meldivo 1.1.1 → 2.0.0

package/README.md

@@ -77,7 +77,11 @@ project.
 | `meldivo remote cloudflare` | Publish the hub through a Cloudflare quick tunnel. |
 | `meldivo remote certificate` | Publish the hub over HTTPS using your own certificate. |
 | `meldivo remote stop` | Turn remote access off. |
-| `meldivo peer add <name> <link>` | Show another machine's hub (and its sessions) in this one. `meldivo peer` lists peers; `meldivo peer remove <name>` removes one. |
+| `meldivo hub enable` | Make this machine a hub that your other machines join. `meldivo hub disable` turns it off. |
+| `meldivo hub code` | Print a one-time code (10 minutes, single use) and the `meldivo join` command for adding a machine. |
+| `meldivo hub machines` | List the machines that joined this hub. `meldivo hub remove <name>` removes one at once. |
+| `meldivo join <hub-address> <code>` | Join a hub, so this machine's sessions appear there. Options: `--name <name>`, `--allow pi,opencode,claude`, `--speech` (also do speech for the hub). |
+| `meldivo leave` | Leave the hub this machine joined. |
 | `meldivo logs` | Show the service's recent log output. |
 | `meldivo uninstall [--purge]` | Remove the background service. `--purge` also deletes configuration, models, and logs. |
 | `meldivo --version` | Print the installed version. |
@@ -101,28 +105,42 @@ how to trust a certificate on iPhone and Android.
 
 ## Several machines, one hub
 
-Install meldivo on each machine, pick one as the main hub, and add the others
-to it as peers. The main hub then lists every machine with its own new-chat
-tiles and sessions, all behind the main hub's single link. Speech runs on the
-main hub; only the text of each turn travels to the other machine.
+If you use coding agents on more than one computer, make one of them (or a
+small always-on box such as a Raspberry Pi) a **hub**. Every other machine
+joins it and keeps an outbound connection to it, so those machines need no
+open ports. The hub's single link then lists every machine with its sessions
+and new-chat tiles. Only the text of each turn goes to the machine that runs
+it. Speech runs on the hub, or on a faster machine that joins with `--speech`,
+which is recommended when the hub is a small computer.
 
-Peers must be reachable from the main hub over a private network such as a
-VPN. On each other machine:
+On the hub:
 
 ```sh
-MELDIVO_HOST=<vpn-ip> meldivo start   # also listen on the VPN address
-meldivo open                          # prints "Also on http://<vpn-ip>:4100/#token=..."
+meldivo hub enable       # prints the hub link
+meldivo hub code         # prints a one-time code and the join command
 ```
 
-Then on the main hub:
+On each other machine (with meldivo installed and started):
 
 ```sh
-meldivo peer add workstation 'http://<vpn-ip>:4100/#token=...'
+meldivo join http://<hub-address>:4100 <code>
 ```
 
-Peer links are stored in `~/.config/meldivo/peers.json`, readable only by you.
-Never put a peer on a public address: the main hub's link now controls every
-machine it lists.
+The hub address must be reachable from that machine, ideally over a private
+network such as a VPN: set `MELDIVO_HOST=<vpn-ip>` when starting the hub so it
+also listens there. See the [self-hosting guide](docs/self-hosting-hub.md) for
+a full walkthrough, including running the hub on a Raspberry Pi.
+
+How it stays private:
+
+- A machine joins only with a one-time code, and gets its own credential; the
+  hub stores only a hash of it. `meldivo hub remove <name>` cuts a machine off
+  immediately.
+- The hub proves its identity on every connection with a key the machine
+  pinned when it joined, so a machine never talks to a look-alike hub.
+- The hub can only ask a machine to run or cancel a text turn in one of its
+  own sessions, never a command. `--allow` limits which agents it may use.
+- Session lists are kept in memory on the hub, never written to disk.
 
