@agimon-ai/po-artifact 0.0.0-alpha.4 → 0.0.0-alpha.41

package/LICENSE

@@ -1,21 +1,149 @@
-MIT License
-
-Copyright (c) 2026 Vuong Ngo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             Agimon Pty Ltd
+Licensed Work:        Po, the software in the Po source repository and the
+                      packages released from it, in each version released by
+                      the Licensor.
+                      The Licensed Work is (c) 2026 Agimon Pty Ltd.
+                      Material identified as third-party in the "Third-party
+                      components" section at the end of this file or in a
+                      NOTICE file, and any package or directory whose own
+                      license file grants a different license, is not part of
+                      the Licensed Work and remains under its own license.
+Additional Use Grant: You may make production use of the Licensed Work if
+  your use is Eligible Use. "Eligible Use" is production use that falls
+  within at least one of the following:
+
+  (a) Personal Use. Use by an individual for their own personal purposes,
+      and not on behalf of, or for the benefit of, an employer, client, or
+      other Organization. Use by an individual in the course of employment
+      or engagement by an Organization is use by that Organization.
+
+  (b) Small Organization Use. Use by or on behalf of an Organization whose
+      Annual Revenue is less than USD 1,000,000.
+
+  (c) Non-profit, Education and Research Use. Use, regardless of Annual
+      Revenue, by (i) an Organization registered or recognized as a
+      non-profit or charitable organization under the laws of its
+      jurisdiction, for its non-profit purposes; (ii) an accredited school,
+      college, or university, for teaching, learning, or academic research;
+      or (iii) a publicly funded research institution, for its research.
+
+  (d) Service Provider Use. Use by a consultant, contractor, agency, or other
+      service provider, regardless of its own Annual Revenue, solely to
+      build, deploy, host, operate, or support the Licensed Work for a client
+      whose own use would be Eligible Use under (a), (b), or (c). A service
+      provider's use for its own purposes is Eligible Use only if the service
+      provider itself qualifies under (b) or (c).
+
+
+  Hosted services. Offering the Licensed Work to third parties as a hosted
+  or managed service whose primary value is the Licensed Work is Eligible
+  Use only if each such third party's own use would be Eligible Use.
+
+  Definitions. "Organization" means any company, partnership, sole
+  proprietorship, trust, association, government body, or other entity, and
+  includes an individual acting in a business or professional capacity.
+  "Affiliate" means any entity that directly or indirectly controls, is
+  controlled by, or is under common control with an Organization, where
+  "control" means ownership of more than 50% of the voting interests of an
+  entity or the power to direct its management and policies by contract or
+  otherwise. "Annual Revenue" means the total gross revenue of an
+  Organization and all of its Affiliates combined, from all sources and
+  whether or not related to the Licensed Work, for its most recently
+  completed fiscal year, or, if it has not completed a fiscal year, for the
+  twelve months before the use (or since its formation, if shorter),
+  converted into US dollars at the average exchange rate for that period.
+  Proceeds of equity or debt financing are not revenue.
+
+  Threshold. If an Organization stops qualifying under (b), its existing
+  production use remains Eligible Use for 90 days after it stops
+  qualifying, after which it must obtain a commercial license or stop
+  production use. Use that was Eligible Use when it occurred never requires
+  a commercial license after the fact.
+Change Date:          Four years from the date a version of the Licensed Work
+                      is first publicly released by the Licensor.
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed
+Work, please visit: https://agimon.ai/licensing
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/dist/apiContracts.cjs

@@ -14,14 +14,21 @@ const ArtifactsPayloadSchema = typebox.Type.Object({
 		size: N,
 		modifiedAt: N
 	})),
+	temporaryRoot: typebox.Type.Optional(S),
 	error: typebox.Type.Optional(S)
 });
+const scopeQuery = {
+	name: "scope",
+	in: "query",
+	required: false,
+	schema: typebox.Type.Union([typebox.Type.Literal("artifacts"), typebox.Type.Literal("temporary")])
+};
 const query = [{
 	name: "path",
 	in: "query",
 	required: true,
 	schema: typebox.Type.String({ minLength: 1 })
-}];
+}, scopeQuery];
 const apiContracts = (0, _agimon_ai_po_core_apiContracts.defineApiContract)({
 	version: 1,
 	dynamic: [],
@@ -33,7 +40,8 @@ const apiContracts = (0, _agimon_ai_po_core_apiContracts.defineApiContract)({
 			path: "/",
 			method: "GET",
 			authentication: "owner",
-			description: "List regular artifacts in the current session folder by modification time.",
+			description: "List regular artifacts or temporary files in the current session folder by modification time.",
+			parameters: [scopeQuery],
 			responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(ArtifactsPayloadSchema)
 		},
 		{

package/dist/apiContracts.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.cjs","names":["Type","defineApiContract","jsonApiResponses"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nexport const ArtifactsPayloadSchema = Type.Object({\n  items: Type.Array(Type.Object({ path: S, name: S, size: N, modifiedAt: N })),\n  error: Type.Optional(S),\n});\nconst query = [{ name: 'path', in: 'query' as const, required: true, schema: Type.String({ minLength: 1 }) }];\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: [],\n  http: [\n    {\n      id: 'artifacts.list',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'List regular artifacts in the current session folder by modification time.',\n      responses: jsonApiResponses(ArtifactsPayloadSchema),\n    },\n    {\n      id: 'artifacts.preview',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/preview',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded text preview from the current session artifact folder.',\n      parameters: query,\n      responses: jsonApiResponses(\n        Type.Object({\n          path: S,\n          content: S,\n          mimeType: S,\n          unavailable: Type.Optional(Type.Boolean()),\n          reason: Type.Optional(S),\n        }),\n      ),\n    },\n    {\n      id: 'artifacts.content',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/content',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded artifact bytes, with range and version checks.',\n      parameters: [\n        ...query,\n        { name: 'Range', in: 'header', required: false, schema: S },\n        { name: 'If-Match', in: 'header', required: false, schema: S },\n      ],\n      responses: {\n        '200': { description: 'Artifact bytes.', contentType: 'application/octet-stream' },\n        '206': { description: 'Artifact byte range.', contentType: 'application/octet-stream' },\n        '400': { description: 'Invalid artifact path.' },\n        '403': { description: 'Artifact access rejected.' },\n        '404': { description: 'Artifact missing.' },\n        '412': { description: 'Artifact changed.' },\n        '413': { description: 'Artifact too large.' },\n        '416': { description: 'Invalid byte range.' },\n      },\n    },\n  ],\n  sockets: (['global', 'workspace'] as const).map((scope) => ({\n    id: 'artifacts.channel',\n    scope,\n    service: 'po.hub',\n    member: 'artifacts',\n    kind: 'channel',\n    direction: 'server-to-client',\n    description: 'Current-session artifact metadata in the hub frame payload.',\n    input: ArtifactsPayloadSchema,\n  })),\n});\nexport default apiContracts;\n"],"mappings":";;;;;;;AAGA,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAa,yBAAyBA,QAAAA,KAAK,OAAO;CAChD,OAAOA,QAAAA,KAAK,MAAMA,QAAAA,KAAK,OAAO;EAAE,MAAM;EAAG,MAAM;EAAG,MAAM;EAAG,YAAY;CAAE,CAAC,CAAC;CAC3E,OAAOA,QAAAA,KAAK,SAAS,CAAC;AACxB,CAAC;AACD,MAAM,QAAQ,CAAC;CAAE,MAAM;CAAQ,IAAI;CAAkB,UAAU;CAAM,QAAQA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE,CAAC;AAC5G,MAAa,gBAAA,GAAeC,gCAAAA,kBAAAA,CAAkB;CAC5C,SAAS;CACT,SAAS,CAAC;CACV,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,sBAAsB;EACpD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;GACZ,YAAA,GAAWA,gCAAAA,iBAAAA,CACTF,QAAAA,KAAK,OAAO;IACV,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAaA,QAAAA,KAAK,SAASA,QAAAA,KAAK,QAAQ,CAAC;IACzC,QAAQA,QAAAA,KAAK,SAAS,CAAC;GACzB,CAAC,CACH;EACF;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;IACV,GAAG;IACH;KAAE,MAAM;KAAS,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;IAC1D;KAAE,MAAM;KAAY,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;GAC/D;GACA,WAAW;IACT,OAAO;KAAE,aAAa;KAAmB,aAAa;IAA2B;IACjF,OAAO;KAAE,aAAa;KAAwB,aAAa;IAA2B;IACtF,OAAO,EAAE,aAAa,yBAAyB;IAC/C,OAAO,EAAE,aAAa,4BAA4B;IAClD,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,sBAAsB;IAC5C,OAAO,EAAE,aAAa,sBAAsB;GAC9C;EACF;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,KAAK,WAAW;EAC1D,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO;CACT,EAAE;AACJ,CAAC"}
+{"version":3,"file":"apiContracts.cjs","names":["Type","defineApiContract","jsonApiResponses"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nexport const ArtifactsPayloadSchema = Type.Object({\n  items: Type.Array(Type.Object({ path: S, name: S, size: N, modifiedAt: N })),\n  temporaryRoot: Type.Optional(S),\n  error: Type.Optional(S),\n});\nconst scopeQuery = {\n  name: 'scope',\n  in: 'query' as const,\n  required: false,\n  schema: Type.Union([Type.Literal('artifacts'), Type.Literal('temporary')]),\n};\nconst query = [\n  { name: 'path', in: 'query' as const, required: true, schema: Type.String({ minLength: 1 }) },\n  scopeQuery,\n];\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: [],\n  http: [\n    {\n      id: 'artifacts.list',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'List regular artifacts or temporary files in the current session folder by modification time.',\n      parameters: [scopeQuery],\n      responses: jsonApiResponses(ArtifactsPayloadSchema),\n    },\n    {\n      id: 'artifacts.preview',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/preview',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded text preview from the current session artifact folder.',\n      parameters: query,\n      responses: jsonApiResponses(\n        Type.Object({\n          path: S,\n          content: S,\n          mimeType: S,\n          unavailable: Type.Optional(Type.Boolean()),\n          reason: Type.Optional(S),\n        }),\n      ),\n    },\n    {\n      id: 'artifacts.content',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/content',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded artifact bytes, with range and version checks.',\n      parameters: [\n        ...query,\n        { name: 'Range', in: 'header', required: false, schema: S },\n        { name: 'If-Match', in: 'header', required: false, schema: S },\n      ],\n      responses: {\n        '200': { description: 'Artifact bytes.', contentType: 'application/octet-stream' },\n        '206': { description: 'Artifact byte range.', contentType: 'application/octet-stream' },\n        '400': { description: 'Invalid artifact path.' },\n        '403': { description: 'Artifact access rejected.' },\n        '404': { description: 'Artifact missing.' },\n        '412': { description: 'Artifact changed.' },\n        '413': { description: 'Artifact too large.' },\n        '416': { description: 'Invalid byte range.' },\n      },\n    },\n  ],\n  sockets: (['global', 'workspace'] as const).map((scope) => ({\n    id: 'artifacts.channel',\n    scope,\n    service: 'po.hub',\n    member: 'artifacts',\n    kind: 'channel',\n    direction: 'server-to-client',\n    description: 'Current-session artifact metadata in the hub frame payload.',\n    input: ArtifactsPayloadSchema,\n  })),\n});\nexport default apiContracts;\n"],"mappings":";;;;;;;AAGA,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAa,yBAAyBA,QAAAA,KAAK,OAAO;CAChD,OAAOA,QAAAA,KAAK,MAAMA,QAAAA,KAAK,OAAO;EAAE,MAAM;EAAG,MAAM;EAAG,MAAM;EAAG,YAAY;CAAE,CAAC,CAAC;CAC3E,eAAeA,QAAAA,KAAK,SAAS,CAAC;CAC9B,OAAOA,QAAAA,KAAK,SAAS,CAAC;AACxB,CAAC;AACD,MAAM,aAAa;CACjB,MAAM;CACN,IAAI;CACJ,UAAU;CACV,QAAQA,QAAAA,KAAK,MAAM,CAACA,QAAAA,KAAK,QAAQ,WAAW,GAAGA,QAAAA,KAAK,QAAQ,WAAW,CAAC,CAAC;AAC3E;AACA,MAAM,QAAQ,CACZ;CAAE,MAAM;CAAQ,IAAI;CAAkB,UAAU;CAAM,QAAQA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE,GAC5F,UACF;AACA,MAAa,gBAAA,GAAeC,gCAAAA,kBAAAA,CAAkB;CAC5C,SAAS;CACT,SAAS,CAAC;CACV,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY,CAAC,UAAU;GACvB,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,sBAAsB;EACpD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;GACZ,YAAA,GAAWA,gCAAAA,iBAAAA,CACTF,QAAAA,KAAK,OAAO;IACV,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAaA,QAAAA,KAAK,SAASA,QAAAA,KAAK,QAAQ,CAAC;IACzC,QAAQA,QAAAA,KAAK,SAAS,CAAC;GACzB,CAAC,CACH;EACF;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;IACV,GAAG;IACH;KAAE,MAAM;KAAS,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;IAC1D;KAAE,MAAM;KAAY,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;GAC/D;GACA,WAAW;IACT,OAAO;KAAE,aAAa;KAAmB,aAAa;IAA2B;IACjF,OAAO;KAAE,aAAa;KAAwB,aAAa;IAA2B;IACtF,OAAO,EAAE,aAAa,yBAAyB;IAC/C,OAAO,EAAE,aAAa,4BAA4B;IAClD,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,sBAAsB;IAC5C,OAAO,EAAE,aAAa,sBAAsB;GAC9C;EACF;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,KAAK,WAAW;EAC1D,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO;CACT,EAAE;AACJ,CAAC"}

package/dist/apiContracts.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.d.mts","names":[],"sources":["../src/schemas/apiContracts.ts"],"mappings":";;qBAUa"}
+{"version":3,"file":"apiContracts.d.mts","names":[],"sources":["../src/schemas/apiContracts.ts"],"mappings":";;qBAoBa"}

package/dist/apiContracts.mjs

@@ -10,14 +10,21 @@ const ArtifactsPayloadSchema = Type.Object({
 		size: N,
 		modifiedAt: N
 	})),
+	temporaryRoot: Type.Optional(S),
 	error: Type.Optional(S)
 });
+const scopeQuery = {
+	name: "scope",
+	in: "query",
+	required: false,
+	schema: Type.Union([Type.Literal("artifacts"), Type.Literal("temporary")])
+};
 const query = [{
 	name: "path",
 	in: "query",
 	required: true,
 	schema: Type.String({ minLength: 1 })
-}];
+}, scopeQuery];
 const apiContracts = defineApiContract({
 	version: 1,
 	dynamic: [],
@@ -29,7 +36,8 @@ const apiContracts = defineApiContract({
 			path: "/",
 			method: "GET",
 			authentication: "owner",
-			description: "List regular artifacts in the current session folder by modification time.",
+			description: "List regular artifacts or temporary files in the current session folder by modification time.",
+			parameters: [scopeQuery],
 			responses: jsonApiResponses(ArtifactsPayloadSchema)
 		},
 		{

