ldrouter 1.5.1

package/CHANGELOG.md

@@ -0,0 +1,49 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/) and the project adheres to
+[Semantic Versioning](https://semver.org/).
+
+## [1.5.1] - 2026-08-30
+
+### Fixed
+- Self-update reported version `0.0.0` in Docker/direct-node runs where
+  `npm_package_version` is unset; it now reads the version from the
+  package.json on disk.
+
+## [1.5.0] - 2026-08-30
+
+### Added
+- Self-update: check the npm registry for newer versions and update in place
+  from the admin UI (Settings → System). Detects the installing package
+  manager (npm / pnpm / yarn / bun) and restarts the server after installing.
+- `/v1/models` now lists the full routable surface: physical models, enabled
+  combos, and enabled aliases (previously only physical models), honoring
+  per-key model ACLs.
+- Combos created without a slug use their name as the model ID (e.g.
+  `gpt-5.5`), keeping dots intact; an explicit slug still yields
+  `combo/<slug>`. Duplicate IDs across combos/models are rejected.
+- Release tooling: package renamed to `ldrouter` (CLI `ldrouter`), versioning
+  policy documented in CLAUDE.md.
+
+### Fixed
+- `/statistics` stuck on "Loading…": the stats queries ordered by a quoted
+  select alias (`c`), which SQLite rejects ("no such column: c"). They now
+  order by the `COUNT(*)` expression; the page also shows an explicit error
+  state instead of failing silently.
+- Provider actions (test/delete) failed with "Gateway error": bodyless
+  `POST`/`DELETE` calls sent an empty JSON body that Fastify rejects; the
+  client now only sends `content-type: application/json` when a body exists.
+- Provider operations failed with an opaque "Gateway error" when the master
+  key was unset: empty-string env vars (e.g. from docker-compose) shadowed
+  the `master.key` file; config now ignores empty env values. Errors are
+  logged with detail instead of being swallowed.
+- Setup now requires the master encryption key up front (no silent
+  auto-generate) and validates it before creating any state.
+
+## [1.4.2] - 2026-08-29
+
+Baseline release of the LateDev Router gateway: Fastify server, SQLite WAL
+storage, canonical OpenAI/Anthropic protocol layer, combo routing
+(fallback / weighted round-robin), encrypted credentials, admin UI, backup
+& restore, request logs and statistics.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 LateDev Router
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,101 @@
+# LateDev Router
+
+Lightweight self-hosted LLM gateway with a polished admin UI. Presents stable OpenAI-compatible and Anthropic-compatible APIs to clients while routing traffic to one or more upstream providers.
+
+## Features
+
+- OpenAI-compatible and Anthropic-compatible gateways (`/v1/chat/completions`, `/v1/responses`, `/v1/messages`, `/v1/messages/count_tokens`, `/v1/models`)
+- Selective model discovery (Fetch → select → import) with **Select All**
+- Virtual **combos** (fallback or weighted round-robin) and one-hop **aliases**
+- Provider API keys encrypted at rest with AES-256-GCM
+- Per-key `ld-` bearer tokens (SHA-256 digest storage, displayed once)
+- IP allow/deny (IPv4 + IPv6 CIDR), trusted-proxy configuration
+- Rate limits: RPM, TPM, daily/monthly token quotas, concurrency, max output tokens
+- TTL-based gateway response cache (disabled by default) + provider prompt-cache accounting
+- Streaming end-to-end with strict "no fallback after stream content sent" rule
+- Request + attempt logs, statistics (Today / 7d / 30d), retention cleanup
+- Admin TOTP 2FA, Argon2id passwords, recovery codes
+- Immutable audit logs
+- Consistent backup / restore (SQLite snapshot + checksum + schema validation)
+- Prometheus `/metrics`, structured logs, graceful shutdown
+- One distributable npm package, multi-stage Dockerfile, Docker Compose
+
+## Quick start
+
+### Using Docker Compose
+
+```bash
+cp .env.example .env
+# Edit LATEDEV_MASTER_KEY (32+ bytes base64). Generate with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+docker compose up -d
+```
+
+Then visit `http://localhost:8787/` and complete the first-run admin setup.
+
+### Using npm
+
+```bash
+npx latedev-router
+latedev-router --host 0.0.0.0 --port 8787
+```
+
+The data directory defaults to `~/.latedev-router/` and can be overridden via `LATEDEV_DATA_DIR` or `--data-dir`.
+
+## Environment variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `LATEDEV_HOST` | Bind host | `0.0.0.0` |
+| `LATEDEV_PORT` | Bind port | `8787` |
+| `LATEDEV_DATA_DIR` | Persistent data directory | `~/.latedev-router/` |
+| `LATEDEV_MASTER_KEY` | 32-byte base64 key for encrypting provider credentials | _required once providers exist_ |
+| `LATEDEV_TRUST_PROXY` | Number of reverse-proxy hops to trust for X-Forwarded-For | `0` |
+| `LATEDEV_LOG_LEVEL` | trace / debug / info / warn / error / fatal | `info` |
+
+## Public API examples
+
+OpenAI-compatible:
+```bash
+curl http://localhost:8787/v1/chat/completions \
+  -H "Authorization: Bearer ld-..." \
+  -H "content-type: application/json" \
+  -d '{"model":"provider/gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}'
+```
+
+Anthropic-compatible:
+```bash
+curl http://localhost:8787/v1/messages \
+  -H "x-api-key: ld-..." \
+  -H "anthropic-version: 2023-06-01" \
+  -H "content-type: application/json" \
+  -d '{"model":"provider/claude-3-5-sonnet-latest","max_tokens":256,"messages":[{"role":"user","content":"hi"}]}'
+```
+
+## Build & test
+
+```bash
+pnpm install --frozen-lockfile
+pnpm lint
+pnpm typecheck
+pnpm test
+pnpm build
+npm pack --dry-run
+docker build -t latedev-router:test .
+docker compose config
+docker compose up -d
+```
+
+## Development
+
+```bash
+pnpm install
+pnpm dev
+# In another terminal
+pnpm --filter . typecheck
+pnpm test
+```
+
+## Architecture
+
+See `AGENTS.md` and the `docs/` directory for the full specification.

