@axiom-lattice/gateway 2.1.108 → 2.1.110

package/src/controllers/resources.ts

@@ -6,8 +6,9 @@ import {
   createSharePayload,
   TokenCache,
   SandboxLatticeManager,
+  buildNamedVolumeName,
 } from "@axiom-lattice/core";
-import { getContentTypeFromFilename, getFilenameFromPath } from "../utils/mime";
+import { getContentTypeFromFilename } from "../utils/mime";
 
 interface ResourceControllerDeps {
   store: SharedResourceStore;
@@ -60,7 +61,7 @@ export class ResourceController {
       : "unknown";
     const tenantId = (request.headers["x-tenant-id"] as string) || "default";
     const shares = await this.deps.store.listByUser(tenantId, userId as string);
-    return reply.send(shares);
+    return reply.send(shares.filter((r: any) => (r as any).visibility !== "internal"));
   }
 
   async updateShare(request: FastifyRequest, reply: FastifyReply) {
@@ -108,17 +109,29 @@ export class ResourceController {
 
     this.deps.logger.info("[share] resolve start", { token, subPath });
 
-    // API runtime — proxy to sandbox
-    if (subPath && (subPath.endsWith(".js") || subPath.endsWith(".py")) && subPath.startsWith("api/")) {
+    const isApi = subPath && /(^|\/)api\//.test(subPath) && (subPath.endsWith(".js") || subPath.endsWith(".py"));
+
+    // Only API paths accept non-GET methods
+    if (request.method !== "GET" && !isApi) {
+      return reply.status(405).send({ error: "Method not allowed" });
+    }
+
+    // API runtime — proxy to sandbox. Detected by /api/ anywhere in subPath.
+    if (isApi) {
       const record = await this.deps.store.findByToken(token);
       if (!record || record.revoked) return reply.status(404).send("Not found");
       if (record.expiresAt && new Date(record.expiresAt) < new Date()) {
         return reply.status(410).send("Expired");
       }
       // Auth check for API calls (same as file access)
-      if (!this._isInternalRequest(request) && record.visibility === "password") {
-        if (!this._isUnlocked(request, token)) {
-          return reply.status(401).send({ error: "Password required" });
+      if (!this._isInternalRequest(request)) {
+        if (record.visibility === "internal") {
+          return reply.status(401).send({ error: "Internal access only" });
+        }
+        if (record.visibility === "password") {
+          if (!this._isUnlocked(request, token)) {
+            return reply.status(401).send({ error: "Password required" });
+          }
         }
       }
       const ext = subPath.endsWith(".py") ? "py" : "js";
@@ -156,6 +169,10 @@ export class ResourceController {
     // 3. Auth
     const isInternal = this._isInternalRequest(request);
     if (!isInternal) {
+      // Internal shares: must be logged in
+      if (record.visibility === "internal") {
+        return reply.status(401).send({ error: "Internal access only" });
+      }
       if (record.visibility === "password") {
         const unlocked = this._isUnlocked(request, token);
         if (!unlocked) {
@@ -190,6 +207,39 @@ export class ResourceController {
     return this._serveFile(record.address, token, subPath, sandboxConfig, reply);
   }
 
+  /**
+   * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}
+   * Decodes 3 UUIDs (no dashes, 96 hex chars), ensures internal share, 302 redirects.
+   */
+  async resolveDirectFile(request: FastifyRequest, reply: FastifyReply) {
+    const params = request.params as unknown as { tid: string; wid: string; pid: string; "*"?: string };
+    const tenantId = params.tid;
+    const workspaceId = params.wid;
+    const projectId = params.pid;
+    const subPath = (params["*"] ?? "");
+
+    const isApi = subPath && /(^|\/)api\//.test(subPath) && (subPath.endsWith(".js") || subPath.endsWith(".py"));
+
+    // Only API paths accept non-GET methods
+    if (request.method !== "GET" && !isApi) {
+      return reply.status(405).send({ error: "Method not allowed" });
+    }
+
+    // API runtime
+    if (isApi) {
+      const ext = subPath.endsWith(".py") ? "py" : "js";
+      return this._execApiCore({
+        tenantId, workspaceId, projectId, assistantId: "",
+        resourcePath: subPath,
+      }, subPath, ext, request, reply);
+    }
+
+    const volume = buildNamedVolumeName("p", "project", tenantId, workspaceId, projectId);
+    return this._resolveAndServe(volume, subPath, reply, `/f/${tenantId}/${workspaceId}/${projectId}`,
+      { tenantId, workspaceId, projectId, assistantId: null },
+    );
+  }
+
   async unlockShare(request: FastifyRequest, reply: FastifyReply) {
     const { token } = request.params as unknown as { token: string };
     const { password } = request.body as unknown as { password: string };
@@ -219,9 +269,17 @@ export class ResourceController {
   }
 
