botmux 3.10.0 → 3.23.1

package/dist/dashboard/aggregator.d.ts

@@ -1,59 +0,0 @@
-import type { DaemonInfo } from './registry.js';
-import type { DashboardEvent } from '../core/dashboard-events.js';
-type Row = {
-    sessionId: string;
-    larkAppId: string;
-    [k: string]: unknown;
-};
-type Sched = {
-    id: string;
-    [k: string]: unknown;
-};
-/**
- * Aggregates session and schedule state across all online daemons.
- * Pure state machine — no I/O. The dashboard process feeds it events from
- * each daemon's SSE stream (via subscribeDaemon below) and from initial
- * hydration calls (via GET /api/sessions /api/schedules).
- */
-export declare class Aggregator {
-    private sessions;
-    private schedules;
-    private listeners;
-    applyEvent(larkAppId: string, ev: DashboardEvent): void;
-    /** Bulk-load on dashboard start before SSE catches up. Idempotent. */
-    hydrateSessions(larkAppId: string, rows: Row[]): void;
-    hydrateSchedules(rows: Sched[]): void;
-    getSessions(): Row[];
-    getSession(sessionId: string): Row | undefined;
-    getSchedules(): Sched[];
-    /** sessionId → owning daemon's larkAppId (used for write routing). */
-    ownerOf(sessionId: string): string | undefined;
-    /** sessionId → owning bot daemon's terminal reverse-proxy port. Used by the
-     *  dashboard `/s/*` bridge to route a terminal request to the right daemon's
-     *  proxy (each bot daemon runs its own terminal proxy on proxyBasePort+idx).
-     *  undefined when the session is unknown or its daemon's proxy isn't up. */
-    terminalProxyPortOf(sessionId: string): number | undefined;
-    /** Whether a session row with this id exists at all in the aggregator,
-     *  regardless of `larkAppId` presence. Mirrors `scheduleExists`; lets
-     *  the Route B write gate tell apart "legacy row with no owner" from
-     *  "unknown id" so the close/resume/locate handler can route legacy rows
-     *  to the caller's bot instead of 404'ing them. */
-    sessionExists(sessionId: string): boolean;
-    scheduleOwnerOf(id: string): string | undefined;
-    /** Whether a schedule row with this id exists at all in the aggregator,
-     *  regardless of `larkAppId` presence. Used by the Route B write gate to
-     *  distinguish a "legacy row with no owner" from a genuinely "unknown id"
-     *  — the former should still proxy somewhere (the caller's bot), the
-     *  latter is a 404 (codex 2026-06-10 schedules slice 2a blocker). */
-    scheduleExists(id: string): boolean;
-    on(fn: (e: DashboardEvent & {
-        larkAppId: string;
-    }) => void): () => void;
-}
-/**
- * Subscribe to one daemon's SSE stream and feed events into the aggregator.
- * Auto-reconnects on error with 1s backoff. Returns an abort function.
- */
-export declare function subscribeDaemon(d: DaemonInfo, agg: Aggregator, onError: (e: Error) => void, fetchImpl?: typeof fetch): () => void;
-export {};
-//# sourceMappingURL=aggregator.d.ts.map

package/dist/dashboard/aggregator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../src/dashboard/aggregator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,KAAK,GAAG,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAC1E,KAAK,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAelD;;;;;GAKG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,SAAS,CAAkE;IAEnF,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,IAAI;IAiDvD,sEAAsE;IACtE,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;IAKrD,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI;IAIrC,WAAW,IAAI,GAAG,EAAE;IACpB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS;IAC9C,YAAY,IAAI,KAAK,EAAE;IAEvB,sEAAsE;IACtE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI9C;;;gFAG4E;IAC5E,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI1D;;;;uDAImD;IACnD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAGzC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI/C;;;;yEAIqE;IACrE,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAInC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,MAAM,IAAI;CAIxE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,CAAC,EAAE,UAAU,EACb,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,MAAM,IAAI,CA6CZ"}

package/dist/dashboard/aggregator.js

@@ -1,176 +0,0 @@
-const SESSION_PRESENTATION_FIELDS = ['botAvatarUrl', 'repoName', 'gitBranch'];
-function mergeSpawnedRow(current, incoming, larkAppId) {
-    const next = { ...incoming, larkAppId };
-    if (current && current.workingDir === next.workingDir) {
-        for (const field of SESSION_PRESENTATION_FIELDS) {
-            if (next[field] === undefined && current[field] !== undefined) {
-                next[field] = current[field];
-            }
-        }
-    }
-    return next;
-}
-/**
- * Aggregates session and schedule state across all online daemons.
