threadshelf 1.2.0

package/dist/src/routes/ingest.js

@@ -0,0 +1,300 @@
+import { Router } from 'express';
+import multer from 'multer';
+import { join, basename, dirname, normalize, resolve, relative, isAbsolute } from 'path';
+import { existsSync, mkdirSync } from 'fs';
+import { copyFile, mkdir, rm } from 'fs/promises';
+import { randomUUID } from 'crypto';
+import { dataPath } from '../paths.js';
+import { ingestFolder, listExportFiles } from '../ingest.js';
+import { listSourceFilesInCollection } from '../store.js';
+import { ValidationError, normalizeCollectionName, normalizeCollectionSelector, normalizeBoolean, } from '../validation.js';
+import { abortOnDisconnect, isAbortError } from './stream-abort.js';
+const router = Router();
+const UPLOADS_DIR = process.env.UPLOADS_DIR || dataPath('uploads');
+const INCOMING_DIR = join(UPLOADS_DIR, '.incoming');
+const MAX_UPLOAD_SIZE = 500 * 1024 * 1024; // 500 MB
+const MAX_UPLOAD_FILES = 1000;
+const upload = multer({
+    storage: multer.diskStorage({
+        destination: (_req, _file, callback) => {
+            mkdirSync(INCOMING_DIR, { recursive: true });
+            callback(null, INCOMING_DIR);
+        },
+        filename: (_req, _file, callback) => callback(null, randomUUID()),
+    }),
+    limits: {
+        fileSize: MAX_UPLOAD_SIZE,
+        files: MAX_UPLOAD_FILES,
+        fields: 10,
+        parts: MAX_UPLOAD_FILES + 10,
+        fieldNameSize: 4096,
+    },
+});
+const tryNormalizeCollectionName = (value) => {
+    try {
+        return normalizeCollectionName(value);
+    }
+    catch {
+        return '';
+    }
+};
+const safeUploadRelativePath = (rawPath) => {
+    const normalized = normalize(String(rawPath || '').replace(/\\/g, '/'));
+    if (!normalized || isAbsolute(normalized) || normalized.startsWith('..'))
+        return null;
+    return normalized;
+};
+const isInsideDirectory = (parentDir, childPath) => {
+    const parent = resolve(parentDir);
+    const child = resolve(childPath);
+    const rel = relative(parent, child);
+    return !!rel && !rel.startsWith('..') && !isAbsolute(rel);
+};
+const getUploadedFiles = (files) => {
+    return Array.isArray(files) ? files : [];
+};
+const cleanupUploadedTemps = async (files) => {
+    await Promise.all(files.map((file) => (file.path ? rm(file.path, { force: true }) : Promise.resolve())));
+};
+const getUploadTarget = (files, requestedCollection) => {
+    const firstPath = (files[0]?.fieldname ?? '').replace(/\\/g, '/');
+    const topDir = firstPath.split('/').filter(Boolean)[0];
+    const collectionName = requestedCollection || tryNormalizeCollectionName(topDir || 'upload') || 'upload';
+    return {
+        collectionName,
+        targetDir: join(UPLOADS_DIR, collectionName),
+    };
+};
+const uploadRelativePath = (fieldname) => {
+    const rel = fieldname.replace(/\\/g, '/');
+    const parts = rel.split('/').filter(Boolean);
+    const pathInsideFolder = parts.length > 1 ? join(...parts.slice(1)) : parts[0];
+    return {
+        rel,
+        relativePath: safeUploadRelativePath(pathInsideFolder ?? ''),
+    };
+};
+const ensureUploadTarget = async (targetDir) => {
+    if (!existsSync(UPLOADS_DIR))
+        await mkdir(UPLOADS_DIR, { recursive: true });
+    if (!existsSync(targetDir))
+        await mkdir(targetDir, { recursive: true });
+};
+const persistUploadedFiles = async (files, targetDir, onFile) => {
+    await ensureUploadTarget(targetDir);
+    for (const [index, file] of files.entries()) {
+        const { rel, relativePath } = uploadRelativePath(file.fieldname);
+        if (!relativePath) {
+            return { ok: false, error: `Unsafe upload path: ${rel}` };
+        }
+        const outPath = join(targetDir, relativePath);
+        if (!isInsideDirectory(targetDir, outPath)) {
+            return { ok: false, error: `Upload path escapes target directory: ${rel}` };