   private _isInternalRequest(request: FastifyRequest): boolean {
-    // Check for valid user session from auth middleware
     const user = (request as any).user;
-    return !!user && !!user.id;
+    if (user && user.id) return true;
+    // Fallback: same-origin browser request (iframe/img embed — no Auth header)
+    const origin = request.headers.origin || request.headers.referer;
+    if (origin) {
+      try {
+        const { hostname } = new URL(origin);
+        if (hostname === request.hostname) return true;
+      } catch { /* malformed */ }
+    }
+    return false;
   }
 
   private _isUnlocked(request: FastifyRequest, token: string): boolean {
@@ -234,37 +292,33 @@ export class ResourceController {
     return /\.[a-zA-Z0-9]+$/.test(path);
   }
 
-  private async _serveFile(
-    address: ResourceAddress,
-    token: string,
-    subPath: string,
-    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },
+  /**
+   * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.
+   */
+  private async _resolveAndServe(
+    volume: string,
+    resourcePath: string,
     reply: FastifyReply,
+    baseTagPrefix: string,
+    sandboxConfig?: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },
   ) {
-    const provider = this.deps.sandboxManager.getDefaultProvider();
-    const resolver = provider.getResourceResolver();
-    const sandboxPath = subPath
-      ? this._resolveSafeSubPath(address.resourcePath, subPath)
-      : address.resourcePath;
-    // If entry has no file extension, treat as directory → try index.html
-    const entryPath = (!subPath && !this._isFilePath(sandboxPath))
-      ? `${sandboxPath}/index.html`
-      : sandboxPath;
-
-    this.deps.logger.info("[share] serving file", {
-      token, volume: address.volume, sandboxPath: entryPath, subPath: subPath || "(none)",
-      tenantId: sandboxConfig.tenantId, workspaceId: sandboxConfig.workspaceId, projectId: sandboxConfig.projectId,
-    });
+    const cleanPath = resourcePath.replace(/\/+$/, "");
+    const entryPath = !cleanPath
+      ? "index.html"
+      : this._isFilePath(cleanPath)
+        ? cleanPath
+        : `${cleanPath}/index.html`;
+
+    const address: ResourceAddress = { volume, resourcePath: "" };
 
     let buf: Buffer;
     try {
-      // Try volume FS first
-      buf = await resolver.resolve({ ...address, resourcePath: entryPath });
-      this.deps.logger.info("[share] resolved via volume FS", { token, size: buf.length });
-    } catch (err) {
-      this.deps.logger.warn("[share] volume FS failed, trying sandbox fallback", {
-        token, path: entryPath, error: (err as Error).message,
-      });
+      // Volume FS first
+      const provider = this.deps.sandboxManager.getDefaultProvider();
+      buf = await provider.getResourceResolver().resolve({ ...address, resourcePath: entryPath });
+    } catch {
+      // Sandbox fallback
+      if (!sandboxConfig) return reply.status(404).send("File not found");
       try {
         const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({
           assistant_id: sandboxConfig.assistantId ?? "",
@@ -274,32 +328,56 @@ export class ResourceController {
           projectId: sandboxConfig.projectId,
         });
         buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });
-        this.deps.logger.info("[share] resolved via sandbox fallback", { token, size: buf.length });
-      } catch (err) {
-        this.deps.logger.warn("[share] all resolution attempts failed", { token, resourcePath: entryPath, error: (err as Error).message });
+      } catch {
         return reply.status(404).send("File not found");
       }
     }
 