- * Pure state machine — no I/O. The dashboard process feeds it events from
- * each daemon's SSE stream (via subscribeDaemon below) and from initial
- * hydration calls (via GET /api/sessions /api/schedules).
- */
-export class Aggregator {
-    sessions = new Map();
-    schedules = new Map();
-    listeners = new Set();
-    applyEvent(larkAppId, ev) {
-        let emitted = ev;
-        switch (ev.type) {
-            case 'session.spawned': {
-                const r = ev.body.session;
-                const next = mergeSpawnedRow(this.sessions.get(r.sessionId), r, larkAppId);
-                this.sessions.set(r.sessionId, next);
-                emitted = { ...ev, body: { session: next } };
-                break;
-            }
-            case 'session.update': {
-                const cur = this.sessions.get(ev.body.sessionId);
-                if (cur) {
-                    const patch = { ...ev.body.patch };
-                    if (Object.prototype.hasOwnProperty.call(patch, 'workingDir')
-                        && patch.workingDir !== cur.workingDir) {
-                        patch.repoName = null;
-                        patch.gitBranch = null;
-                    }
-                    this.sessions.set(ev.body.sessionId, { ...cur, ...patch });
-                    emitted = { ...ev, body: { ...ev.body, patch } };
-                }
-                break;
-            }
-            case 'session.exited': {
-                const cur = this.sessions.get(ev.body.sessionId);
-                if (cur)
-                    this.sessions.set(ev.body.sessionId, { ...cur, status: 'closed' });
-                break;
-            }
-            case 'schedule.created':
-                this.schedules.set(ev.body.schedule.id, ev.body.schedule);
-                break;
-            case 'schedule.updated': {
-                const cur = this.schedules.get(ev.body.id);
-                if (cur)
-                    this.schedules.set(ev.body.id, { ...cur, ...ev.body.patch });
-                break;
-            }
-            case 'schedule.deleted':
-                this.schedules.delete(ev.body.id);
-                break;
-            // schedule.fired and heartbeat are pass-through (no cache mutation)
-        }
-        for (const fn of this.listeners) {
-            try {
-                fn({ ...emitted, larkAppId });
-            }
-            catch { /* swallow */ }
-        }
-    }
-    /** Bulk-load on dashboard start before SSE catches up. Idempotent. */
-    hydrateSessions(larkAppId, rows) {
-        for (const r of rows) {
-            this.sessions.set(r.sessionId, mergeSpawnedRow(this.sessions.get(r.sessionId), r, larkAppId));
-        }
-    }
-    hydrateSchedules(rows) {
-        for (const r of rows)
-            this.schedules.set(r.id, r);
-    }
-    getSessions() { return [...this.sessions.values()]; }
-    getSession(sessionId) { return this.sessions.get(sessionId); }
-    getSchedules() { return [...this.schedules.values()]; }
-    /** sessionId → owning daemon's larkAppId (used for write routing). */
-    ownerOf(sessionId) {
-        return this.sessions.get(sessionId)?.larkAppId;
-    }
-    /** sessionId → owning bot daemon's terminal reverse-proxy port. Used by the
-     *  dashboard `/s/*` bridge to route a terminal request to the right daemon's
-     *  proxy (each bot daemon runs its own terminal proxy on proxyBasePort+idx).
-     *  undefined when the session is unknown or its daemon's proxy isn't up. */
-    terminalProxyPortOf(sessionId) {
-        return this.sessions.get(sessionId)?.proxyPort;
-    }
-    /** Whether a session row with this id exists at all in the aggregator,
-     *  regardless of `larkAppId` presence. Mirrors `scheduleExists`; lets
-     *  the Route B write gate tell apart "legacy row with no owner" from
-     *  "unknown id" so the close/resume/locate handler can route legacy rows
-     *  to the caller's bot instead of 404'ing them. */
-    sessionExists(sessionId) {
-        return this.sessions.has(sessionId);
-    }
-    scheduleOwnerOf(id) {
-        return this.schedules.get(id)?.larkAppId;
-    }
-    /** Whether a schedule row with this id exists at all in the aggregator,
-     *  regardless of `larkAppId` presence. Used by the Route B write gate to
-     *  distinguish a "legacy row with no owner" from a genuinely "unknown id"
-     *  — the former should still proxy somewhere (the caller's bot), the
-     *  latter is a 404 (codex 2026-06-10 schedules slice 2a blocker). */
-    scheduleExists(id) {
-        return this.schedules.has(id);
-    }
-    on(fn) {
-        this.listeners.add(fn);
-        return () => this.listeners.delete(fn);
-    }
-}
-/**
- * Subscribe to one daemon's SSE stream and feed events into the aggregator.