package/dist/apiContracts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nexport const ArtifactsPayloadSchema = Type.Object({\n  items: Type.Array(Type.Object({ path: S, name: S, size: N, modifiedAt: N })),\n  error: Type.Optional(S),\n});\nconst query = [{ name: 'path', in: 'query' as const, required: true, schema: Type.String({ minLength: 1 }) }];\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: [],\n  http: [\n    {\n      id: 'artifacts.list',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'List regular artifacts in the current session folder by modification time.',\n      responses: jsonApiResponses(ArtifactsPayloadSchema),\n    },\n    {\n      id: 'artifacts.preview',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/preview',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded text preview from the current session artifact folder.',\n      parameters: query,\n      responses: jsonApiResponses(\n        Type.Object({\n          path: S,\n          content: S,\n          mimeType: S,\n          unavailable: Type.Optional(Type.Boolean()),\n          reason: Type.Optional(S),\n        }),\n      ),\n    },\n    {\n      id: 'artifacts.content',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/content',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded artifact bytes, with range and version checks.',\n      parameters: [\n        ...query,\n        { name: 'Range', in: 'header', required: false, schema: S },\n        { name: 'If-Match', in: 'header', required: false, schema: S },\n      ],\n      responses: {\n        '200': { description: 'Artifact bytes.', contentType: 'application/octet-stream' },\n        '206': { description: 'Artifact byte range.', contentType: 'application/octet-stream' },\n        '400': { description: 'Invalid artifact path.' },\n        '403': { description: 'Artifact access rejected.' },\n        '404': { description: 'Artifact missing.' },\n        '412': { description: 'Artifact changed.' },\n        '413': { description: 'Artifact too large.' },\n        '416': { description: 'Invalid byte range.' },\n      },\n    },\n  ],\n  sockets: (['global', 'workspace'] as const).map((scope) => ({\n    id: 'artifacts.channel',\n    scope,\n    service: 'po.hub',\n    member: 'artifacts',\n    kind: 'channel',\n    direction: 'server-to-client',\n    description: 'Current-session artifact metadata in the hub frame payload.',\n    input: ArtifactsPayloadSchema,\n  })),\n});\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAM,IAAI,KAAK,OAAO;AACtB,MAAM,IAAI,KAAK,OAAO;AACtB,MAAa,yBAAyB,KAAK,OAAO;CAChD,OAAO,KAAK,MAAM,KAAK,OAAO;EAAE,MAAM;EAAG,MAAM;EAAG,MAAM;EAAG,YAAY;CAAE,CAAC,CAAC;CAC3E,OAAO,KAAK,SAAS,CAAC;AACxB,CAAC;AACD,MAAM,QAAQ,CAAC;CAAE,MAAM;CAAQ,IAAI;CAAkB,UAAU;CAAM,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE,CAAC;AAC5G,MAAa,eAAe,kBAAkB;CAC5C,SAAS;CACT,SAAS,CAAC;CACV,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,WAAW,iBAAiB,sBAAsB;EACpD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;GACZ,WAAW,iBACT,KAAK,OAAO;IACV,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;IACzC,QAAQ,KAAK,SAAS,CAAC;GACzB,CAAC,CACH;EACF;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;IACV,GAAG;IACH;KAAE,MAAM;KAAS,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;IAC1D;KAAE,MAAM;KAAY,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;GAC/D;GACA,WAAW;IACT,OAAO;KAAE,aAAa;KAAmB,aAAa;IAA2B;IACjF,OAAO;KAAE,aAAa;KAAwB,aAAa;IAA2B;IACtF,OAAO,EAAE,aAAa,yBAAyB;IAC/C,OAAO,EAAE,aAAa,4BAA4B;IAClD,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,sBAAsB;IAC5C,OAAO,EAAE,aAAa,sBAAsB;GAC9C;EACF;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,KAAK,WAAW;EAC1D,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO;CACT,EAAE;AACJ,CAAC"}
+{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nexport const ArtifactsPayloadSchema = Type.Object({\n  items: Type.Array(Type.Object({ path: S, name: S, size: N, modifiedAt: N })),\n  temporaryRoot: Type.Optional(S),\n  error: Type.Optional(S),\n});\nconst scopeQuery = {\n  name: 'scope',\n  in: 'query' as const,\n  required: false,\n  schema: Type.Union([Type.Literal('artifacts'), Type.Literal('temporary')]),\n};\nconst query = [\n  { name: 'path', in: 'query' as const, required: true, schema: Type.String({ minLength: 1 }) },\n  scopeQuery,\n];\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: [],\n  http: [\n    {\n      id: 'artifacts.list',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'List regular artifacts or temporary files in the current session folder by modification time.',\n      parameters: [scopeQuery],\n      responses: jsonApiResponses(ArtifactsPayloadSchema),\n    },\n    {\n      id: 'artifacts.preview',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/preview',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded text preview from the current session artifact folder.',\n      parameters: query,\n      responses: jsonApiResponses(\n        Type.Object({\n          path: S,\n          content: S,\n          mimeType: S,\n          unavailable: Type.Optional(Type.Boolean()),\n          reason: Type.Optional(S),\n        }),\n      ),\n    },\n    {\n      id: 'artifacts.content',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/content',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded artifact bytes, with range and version checks.',\n      parameters: [\n        ...query,\n        { name: 'Range', in: 'header', required: false, schema: S },\n        { name: 'If-Match', in: 'header', required: false, schema: S },\n      ],\n      responses: {\n        '200': { description: 'Artifact bytes.', contentType: 'application/octet-stream' },\n        '206': { description: 'Artifact byte range.', contentType: 'application/octet-stream' },\n        '400': { description: 'Invalid artifact path.' },\n        '403': { description: 'Artifact access rejected.' },\n        '404': { description: 'Artifact missing.' },\n        '412': { description: 'Artifact changed.' },\n        '413': { description: 'Artifact too large.' },\n        '416': { description: 'Invalid byte range.' },\n      },\n    },\n  ],\n  sockets: (['global', 'workspace'] as const).map((scope) => ({\n    id: 'artifacts.channel',\n    scope,\n    service: 'po.hub',\n    member: 'artifacts',\n    kind: 'channel',\n    direction: 'server-to-client',\n    description: 'Current-session artifact metadata in the hub frame payload.',\n    input: ArtifactsPayloadSchema,\n  })),\n});\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAM,IAAI,KAAK,OAAO;AACtB,MAAM,IAAI,KAAK,OAAO;AACtB,MAAa,yBAAyB,KAAK,OAAO;CAChD,OAAO,KAAK,MAAM,KAAK,OAAO;EAAE,MAAM;EAAG,MAAM;EAAG,MAAM;EAAG,YAAY;CAAE,CAAC,CAAC;CAC3E,eAAe,KAAK,SAAS,CAAC;CAC9B,OAAO,KAAK,SAAS,CAAC;AACxB,CAAC;AACD,MAAM,aAAa;CACjB,MAAM;CACN,IAAI;CACJ,UAAU;CACV,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,CAAC,CAAC;AAC3E;AACA,MAAM,QAAQ,CACZ;CAAE,MAAM;CAAQ,IAAI;CAAkB,UAAU;CAAM,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE,GAC5F,UACF;AACA,MAAa,eAAe,kBAAkB;CAC5C,SAAS;CACT,SAAS,CAAC;CACV,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY,CAAC,UAAU;GACvB,WAAW,iBAAiB,sBAAsB;EACpD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;GACZ,WAAW,iBACT,KAAK,OAAO;IACV,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;IACzC,QAAQ,KAAK,SAAS,CAAC;GACzB,CAAC,CACH;EACF;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;IACV,GAAG;IACH;KAAE,MAAM;KAAS,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;IAC1D;KAAE,MAAM;KAAY,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;GAC/D;GACA,WAAW;IACT,OAAO;KAAE,aAAa;KAAmB,aAAa;IAA2B;IACjF,OAAO;KAAE,aAAa;KAAwB,aAAa;IAA2B;IACtF,OAAO,EAAE,aAAa,yBAAyB;IAC/C,OAAO,EAAE,aAAa,4BAA4B;IAClD,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,sBAAsB;IAC5C,OAAO,EAAE,aAAa,sBAAsB;GAC9C;EACF;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,KAAK,WAAW;EAC1D,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO;CACT,EAAE;AACJ,CAAC"}

