dscs-server 0.0.0-stage → 0.1.0

package/dist/http.js

@@ -0,0 +1,1281 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { createServer } from 'node:http';
+import { PROTOCOL_VERSION, errorBody } from './shared/protocol.js';
+import { SyncError, statusOf } from './shared/wire.js';
+import { BLOB_BATCH_CONTENT_TYPE, MAX_BATCH_BLOBS, MAX_BATCH_BODY_BYTES, decodeBlobBatch, encodeBlobBatch } from './shared/blob-batch.js';
+import { deriveMasterKey, newSalt } from './shared/crypto.js';
+import { hasBlob, putBlob, readBlob } from './blobs.js';
+import { DEFAULT_DATASET, SERVER_SCHEMA_VERSION, adminPassword, blobRecord, isAdminInitialized, markAdminInitialized, readMaxBytes, readMeta, recordBlob, readRevision, setAdminPassword, usedBlobBytes, writeMaxBytes } from './db.js';
+import { MAX_APPEND_BODY_BYTES, adminSessions, appendFrames, deleteSession, getManifest, getV2SessionSummary, listV2Batches, listV2Changes, listV2Sessions, sessionCounts } from './sessions.js';
+import { acquireLease, releaseLease, SYNC_RESOURCE, vaultResource } from './leases.js';
+import { appendVaultRecord, readVaultCursor, readVaultStream, validVaultWriter } from './vault.js';
+function readServerVersion() {
+    try {
+        const raw = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+        return typeof raw.version === 'string' && raw.version !== '' ? raw.version : '0.0.0';
+    } catch  {
+        return '0.0.0';
+    }
+}
+export const SERVER_VERSION = readServerVersion();
+export const DEFAULT_MAX_BYTES = 10 * 1024 * 1024 * 1024;
+export const DEFAULT_MAX_BLOB_BYTES = 32 * 1024 * 1024;
+function readAsset(url) {
+    try {
+        return readFileSync(url);
+    } catch  {
+        return undefined;
+    }
+}
+const LOGO_SVG = readAsset(new URL('../../../assets/logo-dark.svg', import.meta.url));
+const FAVICON_SVG = readAsset(new URL('../../../assets/favicon.svg', import.meta.url));
+function readText(url, label) {
+    try {
+        return readFileSync(url, 'utf8');
+    } catch  {
+        throw new Error(`缺少页面文件：${label}`);
+    }
+}
+const ADMIN_PAGE = readText(new URL('../web/admin.html', import.meta.url), 'admin.html');
+const SETUP_PAGE = readText(new URL('../web/setup.html', import.meta.url), 'setup.html');
+export function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+export function mintToken() {
+    return randomBytes(32).toString('base64url');
+}
+function json(res, status, body) {
+    res.statusCode = status;
+    res.setHeader('content-type', 'application/json; charset=utf-8');
+    res.setHeader('cache-control', 'no-store');
+    res.end(JSON.stringify(body));
+}
+async function readJson(req, limit = 64 * 1024) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req){
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        size += buffer.length;
+        if (size > limit) throw new SyncError('bad-request', `请求体超过上限 ${limit} 字节`);
+        chunks.push(buffer);
+    }
+    const parsed = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new SyncError('bad-request', '请求体必须是 JSON 对象');
+    }
+    return parsed;
+}
+async function readRaw(req, limit) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req){
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        size += buffer.length;
+        if (size > limit) throw new SyncError('bad-request', `请求体超过上限 ${limit} 字节`);
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks);
+}
+function authenticate(db, req) {
+    const header = String(req.headers.authorization ?? '');
+    if (!header.startsWith('Bearer ')) return undefined;
+    const token = header.slice('Bearer '.length).trim();
+    if (token === '') return undefined;
+    const setupToken = readMeta(db, 'setup_token');
+    if (setupToken !== undefined && token === setupToken) return {
+        role: 'admin'
+    };
+    const row = db.handle.prepare('SELECT device_id, label, created_at, last_seen_at, revoked_at FROM devices WHERE dataset = ? AND token_hash = ?').get(DEFAULT_DATASET, hashToken(token));
+    if (row === undefined || row.revoked_at !== null) return undefined;
+    return {
+        role: 'device',
+        device: {
+            deviceId: row.device_id,
+            label: row.label,
+            createdAt: row.created_at,
+            ...row.last_seen_at === null ? {} : {
+                lastSeenAt: row.last_seen_at
+            }
+        }
+    };
+}
+function requireDevice(db, req) {
+    const auth = authenticate(db, req);
+    if (auth === undefined) throw new SyncError('unauthorized', '未知 token');
+    if (auth.role !== 'device') throw new SyncError('unauthorized', '需要设备 token');
+    const declared = req.headers['x-device-id'];
+    if (declared !== undefined && String(declared) !== auth.device.deviceId) {
+        throw new SyncError('unauthorized', 'X-Device-Id 与 token 不匹配');
+    }
+    return auth.device;
+}
+function clientIdFrom(req) {
+    const raw = req.headers['x-client-id'];
+    const value = Array.isArray(raw) ? raw[0] ?? '' : String(raw ?? '');
+    if (!/^[0-9a-f]{16,64}$/u.test(value)) {
+        throw new SyncError('bad-request', '需要 16–64 位十六进制 X-Client-Id');
+    }
+    return value;
+}
+function idempotencyKeyFrom(req) {
+    const raw = req.headers['idempotency-key'];
+    const value = Array.isArray(raw) ? raw[0] ?? '' : String(raw ?? '');
+    if (!/^[A-Za-z0-9._:-]{1,255}$/u.test(value)) {
+        throw new SyncError('bad-request', '需要 1–255 位合法 Idempotency-Key');
+    }
+    return value;
+}
+const SESSION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/u;
+function sessionIdFrom(pathname, pattern) {
+    const match = pattern.exec(pathname);
+    if (match === null) throw new SyncError('bad-request', '会话 id 缺失');
+    const id = decodeURIComponent(match[1]);
+    if (!SESSION_ID_PATTERN.test(id)) throw new SyncError('bad-request', `会话 id 非法：${id}`);
+    return id;
+}
+const MAX_CURSOR_LENGTH = 512;
+function encodeCursor(value) {
+    return Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
+}
+function decodeCursorObject(raw) {
+    if (raw === null || raw === '') return undefined;
+    if (raw.length > MAX_CURSOR_LENGTH || !/^[A-Za-z0-9_-]+$/u.test(raw)) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