package/dist/cli.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// LateDev Router CLI entry point. The package's "bin" field points here.
+import process from 'node:process';
+async function main() {
+    // Ensure dist/server is importable
+    process.env.LATEDEV_CLI_ENTRY = '1';
+    const { startApp } = await import('./server/app.js');
+    await startApp();
+}
+main().catch((err) => {
+    console.error('Fatal:', err);
+    process.exit(1);
+});

package/dist/server/app.js

@@ -0,0 +1,138 @@
+// Fastify application factory.
+import Fastify from 'fastify';
+import cookie from '@fastify/cookie';
+import helmet from '@fastify/helmet';
+import cors from '@fastify/cors';
+import staticPlugin from '@fastify/static';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadConfig } from './config/index.js';
+import { getLogger } from './logging/logger.js';
+import { openDb, closeDb, getDb, schema } from './db/index.js';
+import { getSettings, markSetupComplete } from './db/repositories/settings.js';
+import { GatewayError, toAnthropicError, toOpenAIError } from './errors.js';
+import { ZodError } from 'zod';
+import { generateRequestId } from './auth/ids.js';
+import { recordAudit } from './db/repositories/audit.js';
+import { isMasterKeyConfigured } from './auth/crypto.js';
+import { registerAdminRoutes } from './routes/admin.js';
+import { registerGatewayRoutes } from './routes/gateway.js';
+import { registerHealthRoutes } from './routes/health.js';
+import { metricsRegistry } from './metrics/registry.js';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+export async function buildApp(opts = {}) {
+    const cfg = loadConfig();
+    const log = getLogger();
+    if (!opts.skipOpenDb)
+        openDb(cfg.dbFile);
+    // Initialize metrics registry after logger is available
+    metricsRegistry.init(log);
+    const app = Fastify({
+        logger: false,
+        bodyLimit: 64 * 1024 * 1024,
+        trustProxy: cfg.trustProxyHops > 0,
+        genReqId: (req) => req.headers['x-request-id'] || generateRequestId(),
+        disableRequestLogging: false,
+    });
+    await app.register(cookie, { secret: cfg.masterKey ?? 'latedev-dev-secret' });
+    await app.register(helmet, {
+        contentSecurityPolicy: false, // we set a permissive one for the admin UI inline bootstrap
+        crossOriginEmbedderPolicy: false,
+    });
+    await app.register(cors, { origin: false, credentials: true });
+    // Per-request logging + error shaping
+    app.addHook('onResponse', async (req, reply) => {
+        reply.header('x-request-id', req.id);
+    });
+    app.setErrorHandler((err, req, reply) => {
+        // Zod validation failures surface as 400 with readable field messages;
+        // otherwise they fall through to the generic 500 "Gateway error" envelope.
+        const normalized = err instanceof ZodError
+            ? new GatewayError('invalid_request_error', err.issues.map((i) => `${i.path.join('.') || 'body'}: ${i.message}`).join('; '), { status: 400 })
+            : err;
+        const g = normalized instanceof GatewayError ? normalized : null;
+        const status = g?.status ?? 500;
+        const requestId = req.id;
+        // Fastify runs with `logger: false`, so req.log is a silent no-op — use the app
+        // logger so failures actually show up in `docker logs`.
+        const log = getLogger();
+        const errMsg = normalized instanceof Error ? normalized.message : String(normalized);
+        const errDetail = {