package/dist/artifactFiles-BJL1H1QG.mjs

@@ -0,0 +1,261 @@
+import { n as ARTIFACT_CONTENT_TYPES, r as ARTIFACT_DIRECTORY } from "./artifacts-Bhobz1nK.mjs";
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { piAgentDirectory } from "@agimon-ai/po-core/piSettings";
+//#region src/services/artifactFiles/artifactPaths.ts
+var ArtifactAccessError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+function artifactRoot(sessionId, environment) {
+	if (!/^[a-zA-Z0-9_-]+$/u.test(sessionId)) throw new ArtifactAccessError("Invalid artifact session identity.", 400);
+	return path.join(piAgentDirectory(environment, environment.HOME), ARTIFACT_DIRECTORY, sessionId);
+}
+function artifactMimeType(relativePath) {
+	return ARTIFACT_CONTENT_TYPES[path.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+}
+//#endregion
+//#region src/services/artifactFiles/index.ts
+/** A copy still being written: promoters write `.<name>.tmp` and rename it into place. */
+const IN_FLIGHT_COPY = /^\..+\.tmp$/u;
+function inside(root, candidate) {
+	const relative = path.relative(root, candidate);
+	return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function codeOf(error) {
+	return error instanceof Error && "code" in error ? String(error.code) : void 0;
+}
+/** The owned directories must not redirect artifact access through a symlink. */
+async function checkedRoot(root) {
+	const base = path.dirname(root);
+	for (const directory of [base, root]) {
+		const stat = await fs.lstat(directory);
+		if (!stat.isDirectory() || stat.isSymbolicLink()) throw new ArtifactAccessError("The artifact folder is unavailable.", 403);
+	}
+	const realBase = await fs.realpath(base);
+	const realRoot = await fs.realpath(root);
+	if (!inside(realBase, realRoot)) throw new ArtifactAccessError("The artifact folder is outside its storage directory.", 403);
+	return realRoot;
+}
+async function ensureArtifactRoot(root) {
+	await fs.mkdir(path.dirname(root), {
+		recursive: true,
+		mode: 448
+	});
+	await fs.mkdir(root, {
+		recursive: true,
+		mode: 448
+	});
+	await checkedRoot(root);
+}
+/** Open without following mutable ancestors. Node exposes no portable openat API. */
+async function openContained(root, segments) {
+	if (process.platform === "darwin") return fs.open(path.join(root, ...segments), constants.O_RDONLY | constants.O_NONBLOCK | 536870912);
+	if (process.platform !== "linux") throw new ArtifactAccessError("Secure artifact reads require macOS or Linux.", 403);
+	const flags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+	let directory = await fs.open(path.dirname(root), flags);
+	try {
+		for (const segment of [path.basename(root), ...segments.slice(0, -1)]) {
+			const child = await fs.open(`/proc/self/fd/${directory.fd}/${segment}`, flags);
+			await directory.close();
+			directory = child;
+		}
+		return await fs.open(`/proc/self/fd/${directory.fd}/${segments.at(-1)}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+	} finally {
+		await directory.close();
+	}
+}
+function artifactSegments(requested) {
+	if (!requested || requested.includes("\0") || requested.includes("\\") || path.isAbsolute(requested) || requested.split("/").some((part) => part === ".." || part === "." || part === "")) throw new ArtifactAccessError("Invalid artifact path.", 400);
+	return requested.split("/");
+}
+function accessError(error, action) {
+	if (error instanceof ArtifactAccessError) return error;
+	if (codeOf(error) === "ENOENT" || codeOf(error) === "ENOTDIR") return new ArtifactAccessError("The artifact no longer exists.", 404);
+	if (codeOf(error) === "EACCES" || codeOf(error) === "EPERM" || codeOf(error) === "ELOOP") return new ArtifactAccessError(`The artifact cannot be ${action}.`, 403);
+	return error;
+}
+/** One guarded open shared by metadata, text and byte reads. The caller closes the handle. */
+async function openArtifact(root, requested, workflowVisible) {
+	const segments = artifactSegments(requested);
+	if (segments[0] === "workflow" && !workflowVisible?.(segments.slice(1).join("/"), "file")) throw new ArtifactAccessError("This workflow file is private.", 403);
+	try {
+		const realRoot = await checkedRoot(root);
+		const candidate = path.resolve(realRoot, requested);
+		if (!inside(realRoot, candidate)) throw new ArtifactAccessError("The artifact is outside this session folder.", 403);
+		let current = realRoot;
+		for (let index = 0; index < segments.length; index += 1) {
+			current = path.join(current, segments[index]);
+			const stat = await fs.lstat(current);
+			if (stat.isSymbolicLink()) throw new ArtifactAccessError("Artifact symlinks cannot be read.", 403);
+			if (index < segments.length - 1 ? !stat.isDirectory() : !stat.isFile()) throw new ArtifactAccessError("The artifact is not a regular file.", 404);
+		}
+		const real = await fs.realpath(candidate);
+		if (!inside(realRoot, real)) throw new ArtifactAccessError("The artifact is outside this session folder.", 403);
+		const expected = await fs.lstat(real);
+		const handle = await openContained(realRoot, segments);
+		try {
+			const stat = await handle.stat();
+			if (!stat.isFile() || stat.dev !== expected.dev || stat.ino !== expected.ino) throw new ArtifactAccessError("The artifact changed while it was opened. Try again.", 403);
+			return {
+				handle,
+				stat,
+				path: requested,
+				mimeType: artifactMimeType(requested)
+			};
+		} catch (error) {
+			await handle.close();
+			throw error;
+		}
+	} catch (error) {
+		throw accessError(error, "read");
+	}
+}
+/** Bound allocation and read length even when the file grows after its metadata was read. */
+async function readArtifactBytes(handle, size, offset = 0) {
+	const bytes = new Uint8Array(size);
+	let read = 0;
+	while (read < size) {
+		const result = await handle.read(bytes, read, size - read, offset + read);
+		if (result.bytesRead === 0) break;
+		read += result.bytesRead;
+	}
+	return bytes.subarray(0, read);
+}
+/** Walk to the parent folder without following symlinks, creating missing folders on request. */
+async function containedParent(realRoot, segments, create) {
+	let directory = realRoot;
+	for (const segment of segments.slice(0, -1)) {
+		directory = path.join(directory, segment);
+		if (create) await fs.mkdir(directory, { mode: 448 }).catch((error) => {
+			if (codeOf(error) !== "EEXIST") throw error;
+		});
+		const stat = await fs.lstat(directory);
+		if (stat.isSymbolicLink() || !stat.isDirectory()) throw new ArtifactAccessError("The artifact folder is not a directory.", 403);
+	}
+	return directory;
+}
+async function sameText(root, requested, bytes) {
+	try {
+		const file = await openArtifact(root, requested);
+		try {
+			if (file.stat.size !== bytes.length) return false;
+			return bytes.equals(await readArtifactBytes(file.handle, file.stat.size));
+		} finally {
+			await file.handle.close();
+		}
+	} catch (error) {
+		if (error instanceof ArtifactAccessError) return false;
+		throw error;
+	}
+}
+/**
+* Publish text through a same-folder temp file and rename, skipping identical content so mtimes stay stable.
+* ponytail: best-effort same-user guards, not race-resistant. Linux checks ancestors with lstat only;
+* walk with openat-style /proc/self/fd handles like openContained if artifacts cross a trust boundary.