+    } catch  {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    return parsed;
+}
+function decodeSessionsCursor(raw) {
+    const value = decodeCursorObject(raw);
+    if (value === undefined) return undefined;
+    if (value['v'] !== 2 || typeof value['after'] !== 'string' || !SESSION_ID_PATTERN.test(value['after'])) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    return value['after'];
+}
+function decodeChangesCursor(raw) {
+    const value = decodeCursorObject(raw);
+    if (value === undefined) {
+        return {
+            revision: 0,
+            tombstone: {
+                deletedAt: 0,
+                sessionId: '',
+                createdAt: 0
+            }
+        };
+    }
+    const revision = value['revision'];
+    const tombstone = value['tombstone'];
+    if (value['v'] !== 2 || typeof revision !== 'number' || !Number.isSafeInteger(revision) || revision < 0 || tombstone === null || typeof tombstone !== 'object' || Array.isArray(tombstone)) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    const record = tombstone;
+    const deletedAt = record['deletedAt'];
+    const sessionId = record['sessionId'];
+    const createdAt = record['createdAt'];
+    const empty = deletedAt === 0 && sessionId === '' && createdAt === 0;
+    if (typeof deletedAt !== 'number' || !Number.isSafeInteger(deletedAt) || deletedAt < 0 || typeof sessionId !== 'string' || !empty && !SESSION_ID_PATTERN.test(sessionId) || typeof createdAt !== 'number' || !Number.isSafeInteger(createdAt) || createdAt < 0) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    return {
+        revision,
+        tombstone: {
+            deletedAt,
+            sessionId,
+            createdAt
+        }
+    };
+}
+function etagMatches(header, digest) {
+    const raw = Array.isArray(header) ? header.join(',') : header;
+    if (raw === undefined) return false;
+    const target = `"${digest}"`;
+    return raw.split(',').some((entry)=>{
+        const value = entry.trim();
+        return value === '*' || value === target || value === `W/${target}`;
+    });
+}
+function parseAppend(body) {
+    if (!Number.isSafeInteger(body.baseIndex)) throw new SyncError('bad-request', 'baseIndex 必须是整数');
+    const baseChainHash = body.baseChainHash;
+    if (baseChainHash !== null && (typeof baseChainHash !== 'string' || !/^[0-9a-f]{64}$/u.test(baseChainHash))) {
+        throw new SyncError('bad-request', 'baseChainHash 必须是 64 位十六进制或 null');
+    }
+    if (!Number.isSafeInteger(body.createdAt) || Number(body.createdAt) < 0) throw new SyncError('bad-request', 'createdAt 必须是非负整数');
+    if (!Number.isSafeInteger(body.formatVersion) || Number(body.formatVersion) < 1) throw new SyncError('bad-request', 'formatVersion 必须是正整数');
+    const refs = body.batches;
+    if (!Array.isArray(refs)) throw new SyncError('bad-request', 'batches 必须是数组');
+    if (body.tailOpen !== undefined && typeof body.tailOpen !== 'boolean') throw new SyncError('bad-request', 'tailOpen 必须是布尔值');
+    if (body.safeThroughSeq !== undefined && (!Number.isSafeInteger(body.safeThroughSeq) || Number(body.safeThroughSeq) < -1)) {
+        throw new SyncError('bad-request', 'safeThroughSeq 必须是不小于 -1 的整数');
+    }
+    if (body.workspaceKey !== undefined && (typeof body.workspaceKey !== 'string' || !/^[A-Za-z0-9_-]{16,64}$/u.test(body.workspaceKey))) {
+        throw new SyncError('bad-request', 'workspaceKey 非法');
+    }
+    return {
+        baseIndex: Number(body.baseIndex),
+        baseChainHash: baseChainHash,
+        createdAt: Number(body.createdAt),
+        formatVersion: Number(body.formatVersion),
+        frames: refs,
+        ...body.tailOpen === undefined ? {} : {
+            tailOpen: body.tailOpen
+        },
+        ...body.safeThroughSeq === undefined ? {} : {
+            safeThroughSeq: Number(body.safeThroughSeq)
+        },
+        ...body.workspaceKey === undefined ? {} : {
+            workspaceKey: body.workspaceKey
+        }
+    };
+}
+function intParam(value, fallback, min, max) {
+    if (value === null) return fallback;
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) throw new SyncError('bad-request', `查询参数必须是整数：${value}`);
+    return Math.min(max, Math.max(min, parsed));
+}
+const SYNC_LEASE_PATH = /^\/v2\/sync\/lease$/u;
+const V2_SESSIONS_PATH = /^\/v2\/sessions$/u;
+const V2_CHANGES_PATH = /^\/v2\/changes$/u;
+const V2_SUMMARY_PATH = /^\/v2\/sessions\/([^/]+)\/summary$/u;
+const V2_BATCHES_PATH = /^\/v2\/sessions\/([^/]+)\/batches$/u;
+const V2_MANIFEST_PATH = /^\/v2\/sessions\/([^/]+)\/manifest$/u;
+const V2_APPEND_PATH = /^\/v2\/sessions\/([^/]+)\/append$/u;
+const V2_DELETE_PATH = /^\/v2\/sessions\/([^/]+)\/delete$/u;
+const DEVICES_PATH = /^\/v2\/devices$/u;
+const DEVICE_PATH = /^\/v2\/devices\/([0-9a-f]+)$/u;
+const BLOB_PATH = /^\/v2\/blobs\/([0-9a-f]{64})$/u;
+const BLOB_BATCH_PATH = /^\/v2\/blobs\/batch$/u;
+const BLOB_BATCH_READ_PATH = /^\/v2\/blobs\/batch\/read$/u;
+const ME_PATH = /^\/v2\/me$/u;
+const VAULT_APPEND_PATH = /^\/v2\/vault\/append$/u;
+const VAULT_LEASE_PATH = /^\/v2\/vault\/lease$/u;
+const VAULT_CURSOR_PATH = /^\/v2\/vault\/cursor$/u;
+const VAULT_STREAM_PATH = /^\/v2\/vault\/stream\/([^/]+)$/u;
+const ADMIN_DEVICE_PATH = /^\/admin\/devices\/([0-9a-f]+)$/u;
+function withBatchFields(value) {
+    if (value === null || typeof value !== 'object') return value;
+    const record = value;
+    const result = {
+        ...record
+    };
+    const refs = Array.isArray(record['batches']) ? record['batches'] : record['frames'];
+    if (Array.isArray(refs)) {
+        result['batches'] = refs;
+        if (typeof record['batchCount'] !== 'number') result['batchCount'] = refs.length;
+        delete result['frames'];
+    }
+    if (record['manifest'] !== null && typeof record['manifest'] === 'object') {
+        result['manifest'] = withBatchFields(record['manifest']);
+    }
+    return result;
+}
+const ADMIN_COOKIE = 'dsh_sync_admin';
+const SETUP_COOKIE = 'dsh_sync_setup';
+const ADMIN_TTL_MS = 12 * 60 * 60 * 1000;
+const SETUP_TTL_MS = 15 * 60 * 1000;
+export const ONBOARDING_TTL_MS = 10 * 60 * 1000;
+export const ONBOARDING_CODE_FILE = 'onboarding-code.json';
+const ONBOARDING_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+const MIN_MAX_BYTES = 16 * 1024 * 1024;
