signalk-backup 0.1.0

package/plugin/index.js

@@ -0,0 +1,477 @@
+import path from 'node:path';
+import { BackupClient } from './backup-client.js';
+import { registerProxy } from './proxy.js';
+import { ConfigSchema, SCHEMA_DEFAULTS } from './config/schema.js';
+import { runAllExports } from './database-export/index.js';
+const BACKUP_IMAGE = 'ghcr.io/dirkwa/signalk-backup-server';
+const CONTAINER_NAME = 'signalk-backup-server';
+const PLUGIN_ID = 'signalk-backup';
+const SK_MOUNT = '/signalk-data';
+const API_PORT = 3010;
+const OAUTH_PORT = 53682;
+const SAFE_TAG = /^[a-zA-Z0-9._-]+$/;
+/**
+ * Sensible default resource limits for the backup-server container.
+ * Backup work is mostly I/O bound (Kopia is content-addressable so it
+ * reads more than it CPUs); rclone uploads are network-bound. 1 CPU
+ * and 256MB is enough for typical SignalK installs (a few GB of config).
+ *
+ * Users can override any field via signalk-container's plugin config
+ * under "Per-container resource overrides", keyed by the unprefixed
+ * container name `signalk-backup-server`. See:
+ *   signalk-container/doc/plugin-developer-guide.md §"Resource Limits"
+ */
+const DEFAULT_RESOURCES = {
+    cpus: 1,
+    memory: '256m',
+    memorySwap: '256m',
+    pidsLimit: 100
+};
+function getContainerManager() {
+    return globalThis.__signalk_containerManager;
+}
+/**
+ * Wait for signalk-container's API to be FULLY ready on globalThis —
+ * both the manager object exposed AND its runtime detection complete.
+ *
+ * signalk-container publishes `__signalk_containerManager` synchronously
+ * during its own start() but kicks off `detectRuntime` async, so there's
+ * a ~1-2s window where getRuntime() returns null. signalk-backup loads
+ * BEFORE signalk-container alphabetically and races into that window
+ * unless we wait for both signals.
+ */
+async function waitForContainerManager(maxMs, intervalMs = 500) {
+    const deadline = Date.now() + maxMs;
+    while (Date.now() < deadline) {
+        const m = getContainerManager();
+        if (m && m.getRuntime())
+            return m;
+        await new Promise((r) => setTimeout(r, intervalMs));
+    }
+    return getContainerManager();
+}
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Resolve the actual host:port the backup-server container is reachable at.
+ *
+ * signalk-container exposes `resolveContainerAddress`, but its result comes
+ * from a process-local port-allocation cache that can drift from the live
+ * podman binding (TOCTOU between the in-process port probe and the actual
+ * `podman create`). When that drift happens, the returned address points at
+ * a port that nothing is listening on — every subsequent proxy request
+ * returns ECONNREFUSED.
+ *
+ * This helper queries `listContainers()` (which signalk-container reads
+ * directly from podman/docker) and parses the live `Ports` field for the
+ * binding mapped from the container's API_PORT. That's authoritative.
+ *
+ * Falls back to `resolveContainerAddress` if the live binding can't be
+ * parsed, so this is a strict superset of the documented contract.
+ */
+async function resolveActualAddress(containers) {
+    try {
+        const list = await containers.listContainers();
+        const found = list.find((c) => c.name === `sk-${CONTAINER_NAME}`);
+        if (found && Array.isArray(found.ports)) {
+            // The shape ContainerInfo we mirror only declares { name, image, state },
+            // but the runtime object includes a `ports` array of strings like
+            // "127.0.0.1:3010->3010/tcp". Parse the binding for our API_PORT.
+            const ports = found.ports;
+            const wanted = `->${API_PORT}/tcp`;
+            for (const entry of ports) {
+                if (!entry.endsWith(wanted))
+                    continue;
+                const hostPart = entry.slice(0, -wanted.length);
+                // hostPart looks like "127.0.0.1:3010" or "0.0.0.0:3010".
+                if (hostPart.includes(':'))
+                    return hostPart;
+            }
+        }
+    }
+    catch {
+        // fall through to the documented API
+    }
+    return containers.resolveContainerAddress(CONTAINER_NAME, API_PORT);
+}
+export default function (app) {
+    let client = null;
+    let currentSettings = null;
+    let containerAddress = null;
+    let dbExportTimer = null;
+    let dbExportInFlight = false;
+    const buildContainerConfig = (tag, logLevel) => ({
+        image: BACKUP_IMAGE,
+        tag,
+        // signalkConfigRootMount mounts the entire SignalK config root
+        // (`~/.signalk/` typically) — settings.json, security.json, the
+        // whole plugin-config-data tree. signalkDataMount would only mount
+        // this plugin's own subdir, which isn't enough for backup/restore.