 ## How it works
 
@@ -144,7 +162,7 @@ All settings are optional.
 | `MELDIVO_PORT` | `4100` | Port of the local server (`127.0.0.1` only). |
 | `MELDIVO_HTTPS_PORT` | `4443` | HTTPS port used by the "own certificate" remote option. |
 | `MELDIVO_PUBLIC_URL` | unset | Base URL to print when you run your own reverse proxy. |
-| `MELDIVO_HOST` | unset | Extra addresses to listen on besides `127.0.0.1` (comma-separated), e.g. a VPN address your reverse proxy forwards to. |
+| `MELDIVO_HOST` | unset | Extra addresses to listen on besides `127.0.0.1` (comma-separated), e.g. a VPN address that joined machines or your reverse proxy connect to. |
 | `MELDIVO_MODELS_DIR` | `~/.cache/meldivo/models` | Location of the downloaded speech models. |
 
 ## Files and locations
@@ -152,7 +170,8 @@ All settings are optional.
 | Path | Contents |
 |---|---|
 | `~/.config/meldivo/secret` | The hub's shared secret, generated automatically. |
-| `~/.config/meldivo/peers.json` | Other machines' hubs shown in this one, with their keys. |
+| `~/.config/meldivo/hub.json` | On a machine that joined a hub: the hub's address, this machine's credential, and the hub's pinned key. |
+| `~/.config/meldivo/machines.json`, `hub-key.pem` | On a hub: joined machines (names and credential hashes) and the hub's signing key. |
 | `~/.cache/meldivo/models` | Downloaded speech models. |
 | `~/.local/state/meldivo` | Service logs and runtime state. |
 
@@ -162,7 +181,7 @@ The server listens on `127.0.0.1` only; it is never exposed on the network
 unless you explicitly turn on phone access. Every hub link, local or remote,
 embeds a random token, and requests without it are rejected. Treat the hub
 link like a password: anyone who has it can use every session in the hub,
-including the sessions of every peer machine added to it.
+including the sessions of every machine that joined it.
 
 ## Uninstall
 

package/bin/meldivo.mjs

@@ -42,8 +42,8 @@ function runtimePath() {
   return path.join(configDir(), "runtime.json");
 }
 
-function peersPath() {
-  return path.join(configDir(), "peers.json");
+function hubLinkPath() {
+  return path.join(configDir(), "hub.json");
 }
 
 function pidPath() {
@@ -171,6 +171,7 @@ function serviceEnv(port, httpsPort) {
   if (publicUrl) env.MELDIVO_PUBLIC_URL = publicUrl;
   const host = resolveHost();
   if (host) env.MELDIVO_HOST = host;
+  if (readRuntime().hub) env.MELDIVO_HUB = "1";
   if (process.env.MELDIVO_MODELS_DIR) env.MELDIVO_MODELS_DIR = process.env.MELDIVO_MODELS_DIR;
   env.PATH = servicePath();
   return env;
@@ -312,19 +313,19 @@ function serviceMode() {
   return "detached";
 }
 
-async function cmdStart(args) {
+async function cmdStart(args, { quiet = false } = {}) {
   const foreground = args.includes("--foreground");
   const port = resolvePort();
   const httpsPort = resolveHttpsPort();
   const secret = ensureSecret();
-  writeRuntime({ port, httpsPort, publicUrl: resolvePublicUrl() || undefined, host: resolveHost() || undefined });
+  writeRuntime({ ...readRuntime(), port, httpsPort, publicUrl: resolvePublicUrl() || undefined, host: resolveHost() || undefined });
 
   if (foreground) {
     process.env.MELDIVO_SECRET = secret;
     process.env.MELDIVO_PORT = String(port);
     process.env.MELDIVO_HTTPS_PORT = String(httpsPort);
     const { startServer } = await import(pathToFileURL(serverEntry).href);
-    const server = await startServer({ port, host: "127.0.0.1", secret, httpsPort });
+    const server = await startServer({ port, host: "127.0.0.1", secret, httpsPort, hub: Boolean(readRuntime().hub), version: pkgJson.version });
     console.log(`meldivo running in the foreground on port ${server.port}`);
     await printUrl(secret);
     const shutdown = () => server.close().then(() => process.exit(0));
@@ -337,17 +338,19 @@ async function cmdStart(args) {
   const mode = serviceMode();
   if (mode === "systemd") {
     installSystemdUnit(env);
-    console.log("Installed and started the meldivo systemd user service.");
-    console.log("To keep it running after logout: loginctl enable-linger $USER");
+    if (!quiet) console.log("Installed and started the meldivo systemd user service.");
+    if (!quiet) console.log("To keep it running after logout: loginctl enable-linger $USER");
   } else if (mode === "launchd") {
     installLaunchAgent(env);
-    console.log("Installed and started the meldivo LaunchAgent.");
+    if (!quiet) console.log("Installed and started the meldivo LaunchAgent.");
   } else {
+    stopDetached();
     startDetached(env);
-    console.log(`Started meldivo as a background process (no user service manager found). Logs: ${logPath()}`);
+    if (!quiet) console.log(`Started meldivo as a background process (no user service manager found). Logs: ${logPath()}`);
   }
 