+const MAX_MAX_BYTES = 1024 * 1024 * 1024 * 1024;
+export function mintOnboardingCode() {
+    const bytes = randomBytes(8);
+    let raw = '';
+    for (const byte of bytes)raw += ONBOARDING_ALPHABET[byte % ONBOARDING_ALPHABET.length];
+    return `${raw.slice(0, 4)}-${raw.slice(4)}`;
+}
+function normalizeOnboardingCode(raw) {
+    return raw.toUpperCase().replace(/[^A-Z0-9]/gu, '');
+}
+export function validateAdminPassword(password) {
+    if (typeof password !== 'string') return '密码不能为空';
+    if (password.length < 6) return '密码至少 6 位';
+    if (password.length > 128) return '密码不能超过 128 位';
+    const classes = [
+        /[A-Za-z]/u,
+        /[0-9]/u,
+        /[^A-Za-z0-9]/u
+    ].filter((pattern)=>pattern.test(password)).length;
+    if (classes < 2) return '密码需要包含字母、数字、特殊字符中的至少两类';
+    return undefined;
+}
+function cookieValue(req, name) {
+    const header = req.headers.cookie;
+    if (typeof header !== 'string') return undefined;
+    for (const part of header.split(';')){
+        const separator = part.indexOf('=');
+        if (separator === -1) continue;
+        if (part.slice(0, separator).trim() === name) return part.slice(separator + 1).trim();
+    }
+    return undefined;
+}
+function writeAdminCookie(res, token, maxAgeSeconds) {
+    res.appendHeader('set-cookie', `${ADMIN_COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${maxAgeSeconds}`);
+}
+function writeSetupCookie(res, token, maxAgeSeconds) {
+    res.appendHeader('set-cookie', `${SETUP_COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/setup; Max-Age=${maxAgeSeconds}`);
+}
+export function createDevice(db, label) {
+    const deviceId = randomBytes(8).toString('hex');
+    const token = mintToken();
+    const now = Date.now();
+    db.handle.prepare('INSERT INTO devices (dataset, device_id, label, token_hash, created_at) VALUES (?, ?, ?, ?, ?)').run(DEFAULT_DATASET, deviceId, label, hashToken(token), now);
+    return {
+        device: {
+            deviceId,
+            label,
+            createdAt: now
+        },
+        token
+    };
+}
+export function listDevices(db) {
+    const rows = db.handle.prepare('SELECT device_id, label, created_at, last_seen_at FROM devices WHERE dataset = ? AND revoked_at IS NULL ORDER BY created_at').all(DEFAULT_DATASET);
+    return rows.map((row)=>({
+            deviceId: row.device_id,
+            label: row.label,
+            createdAt: row.created_at,
+            ...row.last_seen_at === null ? {} : {
+                lastSeenAt: row.last_seen_at
+            }
+        }));
+}
+export function revokeDevice(db, deviceId) {
+    const result = db.handle.prepare('UPDATE devices SET revoked_at = ? WHERE dataset = ? AND device_id = ? AND revoked_at IS NULL').run(Date.now(), DEFAULT_DATASET, deviceId);
+    return Number(result.changes) > 0;
+}
+export function createHttpServer(options) {
+    const { db } = options;
+    const version = options.version ?? SERVER_VERSION;
+    const maxBlobBytes = options.maxBlobBytes ?? DEFAULT_MAX_BLOB_BYTES;
+    const defaultMaxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+    const effectiveMaxBytes = ()=>readMaxBytes(db, defaultMaxBytes);
+    const adminSessionsByKey = new Map();
+    const setupSessionsByKey = new Map();
+    const attemptsByKey = new Map();
+    const onboarding = {
+        codeHash: options.onboardingCode === undefined ? undefined : hashToken(normalizeOnboardingCode(options.onboardingCode)),
+        expiresAt: Date.now() + ONBOARDING_TTL_MS
+    };
+    function requireAdmin(req) {
+        const token = cookieValue(req, ADMIN_COOKIE);
+        if (token === undefined) throw new SyncError('unauthorized', '需要登录管理台');
+        const key = hashToken(token);
+        const expiresAt = adminSessionsByKey.get(key);
+        if (expiresAt === undefined || expiresAt <= Date.now()) {
+            adminSessionsByKey.delete(key);
+            throw new SyncError('unauthorized', '管理台会话已过期');
+        }
+    }
+    function requireSetup(req) {
+        const token = cookieValue(req, SETUP_COOKIE);
+        if (token === undefined) throw new SyncError('unauthorized', '请先验证初始化密钥');
+        const key = hashToken(token);
+        const expiresAt = setupSessionsByKey.get(key);
+        if (expiresAt === undefined || expiresAt <= Date.now()) {
+            setupSessionsByKey.delete(key);
+            throw new SyncError('unauthorized', '初始化会话已过期，请重新验证密钥');
+        }
+    }
+    function issueAdminSession(res) {
+        const token = randomBytes(32).toString('base64url');
+        const expiresAt = Date.now() + ADMIN_TTL_MS;
+        adminSessionsByKey.set(hashToken(token), expiresAt);
+        writeAdminCookie(res, token, Math.floor(ADMIN_TTL_MS / 1000));
+        return expiresAt;
+    }
+    function guardAttempts(key) {
+        const now = Date.now();
+        const entry = attemptsByKey.get(key);
+        if (entry === undefined || entry.resetAt <= now) {
+            attemptsByKey.set(key, {
+                count: 0,
+                resetAt: now + 10 * 60 * 1000
+            });
+            return;
+        }
+        if (entry.count >= 10) throw new SyncError('rate-limited', '尝试过于频繁，请稍后再试');
+    }
+    function noteFailure(key) {
+        const entry = attemptsByKey.get(key);
+        if (entry !== undefined) entry.count += 1;
+    }
+    function passwordMatches(submitted) {
+        const stored = adminPassword(db);
+        if (stored === undefined || submitted.length === 0) return false;
+        const derived = deriveMasterKey(submitted, Buffer.from(stored.salt, 'hex'));
+        const actual = Buffer.from(stored.hash, 'hex');
+        return derived.length === actual.length && timingSafeEqual(derived, actual);
+    }
+    const routes = [
+        {
+            method: 'GET',
+            path: /^\/health$/,
+            handler: async (_req, res)=>{
+                json(res, 200, {
+                    ok: true,
+                    server: {
+                        version,
+                        apiVersions: [
+                            2
+                        ],
+                        protocols: [
+                            PROTOCOL_VERSION
+                        ],