+        }
+        const outDir = dirname(outPath);
+        if (!existsSync(outDir))
+            await mkdir(outDir, { recursive: true });
+        await copyFile(file.path, outPath);
+        onFile?.(index + 1, relativePath);
+    }
+    return { ok: true };
+};
+const writeEvent = (res, payload) => {
+    if (res.destroyed || res.writableEnded)
+        return;
+    res.write(`${JSON.stringify(payload)}\n`);
+};
+const canonicalSourcePath = (filePath) => {
+    const canonical = resolve(filePath).replace(/\\/g, '/');
+    return process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+};
+router.get('/api/ingest-preview', async (req, res) => {
+    const folderPath = req.query.folderPath;
+    let collection;
+    try {
+        collection = normalizeCollectionSelector(req.query.collection);
+    }
+    catch (e) {
+        if (e instanceof ValidationError) {
+            return res.status(400).json({ error: e.message, field: e.field });
+        }
+        throw e;
+    }
+    if (!folderPath || typeof folderPath !== 'string' || folderPath.trim().length === 0) {
+        return res.status(400).json({ error: 'Missing folderPath' });
+    }
+    if (folderPath.length > 4096) {
+        return res.status(400).json({ error: 'folderPath too long' });
+    }
+    try {
+        const files = await listExportFiles(folderPath);
+        const existingFiles = collection === 'all' ? [] : await listSourceFilesInCollection(collection);
+        const existingPaths = new Set(existingFiles.map(canonicalSourcePath));
+        const duplicates = files
+            .map((filePath) => ({
+            sourceFile: filePath,
+            name: basename(filePath),
+            canonicalPath: canonicalSourcePath(filePath),
+        }))
+            .filter((file) => existingPaths.has(file.canonicalPath));
+        res.json({ collection, files, duplicates });
+    }
+    catch (e) {
+        console.error('[/api/ingest-preview]', e);
+        res.status(500).json({ error: e.message });
+    }
+});
+router.post('/api/ingest-upload', upload.any(), async (req, res) => {
+    const files = getUploadedFiles(req.files);
+    let clearFirst;
+    try {
+        clearFirst = normalizeBoolean(req.body?.clearFirst, { field: 'clearFirst' });
+    }
+    catch (e) {
+        await cleanupUploadedTemps(files);
+        if (e instanceof ValidationError) {
+            return res.status(400).json({ error: e.message, field: e.field });
+        }
+        throw e;
+    }
+    if (files.length === 0) {
+        return res
+            .status(400)
+            .json({ error: 'No files uploaded. Choose a folder with JSON export files.' });
+    }
+    const requestedCollection = tryNormalizeCollectionName(req.body?.collectionName);
+    const { collectionName, targetDir } = getUploadTarget(files, requestedCollection);
+    try {
+        const persisted = await persistUploadedFiles(files, targetDir);
+        if (!persisted.ok) {
+            return res.status(400).json({ status: 'error', error: persisted.error });
+        }
+        const result = await ingestFolder(collectionName, targetDir, { clearFirst });
+        res.json({ status: 'completed', result, collectionName });
+    }
+    catch (e) {
+        console.error('[/api/ingest-upload]', e);
+        res.status(500).json({ status: 'error', error: e.message });
+    }
+    finally {
+        await cleanupUploadedTemps(files);
+    }
+});
+router.post('/api/ingest-upload-progress', upload.any(), async (req, res) => {
+    const files = getUploadedFiles(req.files);
+    let clearFirst;
+    try {
+        clearFirst = normalizeBoolean(req.body?.clearFirst, { field: 'clearFirst' });
+    }
+    catch (e) {
+        await cleanupUploadedTemps(files);
+        if (e instanceof ValidationError) {
+            return res.status(400).json({ error: e.message, field: e.field });
+        }
+        throw e;