+        // Requires signalk-container >= 1.5.0.
+        signalkConfigRootMount: SK_MOUNT,
+        signalkAccessiblePorts: [API_PORT, OAUTH_PORT],
+        env: {
+            PORT: String(API_PORT),
+            // The backup engine's own state lives in a plugin-config-data subdir
+            // so it travels with the SignalK config (snapshotted by backup, included in restore).
+            DATA_DIR: `${SK_MOUNT}/plugin-config-data/${PLUGIN_ID}`,
+            SIGNALK_DATA_PATH: SK_MOUNT,
+            SIGNALK_VERSION: getSignalKVersion(app),
+            LOG_LEVEL: logLevel
+        },
+        resources: DEFAULT_RESOURCES,
+        restart: 'unless-stopped'
+    });
+    const plugin = {
+        id: PLUGIN_ID,
+        name: 'Backup',
+        description: 'Scheduled deduplicated backups of SignalK config to local storage and Google Drive',
+        schema: ConfigSchema,
+        start(config) {
+            app.debug('Starting signalk-backup');
+            // CRITICAL: Signal K does not seed schema defaults into the runtime
+            // config — when the plugin is auto-enabled (or enabled without
+            // saving the form), `config` is `{}`. Merge defaults so callers can
+            // rely on every field being present.
+            const merged = { ...SCHEMA_DEFAULTS, ...config };
+            currentSettings = merged;
+            void asyncStart(merged).catch((err) => {
+                app.setPluginError(`Startup failed: ${errMsg(err)}`);
+            });
+        },
+        async stop() {
+            app.debug('Stopping signalk-backup');
+            stopDbExportTimer();
+            client = null;
+            containerAddress = null;
+            const containers = getContainerManager();
+            if (containers && currentSettings?.managedContainer !== false) {
+                try {
+                    containers.updates.unregister(PLUGIN_ID);
+                }
+                catch (err) {
+                    app.debug(`Error unregistering update tracker: ${errMsg(err)}`);
+                }
+                try {
+                    await containers.stop(CONTAINER_NAME);
+                }
+                catch (err) {
+                    app.debug(`Error stopping ${CONTAINER_NAME}: ${errMsg(err)}`);
+                }
+            }
+            app.setPluginStatus('Stopped');
+        },
+        registerWithRouter(router) {
+            // Lightweight readiness signal for admin/webapp badges.
+            router.get('/status', async (_req, res) => {
+                const containers = getContainerManager();
+                let containerState = 'unknown';
+                let containerImage = '';
+                if (containers) {
+                    try {
+                        containerState = await containers.getState(CONTAINER_NAME);
+                    }
+                    catch (err) {
+                        app.debug(`status: getState failed: ${errMsg(err)}`);
+                    }
+                    if (containers.getRuntime()) {
+                        try {
+                            const list = await containers.listContainers();
+                            const found = list.find((c) => c.name === `sk-${CONTAINER_NAME}`);
+                            if (found)
+                                containerImage = found.image;
+                        }
+                        catch (err) {
+                            app.debug(`status: listContainers failed: ${errMsg(err)}`);
+                        }
+                    }
+                }
+                if (!containerImage) {
+                    containerImage = `${BACKUP_IMAGE}:${currentSettings?.imageTag ?? 'latest'}`;
+                }
+                res.json({
+                    container: {
+                        state: containerState,
+                        image: containerImage,
+                        managed: currentSettings?.managedContainer !== false
+                    },
+                    ready: client !== null
+                });
+            });
+            // Update detection — delegated to signalk-container's centralized
+            // update service. Same pattern as mayara.
+            router.get('/api/update/check', async (_req, res) => {
+                const containers = getContainerManager();
+                if (!containers) {
+                    res.status(503).json({ error: 'signalk-container not available' });
+                    return;
+                }
+                try {
+                    const result = await containers.updates.checkOne(PLUGIN_ID);
+                    res.json(result);
+                }
+                catch (err) {
+                    res.status(500).json({ error: errMsg(err) });
+                }
+            });
+            router.post('/api/update/apply', async (req, res) => {
+                const containers = getContainerManager();
+                if (!containers) {
+                    res.status(503).json({ error: 'signalk-container not available' });
+                    return;
+                }
+                const body = (req.body ?? {});
+                const tag = (typeof body.tag === 'string' ? body.tag : undefined) ??
+                    currentSettings?.imageTag ??