+                        schemaVersion: SERVER_SCHEMA_VERSION,
+                        capabilities: [
+                            'session-summary',
+                            'changes-cursor',
+                            'conditional-get',
+                            'idempotent-append',
+                            'manifest-digest',
+                            'batches',
+                            'batch-upload',
+                            'batch-download',
+                            'zstd-frame'
+                        ],
+                        limits: {
+                            batchBytes: MAX_BATCH_BODY_BYTES,
+                            batchBlobs: MAX_BATCH_BLOBS,
+                            blobBytes: maxBlobBytes
+                        }
+                    },
+                    now: Date.now()
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_SESSIONS_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const after = decodeSessionsCursor(url.searchParams.get('cursor'));
+                const limit = intParam(url.searchParams.get('limit'), 200, 1, 1000);
+                const page = listV2Sessions(db, after, limit);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        sessions: page.sessions,
+                        nextCursor: page.nextSessionId === null ? null : encodeCursor({
+                            v: 2,
+                            after: page.nextSessionId
+                        })
+                    }
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_CHANGES_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const cursor = decodeChangesCursor(url.searchParams.get('cursor'));
+                const limit = intParam(url.searchParams.get('limit'), 200, 1, 1000);
+                const page = listV2Changes(db, cursor.revision, cursor.tombstone, limit);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        sessions: page.sessions,
+                        tombstones: page.tombstones,
+                        nextCursor: encodeCursor({
+                            v: 2,
+                            revision: page.nextRevision,
+                            tombstone: page.nextTombstone
+                        }),
+                        hasMore: page.hasMore
+                    }
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_SUMMARY_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_SUMMARY_PATH);
+                const summary = getV2SessionSummary(db, id);
+                if (summary === undefined) return json(res, 404, errorBody('not-found', `没有会话 ${id}`));
+                res.setHeader('etag', `"${summary.manifestDigest}"`);
+                if (etagMatches(req.headers['if-none-match'], summary.manifestDigest)) {
+                    res.statusCode = 304;
+                    res.end();
+                    return;
+                }
+                return json(res, 200, {
+                    ok: true,
+                    value: summary
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_BATCHES_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const id = sessionIdFrom(url.pathname, V2_BATCHES_PATH);
+                const from = intParam(url.searchParams.get('from'), 0, 0, Number.MAX_SAFE_INTEGER);
+                const limit = intParam(url.searchParams.get('limit'), 500, 1, 1000);
+                const expected = url.searchParams.get('expectedManifestDigest');
+                if (expected !== null && !/^[0-9a-f]{64}$/u.test(expected)) {
+                    throw new SyncError('bad-request', 'expectedManifestDigest 必须是 64 位十六进制');
+                }
+                const page = listV2Batches(db, id, from, limit);
+                if (page === undefined) return json(res, 404, errorBody('not-found', `没有会话 ${id}`));
+                if (expected !== null && expected !== page.manifestDigest) {
+                    throw new SyncError('conflict', 'manifest 已变化，请重新读取摘要');
+                }
+                return json(res, 200, {
+                    ok: true,
+                    value: page
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: V2_APPEND_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                const idempotencyKey = idempotencyKeyFrom(req);
+                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_APPEND_PATH);
+                const body = await readJson(req, MAX_APPEND_BODY_BYTES);
+                const parsed = parseAppend(body);
+                const value = appendFrames(db, options.dataDir, {
+                    sessionId: id,
+                    deviceId: device.deviceId,
+                    clientId,
+                    idempotencyKey,
+                    ...parsed
+                });
+                return json(res, 200, {
+                    ok: true,
+                    value
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_MANIFEST_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_MANIFEST_PATH);
+                const found = getManifest(db, id);
+                if (found === undefined) return json(res, 404, errorBody('not-found', `没有会话 ${id}`));
+                return json(res, 200, {
+                    ok: true,
+                    value: withBatchFields(found)
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: V2_DELETE_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_DELETE_PATH);
+                const body = await readJson(req);
+                if (!Number.isSafeInteger(body.createdAt)) throw new SyncError('bad-request', 'createdAt 必须是整数');
+                return json(res, 200, {
+                    ok: true,
+                    value: deleteSession(db, id, device.deviceId, clientId, Number(body.createdAt))
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: DEVICES_PATH,
+            handler: async (req, res)=>{
+                const auth = authenticate(db, req);
+                if (auth?.role !== 'admin') return json(res, 401, errorBody('unauthorized', '需要 setup token'));
+                const body = await readJson(req);
+                const label = typeof body.label === 'string' && body.label.trim() !== '' ? body.label.trim() : 'device';
+                const created = createDevice(db, label);
+                return json(res, 201, {