+            name: normalized instanceof Error ? normalized.name : undefined,
+            message: errMsg,
+            stack: normalized instanceof Error ? normalized.stack : undefined,
+        };
+        if (status >= 500)
+            log.error({ requestId, url: req.url, err: errDetail }, 'request error');
+        else
+            log.warn({ requestId, url: req.url, err: { type: (g?.type ?? 'error'), message: errMsg } }, 'request rejected');
+        const accept = (req.headers['accept'] ?? '').toString();
+        const isAnthropic = accept.includes('application/vnd.anthropic') || req.url.includes('/v1/messages');
+        if (g) {
+            reply.code(status).send(isAnthropic ? toAnthropicError(g, requestId) : toOpenAIError(g, requestId));
+            return;
+        }
+        const e = new GatewayError('gateway_error', 'Internal gateway error', { safe: false, cause: err });
+        reply.code(500).send(isAnthropic ? toAnthropicError(e, requestId) : toOpenAIError(e, requestId));
+    });
+    // Static admin UI (if built). The not-found handler is registered once:
+    // with a built UI it serves the SPA index.html for non-API paths; without it,
+    // every miss returns a JSON 404 in the requesting protocol's shape.
+    const webDist = path.resolve(__dirname, '../web');
+    const hasWeb = fs.existsSync(webDist);
+    app.setNotFoundHandler((req, reply) => {
+        if (req.url.startsWith('/api') || req.url.startsWith('/v1') || req.url.startsWith('/health') || req.url.startsWith('/ready') || req.url.startsWith('/metrics') || !hasWeb) {
+            const e = new GatewayError('invalid_request_error', 'Route not found', { status: 404 });
+            reply.code(404).send(toOpenAIError(e, req.id));
+            return;
+        }
+        reply.type('text/html').send(fs.readFileSync(path.join(webDist, 'index.html')));
+    });
+    if (hasWeb) {
+        await app.register(staticPlugin, { root: webDist, prefix: '/', decorateReply: false });
+    }
+    // Operational routes (always available)
+    await registerHealthRoutes(app);
+    // Admin + gateway routes
+    await registerAdminRoutes(app);
+    await registerGatewayRoutes(app);
+    // On startup: ensure settings row + detect master key status
+    app.addHook('onReady', async () => {
+        const s = getSettings();
+        if (!s.masterKeyConfigured && isMasterKeyConfigured()) {
+            getDb()
+                .update(schema.appSettings)
+                .set({ masterKeyConfigured: true })
+                .where(sql `id=1`)
+                .run();
+        }
+        if (s.setupComplete) {
+            log.info({ dbFile: cfg.dbFile }, 'LateDev Router ready');
+        }
+        else {
+            log.info({ dbFile: cfg.dbFile }, 'LateDev Router ready (first-run setup required)');
+        }
+    });
+    return app;
+}
+export async function startApp() {
+    const cfg = loadConfig();
+    const app = await buildApp();
+    const close = async (signal) => {
+        app.log.info({ signal }, 'shutting down');
+        try {
+            await app.close();
+        }
+        finally {
+            closeDb();
+        }
+    };
+    process.once('SIGTERM', () => void close('SIGTERM'));
+    process.once('SIGINT', () => void close('SIGINT'));
+    await app.listen({ host: cfg.host, port: cfg.port });
+    return app;
+}
+// re-export for convenience
+import { sql } from 'drizzle-orm';
+export { recordAudit, markSetupComplete };

