botnote 0.1.1

package/dist/rest/routes.js

@@ -0,0 +1,320 @@
+import { z } from "zod";
+import { get, getByKey, link, listRelated, recent, remove, update, write } from "../service/entities.js";
+import { formatOpeningBrief, openingBrief } from "../service/opening_brief.js";
+import { createProject, getProject, getProjectByKey, listProjects, updateProject } from "../service/projects.js";
+import { search } from "../service/search.js";
+import { createSession, revokeSession, verifyMasterPassword } from "../service/sessions.js";
+import { tasksRange } from "../service/tasks.js";
+import { createToken, listTokens, revokeToken } from "../service/tokens.js";
+import { CreateNoteInput, CreateProjectInput, CreateTaskInput, CreateTokenInput, LinkInput, OpeningBriefInput, RecentInput, SearchInput, TasksRangeInput, UpdateInput, UpdateProjectInput, Uuid } from "../service/types.js";
+import { VERSION } from "../version.js";
+const IdParams = z.object({ id: Uuid });
+const KeyParams = z.object({ key: z.string() });
+const KeySeqParams = z.object({
+    key: z.string().regex(/^[A-Z][A-Z0-9_]*$/),
+    seq: z.coerce.number().int().positive()
+});
+const OpeningBriefBody = OpeningBriefInput.omit({ projectId: true }).optional();
+const LinkBody = LinkInput.omit({ fromId: true });
+function publicToken(t) {
+    return {
+        id: t.id,
+        name: t.name,
+        prefix: t.prefix,
+        lastUsedAt: t.lastUsedAt,
+        createdAt: t.createdAt
+    };
+}
+export async function registerRoutes(rawApp, ctx) {
+    const app = rawApp.withTypeProvider();
+    app.get("/health", async () => ({ ok: true, version: VERSION }));
+    // ----- projects -----
+    app.post("/v1/projects", { schema: { tags: ["projects"], summary: "Create a project", body: CreateProjectInput } }, async (req) => createProject(ctx.db, CreateProjectInput.parse(req.body)));
+    app.get("/v1/projects", { schema: { tags: ["projects"], summary: "List projects" } }, async () => listProjects(ctx.db));
+    app.get("/v1/projects/:id", { schema: { tags: ["projects"], summary: "Fetch a project by id (includes AGENTS.md)", params: IdParams } }, async (req, reply) => {
+        const { id } = IdParams.parse(req.params);
+        const p = await getProject(ctx.db, id);
+        if (!p)
+            return reply.code(404).send({ error: "not_found" });
+        return p;
+    });
+    app.patch("/v1/projects/:id", {
+        schema: {
+            tags: ["projects"],
+            summary: "Update project (name, color, icon, agents_md)",
+            params: IdParams,
+            body: UpdateProjectInput
+        }
+    }, async (req) => {
+        const { id } = IdParams.parse(req.params);
+        const body = UpdateProjectInput.parse(req.body);
+        return updateProject(ctx.db, id, body);
+    });
+    app.get("/v1/projects/by-key/:key", { schema: { tags: ["projects"], summary: "Fetch a project by key", params: KeyParams } }, async (req, reply) => {
+        const { key } = KeyParams.parse(req.params);
+        const p = await getProjectByKey(ctx.db, key);
+        if (!p)
+            return reply.code(404).send({ error: "not_found" });
+        return p;
+    });
+    app.post("/v1/projects/:id/opening-brief", {
+        schema: {
+            tags: ["brief"],
+            summary: "Opening brief for a project",
+            description: "Returns the agent context bundle: AGENTS.md, pinned notes, open tasks, pending decisions, recent activity. Also returns a markdown-formatted version.",
+            params: IdParams,
+            body: OpeningBriefBody
+        }
+    }, async (req) => {
+        const { id } = IdParams.parse(req.params);
+        const bodyOpts = OpeningBriefBody.parse(req.body);
+        const input = OpeningBriefInput.parse({ projectId: id, recentLimit: bodyOpts?.recentLimit });
+        const brief = await openingBrief(ctx.db, input);
+        return { ...brief, markdown: formatOpeningBrief(brief) };
+    });
+    // Workspace-or-project opening brief. The path-param variant above is kept
+    // for clients that already integrate against it; the MCP HTTP client and
+    // new plugin code uses this single entry point and passes projectId in the
+    // body (or omits it for a workspace-wide brief).