- * Auto-reconnects on error with 1s backoff. Returns an abort function.
- */
-export function subscribeDaemon(d, agg, onError, fetchImpl = fetch) {
-    const ctrl = new AbortController();
-    const url = `http://127.0.0.1:${d.ipcPort}/api/events`;
-    (async () => {
-        while (!ctrl.signal.aborted) {
-            try {
-                const res = await fetchImpl(url, { signal: ctrl.signal });
-                if (!res.ok || !res.body)
-                    throw new Error(`bad status ${res.status}`);
-                const reader = res.body.getReader();
-                const dec = new TextDecoder();
-                let buf = '';
-                let evt = '';
-                for (;;) {
-                    const { value, done } = await reader.read();
-                    if (done)
-                        break;
-                    buf += dec.decode(value, { stream: true });
-                    let nl;
-                    while ((nl = buf.indexOf('\n')) >= 0) {
-                        const line = buf.slice(0, nl);
-                        buf = buf.slice(nl + 1);
-                        if (line.startsWith('event:'))
-                            evt = line.slice(6).trim();
-                        else if (line.startsWith('data:') && evt) {
-                            const data = line.slice(5).trim();
-                            try {
-                                const body = JSON.parse(data);
-                                if (evt === 'session.spawned' && d.botAvatarUrl && body?.session) {
-                                    body.session = { ...body.session, botAvatarUrl: d.botAvatarUrl };
-                                }
-                                agg.applyEvent(d.larkAppId, { type: evt, body });
-                            }
-                            catch {
-                                // Skip malformed frame
-                            }
-                            evt = '';
-                        }
-                    }
-                }
-            }
-            catch (e) {
-                if (!ctrl.signal.aborted)
-                    onError(e);
-                await new Promise(r => setTimeout(r, 1_000));
-            }
-        }
-    })();
-    return () => ctrl.abort();
-}
-//# sourceMappingURL=aggregator.js.map

package/dist/dashboard/aggregator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"aggregator.js","sourceRoot":"","sources":["../../src/dashboard/aggregator.ts"],"names":[],"mappings":"AAMA,MAAM,2BAA2B,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;AAEvF,SAAS,eAAe,CAAC,OAAwB,EAAE,QAAa,EAAE,SAAiB;IACjF,MAAM,IAAI,GAAQ,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7C,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,2BAA2B,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IACb,QAAQ,GAAG,IAAI,GAAG,EAAe,CAAC;IAClC,SAAS,GAAG,IAAI,GAAG,EAAiB,CAAC;IACrC,SAAS,GAAG,IAAI,GAAG,EAAuD,CAAC;IAEnF,UAAU,CAAC,SAAiB,EAAE,EAAkB;QAC9C,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAc,CAAC;gBACjC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACrC,OAAO,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7C,MAAM;YACR,CAAC;YACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACnC,IACE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC;2BACtD,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,EACtC,CAAC;wBACD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;wBACtB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;oBACzB,CAAC;oBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;oBAC3D,OAAO,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,GAAG;oBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5E,MAAM;YACR,CAAC;YACD,KAAK,kBAAkB;gBACrB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAE,EAAE,CAAC,IAAI,CAAC,QAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,QAAiB,CAAC,CAAC;gBAC9E,MAAM;YACR,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG;oBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,MAAM;YACR,CAAC;YACD,KAAK,kBAAkB;gBACrB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClC,MAAM;YACR,oEAAoE;QACtE,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBAAC,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,eAAe,CAAC,SAAiB,EAAE,IAAW;QAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,IAAa;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,WAAW,KAAY,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,UAAU,CAAC,SAAiB,IAAqB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvF,YAAY,KAAc,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhE,sEAAsE;IACtE,OAAO,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IACjD,CAAC;IAED;;;gFAG4E;IAC5E,mBAAmB,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,SAA+B,CAAC;IACvE,CAAC;IAED;;;;uDAImD;IACnD,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IACD,eAAe,CAAC,EAAU;QACxB,OAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAwC,EAAE,SAAS,CAAC;IACnF,CAAC;IAED;;;;yEAIqE;IACrE,cAAc,CAAC,EAAU;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,EAAE,CAAC,EAAuD;QACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,CAAa,EACb,GAAe,EACf,OAA2B,EAC3B,YAA0B,KAAK;IAE/B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,OAAO,aAAa,CAAC;IAEvD,CAAC,KAAK,IAAI,EAAE;QACV,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC;oBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAChB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3C,IAAI,EAAU,CAAC;oBACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;wBACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC9B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;wBACxB,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;4BAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;6BACrD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;4BACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;4BAClC,IAAI,CAAC;gCACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gCAC9B,IAAI,GAAG,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;oCACjE,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;gCACnE,CAAC;gCACD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAS,CAAC,CAAC;4BAC1D,CAAC;4BAAC,MAAM,CAAC;gCACP,uBAAuB;4BACzB,CAAC;4BACD,GAAG,GAAG,EAAE,CAAC;wBACX,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,CAAC,CAAU,CAAC,CAAC;gBAC9C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/dashboard/auth.d.ts

@@ -1,106 +0,0 @@
-export interface HmacAttempt {
-    ts: string;
-    nonce: string;
-    sig: string;
-}
-/**
- * Canonical "binding" string mixed into the signed payload so a captured HMAC
- * header can't be replayed against a different route or port. Without it, a
- * single set of `X-Botmux-Cli-*` headers signed only over `ts:nonce` is valid
- * for ANY `/__cli/*` route on ANY dashboard — which lets a malicious local
- * server, handed a discovery probe, forward the headers to the real dashboard
- * (e.g. a `/__cli/current` probe relayed to `/__cli/rotate` to mint a token).
- * Binding `method + path + bound-port` makes the credential single-purpose:
- *  - the verifier uses the port IT actually bound (not the attacker-controlled
- *    Host header), so a forward from port X to the dashboard on port Y mismatches;
- *  - a `/__cli/current` capture can't be replayed to `/__cli/rotate` (path differs).
- */
-export declare function cliAuthBind(method: string, path: string, port: number | string): string;
-/** Mint the three `X-Botmux-Cli-*` header values for a loopback request.
- *  Pass the same `bind` (see {@link cliAuthBind}) the verifier will reconstruct;
- *  omit it only for the legacy daemon-IPC scheme that signs bare `ts:nonce`. */
-export declare function signCliAuth(secretB64Url: string, bind?: string): HmacAttempt;
-/**
- * Verify a CLI rotation HMAC attempt.
- * - Source IP must be loopback (127.0.0.1 / ::1 / IPv4-mapped form).
- * - Timestamp must be within ±TS_WINDOW_S seconds of now.
- * - Nonce must not have been seen in the last NONCE_TTL_MS.
- * - HMAC-SHA256(secret, `${ts}:${nonce}` [+ `:${bind}`]) must match `sig`
- *   (timing-safe). Pass `bind` (method+path+port) to scope the credential to a
- *   single route/port; omit it for the legacy bare daemon-IPC scheme.
- */
-export declare function verifyHmac(secretB64Url: string, attempt: HmacAttempt, remoteAddr: string, bind?: string): {
-    ok: boolean;
-    reason?: string;
-};
-/** 32 random bytes base64url-encoded (43 characters, no padding). */
-export declare function generateToken(): string;
-/**
- * Load a dashboard HMAC secret from disk. Empty / whitespace-only files are
- * treated as missing so callers never sign requests with an empty key.
- */
-export declare function loadDashboardSecret(secretPath: string): string | null;
-/** Load the dashboard HMAC secret, creating a fresh 0600 secret when absent. */
-export declare function loadOrCreateDashboardSecret(secretPath: string): string;
-/**
- * Load the persisted active dashboard token from `tokenPath`, or `null` when
- * the file is absent / empty / unreadable.
- *
- * Persisting the active token lets a previously-issued dashboard URL survive a
- * `botmux restart`: on startup the dashboard hydrates `activeToken` from this
- * file instead of starting blank.  Only `botmux dashboard` rotates the token
- * (via `persistToken` with a fresh value), which is what invalidates the old
- * link.