+                    ok: true,
+                    value: created
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: DEVICES_PATH,
+            handler: async (req, res)=>{
+                const auth = authenticate(db, req);
+                if (auth?.role !== 'admin') return json(res, 401, errorBody('unauthorized', '需要 setup token'));
+                return json(res, 200, {
+                    ok: true,
+                    value: listDevices(db)
+                });
+            }
+        },
+        {
+            method: 'DELETE',
+            path: DEVICE_PATH,
+            handler: async (req, res)=>{
+                const auth = authenticate(db, req);
+                if (auth?.role !== 'admin') return json(res, 401, errorBody('unauthorized', '需要 setup token'));
+                const match = DEVICE_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                if (match === null) return json(res, 404, errorBody('not-found', '没有这个设备'));
+                const revoked = revokeDevice(db, match[1]);
+                return revoked ? json(res, 200, {
+                    ok: true,
+                    value: {
+                        deviceId: match[1],
+                        revoked: true
+                    }
+                }) : json(res, 404, errorBody('not-found', '没有这个设备'));
+            }
+        },
+        {
+            method: 'POST',
+            path: BLOB_BATCH_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const body = await readRaw(req, MAX_BATCH_BODY_BYTES);
+                const entries = decodeBlobBatch(body);
+                const results = [];
+                const fresh = new Map();
+                for (const entry of entries){
+                    const actual = createHash('sha256').update(entry.data).digest('hex');
+                    if (actual !== entry.sha256) {
+                        throw new SyncError('bad-request', `批量 blob 的哈希不匹配：${entry.sha256}`);
+                    }
+                    const existing = blobRecord(db, actual);
+                    if (existing !== undefined || fresh.has(actual)) {
+                        results.push({
+                            sha256: actual,
+                            bytes: entry.data.length,
+                            dedup: true
+                        });
+                        continue;
+                    }
+                    fresh.set(actual, {
+                        kind: entry.kind,
+                        data: entry.data
+                    });
+                    results.push({
+                        sha256: actual,
+                        bytes: entry.data.length,
+                        dedup: false
+                    });
+                }
+                const newBytes = [
+                    ...fresh.values()
+                ].reduce((sum, entry)=>sum + entry.data.length, 0);
+                const used = usedBlobBytes(db);
+                const limit = effectiveMaxBytes();
+                if (used + newBytes > limit) {
+                    throw new SyncError('quota', `存储超额：已用 ${used} 字节，本批新增 ${newBytes} 字节，上限 ${limit} 字节`);
+                }
+                for (const [sha256, entry] of fresh){
+                    await putBlob(options.dataDir, entry.data);
+                    recordBlob(db, sha256, entry.data.length, entry.kind);
+                }
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        blobs: results
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: BLOB_BATCH_READ_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const body = await readJson(req);
+                const raw = body.sha256;
+                if (!Array.isArray(raw) || raw.length < 1 || raw.length > MAX_BATCH_BLOBS) {
+                    throw new SyncError('bad-request', `sha256 必须是 1–${MAX_BATCH_BLOBS} 个数组项`);
+                }
+                const hashes = [];
+                for (const value of raw){
+                    if (typeof value !== 'string' || !/^[0-9a-f]{64}$/u.test(value)) {
+                        throw new SyncError('bad-request', 'sha256 必须是 64 位小写十六进制');
+                    }
+                    hashes.push(value);
+                }
+                const kinds = [];
+                for (const sha256 of hashes){
+                    if (!await hasBlob(options.dataDir, sha256)) return json(res, 404, errorBody('not-found', `没有这个 blob：${sha256}`));
+                    const record = blobRecord(db, sha256);
+                    if (record === undefined) return json(res, 404, errorBody('not-found', `没有这个 blob：${sha256}`));
+                    if (record.kind !== 'frame' && record.kind !== 'attachment' && record.kind !== 'vault') {
+                        throw new SyncError('bad-request', `blob 类别非法：${record.kind}`);
+                    }
+                    kinds.push(record.kind);
+                }
+                const blobs = [];
+                for(let index = 0; index < hashes.length; index += 1){
+                    blobs.push({
+                        kind: kinds[index],
+                        data: await readBlob(options.dataDir, hashes[index])
+                    });
+                }
+                let encoded;
+                try {
+                    encoded = encodeBlobBatch(blobs);
+                } catch (error) {
+                    throw new SyncError('bad-request', error instanceof Error ? error.message : String(error));
+                }
+                res.statusCode = 200;
+                res.setHeader('content-type', BLOB_BATCH_CONTENT_TYPE);
+                res.setHeader('content-length', encoded.length);
+                res.setHeader('cache-control', 'no-store');
+                res.end(encoded);
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/v2\/blobs$/,
+            handler: async (req, res)=>{
+                const auth = authenticate(db, req);
+                if (auth === undefined) return json(res, 401, errorBody('unauthorized', '需要设备或 setup token'));
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const kind = url.searchParams.get('kind') ?? 'frame';
+                if (kind !== 'frame' && kind !== 'attachment' && kind !== 'vault') {
+                    return json(res, 400, errorBody('bad-request', 'kind 只能是 frame、attachment 或 vault'));