+*/
+async function writeArtifactText(root, requested, text) {
+	const segments = artifactSegments(requested);
+	if (process.platform !== "darwin" && process.platform !== "linux") throw new ArtifactAccessError("Secure artifact writes require macOS or Linux.", 403);
+	const bytes = Buffer.from(text, "utf8");
+	try {
+		await ensureArtifactRoot(root);
+		const directory = await containedParent(await checkedRoot(root), segments, true);
+		if (await sameText(root, requested, bytes)) return;
+		const temp = path.join(directory, `.${segments.at(-1)}.${randomUUID()}.tmp`);
+		const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (process.platform === "darwin" ? 536870912 : 0);
+		const handle = await fs.open(temp, flags, 384);
+		try {
+			await handle.writeFile(bytes);
+			await handle.close();
+			await fs.rename(temp, path.join(directory, segments.at(-1)));
+		} catch (error) {
+			await handle.close().catch(() => void 0);
+			await fs.unlink(temp).catch(() => void 0);
+			throw error;
+		}
+	} catch (error) {
+		throw accessError(error, "written");
+	}
+}
+/** Remove one file or one empty folder. A missing target is already removed; nothing is deleted recursively. */
+async function removeArtifact(root, requested) {
+	const segments = artifactSegments(requested);
+	try {
+		const target = path.join(await containedParent(await checkedRoot(root), segments, false), segments.at(-1));
+		const stat = await fs.lstat(target);
+		if (stat.isFile()) await fs.unlink(target);
+		else if (!stat.isDirectory()) throw new ArtifactAccessError("The artifact is not a file or folder.", 403);
+		else await fs.rmdir(target).catch((error) => {
+			if (codeOf(error) !== "ENOTEMPTY" && codeOf(error) !== "EEXIST") throw error;
+		});
+	} catch (error) {
+		if (codeOf(error) === "ENOENT") return;
+		throw accessError(error, "removed");
+	}
+}
+/** Discover persisted session roots without admitting symlinked or malformed owners. */
+async function listArtifactSessions(environment) {
+	const parent = path.dirname(artifactRoot("discovery", environment));
+	try {
+		const stat = await fs.lstat(parent);
+		if (!stat.isDirectory() || stat.isSymbolicLink()) throw new ArtifactAccessError("The artifact storage directory is unavailable.", 403);
+		return (await fs.readdir(parent, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^[a-zA-Z0-9_-]+$/u.test(entry.name)).map((entry) => entry.name);
+	} catch (error) {
+		if (codeOf(error) === "ENOENT") return [];
+		throw error;
+	}
+}
+async function listArtifacts(root, workflowVisible) {
+	const items = [];
+	try {
+		const realRoot = await checkedRoot(root);
+		const visit = async (directory) => {
+			for (const entry of await fs.readdir(directory, { withFileTypes: true })) {
+				const location = path.join(directory, entry.name);
+				const relativePath = path.relative(realRoot, location).split(path.sep).join("/");
+				const segments = relativePath.split("/");
+				if (segments[0] === "workflow" && !workflowVisible?.(segments.slice(1).join("/"), entry.isDirectory() ? "directory" : "file")) continue;
+				if (entry.isDirectory()) {
+					const stat = await fs.lstat(location);
+					if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
+					const real = await fs.realpath(location);
+					if (inside(realRoot, real)) await visit(real);
+				} else if (entry.isFile() && !IN_FLIGHT_COPY.test(entry.name)) try {
+					const file = await openArtifact(root, relativePath, workflowVisible);
+					try {
+						items.push({
+							path: relativePath,
+							name: entry.name,
+							size: file.stat.size,
+							modifiedAt: file.stat.mtimeMs
+						});
+					} finally {
+						await file.handle.close();
+					}
+				} catch (error) {
+					if (error instanceof ArtifactAccessError && (error.status === 404 || error.status === 403)) continue;
+					throw error;
+				}
+			}
+		};
+		await visit(realRoot);
+		items.sort((left, right) => right.modifiedAt - left.modifiedAt || (left.path < right.path ? -1 : left.path > right.path ? 1 : 0));
+		return { items };
+	} catch (error) {
+		if (codeOf(error) === "ENOENT") return { items: [] };
+		return {
+			items: [],
+			error: error instanceof Error ? error.message : "The artifact folder could not be read."
+		};
+	}
+}
+//#endregion
+export { readArtifactBytes as a, ArtifactAccessError as c, openArtifact as i, artifactRoot as l, listArtifactSessions as n, removeArtifact as o, listArtifacts as r, writeArtifactText as s, ensureArtifactRoot as t };
+
+//# sourceMappingURL=artifactFiles-BJL1H1QG.mjs.map

package/dist/artifactFiles-BJL1H1QG.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifactFiles-BJL1H1QG.mjs","names":[],"sources":["../src/services/artifactFiles/artifactPaths.ts","../src/services/artifactFiles/index.ts"],"sourcesContent":["import path from 'node:path';\n\nimport { piAgentDirectory } from '@agimon-ai/po-core/piSettings';\n\nimport { ARTIFACT_CONTENT_TYPES, ARTIFACT_DIRECTORY } from '../../constants/artifacts';\n\nexport class ArtifactAccessError extends Error {\n  constructor(\n    message: string,\n    readonly status: 400 | 403 | 404 | 413,\n  ) {\n    super(message);\n  }\n}\n\nexport function artifactRoot(sessionId: string, environment: Readonly<Record<string, string | undefined>>): string {\n  if (!/^[a-zA-Z0-9_-]+$/u.test(sessionId)) throw new ArtifactAccessError('Invalid artifact session identity.', 400);\n  return path.join(piAgentDirectory(environment, environment.HOME), ARTIFACT_DIRECTORY, sessionId);\n}\n\nexport function artifactMimeType(relativePath: string): string {\n  return ARTIFACT_CONTENT_TYPES[path.extname(relativePath).toLowerCase()] ?? 'application/octet-stream';\n}\n","import { randomUUID } from 'node:crypto';\nimport { constants } from 'node:fs';\nimport fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport { WORKFLOW_ARTIFACT_DIRECTORY } from '../../constants/artifacts';\nimport type { ArtifactItem, ArtifactSnapshot, ArtifactWorkflowVisibility } from '../../types/artifacts';\nimport { ArtifactAccessError, artifactMimeType, artifactRoot } from './artifactPaths';\n\nexport { ArtifactAccessError, artifactMimeType, artifactRoot } from './artifactPaths';\n\n/** A copy still being written: promoters write `.<name>.tmp` and rename it into place. */\nconst IN_FLIGHT_COPY = /^\\..