- */
-export declare function loadPersistedToken(tokenPath: string): string | null;
-/** Persist the active dashboard token to `tokenPath` with 0600 perms. */
-export declare function persistToken(tokenPath: string, token: string): void;
-/** Load the active token, creating and persisting the first one when absent. */
-export declare function loadOrCreatePersistedToken(tokenPath: string): string;
-/** Extract `botmux_dashboard_token` value from a Cookie header. */
-export declare function parseCookie(header: string | undefined): string | undefined;
-/** Build the `Set-Cookie` header value for a fresh dashboard token. */
-export declare function buildSetCookie(token: string): string;
-/**
- * The dashboard splits incoming requests into three categories before the
- * route handlers run:
- *
- *   - `allow`            — request can proceed (auth succeeded OR endpoint
- *                          is public)
- *   - `allow+set-cookie` — `?t=<correct-token>` query: the cookie is set
- *                          and we redirect to a clean URL.  This is the
- *                          only branch that mints a Set-Cookie header.
- *   - `deny401`          — endpoint requires an authenticated session and
- *                          none was presented.
- *
- * Public surfaces today (codex review v0.1.2 → canary.3):
- *   - `GET/HEAD /`, `/assets/*`, root icons    — static SPA shell
- *   - `GET /api/workflows/*`                   — zero-I/O legacy retirement
- *                                                tombstone (HTTP 410).
- *
- * Anything else (sessions, schedules, dashboard rotate, etc.) requires the active session token, matching the
- * "get_write_link" pattern that the chat web terminal already uses.
- */
-export type AuthDecision = {
-    kind: 'allow';
-} | {
-    kind: 'allow+set-cookie';
-    token: string;
-    redirectTo: string;
-} | {
-    kind: 'deny401';
-};
-export declare function decideDashboardAuth(opts: {
-    method: string;
-    pathname: string;
-    hasTokenParam: boolean;
-    presentedToken: string | undefined;
-    activeToken: string;
-    /** When true (config.dashboard.publicReadOnly), the GET/HEAD paths in
-     *  PUBLIC_READ_PATHS (the "watch work" board surfaces) are readable WITHOUT
-     *  a token — a tokenless (or stale-token) visitor gets a read-only dashboard
-     *  instead of a 401 wall. Everything else (management/config reads, raw PTY,
-     *  all writes) still requires the active token. */
-    publicReadOnly?: boolean;
-}): AuthDecision;
-//# sourceMappingURL=auth.d.ts.map

package/dist/dashboard/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/dashboard/auth.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;CAAE;AAExE;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEvF;AAED;;gFAEgF;AAChF,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAM5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BlC;AAED,qEAAqE;AACrE,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIrE;AAED,gFAAgF;AAChF,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+CtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnE;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAInE;AAED,gFAAgF;AAChF,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAO1E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAqBxB,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;uDAImD;IACnD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,YAAY,CAkDf"}

package/dist/dashboard/auth.js

@@ -1,253 +0,0 @@
-import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
-import { readFileSync, existsSync, mkdirSync, chmodSync, linkSync, unlinkSync, writeFileSync, } from 'node:fs';
-import { atomicWriteFileSync } from '../utils/atomic-write.js';
-import { dirname } from 'node:path';
-const NONCE_TTL_MS = 60_000;
-const TS_WINDOW_S = 30;
-const seenNonces = new Map(); // nonce → expiresAt
-/**
- * Canonical "binding" string mixed into the signed payload so a captured HMAC
- * header can't be replayed against a different route or port. Without it, a
- * single set of `X-Botmux-Cli-*` headers signed only over `ts:nonce` is valid
- * for ANY `/__cli/*` route on ANY dashboard — which lets a malicious local
- * server, handed a discovery probe, forward the headers to the real dashboard
- * (e.g. a `/__cli/current` probe relayed to `/__cli/rotate` to mint a token).
- * Binding `method + path + bound-port` makes the credential single-purpose:
- *  - the verifier uses the port IT actually bound (not the attacker-controlled
- *    Host header), so a forward from port X to the dashboard on port Y mismatches;
- *  - a `/__cli/current` capture can't be replayed to `/__cli/rotate` (path differs).
- */
-export function cliAuthBind(method, path, port) {
-    return `${String(method).toUpperCase()} ${path} ${port}`;
-}
-/** Mint the three `X-Botmux-Cli-*` header values for a loopback request.