+                    'latest';
+                if (!SAFE_TAG.test(tag)) {
+                    res.status(400).json({ error: 'Invalid tag format' });
+                    return;
+                }
+                try {
+                    app.setPluginStatus(`Pulling ${BACKUP_IMAGE}:${tag}...`);
+                    await containers.pullImage(`${BACKUP_IMAGE}:${tag}`);
+                    app.setPluginStatus('Recreating signalk-backup-server container...');
+                    await containers.remove(CONTAINER_NAME);
+                    try {
+                        await containers.ensureRunning(CONTAINER_NAME, buildContainerConfig(tag, currentSettings?.logLevel ?? 'info'));
+                    }
+                    catch (recreateErr) {
+                        const msg = `Container removed but recreation failed: ${errMsg(recreateErr)}. Click Update again to retry.`;
+                        app.setPluginError(msg);
+                        res.status(500).json({ error: msg });
+                        return;
+                    }
+                    if (currentSettings) {
+                        currentSettings.imageTag = tag;
+                        await new Promise((resolve) => {
+                            app.savePluginOptions({ ...currentSettings }, (err) => {
+                                if (err) {
+                                    app.error(`Failed to persist new tag: ${errMsg(err)}. Container is running with ${tag} but a plugin restart will revert.`);
+                                }
+                                resolve();
+                            });
+                        });
+                    }
+                    app.setPluginStatus(`Updated to ${BACKUP_IMAGE}:${tag}`);
+                    res.json({ success: true, tag });
+                }
+                catch (err) {
+                    app.setPluginError(`Update failed: ${errMsg(err)}`);
+                    res.status(500).json({ error: errMsg(err) });
+                }
+            });
+            // Proxy /api/* to the backup-server. Registered LAST so the
+            // explicit /api/update/{check,apply} above match first.
+            // containerAddress includes the scheme (http:// or https://) so
+            // external-mode HTTPS upstreams aren't downgraded.
+            registerProxy(router, {
+                getUpstreamBase: () => containerAddress,
+                log: (msg) => {
+                    app.debug(msg);
+                }
+            });
+        }
+    };
+    async function asyncStart(settings) {
+        if (!settings.managedContainer) {
+            // External-server mode: skip the container, point at user-provided URL.
+            const url = settings.externalUrl.trim();
+            if (!url) {
+                app.setPluginError('managedContainer is disabled but externalUrl is empty. Set externalUrl in plugin config.');
+                return;
+            }
+            client = new BackupClient(url);
+            // Keep the scheme so the proxy can route HTTPS external upstreams.
+            containerAddress = url;
+            try {
+                await client.waitForReady(15_000);
+                app.setPluginStatus(`Connected to external backup-server at ${url}`);
+                await seedFirstRunSchedule(client);
+                if (settings.databaseExport.questdb) {
+                    app.setPluginStatus(`Connected to external backup-server. Note: database export ` +
+                        `requires managed-container mode and was skipped.`);
+                }
+            }
+            catch (err) {
+                app.setPluginError(`External backup-server unreachable: ${errMsg(err)}`);
+            }
+            return;
+        }
+        // signalk-container exposes its API via globalThis only after its own
+        // start() has finished. Plugin-load order is alphabetical, and
+        // "signalk-backup" comes before "signalk-container" — so on a cold
+        // server start, getContainerManager() is undefined for the first few
+        // hundred ms. Poll for up to 30s before giving up.
+        const containers = await waitForContainerManager(120_000);
+        if (!containers) {
+            app.setPluginError('signalk-container plugin not available after 120s. Install and enable it, then restart this plugin.');
+            return;
+        }
+        if (!containers.getRuntime()) {
+            app.setPluginError('No container runtime detected (Podman or Docker). Install one and restart signalk-container.');
+            return;
+        }
+        if (!SAFE_TAG.test(settings.imageTag)) {
+            app.setPluginError(`Invalid imageTag "${settings.imageTag}"`);
+            return;
+        }
+        try {
+            app.setPluginStatus(`Starting ${BACKUP_IMAGE}:${settings.imageTag}...`);
+            await containers.ensureRunning(CONTAINER_NAME, buildContainerConfig(settings.imageTag, settings.logLevel));
+            // Register with the central update service so users see "update available"
+            // badges in the signalk-container config panel without us writing custom
+            // GitHub-poll logic.
+            try {
+                containers.updates.register({
+                    pluginId: PLUGIN_ID,
+                    containerName: CONTAINER_NAME,
+                    image: BACKUP_IMAGE,
+                    currentTag: () => currentSettings?.imageTag ?? settings.imageTag,
+                    versionSource: containers.updates.sources.githubReleases('dirkwa/signalk-backup-server')
+                });
+            }
+            catch (err) {
+                app.debug(`updates.register failed (non-fatal): ${errMsg(err)}`);
+            }
+            const addr = await resolveActualAddress(containers);
+            if (!addr) {
+                throw new Error('Could not resolve container address');
+            }
+            // Container is always plain HTTP on the host loopback; storing the
+            // full URL keeps the format consistent with external-mode (which
+            // may be HTTPS) so the proxy can use the same value as-is.
+            containerAddress = `http://${addr}`;
+            // `client` stays null until /api/health succeeds, so /status's
+            // `ready: client !== null` reports the truthful upstream-reachable
+            // signal rather than just "we know the address."