+    app.post("/v1/opening-brief", {
+        schema: {
+            tags: ["brief"],
+            summary: "Opening brief (project-scoped or workspace-wide)",
+            body: OpeningBriefInput.partial().optional()
+        }
+    }, async (req) => {
+        const input = OpeningBriefInput.parse(req.body ?? {});
+        const brief = await openingBrief(ctx.db, input);
+        return { ...brief, markdown: formatOpeningBrief(brief) };
+    });
+    // ----- entities (read) -----
+    app.get("/v1/entities/:id", { schema: { tags: ["entities"], summary: "Fetch an entity by id", params: IdParams } }, async (req, reply) => {
+        const { id } = IdParams.parse(req.params);
+        const e = await get(ctx.db, id);
+        if (!e)
+            return reply.code(404).send({ error: "not_found" });
+        return e;
+    });
+    app.get("/v1/projects/by-key/:key/entities/by-seq/:seq", {
+        schema: {
+            tags: ["entities"],
+            summary: "Fetch an entity by its human-readable identifier (e.g. BOT-12)",
+            params: KeySeqParams
+        }
+    }, async (req, reply) => {
+        const { key, seq } = KeySeqParams.parse(req.params);
+        const e = await getByKey(ctx.db, key, seq);
+        if (!e)
+            return reply.code(404).send({ error: "not_found" });
+        return e;
+    });
+    app.get("/v1/entities/:id/related", {
+        schema: {
+            tags: ["entities"],
+            summary: "List entities whose parent_id is this id (e.g. notes linked to a task)",
+            params: IdParams
+        }
+    }, async (req) => {
+        const { id } = IdParams.parse(req.params);
+        return listRelated(ctx.db, id);
+    });
+    app.post("/v1/recent", {
+        schema: {
+            tags: ["entities"],
+            summary: "Recent entities (filterable by project, kinds, since)",
+            body: RecentInput.optional()
+        }
+    }, async (req) => recent(ctx.db, RecentInput.parse(req.body ?? {})));
+    app.post("/v1/search", {
+        schema: {
+            tags: ["search"],
+            summary: "Hybrid retrieval (BM25 + cosine + time decay, RRF merged)",
+            description: "If OPENAI_API_KEY is set, the query is embedded and cosine similarity is merged in via RRF. Otherwise BM25-only.",
+            body: SearchInput
+        }
+    }, async (req) => {
+        const body = SearchInput.parse(req.body);
+        const queryEmbedding = await ctx.embedding.embedQuery(body.query);
+        const hits = await search(ctx.db, body, queryEmbedding ? { queryEmbedding } : {});
+        return { hits, embeddingUsed: queryEmbedding != null };
+    });
+    app.post("/v1/tasks/range", {
+        schema: {
+            tags: ["tasks"],
+            summary: "Tasks in a date range + overdue + backlog (no due_at)",
+            description: "Returns three buckets: scheduled (due_at in [from, to)), overdue (due_at before now, only when not includeDone), backlog (no due_at, only when includeBacklog).",
+            body: TasksRangeInput
+        }
+    }, async (req) => tasksRange(ctx.db, TasksRangeInput.parse(req.body)));
+    // ----- entities (write) -----
+    app.post("/v1/tasks", {
+        schema: {
+            tags: ["entities"],
+            summary: "Create a task",
+            body: CreateTaskInput
+        }
+    }, async (req) => {
+        const body = CreateTaskInput.parse(req.body);
+        const entity = await write(ctx.db, { ...body, kind: "task", pinned: false });
+        if (ctx.embedding.isEnabled()) {
+            ctx.embedding.enqueue(entity.id, `${entity.title ?? ""}\n${entity.body}`);
+        }
+        return entity;
+    });
+    app.post("/v1/notes", {
+        schema: {
+            tags: ["entities"],
+            summary: "Create a note (title optional; body's first line acts as the label)",
+            body: CreateNoteInput
+        }
+    }, async (req) => {
+        const body = CreateNoteInput.parse(req.body);
+        const entity = await write(ctx.db, {
+            ...body,
+            kind: "note",
+            status: "open",
+            priority: "none",
+            dueAt: null
+        });
+        if (ctx.embedding.isEnabled()) {
+            ctx.embedding.enqueue(entity.id, `${entity.title ?? ""}\n${entity.body}`);
+        }
+        return entity;
+    });
+    app.patch("/v1/entities/:id", {
+        schema: {
+            tags: ["entities"],
+            summary: "Update an entity (task or note)",