   await waitForHealth(port);
+  if (quiet) return;
   console.log("meldivo is up:");
   await printUrl(secret);
 }
@@ -379,6 +382,8 @@ async function cmdStatus() {
   try {
     const health = await waitForHealth(port, 2_000);
     console.log(`Health: ok, speech=${JSON.stringify(health.speech)}`);
+    if (health.hub) console.log("Hub: on (meldivo hub machines lists joined machines)");
+    if (health.joined) console.log(`Joined hub as "${health.joined.name}": ${health.joined.connected ? "connected" : "not connected"}`);
   } catch {
     console.log("Health: unreachable");
   }
@@ -388,59 +393,9 @@ async function cmdOpen(args) {
   const secret = ensureSecret();
   const url = hubUrl(secret);
   await printUrl(secret).then(() => {}).catch(() => {});
-  // Extra private addresses (MELDIVO_HOST) are what another hub uses with `meldivo peer add`.
-  for (const host of resolveHost().split(",").map((value) => value.trim()).filter((value) => value && value !== "127.0.0.1")) {
-    console.log(`Also on http://${host.includes(":") ? `[${host}]` : host}:${resolvePort()}/#token=${encodeURIComponent(secret)}`);
-  }
   if (args.includes("--browser")) openInBrowser(url);
 }
 
-function readPeers() {
-  try {
-    const peers = JSON.parse(readFileSync(peersPath(), "utf8"));
-    return Array.isArray(peers) ? peers : [];
-  } catch {
-    return [];
-  }
-}
-
-function writePeers(peers) {
-  ensureDir(configDir(), 0o700);
-  writePrivate(peersPath(), JSON.stringify(peers, null, 2));
-}
-
-// Peers are other machines' hubs shown in this one. The hub rereads the file, so no restart is needed.
-function cmdPeer(args) {
-  const [sub, name, link] = args;
-  if (!sub || sub === "list") {
-    const peers = readPeers();
-    if (peers.length === 0) console.log("No peers. Add one with: meldivo peer add <name> <link>");
-    for (const peer of peers) console.log(`${peer.name}\t${peer.url}`);
-    return;
-  }
-  if (sub === "remove" && name) {
-    const peers = readPeers();
-    const remaining = peers.filter((peer) => peer.name !== name);
-    if (remaining.length === peers.length) throw new Error(`No peer named "${name}"`);
-    writePeers(remaining);
-    console.log(`Removed ${name}.`);
-    return;
-  }
-  if (sub === "add" && name && link) {
-    if (!/^[A-Za-z0-9._-]{1,40}$/.test(name)) throw new Error("Peer names may use letters, digits, dot, dash, and underscore");
-    const parsed = new URL(link);
-    const token = decodeURIComponent(/(?:^#|&)token=([^&]+)/.exec(parsed.hash)?.[1] ?? "");
-    if (!token) throw new Error("The link must end in #token=<key> (run `meldivo open` on that machine)");
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error("The link must be http(s)");
-    const peers = readPeers().filter((peer) => peer.name !== name);
-    peers.push({ name, url: parsed.origin, token });
-    writePeers(peers);
-    console.log(`Added ${name} (${parsed.origin}).`);
-    return;
-  }
-  throw new Error("Usage: meldivo peer [list] | add <name> <link> | remove <name>");
-}
-
 function openInBrowser(url) {
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
@@ -489,6 +444,90 @@ async function cmdRemote(args) {
   for (const alt of result.alternatives ?? []) console.log(`Also reachable at: ${alt}`);
 }
 