+            const pending = new BackupClient(containerAddress);
+            app.setPluginStatus('Waiting for backup-server to become ready...');
+            await pending.waitForReady(60_000);
+            client = pending;
+            await seedFirstRunSchedule(client);
+            startDbExportTimer();
+        }
+        catch (err) {
+            app.setPluginError(`Container startup failed: ${errMsg(err)}`);
+        }
+    }
+    /**
+     * Start the database-export interval, if any DB exporter is enabled in
+     * settings. The first export fires after one full interval — not at
+     * startup — to avoid hammering the disk during server boot.
+     */
+    function startDbExportTimer() {
+        stopDbExportTimer();
+        const dbCfg = currentSettings?.databaseExport;
+        if (!dbCfg?.questdb) {
+            app.debug('Database export: no exporters enabled, scheduler idle');
+            return;
+        }
+        const intervalMs = Math.max(5, dbCfg.intervalMinutes) * 60 * 1000;
+        app.debug(`Database export: scheduling every ${dbCfg.intervalMinutes}m`);
+        dbExportTimer = setInterval(() => {
+            void runDbExportTick();
+        }, intervalMs);
+    }
+    function stopDbExportTimer() {
+        if (dbExportTimer) {
+            clearInterval(dbExportTimer);
+            dbExportTimer = null;
+        }
+    }
+    async function runDbExportTick() {
+        // Coalesce: if a previous tick is still running (e.g. a slow large
+        // table on a Pi), skip this one entirely rather than queuing.
+        if (dbExportInFlight) {
+            app.debug('Database export: previous tick still running, skipping');
+            return;
+        }
+        dbExportInFlight = true;
+        try {
+            const results = await runAllExports({
+                signalkConfigRoot: resolveSignalkConfigRoot(),
+                signalkBaseUrl: resolveSignalkBaseUrl(),
+                log: (msg) => {
+                    app.debug(msg);
+                }
+            });
+            const totalTables = results.reduce((acc, r) => acc + r.tables.length, 0);
+            const totalBytes = results.reduce((acc, r) => acc + r.totalBytes, 0);
+            app.debug(`Database export tick: ${results.length} sources, ` +
+                `${totalTables} tables, ${totalBytes} bytes`);
+        }
+        catch (err) {
+            app.error(`Database export tick failed: ${errMsg(err)}`);
+        }
+        finally {
+            dbExportInFlight = false;
+        }
+    }
+    /**
+     * Resolve the host-visible SignalK config root. Prefer the env var
+     * (authoritative when set) and fall back to walking up from
+     * getDataDirPath(), which signalk-server guarantees returns
+     * `<configRoot>/plugin-config-data/<pluginId>`.
+     */
+    function resolveSignalkConfigRoot() {
+        const fromEnv = process.env['SIGNALK_NODE_CONFIG_DIR'];
+        if (fromEnv && fromEnv.length > 0)
+            return fromEnv;
+        // dirname twice: <root>/plugin-config-data/signalk-backup → <root>
+        return path.dirname(path.dirname(app.getDataDirPath()));
+    }
+    /**
+     * Resolve the SignalK loopback URL — used to talk to source plugins
+     * (e.g. signalk-questdb) over HTTP. Same convention used by
+     * signalk-questdb itself: PORT env var with 3000 as default.
+     */
+    function resolveSignalkBaseUrl() {
+        const port = process.env['PORT'] ?? '3000';
+        return `http://127.0.0.1:${port}`;
+    }
+    async function seedFirstRunSchedule(c) {
+        try {
+            const existing = await c.getSettings();
+            const alreadyConfigured = existing.scheduler?.configured === true;
+            if (alreadyConfigured) {
+                app.setPluginStatus(`Backup engine ready at ${containerAddress}`);
+                return;
+            }
+            // First run: opt-in safe defaults — daily local-only backup, no cloud.
+            // The user must explicitly enable cloud sync from the GUI.
+            await c.putSettings({
+                scheduler: {
+                    configured: true,
+                    daily: { enabled: true, retain: 7 },
+                    hourly: { enabled: false, retain: 24 },
+                    weekly: { enabled: false, retain: 4 },
+                    startup: { enabled: true, retain: 3 }
+                },
+                cloud: { mode: 'off' }
+            });
+            app.setPluginStatus(`First-run: seeded daily local backup schedule. Open Backup Console to configure.`);
+        }
+        catch (err) {
+            // Don't fail startup if seeding fails — the container is up and the
+            // user can configure manually from the UI.
+            app.debug(`First-run seed failed (non-fatal): ${errMsg(err)}`);
+            app.setPluginStatus(`Backup engine ready at ${containerAddress}`);
+        }
+    }
+    return plugin;
+}
+/**
+ * Best-effort SignalK version detection. Plumbed into the container so
+ * backups can be tagged with the running SignalK version. Falls back to
+ * "unknown" — never throws.