package/dist/server/auth/api-key.js

@@ -0,0 +1,75 @@
+// Gateway API-key authentication: extract credential, hash, compare.
+import { eq, sql } from 'drizzle-orm';
+import { getDb, schema } from '../db/index.js';
+import { sha256Hex } from './ids.js';
+void sha256Hex;
+import { GatewayError } from '../errors.js';
+export function extractBearerToken(header) {
+    if (!header)
+        return null;
+    const m = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return m ? m[1].trim() : null;
+}
+export function extractAnthropicKey(headers) {
+    const v = headers['x-api-key'];
+    if (!v)
+        return null;
+    if (Array.isArray(v))
+        return v[0] ?? null;
+    return v;
+}
+/**
+ * Authenticate a gateway API key. Deterministic precedence:
+ * 1. Authorization: Bearer (OpenAI-style)
+ * 2. x-api-key (Anthropic-style)
+ * Returns null when no credential is present (caller decides 401 vs anonymous).
+ */
+export function authenticateGatewayKey(req) {
+    const bearer = extractBearerToken(Array.isArray(req.headers.authorization) ? req.headers.authorization[0] : req.headers.authorization);
+    const anthropic = extractAnthropicKey(req.headers);
+    let candidate = null;
+    if (bearer && anthropic && bearer !== anthropic) {
+        throw new GatewayError('authentication_error', 'Conflicting credentials', { status: 401 });
+    }
+    if (bearer)
+        candidate = bearer;
+    else if (anthropic)
+        candidate = anthropic;
+    if (!candidate)
+        return null;
+    if (!candidate.startsWith('ld-')) {
+        throw new GatewayError('authentication_error', 'Invalid API key format', { status: 401 });
+    }
+    const digest = sha256Hex(candidate);
+    const db = getDb();
+    const row = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.keyDigest, digest)).get();
+    if (!row) {
+        throw new GatewayError('authentication_error', 'Invalid API key', { status: 401 });
+    }
+    return {
+        id: row.id,
+        name: row.name,
+        keyPrefix: row.keyPrefix,
+        allowAllModels: row.allowAllModels,
+        enabled: row.enabled,
+        expiresAt: row.expiresAt,
+        rpmLimit: row.rpmLimit,
+        tpmLimit: row.tpmLimit,
+        dailyTokenLimit: row.dailyTokenLimit,
+        monthlyTokenLimit: row.monthlyTokenLimit,
+        maxConcurrent: row.maxConcurrent,
+        maxOutputTokensPerRequest: row.maxOutputTokensPerRequest,
+        cacheOverrideEnabled: row.cacheOverrideEnabled,
+    };
+}
+export function keyAllowedFor(key, targetKind, targetId) {
+    if (key.allowAllModels)
+        return true;
+    const db = getDb();
+    const row = db
+        .select()
+        .from(schema.apiKeyModelPermissions)
+        .where(sql `api_key_id = ${key.id} AND target_kind = ${targetKind} AND target_id = ${targetId}`)
+        .get();
+    return Boolean(row);
+}