+            params: IdParams,
+            body: UpdateInput
+        }
+    }, async (req) => {
+        const { id } = IdParams.parse(req.params);
+        const fields = UpdateInput.parse(req.body);
+        const updated = await update(ctx.db, id, fields);
+        if (ctx.embedding.isEnabled() &&
+            (fields.body !== undefined || fields.title !== undefined)) {
+            ctx.embedding.enqueue(updated.id, `${updated.title ?? ""}\n${updated.body}`);
+        }
+        return updated;
+    });
+    app.delete("/v1/entities/:id", {
+        schema: {
+            tags: ["entities"],
+            summary: "Delete an entity",
+            params: IdParams
+        }
+    }, async (req, reply) => {
+        const { id } = IdParams.parse(req.params);
+        const ok = await remove(ctx.db, id);
+        if (!ok)
+            return reply.code(404).send({ error: "not_found" });
+        return reply.code(204).send();
+    });
+    app.post("/v1/entities/:id/links", {
+        schema: {
+            tags: ["entities"],
+            summary: "Link this entity to another (blocks / references / parent_of)",
+            params: IdParams,
+            body: LinkBody
+        }
+    }, async (req) => {
+        const { id } = IdParams.parse(req.params);
+        const body = LinkBody.parse(req.body);
+        return link(ctx.db, { fromId: id, toId: body.toId, kind: body.kind });
+    });
+    // ----- auth (browser session cookie) -----
+    const LoginBody = z.object({
+        password: z.string().min(1).max(500)
+    });
+    app.post("/v1/auth/login", {
+        // Tight cap — this is the brute-force surface.
+        config: { rateLimit: { max: 10, timeWindow: "1 minute" } },
+        schema: {
+            tags: ["auth"],
+            summary: "Master-password login. Sets httpOnly session cookie.",
+            body: LoginBody
+        }
+    }, async (req, reply) => {
+        const { password } = LoginBody.parse(req.body);
+        const ok = verifyMasterPassword(password);
+        if (!ok) {
+            // Add a small constant-time penalty so timing attacks against the
+            // env-lookup branch aren't easier than the rate limit makes them.
+            await new Promise((r) => setTimeout(r, 300));
+            return reply.code(401).send({ error: "invalid_password" });
+        }
+        const ua = req.headers["user-agent"] ?? null;
+        const { plaintext, session } = await createSession(ctx.db, { userAgent: ua });
+        reply.setCookie("botnote_session", plaintext, {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === "production",
+            sameSite: "lax",
+            path: "/",
+            maxAge: 60 * 60 * 24 * 30 // 30 days
+        });
+        return { ok: true, expiresAt: session.expiresAt };
+    });
+    app.post("/v1/auth/logout", {
+        schema: {
+            tags: ["auth"],
+            summary: "Clear session cookie and revoke the server-side row."
+        }
+    }, async (req, reply) => {
+        const plaintext = req.cookies?.botnote_session;
+        if (plaintext)
+            await revokeSession(ctx.db, plaintext);
+        reply.clearCookie("botnote_session", { path: "/" });
+        return { ok: true };
+    });
+    app.get("/v1/auth/whoami", {
+        schema: {
+            tags: ["auth"],
+            summary: "Confirm authentication state + how the caller got in."
+        }
+    }, async (req) => {
+        // If the request reached this handler, the auth gate already passed —
+        // either via cookie, bearer, or trusted tailnet origin.
+        const hasCookie = !!req.cookies?.botnote_session;
+        const hasBearer = !!req.headers.authorization;
+        const viaProxy = !!req.headers["cf-connecting-ip"] || !!req.headers["x-forwarded-for"];
+        return {
+            authenticated: true,
+            via: hasCookie
+                ? "cookie"
+                : hasBearer
+                    ? "bearer"
+                    : viaProxy
+                        ? "unknown"
+                        : "trusted_origin"
+        };
+    });
+    // ----- tokens -----
+    app.get("/v1/tokens", { schema: { tags: ["tokens"], summary: "List API tokens (no hash, no plaintext)" } }, async () => (await listTokens(ctx.db)).map(publicToken));
+    // Token write endpoints get a much tighter cap (30/hour per IP). These are
+    // low-frequency operations — bumping them limits the blast radius if a token
+    // leaks or someone hammers the create endpoint.