+ */
+function getSignalKVersion(app) {
+    // ServerAPI doesn't expose a stable .version field across versions; many
+    // builds make it available, but treating it as optional is safer.
+    const candidate = app.signalk?.version ??
+        app.version;
+    return typeof candidate === 'string' && candidate.length > 0 ? candidate : 'unknown';
+}
+//# sourceMappingURL=index.js.map

package/plugin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO1C,OAAO,EAAE,YAAY,EAAU,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D,MAAM,YAAY,GAAG,sCAAsC,CAAA;AAC3D,MAAM,cAAc,GAAG,uBAAuB,CAAA;AAC9C,MAAM,SAAS,GAAG,gBAAgB,CAAA;AAClC,MAAM,QAAQ,GAAG,eAAe,CAAA;AAChC,MAAM,QAAQ,GAAG,IAAI,CAAA;AACrB,MAAM,UAAU,GAAG,KAAK,CAAA;AACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAA;AAEpC;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAA4B;IACjD,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,MAAM;IACd,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,GAAG;CACf,CAAA;AAED,SAAS,mBAAmB;IAC1B,OAAO,UAAU,CAAC,0BAA0B,CAAA;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,uBAAuB,CACpC,KAAa,EACb,UAAU,GAAG,GAAG;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAA;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAA;QAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;YAAE,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,mBAAmB,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,oBAAoB,CAAC,UAA+B;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,CAAA;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,cAAc,EAAE,CAAC,CAAA;QACjE,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAE,KAAyC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,0EAA0E;YAC1E,kEAAkE;YAClE,kEAAkE;YAClE,MAAM,KAAK,GAAI,KAAwC,CAAC,KAAK,CAAA;YAC7D,MAAM,MAAM,GAAG,KAAK,QAAQ,MAAM,CAAA;YAClC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAQ;gBACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC/C,0DAA0D;gBAC1D,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,OAAO,QAAQ,CAAA;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,UAAU,CAAC,uBAAuB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,CAAC,OAAO,WAAW,GAAoB;IAC3C,IAAI,MAAM,GAAwB,IAAI,CAAA;IACtC,IAAI,eAAe,GAAkB,IAAI,CAAA;IACzC,IAAI,gBAAgB,GAAkB,IAAI,CAAA;IAC1C,IAAI,aAAa,GAA0B,IAAI,CAAA;IAC/C,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAmB,EAAE,CAAC,CAAC;QAChF,KAAK,EAAE,YAAY;QACnB,GAAG;QACH,+DAA+D;QAC/D,gEAAgE;QAChE,mEAAmE;QACnE,mEAAmE;QACnE,uCAAuC;QACvC,sBAAsB,EAAE,QAAQ;QAChC,sBAAsB,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9C,GAAG,EAAE;YACH,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC;YACtB,qEAAqE;YACrE,sFAAsF;YACtF,QAAQ,EAAE,GAAG,QAAQ,uBAAuB,SAAS,EAAE;YACvD,iBAAiB,EAAE,QAAQ;YAC3B,eAAe,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACvC,SAAS,EAAE,QAAQ;SACpB;QACD,SAAS,EAAE,iBAAiB;QAC5B,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAA;IAEF,MAAM,MAAM,GAAW;QACrB,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,oFAAoF;QAEtF,MAAM,EAAE,YAAY;QAEpB,KAAK,CAAC,MAAuB;YAC3B,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;YACpC,oEAAoE;YACpE,+DAA+D;YAC/D,oEAAoE;YACpE,qCAAqC;YACrC,MAAM,MAAM,GAAW,EAAE,GAAG,eAAe,EAAE,GAAG,MAAM,EAAE,CAAA;YACxD,eAAe,GAAG,MAAM,CAAA;YACxB,KAAK,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC7C,GAAG,CAAC,cAAc,CAAC,mBAAmB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,IAAI;YACR,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;YACpC,iBAAiB,EAAE,CAAA;YACnB,MAAM,GAAG,IAAI,CAAA;YACb,gBAAgB,GAAG,IAAI,CAAA;YAEvB,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAA;YACxC,IAAI,UAAU,IAAI,eAAe,EAAE,gBAAgB,KAAK,KAAK,EAAE,CAAC;gBAC9D,IAAI,CAAC;oBACH,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;gBAC1C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,KAAK,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACjE,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;gBACvC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,KAAK,CAAC,kBAAkB,cAAc,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC/D,CAAC;YACH,CAAC;YACD,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;QAChC,CAAC;QAED,kBAAkB,CAAC,MAAe;YAChC,wDAAwD;YACxD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;gBAC3D,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAA;gBACxC,IAAI,cAAc,GAAW,SAAS,CAAA;gBACtC,IAAI,cAAc,GAAG,EAAE,CAAA;gBAEvB,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,cAAc,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;oBAC5D,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBACtD,CAAC;oBACD,IAAI,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC;wBAC5B,IAAI,CAAC;4BACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