-    const fullPath = entryPath;
-    const filename = getFilenameFromPath(fullPath);
-    const isHtml = !subPath && /\.(html|htm)$/i.test(filename);
+    const filename = entryPath.split("/").pop() || "download";
+    const contentType = getContentTypeFromFilename(filename);
 
-    if (isHtml) {
-      buf = this._injectBaseTag(buf, token);
+    // Inject base tag for HTML
+    if (/\.(html|htm)$/i.test(filename)) {
+      const baseDir = cleanPath
+        ? (this._isFilePath(cleanPath) ? cleanPath.replace(/[^/]+$/, "") : cleanPath)
+        : "";
+      const html = buf.toString("utf-8");
+      if (!/<base\b/i.test(html)) {
+        const baseTag = `<base href="${baseTagPrefix}${baseDir ? "/" + baseDir : ""}/">`;
+        buf = Buffer.from(
+          html.includes("<head>") ? html.replace("<head>", `<head>${baseTag}`) : baseTag + html,
+          "utf-8"
+        );
+      }
     }
 
-    const contentType = getContentTypeFromFilename(filename);
-    const contentDisposition = `inline; filename="${filename.replace(/"/g, '\\"')}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-
     return reply
       .status(200)
       .type(contentType)
-      .header("Content-Disposition", contentDisposition)
+      .header("Content-Disposition", `inline; filename*=UTF-8''${encodeURIComponent(filename)}`)
       .header("Access-Control-Allow-Origin", "*")
       .send(buf);
   }
 
+  private async _serveFile(
+    address: ResourceAddress,
+    token: string,
+    subPath: string,
+    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },
+    reply: FastifyReply,
+  ) {
+    const resourcePath = subPath
+      ? this._resolveSafeSubPath(address.resourcePath, subPath)
+      : address.resourcePath;
+    return this._resolveAndServe(
+      address.volume,
+      resourcePath,
+      reply,
+      `/s/${token}`,
+      sandboxConfig,
+    );
+  }
+
   private async _execApi(
     record: ShareRecord,
     apiSubPath: string,
@@ -307,26 +385,41 @@ export class ResourceController {
     request: FastifyRequest,
     reply: FastifyReply,
   ) {
-    // Get or start sandbox
+    const basePath = this._isFilePath(record.address.resourcePath)
+      ? ""
+      : `${record.address.resourcePath}/`;
+    return this._execApiCore({
+      tenantId: record.tenantId,
+      workspaceId: record.workspaceId,
+      projectId: record.projectId,
+      assistantId: record.assistantId,
+      resourcePath: basePath + apiSubPath,
+    }, apiSubPath, ext, request, reply);
+  }
+
+  private async _execApiCore(
+    config: { tenantId: string; workspaceId: string; projectId: string; assistantId?: string | null; resourcePath: string },
+    apiSubPath: string,
+    ext: "js" | "py",
+    request: FastifyRequest,
+    reply: FastifyReply,
+  ) {
     let sandbox: any;
     try {
       sandbox = await this.deps.sandboxManager.getSandboxFromConfig({
-        assistant_id: record.assistantId ?? "",
+        assistant_id: config.assistantId ?? "",
         thread_id: "",
-        tenantId: record.tenantId,
-        workspaceId: record.workspaceId,
-        projectId: record.projectId,
+        tenantId: config.tenantId,
+        workspaceId: config.workspaceId,
+        projectId: config.projectId,
       });
     } catch (err) {
       this.deps.logger.error("[share] sandbox start failed for API", { error: (err as Error).message });
       return reply.status(502).send({ error: "Sandbox unavailable" });
     }
 
-    // Build the command: node /project/api/hello.js or python3 /project/api/hello.py
-    const scriptPath = `/project/${apiSubPath}`;  // e.g., /project/api/hello.js
-    const cmd = ext === "py"
-      ? `python3 ${scriptPath}`
-      : `node ${scriptPath}`;
+    const scriptPath = `/project/${config.resourcePath}`;
+    const cmd = ext === "py" ? `python3 ${scriptPath}` : `node ${scriptPath}`;
 