+\\.tmp$/u;\nfunction inside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);\n}\n\nfunction codeOf(error: unknown): string | undefined {\n  return error instanceof Error && 'code' in error ? String(error.code) : undefined;\n}\n\n/** The owned directories must not redirect artifact access through a symlink. */\nasync function checkedRoot(root: string): Promise<string> {\n  const base = path.dirname(root);\n  for (const directory of [base, root]) {\n    const stat = await fs.lstat(directory);\n    if (!stat.isDirectory() || stat.isSymbolicLink())\n      throw new ArtifactAccessError('The artifact folder is unavailable.', 403);\n  }\n  const realBase = await fs.realpath(base);\n  const realRoot = await fs.realpath(root);\n  if (!inside(realBase, realRoot))\n    throw new ArtifactAccessError('The artifact folder is outside its storage directory.', 403);\n  return realRoot;\n}\n\nexport async function ensureArtifactRoot(root: string): Promise<void> {\n  await fs.mkdir(path.dirname(root), { recursive: true, mode: 0o700 });\n  await fs.mkdir(root, { recursive: true, mode: 0o700 });\n  await checkedRoot(root);\n}\n\n/** Open without following mutable ancestors. Node exposes no portable openat API. */\nasync function openContained(root: string, segments: string[]): Promise<fs.FileHandle> {\n  if (process.platform === 'darwin') {\n    // Darwin O_NOFOLLOW_ANY checks every component atomically. Do not combine it with O_NOFOLLOW.\n    return fs.open(path.join(root, ...segments), constants.O_RDONLY | constants.O_NONBLOCK | 0x20000000);\n  }\n  if (process.platform !== 'linux') throw new ArtifactAccessError('Secure artifact reads require macOS or Linux.', 403);\n  const flags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;\n  let directory = await fs.open(path.dirname(root), flags);\n  try {\n    for (const segment of [path.basename(root), ...segments.slice(0, -1)]) {\n      const child = await fs.open(`/proc/self/fd/${directory.fd}/${segment}`, flags);\n      await directory.close();\n      directory = child;\n    }\n    return await fs.open(\n      `/proc/self/fd/${directory.fd}/${segments.at(-1)!}`,\n      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK,\n    );\n  } finally {\n    await directory.close();\n  }\n}\n\nfunction artifactSegments(requested: string | undefined): string[] {\n  if (\n    !requested ||\n    requested.includes('\\0') ||\n    requested.includes('\\\\') ||\n    path.isAbsolute(requested) ||\n    requested.split('/').some((part) => part === '..' || part === '.' || part === '')\n  )\n    throw new ArtifactAccessError('Invalid artifact path.', 400);\n  return requested.split('/');\n}\n\nfunction accessError(error: unknown, action: string): unknown {\n  if (error instanceof ArtifactAccessError) return error;\n  if (codeOf(error) === 'ENOENT' || codeOf(error) === 'ENOTDIR')\n    return new ArtifactAccessError('The artifact no longer exists.', 404);\n  if (codeOf(error) === 'EACCES' || codeOf(error) === 'EPERM' || codeOf(error) === 'ELOOP')\n    return new ArtifactAccessError(`The artifact cannot be ${action}.`, 403);\n  return error;\n}\n\n/** One guarded open shared by metadata, text and byte reads. The caller closes the handle. */\nexport async function openArtifact(\n  root: string,\n  requested: string | undefined,\n  workflowVisible?: ArtifactWorkflowVisibility,\n) {\n  const segments = artifactSegments(requested);\n  if (segments[0] === WORKFLOW_ARTIFACT_DIRECTORY && !workflowVisible?.(segments.slice(1).join('/'), 'file'))\n    throw new ArtifactAccessError('This workflow file is private.', 403);\n  try {\n    const realRoot = await checkedRoot(root);\n    const candidate = path.resolve(realRoot, requested!);\n    if (!inside(realRoot, candidate))\n      throw new ArtifactAccessError('The artifact is outside this session folder.', 403);\n    let current = realRoot;\n    for (let index = 0; index < segments.length; index += 1) {\n      current = path.join(current, segments[index]!);\n      const stat = await fs.lstat(current);\n      if (stat.isSymbolicLink()) throw new ArtifactAccessError('Artifact symlinks cannot be read.', 403);\n      if (index < segments.length - 1 ? !stat.isDirectory() : !stat.isFile())\n        throw new ArtifactAccessError('The artifact is not a regular file.', 404);\n    }\n    const real = await fs.realpath(candidate);\n    if (!inside(realRoot, real)) throw new ArtifactAccessError('The artifact is outside this session folder.', 403);\n    const expected = await fs.lstat(real);\n    const handle = await openContained(realRoot, segments);\n    try {\n      const stat = await handle.stat();\n      if (!stat.isFile() || stat.dev !== expected.dev || stat.ino !== expected.ino)\n        throw new ArtifactAccessError('The artifact changed while it was opened. Try again.', 403);\n      return { handle, stat, path: requested!, mimeType: artifactMimeType(requested!) };\n    } catch (error) {\n      await handle.close();\n      throw error;\n    }\n  } catch (error) {\n    throw accessError(error, 'read');\n  }\n}\n\n/** Bound allocation and read length even when the file grows after its metadata was read. */\nexport async function readArtifactBytes(handle: fs.FileHandle, size: number, offset = 0): Promise<Uint8Array> {\n  const bytes = new Uint8Array(size);\n  let read = 0;\n  while (read < size) {\n    const result = await handle.read(bytes, read, size - read, offset + read);\n    if (result.bytesRead === 0) break;\n    read += result.bytesRead;\n  }\n  return bytes.subarray(0, read);\n}\n\n/** Walk to the parent folder without following symlinks, creating missing folders on request. */\nasync function containedParent(realRoot: string, segments: string[], create: boolean): Promise<string> {\n  let directory = realRoot;\n  for (const segment of segments.slice(0, -1)) {\n    directory = path.join(directory, segment);\n    if (create)\n      await fs.mkdir(directory, { mode: 0o700 }).catch((error: unknown) => {\n        if (codeOf(error) !== 'EEXIST') throw error;\n      });\n    const stat = await fs.lstat(directory);\n    if (stat.isSymbolicLink() || !stat.isDirectory())\n      throw new ArtifactAccessError('The artifact folder is not a directory.', 403);\n  }\n  return directory;\n}\n\nasync function sameText(root: string, requested: string, bytes: Buffer): Promise<boolean> {\n  try {\n    const file = await openArtifact(root, requested);\n    try {\n      if (file.stat.size !== bytes.length) return false;\n      return bytes.equals(await readArtifactBytes(file.handle, file.stat.size));\n    } finally {\n      await file.handle.close();\n    }\n  } catch (error) {\n    if (error instanceof ArtifactAccessError) return false;\n    throw error;\n  }\n}\n\n/**\n * Publish text through a same-folder temp file and rename, skipping identical content so mtimes stay stable.