,CAAA;4BAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,cAAc,EAAE,CAAC,CAAA;4BACjE,IAAI,KAAK;gCAAE,cAAc,GAAG,KAAK,CAAC,KAAK,CAAA;wBACzC,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,GAAG,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;wBAC5D,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,cAAc,GAAG,GAAG,YAAY,IAAI,eAAe,EAAE,QAAQ,IAAI,QAAQ,EAAE,CAAA;gBAC7E,CAAC;gBAED,GAAG,CAAC,IAAI,CAAC;oBACP,SAAS,EAAE;wBACT,KAAK,EAAE,cAAc;wBACrB,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,eAAe,EAAE,gBAAgB,KAAK,KAAK;qBACrD;oBACD,KAAK,EAAE,MAAM,KAAK,IAAI;iBACvB,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;gBACrE,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAA;gBACxC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;oBAClE,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;oBAC3D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9C,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;gBACrE,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAA;gBACxC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;oBAClE,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAsB,CAAA;gBAClD,MAAM,GAAG,GACP,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;oBACrD,eAAe,EAAE,QAAQ;oBACzB,QAAQ,CAAA;gBACV,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;oBACrD,OAAM;gBACR,CAAC;gBAED,IAAI,CAAC;oBACH,GAAG,CAAC,eAAe,CAAC,WAAW,YAAY,IAAI,GAAG,KAAK,CAAC,CAAA;oBACxD,MAAM,UAAU,CAAC,SAAS,CAAC,GAAG,YAAY,IAAI,GAAG,EAAE,CAAC,CAAA;oBAEpD,GAAG,CAAC,eAAe,CAAC,+CAA+C,CAAC,CAAA;oBACpE,MAAM,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;oBACvC,IAAI,CAAC;wBACH,MAAM,UAAU,CAAC,aAAa,CAC5B,cAAc,EACd,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,IAAI,MAAM,CAAC,CAC/D,CAAA;oBACH,CAAC;oBAAC,OAAO,WAAW,EAAE,CAAC;wBACrB,MAAM,GAAG,GAAG,4CAA4C,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAA;wBAC3G,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;wBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;wBACpC,OAAM;oBACR,CAAC;oBAED,IAAI,eAAe,EAAE,CAAC;wBACpB,eAAe,CAAC,QAAQ,GAAG,GAAG,CAAA;wBAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;4BAClC,GAAG,CAAC,iBAAiB,CAAC,EAAE,GAAG,eAAe,EAAE,EAAE,CAAC,GAAiC,EAAE,EAAE;gCAClF,IAAI,GAAG,EAAE,CAAC;oCACR,GAAG,CAAC,KAAK,CACP,8BAA8B,MAAM,CAAC,GAAG,CAAC,+BAA+B,GAAG,oCAAoC,CAChH,CAAA;gCACH,CAAC;gCACD,OAAO,EAAE,CAAA;4BACX,CAAC,CAAC,CAAA;wBACJ,CAAC,CAAC,CAAA;oBACJ,CAAC;oBAED,GAAG,CAAC,eAAe,CAAC,cAAc,YAAY,IAAI,GAAG,EAAE,CAAC,CAAA;oBACxD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;gBAClC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,cAAc,CAAC,kBAAkB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9C,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,4DAA4D;YAC5D,wDAAwD;YACxD,gEAAgE;YAChE,mDAAmD;YACnD,aAAa,CAAC,MAAM,EAAE;gBACpB,eAAe,EAAE,GAAG,EAAE,CAAC,gBAAgB;gBACvC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;oBACX,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAChB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;IAED,KAAK,UAAU,UAAU,CAAC,QAAgB;QACxC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC/B,wEAAwE;YACxE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;YACvC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,cAAc,CAChB,0FAA0F,CAC3F,CAAA;gBACD,OAAM;YACR,CAAC;YACD,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,CAAA;YAC9B,mEAAmE;YACnE,gBAAgB,GAAG,GAAG,CAAA;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;gBACjC,GAAG,CAAC,eAAe,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAA;gBACpE,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAA;gBAClC,IAAI,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;oBACpC,GAAG,CAAC,eAAe,CACjB,6DAA6D;wBAC3D,kDAAkD,CACrD,CAAA;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,cAAc,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC1E,CAAC;YACD,OAAM;QACR,CAAC;QAED,sEAAsE;QACtE,+DAA+D;QAC/D,mEAAmE;QACnE,qEAAqE;QACrE,mDAAmD;QACnD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,cAAc,CAChB,qGAAqG,CACtG,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC;YAC7B,GAAG,CAAC,cAAc,CAChB,8FAA8F,CAC/F,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,cAAc,CAAC,qBAAqB,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAA;YAC7D,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,eAAe,CAAC,YAAY,YAAY,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,CAAA;YACvE,MAAM,UAAU,CAAC,aAAa,CAC5B,cAAc,EACd,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC3D,CAAA;YAED,2EAA2E;YAC3E,yEAAyE;YACzE,qBAAqB;YACrB,IAAI,CAAC;gBACH,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAC1B,QAAQ,EAAE,SAAS;oBACnB,aAAa,EAAE,cAAc;oBAC7B,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ;oBAChE,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,8BAA8B,CAAC;iBACzF,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAA;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YACxD,CAAC;YACD,mEAAmE;YACnE,iEAAiE;YACjE,2DAA2D;YAC3D,gBAAgB,GAAG,UAAU,IAAI,EAAE,CAAA;YAEnC,+DAA+D;YAC/D,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,gBAAgB,CAAC,CAAA;YAClD,GAAG,CAAC,eAAe,CAAC,8CAA8C,CAAC,CAAA;YACnE,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAClC,MAAM,GAAG,OAAO,CAAA;YAEhB,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAA;YAClC,kBAAkB,EAAE,CAAA;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,cAAc,CAAC,6BAA6B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,SAAS,kBAAkB;QACzB,iBAAiB,EAAE,CAAA;QACnB,MAAM,KAAK,GAAG,eAAe,EAAE,cAAc,CAAA;QAC7C,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAA;YAClE,OAAM;QACR,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;QACjE,GAAG,CAAC,KAAK,CAAC,qCAAqC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAA;QACxE,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;YAC/B,KAAK,eAAe,EAAE,CAAA;QACxB,CAAC,EAAE,UAAU,CAAC,CAAA;IAChB,CAAC;IAED,SAAS,iBAAiB;QACxB,IAAI,aAAa,EAAE,CAAC;YAClB,aAAa,CAAC,aAAa,CAAC,CAAA;YAC5B,aAAa,GAAG,IAAI,CAAA;QACtB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,mEAAmE;QACnE,8DAA8D;QAC9D,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QACD,gBAAgB,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;gBAClC,iBAAiB,EAAE,wBAAwB,EAAE;gBAC7C,cAAc,EAAE,qBAAqB,EAAE;gBACvC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;oBACX,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAChB,CAAC;aACF,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACxE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;YACpE,GAAG,CAAC,KAAK,CACP,yBAAyB,OAAO,CAAC,MAAM,YAAY;gBACjD,GAAG,WAAW,YAAY,UAAU,QAAQ,CAC/C,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1D,CAAC;gBAAS,CAAC;YACT,gBAAgB,GAAG,KAAK,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,SAAS,wBAAwB;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;QACtD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAA;QACjD,mEAAmE;QACnE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;IACzD,CAAC;IAED;;;;OAIG;IACH,SAAS,qBAAqB;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAA;QAC1C,OAAO,oBAAoB,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,CAAe;QACjD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;YACtC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,EAAE,UAAU,KAAK,IAAI,CAAA;YACjE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,GAAG,CAAC,eAAe,CAAC,0BAA0B,gBAAgB,EAAE,CAAC,CAAA;gBACjE,OAAM;YACR,CAAC;YAED,uEAAuE;YACvE,2DAA2D;YAC3D,MAAM,CAAC,CAAC,WAAW,CAAC;gBAClB,SAAS,EAAE;oBACT,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;oBACnC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;oBACtC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE;oBACrC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;iBACtC;gBACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;aACvB,CAAC,CAAA;YACF,GAAG,CAAC,eAAe,CACjB,kFAAkF,CACnF,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,2CAA2C;YAC3C,GAAG,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9D,GAAG,CAAC,eAAe,CAAC,0BAA0B,gBAAgB,EAAE,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,SAAS,GACZ,GAAuE,CAAC,OAAO,EAAE,OAAO;QACxF,GAAuC,CAAC,OAAO,CAAA;IAClD,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;AACtF,CAAC"}

package/plugin/proxy.d.ts

@@ -0,0 +1,13 @@
+import type { IRouter } from 'express';
+export interface ProxyOptions {
+    /**
+     * Lazy accessor for the upstream base URL — must include the scheme
+     * (e.g. `http://127.0.0.1:3010` or `https://server:3010`). Returns
+     * null when the backup-server isn't ready; those requests get a 503.
+     */
+    getUpstreamBase: () => string | null;
+    /** Optional debug logger. */
+    log?: (msg: string) => void;
+}
+export declare function registerProxy(router: IRouter, opts: ProxyOptions): void;
+//# sourceMappingURL=proxy.d.ts.map

package/plugin/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAA0D,MAAM,SAAS,CAAA;AA2B9F,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,eAAe,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;IACpC,6BAA6B;IAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5B;AAID,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA+DvE"}

package/plugin/proxy.js

@@ -0,0 +1,100 @@
+// Reverse proxy from /plugins/signalk-backup/api/* to the backup-server's
+// loopback API. Container is loopback-only so a remote browser can't
+// reach it directly; routing through the SignalK origin also avoids CORS.