+    app.post("/v1/tokens", {
+        config: { rateLimit: { max: 30, timeWindow: "1 hour" } },
+        schema: {
+            tags: ["tokens"],
+            summary: "Create a new API token (plaintext returned once)",
+            body: CreateTokenInput
+        }
+    }, async (req) => {
+        const body = CreateTokenInput.parse(req.body);
+        const { token, plaintext } = await createToken(ctx.db, body);
+        return { ...publicToken(token), plaintext };
+    });
+    app.delete("/v1/tokens/:id", {
+        config: { rateLimit: { max: 30, timeWindow: "1 hour" } },
+        schema: { tags: ["tokens"], summary: "Revoke an API token", params: IdParams }
+    }, async (req, reply) => {
+        const { id } = IdParams.parse(req.params);
+        const ok = await revokeToken(ctx.db, id);
+        if (!ok)
+            return reply.code(404).send({ error: "not_found" });
+        return reply.code(204).send();
+    });
+}
+//# sourceMappingURL=routes.js.map

package/dist/rest/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/rest/routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,WAAW,EACX,MAAM,EACN,MAAM,EACN,MAAM,EACN,KAAK,EACN,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EACL,aAAa,EACb,UAAU,EACV,eAAe,EACf,YAAY,EACZ,aAAa,EACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,aAAa,EACb,oBAAoB,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,SAAS,EACT,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,IAAI,EACL,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACxC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAElD,SAAS,WAAW,CAAC,CAAQ;IAC3B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAuB,EACvB,GAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAmB,CAAC;IAEvD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAEjE,uBAAuB;IAEvB,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EACzF,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACzE,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,cAAc,EACd,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAC5D,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CACjC,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAC3G,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,kBAAkB,EAClB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,+CAA+C;YACxD,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,kBAAkB;SACzB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,0BAA0B,EAC1B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EACxF,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,gCAAgC,EAChC;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EAAE,6BAA6B;YACtC,WAAW,EACT,uJAAuJ;YACzJ,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,gBAAgB;SACvB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3D,CAAC,CACF,CAAC;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,iDAAiD;IACjD,GAAG,CAAC,IAAI,CACN,mBAAmB,EACnB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EAAE,kDAAkD;YAC3D,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC7C;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3D,CAAC,CACF,CAAC;IAEF,8BAA8B;IAE9B,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EACtF,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,+CAA+C,EAC/C;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,gEAAgE;YACzE,MAAM,EAAE,YAAY;SACrB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,0BAA0B,EAC1B;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,wEAAwE;YACjF,MAAM,EAAE,QAAQ;SACjB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,YAAY,EACZ;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,uDAAuD;YAChE,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE;SAC7B;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CACjE,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,YAAY,EACZ;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,2DAA2D;YACpE,WAAW,EACT,kHAAkH;YACpH,IAAI,EAAE,WAAW;SAClB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,IAAI,IAAI,EAAE,CAAC;IACzD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EAAE,uDAAuD;YAChE,WAAW,EACT,iKAAiK;YACnK,IAAI,EAAE,eAAe;SACtB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACnE,CAAC;IAEF,+BAA+B;IAE/B,GAAG,CAAC,IAAI,CACN,WAAW,EACX;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,eAAe;SACtB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,WAAW,EACX;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,qEAAqE;YAC9E,IAAI,EAAE,eAAe;SACtB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;YACjC,GAAG,IAAI;YACP,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,kBAAkB,EAClB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,iCAAiC;YAC1C,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,WAAW;SAClB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACjD,IACE,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE;YACzB,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,EACzD,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,kBAAkB,EAClB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,kBAAkB;YAC3B,MAAM,EAAE,QAAQ;SACjB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,+DAA+D;YACxE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,QAAQ;SACf;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC,CACF,CAAC;IAEF,4CAA4C;IAE5C,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACrC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,gBAAgB,EAChB;QACE,+CAA+C;QAC/C,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE;QAC1D,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,SAAS;SAChB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,kEAAkE;YAClE,kEAAkE;YAClE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,EAAE,GAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI,CAAC;QACrE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,SAAS,EAAE;YAC5C,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,OAAO,EAAE,sDAAsD;SAChE;KACF,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC;QAC/C,IAAI,SAAS;YAAE,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,iBAAiB,EACjB;QACE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,OAAO,EAAE,uDAAuD;SACjE;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC;QACjD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9C,MAAM,QAAQ,GACZ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACxE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,GAAG,EAAE,SAAS;gBACZ,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;oBACT,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,gBAAgB;SACzB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,qBAAqB;IAErB,GAAG,CAAC,GAAG,CACL,YAAY,EACZ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,yCAAyC,EAAE,EAAE,EACpF,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CACxD,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,gDAAgD;IAChD,GAAG,CAAC,IAAI,CACN,YAAY,EACZ;QACE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,kDAAkD;YAC3D,IAAI,EAAE,gBAAgB;SACvB;KACF,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,gBAAgB,EAChB;QACE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE;KAC/E,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/rest/server.d.ts

@@ -0,0 +1,12 @@
+import { type FastifyInstance } from "fastify";
+import type { Database } from "../db/client.js";
+import type { EmbeddingService } from "../service/embedding.js";
+export interface ServerContext {
+    db: Database["db"];
+    embedding: EmbeddingService;
+}
+export interface BuildServerOpts extends ServerContext {
+    logLevel?: string;
+    webDist?: string;
+}
+export declare function buildServer(opts: BuildServerOpts): Promise<FastifyInstance>;

package/dist/rest/server.js

@@ -0,0 +1,282 @@
+import cookie from "@fastify/cookie";
+import cors from "@fastify/cors";
+import rateLimit from "@fastify/rate-limit";
+import fastifyStatic from "@fastify/static";
+import swagger from "@fastify/swagger";
+import swaggerUi from "@fastify/swagger-ui";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import Fastify from "fastify";
+import { hasZodFastifySchemaValidationErrors, isResponseSerializationError, jsonSchemaTransform, serializerCompiler, validatorCompiler } from "fastify-type-provider-zod";
+import { consumeSession } from "../service/sessions.js";
+import { consumeToken } from "../service/tokens.js";
+import { VERSION } from "../version.js";
+import { registerRoutes } from "./routes.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+function resolveWebDist(explicit) {
+    const envPath = process.env.BOTNOTE_WEB_DIST;
+    const candidates = [
+        explicit,
+        envPath,
+        path.resolve(__dirname, "../../web/dist"),
+        path.resolve(__dirname, "../../../web/dist")
+    ].filter(Boolean);
+    for (const c of candidates) {
+        if (existsSync(path.join(c, "index.html")))
+            return c;
+    }
+    return null;
+}
+/** Default CORS allowlist. Add public origins via BOTNOTE_CORS_ORIGINS
+ *  (comma-separated). The tailnet + localhost entries stay for ops access. */
+function defaultCorsOrigins() {
+    const built = [
+        "http://127.0.0.1:4280",
+        "http://localhost:4280",
+        "http://100.68.185.53:4280",
+        "https://botnote.net"
+    ];
+    const extra = process.env.BOTNOTE_CORS_ORIGINS;
+    if (extra) {
+        for (const o of extra.split(",").map((s) => s.trim()).filter(Boolean)) {
+            if (!built.includes(o))
+                built.push(o);
+        }
+    }
+    return built;
+}
+/** Read the caller's real IP. cf-connecting-ip is set by Cloudflare for every
+ *  request that goes through CF Tunnel — without it, rate-limit would key on
+ *  the tunnel's loopback address and the whole world would share one bucket. */
+function clientIp(req) {
+    const cf = req.headers["cf-connecting-ip"];
+    if (typeof cf === "string" && cf)
+        return cf;
+    const xff = req.headers["x-forwarded-for"];
+    if (typeof xff === "string" && xff)
+        return xff.split(",")[0].trim();
+    return req.ip;
+}
+export async function buildServer(opts) {
+    const isProduction = process.env.NODE_ENV === "production";
+    const app = Fastify({
+        logger: { level: opts.logLevel ?? "info" },
+        // We're behind CF Tunnel (or tailscale serve). Trust the immediate proxy so
+        // req.ip is sensible, but rely on clientIp() above for rate-limit keying.