- *  Pass the same `bind` (see {@link cliAuthBind}) the verifier will reconstruct;
- *  omit it only for the legacy daemon-IPC scheme that signs bare `ts:nonce`. */
-export function signCliAuth(secretB64Url, bind) {
-    const ts = Math.floor(Date.now() / 1000).toString();
-    const nonce = randomBytes(8).toString('hex');
-    const msg = bind ? `${ts}:${nonce}:${bind}` : `${ts}:${nonce}`;
-    const sig = createHmac('sha256', secretB64Url).update(msg).digest('base64url');
-    return { ts, nonce, sig };
-}
-/**
- * Verify a CLI rotation HMAC attempt.
- * - Source IP must be loopback (127.0.0.1 / ::1 / IPv4-mapped form).
- * - Timestamp must be within ±TS_WINDOW_S seconds of now.
- * - Nonce must not have been seen in the last NONCE_TTL_MS.
- * - HMAC-SHA256(secret, `${ts}:${nonce}` [+ `:${bind}`]) must match `sig`
- *   (timing-safe). Pass `bind` (method+path+port) to scope the credential to a
- *   single route/port; omit it for the legacy bare daemon-IPC scheme.
- */
-export function verifyHmac(secretB64Url, attempt, remoteAddr, bind) {
-    if (remoteAddr !== '127.0.0.1' &&
-        remoteAddr !== '::1' &&
-        !remoteAddr.endsWith('::ffff:127.0.0.1')) {
-        return { ok: false, reason: 'remote_not_loopback' };
-    }
-    const tsNum = Number(attempt.ts);
-    if (!Number.isFinite(tsNum))
-        return { ok: false, reason: 'bad_ts' };
-    const nowS = Math.floor(Date.now() / 1000);
-    if (Math.abs(nowS - tsNum) > TS_WINDOW_S)
-        return { ok: false, reason: 'ts_window' };
-    // GC nonces
-    const now = Date.now();
-    for (const [n, exp] of seenNonces)
-        if (exp < now)
-            seenNonces.delete(n);
-    if (seenNonces.has(attempt.nonce))
-        return { ok: false, reason: 'replay' };
-    const msg = bind ? `${attempt.ts}:${attempt.nonce}:${bind}` : `${attempt.ts}:${attempt.nonce}`;
-    const expected = createHmac('sha256', secretB64Url).update(msg).digest();
-    let provided;
-    try {
-        provided = Buffer.from(attempt.sig, 'base64url');
-    }
-    catch {
-        return { ok: false, reason: 'bad_sig' };
-    }
-    if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
-        return { ok: false, reason: 'sig_mismatch' };
-    }
-    seenNonces.set(attempt.nonce, now + NONCE_TTL_MS);
-    return { ok: true };
-}
-/** 32 random bytes base64url-encoded (43 characters, no padding). */
-export function generateToken() {
-    return randomBytes(32).toString('base64url');
-}
-/**
- * Load a dashboard HMAC secret from disk. Empty / whitespace-only files are
- * treated as missing so callers never sign requests with an empty key.
- */
-export function loadDashboardSecret(secretPath) {
-    if (!existsSync(secretPath))
-        return null;
-    const secret = readFileSync(secretPath, 'utf8').trim();
-    return secret.length > 0 ? secret : null;
-}
-/** Load the dashboard HMAC secret, creating a fresh 0600 secret when absent. */
-export function loadOrCreateDashboardSecret(secretPath) {
-    const existing = loadDashboardSecret(secretPath);
-    if (existing)
-        return existing;
-    const secret = randomBytes(32).toString('base64url');
-    mkdirSync(dirname(secretPath), { recursive: true });
-    // Daemon fleets and the dashboard start concurrently on a fresh install.
-    // A rename-based "atomic write" is individually atomic but not
-    // create-if-absent: two winners can each return a different key while only
-    // the last rename remains on disk. Publish a fully-written temp inode with
-    // link(2) instead. The link is atomic and fails with EEXIST for every loser;
-    // losers then read the single winner's complete value.
-    const temp = `${secretPath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
-    try {
-        writeFileSync(temp, secret, { mode: 0o600, flag: 'wx' });
-        try {
-            linkSync(temp, secretPath);
-            chmodSync(secretPath, 0o600);
-            return secret;
-        }
-        catch (err) {
-            const raced = loadDashboardSecret(secretPath);
-            if (raced)
-                return raced;
-            // Existing-but-empty/corrupt file: publish one permanent repair seed via
-            // link(2). Every concurrent initializer either wins that O_EXCL election
-            // or reads the same fully-written seed, then atomically restores the main
-            // path with the identical value. Keeping the 0600 seed makes crash recovery
-            // replayable and avoids stale PID locks (and their delete/recreate races).