     // Pass query params and body via environment
     const queryStr = request.url.includes("?") ? (request.url as string).split("?")[1] : "";
@@ -344,30 +437,27 @@ export class ResourceController {
       `export API_BODY='${bodyStr.replace(/'/g, "'\\''")}'`,
       `export API_METHOD='${request.method}'`,
       `export API_GATEWAY_URL='${request.protocol}://${request.hostname}'`,
-      `export API_TENANT_ID='${record.tenantId}'`,
-      `export API_ASSISTANT_ID='${record.assistantId || ""}'`,
+      `export API_TENANT_ID='${config.tenantId}'`,
+      `export API_ASSISTANT_ID='${config.assistantId || ""}'`,
     ].join(" && ");
 
     const fullCmd = `${envVars} && ${cmd}`;
 
-    this.deps.logger.info("[share] API exec", { token: record.token, cmd: cmd, scriptPath });
+    this.deps.logger.info("[api] exec", { scriptPath, cmd: cmd.substring(0, 80) });
 
     try {
-      const result = await sandbox.shell.exec(fullCmd);
+      const result = await sandbox.shell.execCommand({ command: fullCmd });
       // Parse stdout as JSON
       let data: unknown;
       try {
-        data = JSON.parse(result.stdout.trim() || "{}");
+        data = JSON.parse(result.output?.trim() || "{}");
       } catch {
-        // If stdout is not JSON, wrap it
-        data = { output: result.stdout.trim() };
+        data = { output: result.output?.trim() || "" };
       }
       return reply.status(200).type("application/json").send(data);
     } catch (err) {
-      this.deps.logger.warn("[share] API exec failed", { token: record.token, cmd, error: (err as Error).message });
-      // Try to extract error from stderr
-      const msg = (err as any)?.stderr || (err as Error).message;
-      return reply.status(500).send({ error: msg });
+      this.deps.logger.warn("[api] exec failed", { scriptPath, error: (err as Error).message });
+      return reply.status(500).send({ error: (err as Error).message });
     }
   }
 
@@ -382,24 +472,6 @@ export class ResourceController {
     return (entryDir + subPath).replace(/\/+/g, "/");
   }
 
-  private _injectBaseTag(buf: Buffer, token: string): Buffer {
-    const html = buf.toString("utf-8");
-    if (/<base\b/i.test(html)) return buf;
-    const baseTag = `<base href="/s/${token}/">`;
-    if (html.includes("</head>")) {
-      return Buffer.from(html.replace("</head>", `${baseTag}</head>`), "utf-8");
-    }
-    // No </head> — insert after <head> or <html> or after <!doctype>
-    if (html.includes("<head>")) {
-      return Buffer.from(html.replace("<head>", `<head>${baseTag}`), "utf-8");
-    }
-    if (html.includes("<html>")) {
-      return Buffer.from(html.replace("<html>", `<html>${baseTag}`), "utf-8");
-    }
-    // Fallback: prepend (will be after <!doctype> if present since html starts with <!doctype)
-    return Buffer.from(baseTag + html, "utf-8");
-  }
-
   private _passwordPage(token: string): string {
     return `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class="card"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id="f"><input type="password" id="p" placeholder="Enter password" required><button type="submit">Unlock</button><div class="error" id="e">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;
   }

package/src/index.ts

@@ -78,8 +78,8 @@ function initializeLogger(config: LoggerConfig) {
 
 // 创建 Fastify 应用
 const app = fastify({
-  logger: false, // 禁用内置日志记录器
-  bodyLimit: Number(process.env.BODY_LIMIT) || 50 * 1024 * 1024, // Default 50MB, configurable via BODY_LIMIT env var
+  logger: false,
+  bodyLimit: Number(process.env.BODY_LIMIT) || 50 * 1024 * 1024,
 });
 
 // Custom content type parser to handle DELETE requests with Content-Type but no body
@@ -138,6 +138,9 @@ app.addHook("preHandler", async (request, reply) => {
   const urlPath = request.url.split("?")[0];
   if (urlPath.includes("/viewfile") || urlPath.includes("/downloadfile") || urlPath.includes("/uploadfile")) return;
 