+                }
+                const bytes = await readRaw(req, maxBlobBytes);
+                if (bytes.length === 0) return json(res, 400, errorBody('bad-request', 'blob 不能为空'));
+                const sha256 = createHash('sha256').update(bytes).digest('hex');
+                const existing = blobRecord(db, sha256);
+                if (existing !== undefined) return json(res, 200, {
+                    ok: true,
+                    value: {
+                        sha256,
+                        bytes: existing.bytes,
+                        dedup: true
+                    }
+                });
+                const used = usedBlobBytes(db);
+                const limit = effectiveMaxBytes();
+                if (used + bytes.length > limit) {
+                    throw new SyncError('quota', `存储超额：已用 ${used} 字节，上限 ${limit} 字节`);
+                }
+                const stored = await putBlob(options.dataDir, bytes);
+                recordBlob(db, stored.sha256, stored.bytes, kind);
+                return json(res, 201, {
+                    ok: true,
+                    value: {
+                        sha256: stored.sha256,
+                        bytes: stored.bytes,
+                        dedup: false
+                    }
+                });
+            }
+        },
+        {
+            method: 'HEAD',
+            path: BLOB_PATH,
+            handler: async (req, res)=>{
+                const auth = authenticate(db, req);
+                if (auth === undefined) {
+                    res.statusCode = 401;
+                    res.end();
+                    return;
+                }
+                const match = BLOB_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                res.statusCode = match !== null && await hasBlob(options.dataDir, match[1]) ? 200 : 404;
+                res.end();
+            }
+        },
+        {
+            method: 'GET',
+            path: BLOB_PATH,
+            handler: async (req, res)=>{
+                const auth = authenticate(db, req);
+                if (auth === undefined) return json(res, 401, errorBody('unauthorized', '需要设备或 setup token'));
+                const match = BLOB_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                if (match === null) return json(res, 404, errorBody('not-found', '没有这个 blob'));
+                const sha256 = match[1];
+                if (!await hasBlob(options.dataDir, sha256)) return json(res, 404, errorBody('not-found', '没有这个 blob'));
+                const bytes = await readBlob(options.dataDir, sha256);
+                res.statusCode = 200;
+                res.setHeader('content-type', 'application/octet-stream');
+                res.setHeader('content-length', bytes.length);
+                res.end(bytes);
+            }
+        },
+        {
+            method: 'POST',
+            path: SYNC_LEASE_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                return json(res, 200, {
+                    ok: true,
+                    value: acquireLease(db, SYNC_RESOURCE, device.deviceId, clientId)
+                });
+            }
+        },
+        {
+            method: 'DELETE',
+            path: SYNC_LEASE_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        released: releaseLease(db, SYNC_RESOURCE, device.deviceId, clientId)
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: VAULT_LEASE_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                const resource = vaultResource(device.deviceId);
+                return json(res, 200, {
+                    ok: true,
+                    value: acquireLease(db, resource, device.deviceId, clientId)
+                });
+            }
+        },
+        {
+            method: 'DELETE',
+            path: VAULT_LEASE_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                const resource = vaultResource(device.deviceId);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        released: releaseLease(db, resource, device.deviceId, clientId)
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: VAULT_APPEND_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                const body = await readJson(req);
+                const writer = typeof body.writer === 'string' ? body.writer : device.deviceId;
+                if (writer !== device.deviceId) throw new SyncError('bad-request', 'writer 必须等于当前 deviceId');
+                const sealedRaw = body.sealed;
+                if (sealedRaw === null || typeof sealedRaw !== 'object' || Array.isArray(sealedRaw)) {
+                    throw new SyncError('bad-request', 'sealed 必须是对象');
+                }
+                const sealed = sealedRaw;
+                const result = appendVaultRecord(db, options.dataDir, {
+                    writer,
+                    deviceId: device.deviceId,
+                    clientId,
+                    seq: Number(body.seq),
+                    prevHash: body.prevHash === null ? null : String(body.prevHash),
+                    blobSha256: typeof body.blobSha256 === 'string' ? body.blobSha256 : '',
+                    bytes: Number(body.bytes),
+                    createdAt: Number(body.createdAt),
+                    sealed: {
+                        formatVersion: Number(sealed.formatVersion),
+                        keyId: typeof sealed.keyId === 'string' ? sealed.keyId : ''
+                    }
+                });
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        ...result.record,
+                        dedup: result.dedup
+                    }
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: VAULT_CURSOR_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const since = intParam(url.searchParams.get('since'), 0, 0, Number.MAX_SAFE_INTEGER);
+                const limit = intParam(url.searchParams.get('limit'), 200, 1, 500);
+                return json(res, 200, {
+                    ok: true,
+                    value: readVaultCursor(db, since, limit)
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: VAULT_STREAM_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const match = VAULT_STREAM_PATH.exec(url.pathname);