-            const repairSeedPath = `${secretPath}.repair-seed`;
-            let repairSecret;
-            try {
-                linkSync(temp, repairSeedPath);
-                chmodSync(repairSeedPath, 0o600);
-                repairSecret = secret;
-            }
-            catch (seedErr) {
-                if (seedErr.code !== 'EEXIST')
-                    throw seedErr;
-                const published = loadDashboardSecret(repairSeedPath);
-                if (!published) {
-                    throw new Error(`dashboard secret repair seed is unreadable: ${repairSeedPath}`);
-                }
-                repairSecret = published;
-            }
-            atomicWriteFileSync(secretPath, repairSecret, { mode: 0o600 });
-            chmodSync(secretPath, 0o600);
-            return repairSecret;
-        }
-    }
-    finally {
-        try {
-            unlinkSync(temp);
-        }
-        catch { /* already absent */ }
-    }
-}
-/**
- * Load the persisted active dashboard token from `tokenPath`, or `null` when
- * the file is absent / empty / unreadable.
- *
- * Persisting the active token lets a previously-issued dashboard URL survive a
- * `botmux restart`: on startup the dashboard hydrates `activeToken` from this
- * file instead of starting blank.  Only `botmux dashboard` rotates the token
- * (via `persistToken` with a fresh value), which is what invalidates the old
- * link.
- */
-export function loadPersistedToken(tokenPath) {
-    try {
-        if (existsSync(tokenPath))
-            return readFileSync(tokenPath, 'utf8').trim() || null;
-    }
-    catch { /* unreadable token file → behave as if none persisted */ }
-    return null;
-}
-/** Persist the active dashboard token to `tokenPath` with 0600 perms. */
-export function persistToken(tokenPath, token) {
-    mkdirSync(dirname(tokenPath), { recursive: true });
-    atomicWriteFileSync(tokenPath, token, { mode: 0o600 });
-    chmodSync(tokenPath, 0o600);
-}
-/** Load the active token, creating and persisting the first one when absent. */
-export function loadOrCreatePersistedToken(tokenPath) {
-    const existing = loadPersistedToken(tokenPath);
-    if (existing)
-        return existing;
-    const token = generateToken();
-    persistToken(tokenPath, token);
-    return token;
-}
-/** Extract `botmux_dashboard_token` value from a Cookie header. */
-export function parseCookie(header) {
-    if (!header)
-        return undefined;
-    for (const part of header.split(';')) {
-        const [k, v] = part.trim().split('=');
-        if (k === 'botmux_dashboard_token')
-            return v;
-    }
-    return undefined;
-}
-/** Build the `Set-Cookie` header value for a fresh dashboard token. */
-export function buildSetCookie(token) {
-    return `botmux_dashboard_token=${token}; HttpOnly; SameSite=Lax; Path=/`;
-}
-/** Tokenless-readable API paths when `config.dashboard.publicReadOnly` is on.
- *  ALLOW-LIST (fail-closed): only the "watch work" surfaces the read-only
- *  dashboard renders. Anything NOT in this set stays behind the active token
- *  even in public mode — so a newly-added GET endpoint is private by default
- *  and can't silently leak (connector configs, webhook-secret metadata,
- *  trigger logs, role/persona files, per-bot config, onboarding, raw PTY are
- *  all absent on purpose). The static SPA shell and the zero-I/O legacy
- *  workflow tombstone are handled separately in decideDashboardAuth. Full v3
- *  workflow projections stay private because goals, node ids, and run ids can
- *  contain project or personal information.
- *  口径：公开 = 会话板 / 排程(脱敏) / 设置(只读) / 群名册 / 事件流。 */
-const PUBLIC_READ_PATHS = new Set([
-    '/api/sessions', // session board
-    '/api/schedules', // schedules page — task prompt redacted for anon upstream
-    '/api/settings', // read-only settings — only public flags + authed:false
-    '/api/groups', // board name maps: bot friendly name + group name
-    '/events', // SSE stream — schedule prompt redacted for anon upstream
-]);
-export function decideDashboardAuth(opts) {
-    const { method, pathname, hasTokenParam, presentedToken, activeToken, publicReadOnly } = opts;
-    // Historical `…/terminal-log/raw` routes are gone, but keep the generic raw
-    // suffix excluded from public-read policy so future APIs cannot expose a PTY
-    // transcript by accidentally inheriting this carve-out.