+  // Internal file access — auth handled by controller (Referer check)
+  if (urlPath.startsWith("/f/") || urlPath === "/f") return;
+
   return reply.status(401).send({
     success: false,
     error: "Unauthorized - Missing or invalid token",

package/src/routes/index.ts

@@ -19,6 +19,7 @@ import * as dataQueryController from "../controllers/data-query";
 import * as workflowTrackingController from "../controllers/workflow-tracking";
 import * as paController from "../controllers/personal-assistant";
 import * as tasksController from "../controllers/tasks";
+import { middlewareTypesRoutes } from "../controllers/middleware-types";
 import {
   createRunSchema,
   getAllMemoryItemsSchema,
@@ -41,6 +42,7 @@ import { registerSandboxProxyRoutes } from "../controllers/sandbox";
 import { registerWorkspaceRoutes } from "../controllers/workspace";
 import { registerDatabaseConfigRoutes } from "../controllers/database-configs";
 import { registerMetricsServerConfigRoutes } from "../controllers/metrics-configs";
+import { connectionRoutes } from "../controllers/connections";
 import { registerMcpServerConfigRoutes } from "../controllers/mcp-configs";
 import { registerEvalRoutes } from "../controllers/eval";
 import { registerUserRoutes } from "../controllers/users";
@@ -412,6 +414,11 @@ export const registerLatticeRoutes = (app: FastifyInstance, channelDeps?: { rout
 
   registerMetricsServerConfigRoutes(app);
 
+  connectionRoutes(app);
+
+  // Plugin middleware types discovery
+  middlewareTypesRoutes(app);
+
   // Data query route
   app.post<{
     Body: any;

package/src/routes/resource-routes.ts

@@ -8,6 +8,9 @@ export function registerResourceRoutes(
   // Public share access — MUST be before /api/** wildcard routes
   app.get("/s/:token", controller.resolveResource.bind(controller));
   app.get("/s/:token/*", controller.resolveResource.bind(controller));
+  app.post("/s/:token/*", controller.resolveResource.bind(controller));
+  app.put("/s/:token/*", controller.resolveResource.bind(controller));
+  app.delete("/s/:token/*", controller.resolveResource.bind(controller));
   app.post("/s/:token/unlock", controller.unlockShare.bind(controller));
   app.options("/s/:token", async (_req, reply) => {
     reply.header("Access-Control-Allow-Origin", "*");
@@ -16,6 +19,14 @@ export function registerResourceRoutes(
     return reply.status(204).send();
   });
 
+  // Internal file access: /f/{tenant}/{workspace}/{project}/*
+  const dirFile = controller.resolveDirectFile.bind(controller);
+  app.get("/f/:tid/:wid/:pid", dirFile);
+  app.get("/f/:tid/:wid/:pid/*", dirFile);
+  app.post("/f/:tid/:wid/:pid/*", dirFile);
+  app.put("/f/:tid/:wid/:pid/*", dirFile);
+  app.delete("/f/:tid/:wid/:pid/*", dirFile);
+
   // Management API
   app.post("/api/resources/share", controller.createShare.bind(controller));
   app.get("/api/resources/shares", controller.listShares.bind(controller));