+        trustProxy: true
+    }).withTypeProvider();
+    app.setValidatorCompiler(validatorCompiler);
+    app.setSerializerCompiler(serializerCompiler);
+    await app.register(cookie, {
+        // No global secret/sign — session cookies carry an opaque random token
+        // that maps to a row in `sessions`; tamper-detection isn't useful since
+        // we already validate every value against the DB.
+        hook: "onRequest"
+    });
+    await app.register(cors, {
+        origin: defaultCorsOrigins(),
+        // credentials: true so cookies can be sent across origins (browser will
+        // refuse to attach cookies on a fetch to a different origin otherwise).
+        credentials: true,
+        methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+        allowedHeaders: ["content-type", "authorization"],
+        maxAge: 86400
+    });
+    await app.register(rateLimit, {
+        // 1000 req/min per IP — generous enough that a Claude Code session burst
+        // and the Web UI's 30s polling combined don't trip it; tight enough that a
+        // leaked token can't quietly exfil thousands of entities per second.
+        max: 1000,
+        timeWindow: "1 minute",
+        keyGenerator: (req) => clientIp(req),
+        // /health is a probe; /assets/* are dozens of static files per page load.
+        // Counting them would cap real API headroom for no benefit.
+        allowList: (req) => {
+            const u = req.url;
+            return u === "/health" || u.startsWith("/health?") || u.startsWith("/assets/");
+        },
+        errorResponseBuilder: (_req, ctx) => ({
+            error: "rate_limited",
+            message: `Too many requests. Try again in ${Math.ceil(ctx.ttl / 1000)}s.`,
+            retryAfter: Math.ceil(ctx.ttl / 1000)
+        })
+    });
+    if (!isProduction) {
+        await app.register(swagger, {
+            openapi: {
+                info: {
+                    title: "botnote",
+                    version: VERSION,
+                    description: "Notion for bots. A lightweight, agent-first project + notes + memory store."
+                },
+                servers: [
+                    {
+                        url: `http://localhost:${process.env.BOTNOTE_PORT ?? 4280}`,
+                        description: "local"
+                    }
+                ],
+                tags: [
+                    { name: "projects", description: "Project lifecycle and AGENTS.md." },
+                    { name: "entities", description: "Tasks and notes." },
+                    { name: "tasks", description: "Task calendar queries (range + backlog)." },
+                    { name: "search", description: "Hybrid retrieval." },
+                    { name: "brief", description: "Opening brief — agent context bundle." },
+                    { name: "tokens", description: "API token management." }
+                ]
+            },
+            transform: jsonSchemaTransform
+        });
+        await app.register(swaggerUi, {
+            routePrefix: "/docs",
+            uiConfig: {
+                docExpansion: "list",
+                deepLinking: false
+            }
+        });
+        app.log.info("swagger UI mounted at /docs (dev mode)");
+    }
+    else {
+        app.log.info("swagger UI disabled (production)");
+    }
+    // ----- error handler -----
+    // Strip Node stack traces from all responses. Zod validation errors return
+    // field-level info but no schema dump; Fastify's own errors get a safe
+    // summary.
+    app.setErrorHandler((error, req, reply) => {
+        const err = error;
+        if (hasZodFastifySchemaValidationErrors(err)) {
+            return reply.code(400).send({
+                error: "validation_error",
+                message: "Request body or params failed validation.",
+                details: err.validation.map((v) => ({
+                    path: v.instancePath || v.schemaPath || "",
+                    message: v.message ?? ""
+                }))
+            });
+        }
+        if (isResponseSerializationError(err)) {
+            req.log.error({ err }, "response serialization failed");
+            return reply.code(500).send({ error: "server_error" });
+        }
+        // fastify-rate-limit's errorResponseBuilder result lands here without a
+        // statusCode prop, so it would otherwise fall through to the 500 bucket
+        // and lose the retryAfter signal. Surface it explicitly.