\n * ponytail: best-effort same-user guards, not race-resistant. Linux checks ancestors with lstat only;\n * walk with openat-style /proc/self/fd handles like openContained if artifacts cross a trust boundary.\n */\nexport async function writeArtifactText(root: string, requested: string, text: string): Promise<void> {\n  const segments = artifactSegments(requested);\n  if (process.platform !== 'darwin' && process.platform !== 'linux')\n    throw new ArtifactAccessError('Secure artifact writes require macOS or Linux.', 403);\n  const bytes = Buffer.from(text, 'utf8');\n  try {\n    await ensureArtifactRoot(root);\n    const directory = await containedParent(await checkedRoot(root), segments, true);\n    if (await sameText(root, requested, bytes)) return;\n    const temp = path.join(directory, `.${segments.at(-1)!}.${randomUUID()}.tmp`);\n    // Darwin O_NOFOLLOW_ANY refuses a symlink in any component; O_EXCL refuses one at the leaf.\n    const flags =\n      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (process.platform === 'darwin' ? 0x20000000 : 0);\n    const handle = await fs.open(temp, flags, 0o600);\n    try {\n      await handle.writeFile(bytes);\n      await handle.close();\n      await fs.rename(temp, path.join(directory, segments.at(-1)!));\n    } catch (error) {\n      await handle.close().catch(() => undefined);\n      await fs.unlink(temp).catch(() => undefined);\n      throw error;\n    }\n  } catch (error) {\n    throw accessError(error, 'written');\n  }\n}\n\n/** Remove one file or one empty folder. A missing target is already removed; nothing is deleted recursively. */\nexport async function removeArtifact(root: string, requested: string): Promise<void> {\n  const segments = artifactSegments(requested);\n  try {\n    const target = path.join(await containedParent(await checkedRoot(root), segments, false), segments.at(-1)!);\n    const stat = await fs.lstat(target);\n    if (stat.isFile()) await fs.unlink(target);\n    else if (!stat.isDirectory()) throw new ArtifactAccessError('The artifact is not a file or folder.', 403);\n    else\n      await fs.rmdir(target).catch((error: unknown) => {\n        if (codeOf(error) !== 'ENOTEMPTY' && codeOf(error) !== 'EEXIST') throw error;\n      });\n  } catch (error) {\n    if (codeOf(error) === 'ENOENT') return;\n    throw accessError(error, 'removed');\n  }\n}\n/** Discover persisted session roots without admitting symlinked or malformed owners. */\nexport async function listArtifactSessions(\n  environment: Readonly<Record<string, string | undefined>>,\n): Promise<readonly string[]> {\n  const parent = path.dirname(artifactRoot('discovery', environment));\n  try {\n    const stat = await fs.lstat(parent);\n    if (!stat.isDirectory() || stat.isSymbolicLink())\n      throw new ArtifactAccessError('The artifact storage directory is unavailable.', 403);\n    const entries = await fs.readdir(parent, { withFileTypes: true });\n    return entries\n      .filter((entry) => entry.isDirectory() && /^[a-zA-Z0-9_-]+$/u.test(entry.name))\n      .map((entry) => entry.name);\n  } catch (error) {\n    if (codeOf(error) === 'ENOENT') return [];\n    throw error;\n  }\n}\n\nexport async function listArtifacts(\n  root: string,\n  workflowVisible?: ArtifactWorkflowVisibility,\n): Promise<ArtifactSnapshot> {\n  const items: ArtifactItem[] = [];\n  try {\n    const realRoot = await checkedRoot(root);\n    const visit = async (directory: string): Promise<void> => {\n      for (const entry of await fs.readdir(directory, { withFileTypes: true })) {\n        const location = path.join(directory, entry.name);\n        const relativePath = path.relative(realRoot, location).split(path.sep).join('/');\n        const segments = relativePath.split('/');\n        if (\n          segments[0] === WORKFLOW_ARTIFACT_DIRECTORY &&\n          !workflowVisible?.(segments.slice(1).join('/'), entry.isDirectory() ? 'directory' : 'file')\n        )\n          continue;\n        if (entry.isDirectory()) {\n          // Recheck each directory rather than trusting a readdir entry across a rename.\n          const stat = await fs.lstat(location);\n          if (!stat.isDirectory() || stat.isSymbolicLink()) continue;\n          const real = await fs.realpath(location);\n          if (inside(realRoot, real)) await visit(real);\n        } else if (entry.isFile() && !IN_FLIGHT_COPY.test(entry.name)) {\n          try {\n            const file = await openArtifact(root, relativePath, workflowVisible);\n            try {\n              items.push({ path: relativePath, name: entry.name, size: file.stat.size, modifiedAt: file.stat.mtimeMs });\n            } finally {\n              await file.handle.close();\n            }\n          } catch (error) {\n            if (error instanceof ArtifactAccessError && (error.status === 404 || error.status === 403)) continue;\n            throw error;\n          }\n        }\n      }\n    };\n    await visit(realRoot);\n    items.sort(\n      (left, right) =>\n        right.modifiedAt - left.modifiedAt || (left.path < right.path ? -1 : left.path > right.path ? 1 : 0),\n    );\n    return { items };\n  } catch (error) {\n    if (codeOf(error) === 'ENOENT') return { items: [] };\n    return { items: [], error: error instanceof Error ? error.message : 'The artifact folder could not be read.' };\n  }\n}\n"],"mappings":";;;;;;;AAMA,IAAa,sBAAb,cAAyC,MAAM;CAGlC;CAFX,YACE,SACA,QACA;EACA,MAAM,OAAO;EAFJ,KAAA,SAAA;CAGX;AACF;AAEA,SAAgB,aAAa,WAAmB,aAAmE;CACjH,IAAI,CAAC,oBAAoB,KAAK,SAAS,GAAG,MAAM,IAAI,oBAAoB,sCAAsC,GAAG;CACjH,OAAO,KAAK,KAAK,iBAAiB,aAAa,YAAY,IAAI,GAAG,oBAAoB,SAAS;AACjG;AAEA,SAAgB,iBAAiB,cAA8B;CAC7D,OAAO,uBAAuB,KAAK,QAAQ,YAAY,CAAC,CAAC,YAAY,MAAM;AAC7E;;;;ACVA,MAAM,iBAAiB;AACvB,SAAS,OAAO,MAAc,WAA4B;CACxD,MAAM,WAAW,KAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,QAAQ,CAAC,SAAS,WAAW,KAAK,KAAK,KAAK,KAAK,CAAC,KAAK,WAAW,QAAQ;AAChG;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,iBAAiB,SAAS,UAAU,QAAQ,OAAO,MAAM,IAAI,IAAI,KAAA;AAC1E;;AAGA,eAAe,YAAY,MAA+B;CACxD,MAAM,OAAO,KAAK,QAAQ,IAAI;CAC9B,KAAK,MAAM,aAAa,CAAC,MAAM,IAAI,GAAG;EACpC,MAAM,OAAO,MAAM,GAAG,MAAM,SAAS;EACrC,IAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,GAC7C,MAAM,IAAI,oBAAoB,uCAAuC,GAAG;CAC5E;CACA,MAAM,WAAW,MAAM,GAAG,SAAS,IAAI;CACvC,MAAM,WAAW,MAAM,GAAG,SAAS,IAAI;CACvC,IAAI,CAAC,OAAO,UAAU,QAAQ,GAC5B,MAAM,IAAI,oBAAoB,yDAAyD,GAAG;CAC5F,OAAO;AACT;AAEA,eAAsB,mBAAmB,MAA6B;CACpE,MAAM,GAAG,MAAM,KAAK,QAAQ,IAAI,GAAG;