package/dist/resources-P4XF764M.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/controllers/resources.ts"],"sourcesContent":["import { FastifyRequest, FastifyReply } from \"fastify\";\nimport type { ResourceAddress, ShareRecord, SharedResourceStore } from \"@axiom-lattice/protocols\";\nimport bcrypt from \"bcryptjs\";\nimport {\n  generateToken,\n  createSharePayload,\n  TokenCache,\n  SandboxLatticeManager,\n} from \"@axiom-lattice/core\";\nimport { getContentTypeFromFilename, getFilenameFromPath } from \"../utils/mime\";\n\ninterface ResourceControllerDeps {\n  store: SharedResourceStore;\n  sandboxManager: SandboxLatticeManager;\n  cache: TokenCache;\n  logger: { info: (msg: string, obj?: object) => void; warn: (msg: string, obj?: object) => void; error: (msg: string, obj?: object) => void };\n}\n\nexport class ResourceController {\n  constructor(private deps: ResourceControllerDeps) {}\n\n  async createShare(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const workspaceId = request.headers[\"x-workspace-id\"] as string;\n    const projectId = request.headers[\"x-project-id\"] as string;\n    const body = request.body as any;\n\n    if (!workspaceId || !projectId) {\n      return reply.status(400).send({ error: \"x-workspace-id and x-project-id headers required\" });\n    }\n\n    const payload = createSharePayload(\n      tenantId,\n      workspaceId,\n      projectId,\n      userId as string,\n      body,\n    );\n    const token = generateToken();\n\n    try {\n      await this.deps.store.create({ ...payload, token });\n      this.deps.logger.info(\n        \"[share] created\",\n        { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId },\n      );\n    } catch {\n      return reply.status(500).send({ error: \"Failed to create share\" });\n    }\n\n    return reply.status(201).send({ token, url: `/s/${token}` });\n  }\n\n  async listShares(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const shares = await this.deps.store.listByUser(tenantId, userId as string);\n    return reply.send(shares);\n  }\n\n  async updateShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const patch = request.body as any;\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, patch);\n\n    if (patch.revoked) {\n      this.deps.cache.invalidate(token);\n    }\n\n    return reply.send({ ok: true });\n  }\n\n  async revokeShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, { revoked: true });\n    this.deps.cache.invalidate(token);\n\n    return reply.send({ ok: true });\n  }\n\n  async resolveResource(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { token: string; \"*\"?: string };\n    const { token } = params;\n    const subPath = params[\"*\"] ?? \"\";\n\n    this.deps.logger.info(\"[share] resolve start\", { token, subPath });\n\n    // API runtime — proxy to sandbox\n    if (subPath && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\")) && subPath.startsWith(\"api/\")) {\n      const record = await this.deps.store.findByToken(token);\n      if (!record || record.revoked) return reply.status(404).send(\"Not found\");\n      if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n        return reply.status(410).send(\"Expired\");\n      }\n      // Auth check for API calls (same as file access)\n      if (!this._isInternalRequest(request) && record.visibility === \"password\") {\n        if (!this._isUnlocked(request, token)) {\n          return reply.status(401).send({ error: \"Password required\" });\n        }\n      }\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApi(record, subPath, ext, request, reply);\n    }\n\n    // 1. Check cache\n    const cached = this.deps.cache.get(token);\n    if (cached && !cached.requiresUnlock) {\n      this.deps.logger.info(\"[share] cache hit\", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });\n      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: \"default\", workspaceId: \"\", projectId: \"\", assistantId: null }, reply);\n    }\n    this.deps.logger.info(\"[share] cache miss, querying DB\", { token });\n\n    // 2. Single DB lookup\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.revoked) {\n      this.deps.logger.warn(\"[share] token not found or revoked\", { token, found: !!record, revoked: record?.revoked });\n      return reply.status(404).send(\"Not found\");\n    }\n    if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n      this.deps.logger.info(\"[share] token expired\", { token, expiresAt: record.expiresAt });\n      return reply.status(410).send(\"Expired\");\n    }\n\n    this.deps.logger.info(\"[share] record found\", {\n      token,\n      volume: record.address.volume,\n      resourcePath: record.address.resourcePath,\n      visibility: record.visibility,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n    });\n\n    // 3. Auth\n    const isInternal = this._isInternalRequest(request);\n    if (!isInternal) {\n      if (record.visibility === \"password\") {\n        const unlocked = this._isUnlocked(request, token);\n        if (!unlocked) {\n          this.deps.logger.info(\"[share] password protected, returning password page\", { token });\n          this.deps.cache.set(token, {\n            address: record.address,\n            requiresUnlock: true,\n            sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId },\n          });\n          return reply.type(\"text/html\").send(this._passwordPage(token));\n        }\n        this.deps.logger.info(\"[share] password unlocked\", { token });\n      }\n    }\n\n    // 4. Access count\n    if (record.maxAccess !