package/dist/server/auth/crypto.js

@@ -0,0 +1,94 @@
+// Master-key encryption utilities (AES-256-GCM).
+// Provider API keys and sensitive custom headers are encrypted at rest.
+import crypto from 'node:crypto';
+import { loadConfig } from '../config/index.js';
+export class MasterKeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'MasterKeyError';
+    }
+}
+let cachedKey = null;
+let cachedKeyVersion = 1;
+/** Parse a raw master-key string into 32 key bytes. Accepts 32-byte base64
+ *  (44 chars) or a plain 32-character string. Exported so setup can reject
+ *  malformed keys up front instead of failing later at first encrypt. */
+export function parseMasterKey(raw) {
+    let decoded;
+    try {
+        decoded = Buffer.from(raw, 'base64');
+    }
+    catch {
+        decoded = Buffer.alloc(0);
+    }
+    if (decoded.length === 32)
+        return decoded;
+    if (raw.length === 32)
+        return Buffer.from(raw, 'utf8');
+    throw new MasterKeyError('Master key must be 32 bytes encoded as base64 (44 chars) or a plain 32-character string');
+}
+export function getMasterKey() {
+    if (cachedKey)
+        return cachedKey;
+    const cfg = loadConfig();
+    if (!cfg.masterKey) {
+        throw new MasterKeyError('LATEDEV_MASTER_KEY is not configured');
+    }
+    cachedKey = parseMasterKey(cfg.masterKey);
+    return cachedKey;
+}
+export function isMasterKeyConfigured() {
+    return Boolean(loadConfig().masterKey);
+}
+export function masterKeyVersion() {
+    return cachedKeyVersion;
+}
+/** Encrypt a UTF-8 string. Returns { ciphertext (base64), nonce (base64), version }. */
+export function encryptSecret(plain) {
+    const key = getMasterKey();
+    const nonce = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
+    const ct = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        ciphertext: Buffer.concat([ct, tag]).toString('base64'),
+        nonce: nonce.toString('base64'),
+        version: masterKeyVersion(),
+    };
+}
+/** Decrypt an EncryptedPayload. Throws MasterKeyError on failure. */
+export function decryptSecret(payload) {
+    try {
+        const key = getMasterKey();
+        const nonce = Buffer.from(payload.nonce, 'base64');
+        const full = Buffer.from(payload.ciphertext, 'base64');
+        const ct = full.subarray(0, full.length - 16);
+        const tag = full.subarray(full.length - 16);
+        const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+        decipher.setAuthTag(tag);
+        const out = Buffer.concat([decipher.update(ct), decipher.final()]);
+        return out.toString('utf8');
+    }
+    catch (e) {
+        throw new MasterKeyError(`Failed to decrypt secret: ${e.message}`);
+    }
+}
+export function encryptJson(value) {
+    return encryptSecret(JSON.stringify(value));
+}
+export function decryptJson(payload) {
+    return JSON.parse(decryptSecret(payload));
+}
+/** Encrypt custom headers map preserving header names. */
+export function encryptCustomHeaders(headers) {
+    if (!headers || Object.keys(headers).length === 0)
+        return null;
+    return encryptJson(headers);
+}
+export function decryptCustomHeaders(payload) {
+    if (!payload)
+        return {};
+    return decryptJson(payload);
+}
+// --- Hashing helpers ------------------------------------------------------
+export { sha256Hex, timingSafeEqualHex } from './ids.js';