+    }
+    const requestedCollection = tryNormalizeCollectionName(req.body?.collectionName);
+    if (!files.length) {
+        return res.status(400).json({ status: 'error', error: 'No files uploaded' });
+    }
+    const { collectionName, targetDir } = getUploadTarget(files, requestedCollection);
+    res.setHeader('Content-Type', 'application/x-ndjson; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-cache');
+    res.setHeader('X-Accel-Buffering', 'no');
+    if (typeof res.flushHeaders === 'function')
+        res.flushHeaders();
+    const controller = abortOnDisconnect(req, res, 'Indexing stopped');
+    try {
+        writeEvent(res, {
+            status: 'starting',
+            phase: 'uploading',
+            totalFiles: files.length,
+            processedFiles: 0,
+            totalChunks: 0,
+            totalTokens: 0,
+            elapsedMs: 0,
+        });
+        const persisted = await persistUploadedFiles(files, targetDir, (processedFiles, relativePath) => {
+            writeEvent(res, {
+                status: 'progress',
+                phase: 'uploading',
+                totalFiles: files.length,
+                processedFiles,
+                currentFile: relativePath,
+                totalChunks: 0,
+                totalTokens: 0,
+                elapsedMs: 0,
+            });
+        });
+        if (!persisted.ok) {
+            writeEvent(res, { status: 'error', error: persisted.error });
+            return;
+        }
+        const onProgress = (data) => writeEvent(res, data);
+        const result = await ingestFolder(collectionName, targetDir, {
+            clearFirst,
+            onProgress,
+            signal: controller.signal,
+        });
+        writeEvent(res, { status: 'completed', result, collectionName });
+    }
+    catch (e) {
+        if (!isAbortError(e)) {
+            console.error('[/api/ingest-upload-progress]', e);
+            writeEvent(res, { status: 'error', error: e.message });
+        }
+    }
+    finally {
+        await cleanupUploadedTemps(files);
+        res.end();
+    }
+});
+router.post('/api/ingest-progress', async (req, res) => {
+    const folderPath = req.body?.folderPath;
+    let clearFirst;
+    try {
+        clearFirst = normalizeBoolean(req.body?.clearFirst, { field: 'clearFirst' });
+    }
+    catch (e) {
+        if (e instanceof ValidationError) {
+            return res.status(400).json({ error: e.message, field: e.field });
+        }
+        throw e;
+    }
+    if (!folderPath || typeof folderPath !== 'string') {
+        return res.status(400).json({ error: 'Missing folderPath' });
+    }
+    if (folderPath.length > 4096 || folderPath.includes('\0')) {
+        return res.status(400).json({ error: 'Invalid folderPath' });
+    }
+    const collectionName = tryNormalizeCollectionName(req.body?.collection) ||
+        tryNormalizeCollectionName(basename(folderPath)) ||
+        'chunks';
+    res.setHeader('Content-Type', 'application/x-ndjson; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-cache');
+    res.setHeader('X-Accel-Buffering', 'no');
+    if (typeof res.flushHeaders === 'function')
+        res.flushHeaders();
+    const controller = abortOnDisconnect(req, res, 'Indexing stopped');
+    const onProgress = (data) => {
+        res.write(`${JSON.stringify(data)}\n`);
+    };
+    try {
+        const result = await ingestFolder(collectionName, folderPath, {
+            clearFirst,
+            onProgress,
+            signal: controller.signal,
+        });
+        res.write(`${JSON.stringify({ status: 'completed', result })}\n`);
+    }
+    catch (e) {
+        if (!isAbortError(e)) {
+            console.error('[/api/ingest-progress]', e);
+            writeEvent(res, { status: 'error', error: e.message });
+        }
+    }
+    finally {
+        res.end();
+    }
+});
+export default router;