+        const errAny = err;
+        if (errAny.error === "rate_limited") {
+            return reply.code(429).send({
+                error: "rate_limited",
+                message: err.message,
+                retryAfter: errAny.retryAfter
+            });
+        }
+        const sc = err.statusCode;
+        if (typeof sc === "number" && sc >= 400 && sc < 500) {
+            return reply.code(sc).send({ error: err.code ?? "client_error", message: err.message });
+        }
+        req.log.error({ err }, "unhandled error");
+        return reply.code(500).send({ error: "server_error" });
+    });
+    // ----- auth -----
+    // Trust direct connections (tailnet IP, 127.0.0.1, the macmini-local Web UI)
+    // and only enforce bearer tokens on requests that came through Cloudflare
+    // Tunnel (or any reverse proxy that sets cf-connecting-ip / x-forwarded-for).
+    // This lets Boss browse the local tailnet URL without a login flow while
+    // keeping the public botnote.net surface fully token-gated.
+    const requireAuth = process.env.BOTNOTE_REQUIRE_AUTH === "1";
+    if (requireAuth) {
+        // IMPORTANT: register at onRequest, not preHandler. fastify-type-provider-zod
+        // runs schema validation at preValidation, which is BEFORE preHandler — so
+        // a preHandler auth gate lets an unauthenticated POST get a 400 zod error
+        // back, leaking the request schema. onRequest fires first; no body has been
+        // parsed yet, but headers and cookies are all we need.
+        app.addHook("onRequest", async (req, reply) => {
+            if (!req.url.startsWith("/v1/"))
+                return;
+            // The login endpoint is the entry point — gating it would be a
+            // chicken-and-egg loop. Logout is fine to leave open too (it's a noop
+            // when no cookie is present).
+            if (req.url.startsWith("/v1/auth/login") ||
+                req.url.startsWith("/v1/auth/logout")) {
+                return;
+            }
+            const viaProxy = !!req.headers["cf-connecting-ip"] || !!req.headers["x-forwarded-for"];
+            if (!viaProxy)
+                return; // direct tailnet/localhost — trusted
+            // Browser path: session cookie set by /v1/auth/login.
+            const cookieToken = req.cookies?.botnote_session;
+            if (cookieToken) {
+                const session = await consumeSession(opts.db, cookieToken);
+                if (session)
+                    return;
+            }
+            // CLI / MCP path: bearer token.
+            const auth = req.headers.authorization;
+            if (auth && auth.startsWith("Bearer ")) {
+                const plaintext = auth.slice("Bearer ".length).trim();
+                const tok = await consumeToken(opts.db, plaintext);
+                if (tok)
+                    return;
+            }
+            return reply.code(401).send({ error: "unauthenticated" });
+        });
+        app.log.info("auth: required for /v1/* via reverse proxy (cookie or bearer; direct tailnet trusted)");
+    }
+    else {
+        app.log.info("auth: disabled (set BOTNOTE_REQUIRE_AUTH=1 to enforce)");
+    }
+    await registerRoutes(app, { db: opts.db, embedding: opts.embedding });
+    const webDist = resolveWebDist(opts.webDist);
+    if (webDist) {
+        await app.register(fastifyStatic, {
+            root: webDist,
+            prefix: "/",
+            // wildcard: true lets fastify-static answer for every file under root
+            // (notably /assets/<hash>.js / .css). Without it, those paths fall
+            // through to the not-found handler and the SPA fallback sends back
+            // index.html — the browser then tries to parse HTML as a JS module and
+            // the page renders blank.
+            wildcard: true,
+            decorateReply: true,
+            cacheControl: true,
+            maxAge: "1d",
+            immutable: false
+        });
+        const indexHtmlPath = path.join(webDist, "index.html");
+        // Re-read on each request. The file is ~700 bytes so the cost is trivial,
+        // and this guarantees we never serve a stale HTML that points to an old
+        // asset hash after `pnpm build` overwrites the bundle — that's how the
+        // page goes blank when the daemon outlives the previous build.
+        const readIndex = () => readFileSync(indexHtmlPath, "utf8");
+        // Explicit `/` route wins over fastify-static's wildcard so the homepage
+        // always serves fresh HTML with no-cache, sidestepping the long max-age
+        // applied to /assets/*.
+        app.get("/", async (_req, reply) => {
+            reply.type("text/html; charset=utf-8");
+            reply.header("cache-control", "no-cache");
+            return readIndex();
+        });
+        app.setNotFoundHandler(async (req, reply) => {
+            const url = req.url;
+            if (url.startsWith("/v1") ||
+                url.startsWith("/docs") ||
+                url === "/health" ||
+                url.startsWith("/health?") ||
+                url.startsWith("/assets/")) {
+                return reply.code(404).send({ error: "not_found", path: url });
+            }
+            // SPA fallback for client-side routes (/today, /p/:key, etc.). Send the
+            // file fresh from disk with no-cache so the browser never pins it to
+            // an old asset hash after a redeploy.