-    const isRawTerminalLog = pathname.endsWith('/terminal-log/raw');
-    // The legacy workflow prefix is now a public zero-I/O 410 tombstone. Keeping
-    // it public lets stale cards/clients receive an actionable retirement result.
-    const isWorkflowReadOnly = method === 'GET' &&
-        (pathname === '/api/workflows' || pathname.startsWith('/api/workflows/')) &&
-        !isRawTerminalLog;
-    const isStaticShell = (method === 'GET' || method === 'HEAD') &&
-        (pathname === '/' ||
-            pathname === '/favicon.ico' ||
-            pathname === '/favicon.png' ||
-            pathname === '/apple-touch-icon.png' ||
-            pathname.startsWith('/assets/') ||
-            pathname.startsWith('/game/'));
-    // Public read-only mode opens ONLY the allow-listed "watch work" reads
-    // (PUBLIC_READ_PATHS) — fail-closed: a path not on the list stays token-gated
-    // even under publicReadOnly, so new endpoints don't silently become public.
-    const isPublicRead = !!publicReadOnly &&
-        (method === 'GET' || method === 'HEAD') &&
-        PUBLIC_READ_PATHS.has(pathname);
-    const authed = !!presentedToken && presentedToken === activeToken;
-    if (!authed && !isWorkflowReadOnly && !isStaticShell && !isPublicRead) {
-        return { kind: 'deny401' };
-    }
-    // First hit with `?t=<correct token>` sets the cookie + redirects to the
-    // clean URL.  Only reached when the token matched (`authed === true`).
-    if (hasTokenParam && authed && presentedToken) {
-        return {
-            kind: 'allow+set-cookie',
-            token: presentedToken,
-            redirectTo: pathname || '/',
-        };
-    }
-    return { kind: 'allow' };
-}
-//# sourceMappingURL=auth.js.map

package/dist/dashboard/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,GACpF,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAG,oBAAoB;AAIpE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,IAAqB;IAC7E,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;gFAEgF;AAChF,MAAM,UAAU,WAAW,CAAC,YAAoB,EAAE,IAAa;IAC7D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,YAAoB,EACpB,OAAoB,EACpB,UAAkB,EAClB,IAAa;IAEb,IACE,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,KAAK;QACpB,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACxC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEpF,YAAY;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU;QAAE,IAAI,GAAG,GAAG,GAAG;YAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE1E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;IAC/F,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAAC,CAAC;IACzD,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,YAAY,CAAC,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,yEAAyE;IACzE,+DAA+D;IAC/D,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,uDAAuD;IACvD,MAAM,IAAI,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAClF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC3B,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,4EAA4E;YAC5E,2EAA2E;YAC3E,MAAM,cAAc,GAAG,GAAG,UAAU,cAAc,CAAC;YACnD,IAAI,YAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBAC/B,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;gBACjC,YAAY,GAAG,MAAM,CAAC;YACxB,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,IAAK,OAAiC,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,OAAO,CAAC;gBACxE,MAAM,SAAS,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;gBACtD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CAAC,+CAA+C,cAAc,EAAE,CAAC,CAAC;gBACnF,CAAC;gBACD,YAAY,GAAG,SAAS,CAAC;YAC3B,CAAC;YACD,mBAAmB,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC7B,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC,CAAC,yDAAyD,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,KAAa;IAC3D,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,wBAAwB;YAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,0BAA0B,KAAK,kCAAkC,CAAC;AAC3E,CAAC;AA6BD;;;;;;;;;;iDAUiD;AACjD,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,eAAe,EAAK,gBAAgB;IACpC,gBAAgB,EAAI,0DAA0D;IAC9E,eAAe,EAAK,wDAAwD;IAC5E,aAAa,EAAO,kDAAkD;IACtE,SAAS,EAAW,0DAA0D;CAC/E,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CAAC,IAYnC;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE9F,4EAA4E;IAC5E,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,kBAAkB,GACtB,MAAM,KAAK,KAAK;QAChB,CAAC,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACzE,CAAC,gBAAgB,CAAC;IACpB,MAAM,aAAa,GACjB,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;QACvC,CACE,QAAQ,KAAK,GAAG;YAChB,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,uBAAuB;YACpC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/B,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC9B,CAAC;IAEJ,uEAAuE;IACvE,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,YAAY,GAChB,CAAC,CAAC,cAAc;QAChB,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;QACvC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,IAAI,cAAc,KAAK,WAAW,CAAC;IAElE,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,aAAa,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,QAAQ,IAAI,GAAG;SAC5B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}