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACnE,MAAM,GAAG,MAAM,MAAM;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACrD,MAAM,YAAY,IAAI;AACxB;;AAGA,eAAe,cAAc,MAAc,UAA4C;CACrF,IAAI,QAAQ,aAAa,UAEvB,OAAO,GAAG,KAAK,KAAK,KAAK,MAAM,GAAG,QAAQ,GAAG,UAAU,WAAW,UAAU,aAAa,SAAU;CAErG,IAAI,QAAQ,aAAa,SAAS,MAAM,IAAI,oBAAoB,iDAAiD,GAAG;CACpH,MAAM,QAAQ,UAAU,WAAW,UAAU,cAAc,UAAU;CACrE,IAAI,YAAY,MAAM,GAAG,KAAK,KAAK,QAAQ,IAAI,GAAG,KAAK;CACvD,IAAI;EACF,KAAK,MAAM,WAAW,CAAC,KAAK,SAAS,IAAI,GAAG,GAAG,SAAS,MAAM,GAAG,EAAE,CAAC,GAAG;GACrE,MAAM,QAAQ,MAAM,GAAG,KAAK,iBAAiB,UAAU,GAAG,GAAG,WAAW,KAAK;GAC7E,MAAM,UAAU,MAAM;GACtB,YAAY;EACd;EACA,OAAO,MAAM,GAAG,KACd,iBAAiB,UAAU,GAAG,GAAG,SAAS,GAAG,EAAE,KAC/C,UAAU,WAAW,UAAU,aAAa,UAAU,UACxD;CACF,UAAU;EACR,MAAM,UAAU,MAAM;CACxB;AACF;AAEA,SAAS,iBAAiB,WAAyC;CACjE,IACE,CAAC,aACD,UAAU,SAAS,IAAI,KACvB,UAAU,SAAS,IAAI,KACvB,KAAK,WAAW,SAAS,KACzB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO,SAAS,EAAE,GAEhF,MAAM,IAAI,oBAAoB,0BAA0B,GAAG;CAC7D,OAAO,UAAU,MAAM,GAAG;AAC5B;AAEA,SAAS,YAAY,OAAgB,QAAyB;CAC5D,IAAI,iBAAiB,qBAAqB,OAAO;CACjD,IAAI,OAAO,KAAK,MAAM,YAAY,OAAO,KAAK,MAAM,WAClD,OAAO,IAAI,oBAAoB,kCAAkC,GAAG;CACtE,IAAI,OAAO,KAAK,MAAM,YAAY,OAAO,KAAK,MAAM,WAAW,OAAO,KAAK,MAAM,SAC/E,OAAO,IAAI,oBAAoB,0BAA0B,OAAO,IAAI,GAAG;CACzE,OAAO;AACT;;AAGA,eAAsB,aACpB,MACA,WACA,iBACA;CACA,MAAM,WAAW,iBAAiB,SAAS;CAC3C,IAAI,SAAS,OAAA,cAAsC,CAAC,kBAAkB,SAAS,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,MAAM,GACvG,MAAM,IAAI,oBAAoB,kCAAkC,GAAG;CACrE,IAAI;EACF,MAAM,WAAW,MAAM,YAAY,IAAI;EACvC,MAAM,YAAY,KAAK,QAAQ,UAAU,SAAU;EACnD,IAAI,CAAC,OAAO,UAAU,SAAS,GAC7B,MAAM,IAAI,oBAAoB,gDAAgD,GAAG;EACnF,IAAI,UAAU;EACd,KAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS,GAAG;GACvD,UAAU,KAAK,KAAK,SAAS,SAAS,MAAO;GAC7C,MAAM,OAAO,MAAM,GAAG,MAAM,OAAO;GACnC,IAAI,KAAK,eAAe,GAAG,MAAM,IAAI,oBAAoB,qCAAqC,GAAG;GACjG,IAAI,QAAQ,SAAS,SAAS,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,OAAO,GACnE,MAAM,IAAI,oBAAoB,uCAAuC,GAAG;EAC5E;EACA,MAAM,OAAO,MAAM,GAAG,SAAS,SAAS;EACxC,IAAI,CAAC,OAAO,UAAU,IAAI,GAAG,MAAM,IAAI,oBAAoB,gDAAgD,GAAG;EAC9G,MAAM,WAAW,MAAM,GAAG,MAAM,IAAI;EACpC,MAAM,SAAS,MAAM,cAAc,UAAU,QAAQ;EACrD,IAAI;GACF,MAAM,OAAO,MAAM,OAAO,KAAK;GAC/B,IAAI,CAAC,KAAK,OAAO,KAAK,KAAK,QAAQ,SAAS,OAAO,KAAK,QAAQ,SAAS,KACvE,MAAM,IAAI,oBAAoB,wDAAwD,GAAG;GAC3F,OAAO;IAAE;IAAQ;IAAM,MAAM;IAAY,UAAU,iBAAiB,SAAU;GAAE;EAClF,SAAS,OAAO;GACd,MAAM,OAAO,MAAM;GACnB,MAAM;EACR;CACF,SAAS,OAAO;EACd,MAAM,YAAY,OAAO,MAAM;CACjC;AACF;;AAGA,eAAsB,kBAAkB,QAAuB,MAAc,SAAS,GAAwB;CAC5G,MAAM,QAAQ,IAAI,WAAW,IAAI;CACjC,IAAI,OAAO;CACX,OAAO,OAAO,MAAM;EAClB,MAAM,SAAS,MAAM,OAAO,KAAK,OAAO,MAAM,OAAO,MAAM,SAAS,IAAI;EACxE,IAAI,OAAO,cAAc,GAAG;EAC5B,QAAQ,OAAO;CACjB;CACA,OAAO,MAAM,SAAS,GAAG,IAAI;AAC/B;;AAGA,eAAe,gBAAgB,UAAkB,UAAoB,QAAkC;CACrG,IAAI,YAAY;CAChB,KAAK,MAAM,WAAW,SAAS,MAAM,GAAG,EAAE,GAAG;EAC3C,YAAY,KAAK,KAAK,WAAW,OAAO;EACxC,IAAI,QACF,MAAM,GAAG,MAAM,WAAW,EAAE,MAAM,IAAM,CAAC,CAAC,CAAC,OAAO,UAAmB;GACnE,IAAI,OAAO,KAAK,MAAM,UAAU,MAAM;EACxC,CAAC;EACH,MAAM,OAAO,MAAM,GAAG,MAAM,SAAS;EACrC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,YAAY,GAC7C,MAAM,IAAI,oBAAoB,2CAA2C,GAAG;CAChF;CACA,OAAO;AACT;AAEA,eAAe,SAAS,MAAc,WAAmB,OAAiC;CACxF,IAAI;EACF,MAAM,OAAO,MAAM,aAAa,MAAM,SAAS;EAC/C,IAAI;GACF,IAAI,KAAK,KAAK,SAAS,MAAM,QAAQ,OAAO;GAC5C,OAAO,MAAM,OAAO,MAAM,kBAAkB,KAAK,QAAQ,KAAK,KAAK,IAAI,CAAC;EAC1E,UAAU;GACR,MAAM,KAAK,OAAO,MAAM;EAC1B;CACF,SAAS,OAAO;EACd,IAAI,iBAAiB,qBAAqB,OAAO;EACjD,MAAM;CACR;AACF;;;;;;AAOA,eAAsB,kBAAkB,MAAc,WAAmB,MAA6B;CACpG,MAAM,WAAW,iBAAiB,SAAS;CAC3C,IAAI,QAAQ,aAAa,YAAY,QAAQ,aAAa,SACxD,MAAM,IAAI,oBAAoB,kDAAkD,GAAG;CACrF,MAAM,QAAQ,OAAO,KAAK,MAAM,MAAM;CACtC,IAAI;EACF,MAAM,mBAAmB,IAAI;EAC7B,MAAM,YAAY,MAAM,gBAAgB,MAAM,YAAY,IAAI,GAAG,UAAU,IAAI;EAC/E,IAAI,MAAM,SAAS,MAAM,WAAW,KAAK,GAAG;EAC5C,MAAM,OAAO,KAAK,KAAK,WAAW,IAAI,SAAS,GAAG,EAAE,EAAG,GAAG,WAAW,EAAE,KAAK;EAE5E,MAAM,QACJ,UAAU,WAAW,UAAU,UAAU,UAAU,UAAU,QAAQ,aAAa,WAAW,YAAa;EAC5G,MAAM,SAAS,MAAM,GAAG,KAAK,MAAM,OAAO,GAAK;EAC/C,IAAI;GACF,MAAM,OAAO,UAAU,KAAK;GAC5B,MAAM,OAAO,MAAM;GACnB,MAAM,GAAG,OAAO,MAAM,KAAK,KAAK,WAAW,SAAS,GAAG,EAAE,CAAE,CAAC;EAC9D,SAAS,OAAO;GACd,MAAM,OAAO,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;GAC1C,MAAM,GAAG,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;GAC3C,MAAM;EACR;CACF,SAAS,OAAO;EACd,MAAM,YAAY,OAAO,SAAS;CACpC;AACF;;AAGA,eAAsB,eAAe,MAAc,WAAkC;CACnF,MAAM,WAAW,iBAAiB,SAAS;CAC3C,IAAI;EACF,MAAM,SAAS,KAAK,KAAK,MAAM,gBAAgB,MAAM,YAAY,IAAI,GAAG,UAAU,KAAK,GAAG,SAAS,GAAG,EAAE,CAAE;EAC1G,MAAM,OAAO,MAAM,GAAG,MAAM,MAAM;EAClC,IAAI,KAAK,OAAO,GAAG,MAAM,GAAG,OAAO,MAAM;OACpC,IAAI,CAAC,KAAK,YAAY,GAAG,MAAM,IAAI,oBAAoB,yCAAyC,GAAG;OAEtG,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;GAC/C,IAAI,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,UAAU,MAAM;EACzE,CAAC;CACL,SAAS,OAAO;EACd,IAAI,OAAO,KAAK,MAAM,UAAU;EAChC,MAAM,YAAY,OAAO,SAAS;CACpC;AACF;;AAEA,eAAsB,qBACpB,aAC4B;CAC5B,MAAM,SAAS,KAAK,QAAQ,aAAa,aAAa,WAAW,CAAC;CAClE,IAAI;EACF,MAAM,OAAO,MAAM,GAAG,MAAM,MAAM;EAClC,IAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,GAC7C,MAAM,IAAI,oBAAoB,kDAAkD,GAAG;EAErF,QAAO,MADe,GAAG,QAAQ,QAAQ,EAAE,eAAe,KAAK,CAAC,EAAA,CAE7D,QAAQ,UAAU,MAAM,YAAY,KAAK,oBAAoB,KAAK,MAAM,IAAI,CAAC,CAAC,CAC9E,KAAK,UAAU,MAAM,IAAI;CAC9B,SAAS,OAAO;EACd,IAAI,OAAO,KAAK,MAAM,UAAU,OAAO,CAAC;EACxC,MAAM;CACR;AACF;AAEA,eAAsB,cACpB,MACA,iBAC2B;CAC3B,MAAM,QAAwB,CAAC;CAC/B,IAAI;EACF,MAAM,WAAW,MAAM,YAAY,IAAI;EACvC,MAAM,QAAQ,OAAO,cAAqC;GACxD,KAAK,MAAM,SAAS,MAAM,GAAG,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;IACxE,MAAM,WAAW,KAAK,KAAK,WAAW,MAAM,IAAI;IAChD,MAAM,eAAe,KAAK,SAAS,UAAU,QAAQ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;IAC/E,MAAM,WAAW,aAAa,MAAM,GAAG;IACvC,IACE,SAAS,OAAA,cACT,CAAC,kBAAkB,SAAS,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,MAAM,YAAY,IAAI,cAAc,MAAM,GAE1F;IACF,IAAI,MAAM,YAAY,GAAG;KAEvB,MAAM,OAAO,MAAM,GAAG,MAAM,QAAQ;KACpC,IAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,GAAG;KAClD,MAAM,OAAO,MAAM,GAAG,SAAS,QAAQ;KACvC,IAAI,OAAO,UAAU,IAAI,GAAG,MAAM,MAAM,IAAI;IAC9C,OAAO,IAAI,MAAM,OAAO,KAAK,CAAC,eAAe,KAAK,MAAM,IAAI,GAC1D,IAAI;KACF,MAAM,OAAO,MAAM,aAAa,MAAM,cAAc,eAAe;KACnE,IAAI;MACF,MAAM,KAAK;OAAE,MAAM;OAAc,MAAM,MAAM;OAAM,MAAM,KAAK,KAAK;OAAM,YAAY,KAAK,KAAK;MAAQ,CAAC;KAC1G,UAAU;MACR,MAAM,KAAK,OAAO,MAAM;KAC1B;IACF,SAAS,OAAO;KACd,IAAI,iBAAiB,wBAAwB,MAAM,WAAW,OAAO,MAAM,WAAW,MAAM;KAC5F,MAAM;IACR;GAEJ;EACF;EACA,MAAM,MAAM,QAAQ;EACpB,MAAM,MACH,MAAM,UACL,MAAM,aAAa,KAAK,eAAe,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,EACtG;EACA,OAAO,EAAE,MAAM;CACjB,SAAS,OAAO;EACd,IAAI,OAAO,KAAK,MAAM,UAAU,OAAO,EAAE,OAAO,CAAC,EAAE;EACnD,OAAO;GAAE,OAAO,CAAC;GAAG,OAAO,iBAAiB,QAAQ,MAAM,UAAU;EAAyC;CAC/G;AACF"}