package/dist/src/routes/insights.js

@@ -0,0 +1,24 @@
+import { Router } from 'express';
+import { getInsights } from '../services/insights.js';
+import { ValidationError, normalizeCollectionSelector } from '../validation.js';
+const router = Router();
+router.get('/api/insights', async (req, res) => {
+    let collection;
+    try {
+        collection = normalizeCollectionSelector(req.query?.collection);
+    }
+    catch (e) {
+        if (e instanceof ValidationError) {
+            return res.status(400).json({ error: e.message, field: e.field });
+        }
+        throw e;
+    }
+    try {
+        res.json(await getInsights(collection));
+    }
+    catch (e) {
+        console.error('[/api/insights]', e);
+        res.status(500).json({ error: e.message });
+    }
+});
+export default router;

package/dist/src/routes/loopback.js

@@ -0,0 +1,15 @@
+import { isLoopbackRequest } from '../generation/filesystem-browser.js';
+/**
+ * Local generation controls — installing runtimes, browsing the filesystem,
+ * downloading models — are never exposed beyond the machine running the server.
+ */
+export const requireLoopback = (req, res, next) => {
+    const forwardedFor = [req.headers['x-forwarded-for'], req.headers['x-real-ip']]
+        .flatMap((value) => (Array.isArray(value) ? value : value ? [value] : []))
+        .map(String);
+    if (!isLoopbackRequest(req.socket.remoteAddress, forwardedFor, req.headers.forwarded, req.hostname)) {
+        res.status(403).json({ error: 'Local generation controls are available only from localhost' });
+        return;
+    }
+    next();
+};

package/dist/src/routes/model-catalog.js

@@ -0,0 +1,178 @@
+import { Router } from 'express';
+import { requireLoopback } from './loopback.js';
+import { abortOnDisconnect, isAbortError } from './stream-abort.js';
+import { inspectHardware, judgeFit } from '../generation/hardware.js';
+import { CatalogError, getCatalogModel, huggingFaceToken, searchCatalogModels, } from '../generation/model-catalog.js';
+import { downloadModel, planModelDownload } from '../generation/model-download.js';
+import { buildQuickSetupPlan, quickSetupFingerprint, quickSetupFingerprintMatches, runQuickSetupPlan, } from '../generation/quick-setup.js';
+const router = Router();
+const sorts = new Set(['downloads', 'likes', 'trending', 'recent']);
+const variants = new Set(['cpu', 'vulkan', 'cuda', 'rocm', 'sycl']);
+const fail = (res, error) => {
+    if (error instanceof CatalogError) {
+        res.status(error.status && error.status < 600 ? error.status : 502).json({
+            error: error.message,
+        });
+        return;
+    }
+    console.error('[/api/generation/catalog]', error);
+    res.status(502).json({ error: error instanceof Error ? error.message : 'Catalog request failed' });
+};
+/** NDJSON, matching the ingest and chat streams the client already consumes. */
+const openStream = (res) => {
+    res.setHeader('Content-Type', 'application/x-ndjson; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-cache, no-transform');
+    res.setHeader('X-Accel-Buffering', 'no');
+    if (typeof res.flushHeaders === 'function')
+        res.flushHeaders();
+    return (event) => {
+        res.write(`${JSON.stringify(event)}\n`);
+    };
+};
+router.get('/api/generation/hardware', requireLoopback, async (_req, res) => {
+    try {
+        res.json(await inspectHardware());
+    }
+    catch (error) {
+        fail(res, error);
+    }
+});
+router.get('/api/generation/catalog/search', requireLoopback, async (req, res) => {
+    try {
+        const sort = String(req.query.sort || 'downloads');
+        const [result, hardware] = await Promise.all([
+            searchCatalogModels({
+                query: typeof req.query.q === 'string' ? req.query.q : '',
+                sort: sorts.has(sort) ? sort : 'downloads',
+                limit: Number(req.query.limit) || 24,
+                author: typeof req.query.author === 'string' ? req.query.author : undefined,
+            }),
+            inspectHardware(),
+        ]);
+        res.json({ ...result, hardware });
+    }
+    catch (error) {
+        fail(res, error);
+    }
+});
+router.get('/api/generation/catalog/model', requireLoopback, async (req, res) => {
+    try {
+        const id = typeof req.query.id === 'string' ? req.query.id : '';
+        const [detail, hardware] = await Promise.all([getCatalogModel(id), inspectHardware()]);
+        res.json({
+            model: {
+                ...detail,
+                // Fit is judged server-side so every surface agrees on one verdict.
+                quants: detail.quants.map((quant) => ({
+                    ...quant,
+                    fit: judgeFit(quant.totalBytes, hardware),
+                })),
+            },
+            hardware,
+            tokenConfigured: Boolean(huggingFaceToken()),
+        });
+    }
+    catch (error) {
+        fail(res, error);
+    }
+});
+router.post('/api/generation/catalog/download', requireLoopback, async (req, res) => {
+    const controller = abortOnDisconnect(req, res, 'Download cancelled');
+    try {
+        const plan = await planModelDownload({
+            repoId: String(req.body?.repoId ?? ''),
+            quant: req.body?.quant ? String(req.body.quant) : undefined,
+            includeProjector: req.body?.includeProjector === true,
+        });
+        const send = openStream(res);
+        send({ type: 'plan', plan });
+        await downloadModel(plan, {
+            signal: controller.signal,
+            onProgress: (progress) => send({ type: 'progress', ...progress }),
+        });
+        send({ type: 'done', primaryPath: plan.primaryPath, directory: plan.directory });
+        res.end();
+    }
+    catch (error) {
+        if (isAbortError(error) || controller.signal.aborted) {
+            res.end();
+            return;
+        }
+        if (res.headersSent) {
+            res.write(`${JSON.stringify({ type: 'error', error: error instanceof Error ? error.message : 'Download failed' })}\n`);
+            res.end();
+            return;
+        }
+        fail(res, error);
+    }
+});
+router.get('/api/generation/setup/plan', requireLoopback, async (req, res) => {
+    try {
+        const variant = String(req.query.variant || '');
+        res.json(await buildQuickSetupPlan({
+            variant: variants.has(variant) ? variant : undefined,
+            repoId: typeof req.query.model === 'string' ? req.query.model : undefined,
+            quant: typeof req.query.quant === 'string' ? req.query.quant : undefined,
+        }));
+    }
+    catch (error) {
+        fail(res, error);
+    }
+});
+router.post('/api/generation/setup/run', requireLoopback, async (req, res) => {
+    const controller = abortOnDisconnect(req, res, 'Setup cancelled');
+    try {
+        // The confirmation flag is the recorded consent for this download.
+        if (req.body?.confirm !== true) {
+            res.status(400).json({ error: 'Setup requires explicit confirmation' });
+            return;
+        }
+        const variant = String(req.body?.variant || '');
+        // Re-resolved server-side rather than taken from the request: a client must
+        // never be able to hand the server a URL to fetch and execute. The pins keep
+        // that resolution deterministic, so it lands on what the user approved.
+        const plan = await buildQuickSetupPlan({
+            variant: variants.has(variant) ? variant : undefined,
+            repoId: typeof req.body?.model === 'string' ? req.body.model : undefined,
+            quant: typeof req.body?.quant === 'string' ? req.body.quant : undefined,
+            releaseTag: typeof req.body?.releaseTag === 'string' ? req.body.releaseTag : undefined,
+        });
+        // The approved plan is identified by its digests, sizes and versions. If a
+        // nightly build moved, the catalog returned different files, or free VRAM
+        // changed the recommendation, the user is shown the new plan to approve
+        // rather than handed a download they never agreed to.
+        const approved = req.body?.fingerprint;
+        const current = quickSetupFingerprint(plan);
+        if (!quickSetupFingerprintMatches(plan, approved)) {
+            res.status(409).json({
+                error: typeof approved === 'string' && approved
+                    ? 'The setup plan changed since it was shown. Review the new plan and confirm again.'
+                    : 'Setup requires approval of the exact plan shown. Review the plan and confirm again.',
+                plan,
+                fingerprint: current,
+            });
+            return;
+        }
+        const send = openStream(res);
+        send({ type: 'plan', plan });
+        const result = await runQuickSetupPlan(plan, {
+            signal: controller.signal,
+            onProgress: (progress) => send({ type: 'progress', ...progress }),
+        });
+        send({ type: 'done', ...result });
+        res.end();
+    }
+    catch (error) {
+        if (isAbortError(error) || controller.signal.aborted) {
+            res.end();
+            return;
+        }
+        if (res.headersSent) {
+            res.write(`${JSON.stringify({ type: 'error', error: error instanceof Error ? error.message : 'Setup failed' })}\n`);
+            res.end();
+            return;
+        }
+        fail(res, error);
+    }
+});
+export default router;