+// Addresses other machines can use to reach this hub: MELDIVO_HOST addresses, then the public URL.
+function hubAddresses() {
+  const port = resolvePort();
+  const addresses = resolveHost().split(",").map((value) => value.trim()).filter((value) => value && value !== "127.0.0.1")
+    .map((host) => `http://${host.includes(":") ? `[${host}]` : host}:${port}`);
+  if (resolvePublicUrl()) addresses.push(resolvePublicUrl());
+  return addresses.length ? addresses : [baseUrl()];
+}
+
+async function cmdHub(args) {
+  const [sub, name] = args;
+  const secret = ensureSecret();
+  if (sub === "enable" || sub === "disable") {
+    writeRuntime({ ...readRuntime(), hub: sub === "enable" || undefined });
+    await cmdStart([], { quiet: true });
+    if (sub === "disable") {
+      console.log("Hub mode is off. Machines that joined this hub keep trying to reconnect until you run `meldivo leave` on them.");
+      return;
+    }
+    console.log("This machine is now a hub. Open it with:");
+    await printUrl(secret);
+    console.log("To add a machine, run `meldivo hub code` here and follow the instructions it prints.");
+    return;
+  }
+  if (!readRuntime().hub) throw new Error("This machine is not a hub. Turn hub mode on with: meldivo hub enable");
+  if (sub === "code") {
+    const { code, expiresAt } = await apiCall("/api/hub/codes", "POST", secret);
+    const minutes = Math.round((expiresAt - Date.now()) / 60_000);
+    console.log(`One-time code (valid ${minutes} minutes, single use): ${code}`);
+    console.log("\nOn the machine you want to add, run:");
+    for (const address of hubAddresses()) console.log(`  meldivo join ${address} ${code}`);
+    console.log("\nUse an address that machine can reach privately, such as a VPN address (see MELDIVO_HOST).");
+    return;
+  }
+  if (!sub || sub === "machines") {
+    const { machines } = await apiCall("/api/hub/machines", "GET", secret);
+    if (machines.length === 0) console.log("No machines yet. Add one with: meldivo hub code");
+    for (const machine of machines) {
+      console.log(`${machine.name}\t${machine.online ? "online" : "offline"}${machine.version ? `\t${machine.version}` : ""}\tjoined ${new Date(machine.joinedAt).toISOString().slice(0, 10)}`);
+    }
+    return;
+  }
+  if (sub === "remove" && name) {
+    await apiCall(`/api/hub/machines/${encodeURIComponent(name)}`, "DELETE", secret);
+    console.log(`Removed ${name}. It can no longer connect; run \`meldivo leave\` on it to stop it trying.`);
+    return;
+  }
+  throw new Error("Usage: meldivo hub enable | disable | code | machines | remove <name>");
+}
+
+function optionValue(args, flag) {
+  const index = args.indexOf(flag);
+  return index >= 0 ? args[index + 1] : undefined;
+}
+
+async function cmdJoin(args) {
+  const positional = args.filter((arg, index) => !arg.startsWith("--") && !(index > 0 && args[index - 1].startsWith("--")));
+  const [hubAddress, code] = positional;
+  if (!hubAddress || !code) throw new Error("Usage: meldivo join <hub-address> <code> [--name <name>] [--allow pi,opencode,claude] [--speech]");
+  const requestedName = optionValue(args, "--name") ?? os.hostname().split(".")[0].replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 40);
+  const allow = optionValue(args, "--allow")?.split(",").map((id) => id.trim()).filter(Boolean);
+  const url = new URL(hubAddress);
+  if (url.protocol === "http:" && !/^(127\.|localhost$|\[::1\]$)/.test(url.hostname)) {
+    console.log("Note: this hub address is plain http. That is fine on a private VPN; over any other network use https.");
+  }
+  const { joinHub } = await import(pathToFileURL(path.join(pkgRoot, "dist", "server", "machine-client.js")).href);
+  const link = await joinHub(hubAddress, code, requestedName);
+  ensureDir(configDir(), 0o700);
+  const speech = args.includes("--speech") || undefined;
+  writePrivate(hubLinkPath(), JSON.stringify({ ...link, ...(allow?.length ? { allow } : {}), ...(speech ? { speech } : {}) }, null, 2));
+  await cmdStart([], { quiet: true });
+  console.log(`Joined the hub as "${link.name}". This machine's sessions now appear in the hub.`);
+}
+
+async function cmdLeave() {
+  if (!existsSync(hubLinkPath())) {
+    console.log("This machine has not joined a hub.");
+    return;
+  }
+  rmSync(hubLinkPath(), { force: true });
+  await cmdStart([], { quiet: true });
+  console.log("Left the hub. Also remove this machine on the hub with: meldivo hub remove <name>");
+}
+
 async function cmdUninstall(args) {
   await cmdStop();
   const mode = serviceMode();
@@ -524,14 +563,20 @@ function printHelp() {
 Usage: meldivo <command> [options]
 