+// Both directions stream via Readable.fromWeb + stream/promises::pipeline
+// so multi-GB ZIP downloads/uploads don't allocate the body in memory.
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+// Hop-by-hop headers per RFC 7230 §6.1 (must NOT cross a proxy hop), plus
+// host (gets rewritten to upstream) and content-length (recomputed by
+// undici from the streamed body).
+const HOP_BY_HOP_REQUEST_HEADERS = new Set([
+    'host',
+    'connection',
+    'keep-alive',
+    'proxy-authorization',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+    'content-length'
+]);
+// Same list, response side. content-encoding stays — upstream may have
+// already gzipped and we pass that through unchanged.
+const HOP_BY_HOP_RESPONSE_HEADERS = new Set([
+    'connection',
+    'keep-alive',
+    'transfer-encoding',
+    'upgrade',
+    'proxy-authenticate'
+]);
+// Catches /api/*; the explicit /api/update/{check,apply} routes must
+// register BEFORE this — Express matches in registration order.
+export function registerProxy(router, opts) {
+    router.all(/^\/api\/.*/, async (req, res) => {
+        const base = opts.getUpstreamBase();
+        if (!base) {
+            res.status(503).json({ error: 'backup-server not ready' });
+            return;
+        }
+        // Express's router-mount prefix has already been stripped, so
+        // req.url is e.g. `/api/backups?type=manual`.
+        const upstreamUrl = base.replace(/\/$/, '') + req.url;
+        const headers = new Headers();
+        for (const [name, value] of Object.entries(req.headers)) {
+            if (value === undefined)
+                continue;
+            if (HOP_BY_HOP_REQUEST_HEADERS.has(name.toLowerCase()))
+                continue;
+            if (Array.isArray(value)) {
+                for (const v of value)
+                    headers.append(name, v);
+            }
+            else {
+                headers.set(name, value);
+            }
+        }
+        // duplex: 'half' is required by undici when body is a Node Readable;
+        // both fields are absent from the DOM RequestInit we'd otherwise import.
+        const init = {
+            method: req.method,
+            headers
+        };
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            init.body = req;
+            init.duplex = 'half';
+        }
+        let upstreamRes;
+        try {
+            upstreamRes = await fetch(upstreamUrl, init);
+        }
+        catch (err) {
+            opts.log?.(`proxy ${req.method} ${req.url} → upstream error: ${errMsg(err)}`);
+            res.status(502).json({ error: 'backup-server unreachable', detail: errMsg(err) });
+            return;
+        }
+        res.status(upstreamRes.status);
+        for (const [name, value] of upstreamRes.headers.entries()) {
+            if (HOP_BY_HOP_RESPONSE_HEADERS.has(name.toLowerCase()))
+                continue;
+            res.setHeader(name, value);
+        }
+        if (!upstreamRes.body) {
+            res.end();
+            return;
+        }
+        try {
+            await pipeline(Readable.fromWeb(upstreamRes.body), res);
+        }
+        catch (err) {
+            opts.log?.(`proxy ${req.method} ${req.url} → stream error: ${errMsg(err)}`);
+            if (!res.writableEnded) {
+                res.end();
+            }
+        }
+    });
+}
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=proxy.js.map

package/plugin/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,qEAAqE;AACrE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AAEvE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAG/C,0EAA0E;AAC1E,sEAAsE;AACtE,kCAAkC;AAClC,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,gBAAgB;CACjB,CAAC,CAAA;AAEF,uEAAuE;AACvE,sDAAsD;AACtD,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,SAAS;IACT,oBAAoB;CACrB,CAAC,CAAA;AAaF,qEAAqE;AACrE,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,MAAe,EAAE,IAAkB;IAC/D,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,EAAE;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAA;YAC1D,OAAM;QACR,CAAC;QAED,8DAA8D;QAC9D,8CAA8C;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAA;QAErD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAQ;YACjC,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,SAAQ;YAChE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,CAAC,IAAI,KAAK;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YAChD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,yEAAyE;QACzE,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO;SACR,CAAA;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;YACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACtB,CAAC;QAED,IAAI,WAA8C,CAAA;QAClD,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,sBAAsB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACjF,OAAM;QACR,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,SAAQ;YACjE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5B,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACtB,GAAG,CAAC,GAAG,EAAE,CAAA;YACT,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,IAAa,CAAC,EAAE,GAAG,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,oBAAoB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC3E,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvB,GAAG,CAAC,GAAG,EAAE,CAAA;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC"}