package/dist/src/routes/search.js

@@ -0,0 +1,57 @@
+import { Router } from 'express';
+import { searchAcrossCollections } from '../services/search.js';
+import { ValidationError, normalizeCollectionSelector, normalizeQuery, normalizeCount, normalizeRoles, normalizeBoolean, normalizeOptionalString, normalizeDateRange, normalizeSearchMode, } from '../validation.js';
+const router = Router();
+router.get('/api/search', async (req, res) => {
+    let q;
+    let collection;
+    let n;
+    let roles;
+    let keywordBoost;
+    let model;
+    let from;
+    let to;
+    let mode;
+    let origin;
+    try {
+        q = normalizeQuery(req.query?.q);
+        collection = normalizeCollectionSelector(req.query?.collection);
+        n = normalizeCount(req.query?.n, { defaultValue: 15 });
+        roles = normalizeRoles(req.query?.roles) || null;
+        keywordBoost = normalizeBoolean(req.query?.keywordBoost, { field: 'keywordBoost' });
+        model = normalizeOptionalString(req.query?.model, { field: 'model' });
+        ({ from, to } = normalizeDateRange(req.query?.from, req.query?.to));
+        mode = normalizeSearchMode(req.query?.mode);
+        const rawOrigin = normalizeOptionalString(req.query?.origin, { field: 'origin' });
+        if (rawOrigin && rawOrigin !== 'threadshelf' && rawOrigin !== 'archive') {
+            throw new ValidationError('Invalid origin: expected threadshelf or archive', {
+                field: 'origin',
+            });
+        }
+        origin = rawOrigin;
+    }
+    catch (e) {
+        if (e instanceof ValidationError) {
+            return res.status(400).json({ error: e.message, field: e.field });
+        }
+        throw e;
+    }
+    try {
+        const results = await searchAcrossCollections(q, collection, {
+            n,
+            roles: roles ?? undefined,
+            keywordBoost,
+            model,
+            from,
+            to,
+            mode,
+            origin,
+        });
+        res.json({ results });
+    }
+    catch (e) {
+        console.error('[/api/search]', e);
+        res.status(500).json({ error: e.message, results: [] });
+    }
+});
+export default router;

package/dist/src/routes/stream-abort.js

@@ -0,0 +1,23 @@
+/**
+ * Aborts long-running streamed work when the client goes away.
+ *
+ * Both events are needed: `req`'s `aborted` covers a dropped connection, while
+ * `res`'s `close` is what actually fires when a browser stops reading a streamed
+ * response (an `AbortController` on the fetch caller). Listening to only one of
+ * them leaves the server downloading gigabytes after the user pressed Cancel.
+ */
+export const abortOnDisconnect = (req, res, message = 'Client disconnected') => {
+    const controller = new AbortController();
+    const stop = () => {
+        if (!controller.signal.aborted) {
+            controller.abort(new DOMException(message, 'AbortError'));
+        }
+    };
+    req.once('aborted', stop);
+    res.once('close', () => {
+        if (!res.writableEnded)
+            stop();
+    });
+    return controller;
+};
+export const isAbortError = (error) => error instanceof Error && error.name === 'AbortError';

package/dist/src/routes/thread.js

@@ -0,0 +1,43 @@
+import { Router } from 'express';
+import { loadThread, NotFoundError, BadRequestError } from '../services/thread.js';
+import { ValidationError, normalizeCollectionSelector } from '../validation.js';
+const router = Router();
+router.get('/api/thread', async (req, res) => {
+    const sourceFile = req.query?.sourceFile;
+    const conversationKey = req.query?.conversationKey;
+    let collection;
+    try {
+        collection = normalizeCollectionSelector(req.query?.collection);
+    }
+    catch (e) {
+        if (e instanceof ValidationError) {
+            return res.status(400).json({ error: e.message, field: e.field });
+        }
+        throw e;
+    }
+    if (!sourceFile || typeof sourceFile !== 'string') {
+        return res.status(400).json({ error: 'Missing sourceFile' });
+    }
+    if (sourceFile.includes('\0') || sourceFile.length > 4096) {
+        return res.status(400).json({ error: 'Invalid sourceFile' });
+    }
+    if (conversationKey != null &&
+        (typeof conversationKey !== 'string' ||
+            conversationKey.includes('\0') ||
+            conversationKey.length > 4096)) {
+        return res.status(400).json({ error: 'Invalid conversationKey' });
+    }
+    try {
+        const thread = await loadThread(sourceFile, collection, typeof conversationKey === 'string' ? conversationKey : undefined);
+        res.json(thread);
+    }
+    catch (e) {
+        if (e instanceof NotFoundError)
+            return res.status(404).json({ error: e.message });
+        if (e instanceof BadRequestError)
+            return res.status(400).json({ error: e.message });
+        console.error('[/api/thread]', e);
+        res.status(500).json({ error: e.message });
+    }
+});
+export default router;