 Commands:
-  start [--foreground]        Start the meldivo hub as a user service
+  start [--foreground]        Start meldivo as a user service
   stop                        Stop and disable the service
   status                      Show health, speech, and service state
   open [--browser]            Print the hub URL and QR (optionally open it)
   remote [tailscale|cloudflare|certificate|stop]
                                Manage remote access
-  peer [list|add <name> <link>|remove <name>]
-                              Show other machines' hubs in this one (link from their \`meldivo open\`)
+  hub enable|disable          Make this machine a hub that other machines join (or stop)
+  hub code                    Print a one-time code for adding a machine to this hub
+  hub machines                List the machines that joined this hub
+  hub remove <name>           Remove a machine from this hub
+  join <hub-address> <code> [--name <name>] [--allow pi,opencode,claude] [--speech]
+                              Join a hub: this machine's sessions appear there
+                              (--speech: also do speech for the hub)
+  leave                       Leave the hub this machine joined
   uninstall [--purge]         Stop and remove the service (optionally wipe config/cache/state)
   logs                        Tail service logs
   --version                   Print the version
@@ -558,8 +603,14 @@ async function main() {
       case "remote":
         await cmdRemote(rest);
         break;
-      case "peer":
-        cmdPeer(rest);
+      case "hub":
+        await cmdHub(rest);
+        break;
+      case "join":
+        await cmdJoin(rest);
+        break;
+      case "leave":
+        await cmdLeave();
         break;
       case "uninstall":
         await cmdUninstall(rest);

package/dist/server/access.js

@@ -39,7 +39,7 @@ export function createAccessGate(secret) {
     return { middleware, unlock, isAuthorized };
 }
 // The same bare 404 for every unauthenticated request, page or API, right key path or not.
-function notFound(req, res) {
+export function notFound(req, res) {
     res.removeHeader("X-Request-Id");
     res.status(404).set({ "Cache-Control": "no-store", "Content-Type": "text/html" });
     res.end(req.method === "HEAD" ? undefined : NOT_FOUND_PAGE);

package/dist/server/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../../server/src/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG1D,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,4FAA4F;AAC5F,4FAA4F;AAC5F,+FAA+F;AAC/F,uEAAuE;AAEvE,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,gBAAgB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAW5C,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,kFAAkF;IAClF,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5F,SAAS,YAAY,CAAC,GAAY;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC5C,OAAO,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,EAAE,CAAC;QACvE,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,mEAAmE;YACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YACpD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC9C,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CAAC,GAAY,EAAE,GAAa;IAC3C,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;IAClF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,GAAa,EAAE,KAAa;IAClE,gGAAgG;IAChG,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,gBAAgB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACvH,IAAI,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,SAAiB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,4FAA4F;AAC5F,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCtB,CAAC"}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../server/src/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG1D,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,4FAA4F;AAC5F,4FAA4F;AAC5F,+FAA+F;AAC/F,uEAAuE;AAEvE,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,gBAAgB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAW5C,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,kFAAkF;IAClF,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5F,SAAS,YAAY,CAAC,GAAY;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC5C,OAAO,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,EAAE,CAAC;QACvE,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,mEAAmE;YACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YACpD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC9C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,QAAQ,CAAC,GAAY,EAAE,GAAa;IAClD,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;IAClF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,GAAa,EAAE,KAAa;IAClE,gGAAgG;IAChG,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,gBAAgB,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACvH,IAAI,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,SAAiB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,4FAA4F;AAC5F,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCtB,CAAC"}