+            reply.type("text/html; charset=utf-8");
+            reply.header("cache-control", "no-cache");
+            return readIndex();
+        });
+        app.log.info(`web UI served from ${webDist}`);
+    }
+    else {
+        app.log.warn("web/dist not found; UI not served (BOTNOTE_WEB_DIST or build required)");
+    }
+    return app;
+}
+//# sourceMappingURL=server.js.map

package/dist/rest/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/rest/server.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,OAAO,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,OAAsD,MAAM,SAAS,CAAC;AAC7E,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAY7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,QAAiB;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC7C,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,OAAO;QACP,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC;KAC7C,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;8EAC8E;AAC9E,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAa;QACtB,uBAAuB;QACvB,uBAAuB;QACvB,2BAA2B;QAC3B,qBAAqB;KACtB,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;gFAEgF;AAChF,SAAS,QAAQ,CAAC,GAAmB;IACnC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAE3D,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE;QAC1C,4EAA4E;QAC5E,0EAA0E;QAC1E,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC,gBAAgB,EAAmB,CAAC;IAEvC,GAAG,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAC5C,GAAG,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IAE9C,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;QACzB,uEAAuE;QACvE,wEAAwE;QACxE,kDAAkD;QAClD,IAAI,EAAE,WAAW;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,kBAAkB,EAAE;QAC5B,wEAAwE;QACxE,wEAAwE;QACxE,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QACtD,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;QACjD,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC5B,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,CAAC,GAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpD,0EAA0E;QAC1E,4DAA4D;QAC5D,SAAS,EAAE,CAAC,GAAmB,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAClB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACjF,CAAC;QACD,oBAAoB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACpC,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,mCAAmC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI;YACzE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;SACtC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE;YAC1B,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,OAAO;oBAChB,WAAW,EACT,6EAA6E;iBAChF;gBACD,OAAO,EAAE;oBACP;wBACE,GAAG,EAAE,oBAAoB,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE;wBAC3D,WAAW,EAAE,OAAO;qBACrB;iBACF;gBACD,IAAI,EAAE;oBACJ,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE;oBACrE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE;oBACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;oBAC1E,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;oBACpD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,uCAAuC,EAAE;oBACvE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE;iBACzD;aACF;YACD,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC5B,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE;gBACR,YAAY,EAAE,MAAM;gBACpB,WAAW,EAAE,KAAK;aACnB;SACF,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACnD,CAAC;IAED,4BAA4B;IAC5B,2EAA2E;IAC3E,uEAAuE;IACvE,WAAW;IACX,GAAG,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,KAIX,CAAC;QACF,IAAI,mCAAmC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,2CAA2C;gBACpD,OAAO,EAAE,GAAG,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnC,IAAI,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;oBAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;iBACzB,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,MAAM,GAAG,GAAsD,CAAC;QACtE,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;QAC1B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,mBAAmB;IACnB,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,4DAA4D;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IAC7D,IAAI,WAAW,EAAE,CAAC;QAChB,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,uDAAuD;QACvD,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO;YACxC,+DAA+D;YAC/D,sEAAsE;YACtE,8BAA8B;YAC9B,IACE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBACpC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,EACrC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACZ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACxE,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,qCAAqC;YAE5D,sDAAsD;YACtD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC3D,IAAI,OAAO;oBAAE,OAAO;YACtB,CAAC;YAED,gCAAgC;YAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YACvC,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBACnD,IAAI,GAAG;oBAAE,OAAO;YAClB,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,cAAc,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE;YAChC,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;YACX,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,uEAAuE;YACvE,0BAA0B;YAC1B,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,IAAI;YACnB,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvD,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAE5D,yEAAyE;QACzE,wEAAwE;QACxE,wBAAwB;QACxB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACjC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACvC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC1C,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;YACpB,IACE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBACrB,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;gBACvB,GAAG,KAAK,SAAS;gBACjB,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC1B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAC1B,CAAC;gBACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,sCAAsC;YACtC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACvC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC1C,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}