+                if (match === null) throw new SyncError('bad-request', '缺少 writer');
+                const writer = decodeURIComponent(match[1]);
+                if (!validVaultWriter(writer)) throw new SyncError('bad-request', 'writer 非法');
+                const from = intParam(url.searchParams.get('from'), 1, 1, Number.MAX_SAFE_INTEGER);
+                const limit = intParam(url.searchParams.get('limit'), 200, 1, 500);
+                return json(res, 200, {
+                    ok: true,
+                    value: readVaultStream(db, writer, from, limit)
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/admin\/login$/u,
+            handler: async (req, res)=>{
+                if (!isAdminInitialized(db)) throw new SyncError('conflict', '请先完成初始化');
+                const ip = req.socket.remoteAddress ?? 'unknown';
+                guardAttempts(`login:${ip}`);
+                const body = await readJson(req);
+                const password = typeof body.password === 'string' ? body.password : '';
+                if (!passwordMatches(password)) {
+                    noteFailure(`login:${ip}`);
+                    throw new SyncError('unauthorized', '密码不正确');
+                }
+                attemptsByKey.delete(`login:${ip}`);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        expiresAt: issueAdminSession(res)
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/admin\/logout$/u,
+            handler: async (req, res)=>{
+                const token = cookieValue(req, ADMIN_COOKIE);
+                if (token !== undefined) adminSessionsByKey.delete(hashToken(token));
+                writeAdminCookie(res, '', 0);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        loggedOut: true
+                    }
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: /^\/setup\/state$/u,
+            handler: async (_req, res)=>{
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        initialized: isAdminInitialized(db),
+                        hasPassword: adminPassword(db) !== undefined,
+                        hasQuota: readMeta(db, 'max_bytes') !== undefined,
+                        devices: listDevices(db).length
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/setup\/verify$/u,
+            handler: async (req, res)=>{
+                if (isAdminInitialized(db)) throw new SyncError('conflict', '已经完成初始化');
+                const ip = req.socket.remoteAddress ?? 'unknown';
+                guardAttempts(`verify:${ip}`);
+                if (onboarding.codeHash === undefined || Date.now() > onboarding.expiresAt) {
+                    throw new SyncError('unauthorized', '初始化密钥已过期，请重启服务');
+                }
+                const body = await readJson(req);
+                const submitted = normalizeOnboardingCode(typeof body.code === 'string' ? body.code : '');
+                const actual = Buffer.from(hashToken(submitted), 'hex');
+                const expected = Buffer.from(onboarding.codeHash, 'hex');
+                if (submitted.length === 0 || actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+                    noteFailure(`verify:${ip}`);
+                    throw new SyncError('unauthorized', '初始化密钥不正确');
+                }
+                attemptsByKey.delete(`verify:${ip}`);
+                const token = randomBytes(32).toString('base64url');
+                const expiresAt = Date.now() + SETUP_TTL_MS;
+                setupSessionsByKey.set(hashToken(token), expiresAt);
+                writeSetupCookie(res, token, Math.floor(SETUP_TTL_MS / 1000));
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        expiresAt
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/setup\/password$/u,
+            handler: async (req, res)=>{
+                requireSetup(req);
+                if (isAdminInitialized(db)) throw new SyncError('conflict', '已经完成初始化');
+                const body = await readJson(req);
+                const problem = validateAdminPassword(body.password);
+                if (problem !== undefined) throw new SyncError('bad-request', problem);
+                const salt = newSalt();
+                setAdminPassword(db, deriveMasterKey(String(body.password), salt).toString('hex'), salt.toString('hex'));
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        passwordSet: true
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/setup\/quota$/u,
+            handler: async (req, res)=>{
+                requireSetup(req);
+                if (isAdminInitialized(db)) throw new SyncError('conflict', '已经完成初始化');
+                const body = await readJson(req);
+                if (!Number.isSafeInteger(body.maxBytes)) throw new SyncError('bad-request', '配额必须是整数');
+                const maxBytes = Number(body.maxBytes);
+                if (maxBytes < MIN_MAX_BYTES || maxBytes > MAX_MAX_BYTES) throw new SyncError('bad-request', '配额超出允许范围');
+                writeMaxBytes(db, maxBytes);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        maxBytes
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/setup\/device$/u,
+            handler: async (req, res)=>{
+                requireSetup(req);
+                if (isAdminInitialized(db)) throw new SyncError('conflict', '已经完成初始化');
+                const body = await readJson(req);
+                const label = typeof body.label === 'string' && body.label.trim() !== '' ? body.label.trim() : 'device';
+                return json(res, 201, {
+                    ok: true,
+                    value: createDevice(db, label)
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/setup\/complete$/u,
+            handler: async (req, res)=>{
+                requireSetup(req);
+                if (isAdminInitialized(db)) throw new SyncError('conflict', '已经完成初始化');
+                if (adminPassword(db) === undefined) throw new SyncError('conflict', '请先设置密码');
+                markAdminInitialized(db);
+                onboarding.expiresAt = 0;
+                setupSessionsByKey.clear();
+                rmSync(join(options.dataDir, ONBOARDING_CODE_FILE), {
+                    force: true
+                });
