,UAAsC;AAEzD;;;;GAIG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACoB;IAHzC,YACqB,SAAoB,EACpB,IAAiB,EACG,MAAiB;QAFrC,cAAS,GAAT,SAAS,CAAW;QACpB,SAAI,GAAJ,IAAI,CAAa;QACG,WAAM,GAAN,MAAM,CAAW;IACvD,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,iBAAS,EAAE;YAClE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAEtD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAkB,CAAC;QAChE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAEvG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAEA,GAA2C,CAAC,IAAI,GAAG,OAAO,CAAC;QAC5D,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA3BY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;IAKJ,WAAA,IAAA,eAAM,EAAC,0BAAU,CAAC,CAAA;qCAFS,gBAAS;QACd,kBAAW;GAH7B,SAAS,CA2BrB"}