package/dist/server/auth/ids.js

@@ -0,0 +1,40 @@
+// ID generation helpers — stable random IDs + opaque sortable request IDs.
+import crypto from 'node:crypto';
+export function uuid() {
+    return crypto.randomUUID();
+}
+export function randomBytes(n) {
+    return crypto.randomBytes(n);
+}
+/** Opaque sortable-ish request ID: time (ms) base36 + random suffix. */
+export function generateRequestId() {
+    const t = Date.now().toString(36);
+    const r = crypto.randomBytes(6).toString('base64url');
+    return `req_${t}${r}`;
+}
+export function generateSessionToken() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+/** Generate a gateway API key: ld-<base64url(32 bytes)> */
+export function generateApiKeySecret() {
+    const payload = crypto.randomBytes(32).toString('base64url');
+    return `ld-${payload}`;
+}
+export function slugify(input) {
+    return (input
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 64) || 'item');
+}
+export function sha256Hex(input) {
+    return crypto.createHash('sha256').update(input, 'utf8').digest('hex');
+}
+export function timingSafeEqualHex(a, b) {
+    const ba = Buffer.from(a, 'hex');
+    const bb = Buffer.from(b, 'hex');
+    if (ba.length !== bb.length)
+        return false;
+    return crypto.timingSafeEqual(ba, bb);
+}

package/dist/server/auth/middleware.js

@@ -0,0 +1,36 @@
+// Auth middleware: admin session validation.
+import { getDb, schema } from '../db/index.js';
+import { sql } from 'drizzle-orm';
+import { sha256Hex } from './ids.js';
+import { GatewayError } from '../errors.js';
+import { recordAudit } from '../db/repositories/audit.js';
+const SessionCookie = 'ld_session';
+export async function requireAdminAuth(req, _reply) {
+    const token = req.cookies[SessionCookie];
+    if (!token)
+        throw new GatewayError('authentication_error', 'Login required', { status: 401 });
+    const digest = sha256Hex(token);
+    const db = getDb();
+    const session = db
+        .select()
+        .from(schema.adminSessions)
+        .where(sql `token_digest = ${digest}`)
+        .get();
+    if (!session)
+        throw new GatewayError('authentication_error', 'Invalid session', { status: 401 });
+    if (new Date(session.expiresAt).getTime() < Date.now()) {
+        db.delete(schema.adminSessions).where(sql `id = ${session.id}`).run();
+        throw new GatewayError('authentication_error', 'Session expired', { status: 401 });
+    }
+    // Lookup admin by session's owning relationship is implicit (single admin). Get the singleton.
+    const admin = db.select().from(schema.adminAccount).get();
+    if (!admin) {
+        db.delete(schema.adminSessions).where(sql `id = ${session.id}`).run();
+        recordAudit({ action: 'admin.session.invalid', success: false, ip: req.ip });
+        throw new GatewayError('authentication_error', 'Admin account missing', { status: 401 });
+    }
+    // Touch last_seen_at occasionally (cheap update)
+    db.update(schema.adminSessions).set({ lastSeenAt: new Date().toISOString() }).where(sql `id = ${session.id}`).run();
+    req.adminAccount = admin;
+    req.adminSessionId = session.id;
+}

package/dist/server/auth/recovery.js

@@ -0,0 +1,11 @@
+// Recovery code generator.
+import crypto from 'node:crypto';
+export function generateRecoveryCodes(count) {
+    const out = [];
+    for (let i = 0; i < count; i++) {
+        const b = crypto.randomBytes(6);
+        const groups = [b.subarray(0, 3), b.subarray(3, 6)];
+        out.push(groups.map((g) => g.toString('hex').toUpperCase()).join('-'));
+    }
+    return out;
+}