+                writeSetupCookie(res, '', 0);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        redirect: '/admin',
+                        expiresAt: issueAdminSession(res)
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/admin\/quota$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const body = await readJson(req);
+                if (!Number.isSafeInteger(body.maxBytes)) throw new SyncError('bad-request', '配额必须是整数');
+                const maxBytes = Number(body.maxBytes);
+                if (maxBytes < MIN_MAX_BYTES || maxBytes > MAX_MAX_BYTES) throw new SyncError('bad-request', '配额超出允许范围');
+                writeMaxBytes(db, maxBytes);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        maxBytes
+                    }
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: /^\/admin\/overview$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const counts = sessionCounts(db);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        version,
+                        protocol: PROTOCOL_VERSION,
+                        revision: readRevision(db),
+                        devices: listDevices(db).length,
+                        sessions: counts.total,
+                        deletedSessions: counts.deleted,
+                        usedBytes: usedBlobBytes(db),
+                        maxBytes: effectiveMaxBytes()
+                    }
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: /^\/admin\/devices$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                return json(res, 200, {
+                    ok: true,
+                    value: listDevices(db)
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/admin\/devices$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const body = await readJson(req);
+                const label = typeof body.label === 'string' && body.label.trim() !== '' ? body.label.trim() : 'device';
+                return json(res, 201, {
+                    ok: true,
+                    value: createDevice(db, label)
+                });
+            }
+        },
+        {
+            method: 'DELETE',
+            path: ADMIN_DEVICE_PATH,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                const match = ADMIN_DEVICE_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                if (match === null) return json(res, 404, errorBody('not-found', '没有这个设备'));
+                return revokeDevice(db, match[1]) ? json(res, 200, {
+                    ok: true,
+                    value: {
+                        deviceId: match[1],
+                        revoked: true
+                    }
+                }) : json(res, 404, errorBody('not-found', '没有这个设备'));
+            }
+        },
+        {
+            method: 'GET',
+            path: /^\/admin\/sessions$/u,
+            handler: async (req, res)=>{
+                requireAdmin(req);
+                return json(res, 200, {
+                    ok: true,
+                    value: adminSessions(db)
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: ME_PATH,
+            handler: async (req, res)=>{
+                const auth = authenticate(db, req);
+                if (auth === undefined) return json(res, 401, errorBody('unauthorized', '未知 token'));
+                if (auth.role === 'admin') return json(res, 200, {
+                    ok: true,
+                    value: {
+                        role: 'admin'
+                    }
+                });
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        role: 'device',
+                        device: auth.device
+                    }
+                });
+            }
+        }
+    ];
+    return createServer((req, res)=>{
+        const path = new URL(req.url ?? '/', 'http://localhost').pathname;
+        if (path === '/' && req.method === 'GET') {
+            res.writeHead(302, {
+                location: '/admin'
+            });
+            res.end();
+            return;
+        }
+        if ((path === '/admin' || path === '/admin/') && req.method === 'GET') {
+            if (!isAdminInitialized(db)) {
+                res.writeHead(302, {
+                    location: '/setup'
+                });
+                res.end();
+                return;
+            }
+            res.writeHead(200, {
+                'content-type': 'text/html; charset=utf-8',
+                'cache-control': 'no-store'
+            });
+            res.end(ADMIN_PAGE);
+            return;
+        }
+        if ((path === '/setup' || path === '/setup/') && req.method === 'GET') {
+            if (isAdminInitialized(db)) {
+                res.writeHead(302, {
+                    location: '/admin'
+                });
+                res.end();
+                return;
+            }
+            res.writeHead(200, {
+                'content-type': 'text/html; charset=utf-8',
+                'cache-control': 'no-store'
+            });
+            res.end(SETUP_PAGE);
+            return;
+        }
+        if (path === '/logo.svg' && LOGO_SVG !== undefined) {
+            res.writeHead(200, {
+                'content-type': 'image/svg+xml',
+                'cache-control': 'public, max-age=3600'
+            });
+            res.end(LOGO_SVG);
+            return;
+        }
+        if (path === '/favicon.svg' && FAVICON_SVG !== undefined) {
+            res.writeHead(200, {
+                'content-type': 'image/svg+xml',
+                'cache-control': 'public, max-age=86400'
+            });
+            res.end(FAVICON_SVG);
+            return;
+        }
+        const route = routes.find((candidate)=>candidate.method === req.method && candidate.path.test(path));
+        if (route === undefined) {
+            json(res, 404, errorBody('not-found', `没有 ${req.method ?? 'GET'} ${path} 这条路由`));
+            return;
+        }
+        void route.handler(req, res).catch((error)=>{
+            const sync = error instanceof SyncError ? error : undefined;
+            const code = sync?.code ?? 'bad-request';
+            const message = sync?.message ?? (error instanceof Error ? error.message : String(error));
+            json(res, statusOf(code), errorBody(code, message));
+        });
+    });
+}
+
+
+//# sourceURL=http.ts