== null) {\n      const ok = await this.deps.store.atomicIncrementAccess(token);\n      if (!ok) return reply.status(410).send(\"Access limit reached\");\n    } else {\n      this.deps.store.incrementAccess(token).catch(() => {});\n    }\n\n    // 5. Cache\n    const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };\n    this.deps.cache.set(token, {\n      address: record.address,\n      requiresUnlock: record.visibility === \"password\" && !isInternal,\n      sandboxConfig,\n    });\n\n    return this._serveFile(record.address, token, subPath, sandboxConfig, reply);\n  }\n\n  async unlockShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const { password } = request.body as unknown as { password: string };\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || !record.passwordHash) {\n      return reply.status(404).send({ error: \"Invalid request\" });\n    }\n\n    const valid = await bcrypt.compare(password, record.passwordHash!);\n    if (!valid) {\n      return reply.status(401).send({ error: \"Incorrect password\" });\n    }\n\n    const cookieOpts = [\n      `share_unlock_${token}=1`,\n      \"Max-Age=86400\",\n      `Path=/s/${token}`,\n      \"SameSite=Lax\",\n      \"HttpOnly\",\n    ];\n    if (request.protocol === \"https\") {\n      cookieOpts.push(\"Secure\");\n    }\n    reply.header(\"Set-Cookie\", cookieOpts.join(\"; \"));\n    return reply.send({ ok: true });\n  }\n\n  private _isInternalRequest(request: FastifyRequest): boolean {\n    // Check for valid user session from auth middleware\n    const user = (request as any).user;\n    return !!user && !!user.id;\n  }\n\n  private _isUnlocked(request: FastifyRequest, token: string): boolean {\n    const cookie = request.headers.cookie ?? \"\";\n    return cookie.includes(`share_unlock_${token}=1`);\n  }\n\n  /** Returns true if the path has a file extension indicating it's a file, not a directory */\n  private _isFilePath(path: string): boolean {\n    return /\\.[a-zA-Z0-9]+$/.test(path);\n  }\n\n  private async _serveFile(\n    address: ResourceAddress,\n    token: string,\n    subPath: string,\n    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    reply: FastifyReply,\n  ) {\n    const provider = this.deps.sandboxManager.getDefaultProvider();\n    const resolver = provider.getResourceResolver();\n    const sandboxPath = subPath\n      ? this._resolveSafeSubPath(address.resourcePath, subPath)\n      : address.resourcePath;\n    // If entry has no file extension, treat as directory → try index.html\n    const entryPath = (!subPath && !this._isFilePath(sandboxPath))\n      ? `${sandboxPath}/index.html`\n      : sandboxPath;\n\n    this.deps.logger.info(\"[share] serving file\", {\n      token, volume: address.volume, sandboxPath: entryPath, subPath: subPath || \"(none)\",\n      tenantId: sandboxConfig.tenantId, workspaceId: sandboxConfig.workspaceId, projectId: sandboxConfig.projectId,\n    });\n\n    let buf: Buffer;\n    try {\n      // Try volume FS first\n      buf = await resolver.resolve({ ...address, resourcePath: entryPath });\n      this.deps.logger.info(\"[share] resolved via volume FS\", { token, size: buf.length });\n    } catch (err) {\n      this.deps.logger.warn(\"[share] volume FS failed, trying sandbox fallback\", {\n        token, path: entryPath, error: (err as Error).message,\n      });\n      try {\n        const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n          assistant_id: sandboxConfig.assistantId ?? \"\",\n          thread_id: \"\",\n          tenantId: sandboxConfig.tenantId,\n          workspaceId: sandboxConfig.workspaceId,\n          projectId: sandboxConfig.projectId,\n        });\n        buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });\n        this.deps.logger.info(\"[share] resolved via sandbox fallback\", { token, size: buf.length });\n      } catch (err) {\n        this.deps.logger.warn(\"[share] all resolution attempts failed\", { token, resourcePath: entryPath, error: (err as Error).message });\n        return reply.status(404).send(\"File not found\");\n      }\n    }\n\n    const fullPath = entryPath;\n    const filename = getFilenameFromPath(fullPath);\n    const isHtml = !subPath && /\\.(html|htm)$/i.test(filename);\n\n    if (isHtml) {\n      buf = this._injectBaseTag(buf, token);\n    }\n\n    const contentType = getContentTypeFromFilename(filename);\n    const contentDisposition = `inline; filename=\"${filename.replace(/\"/g, '\\\\\"')}\"; filename*=UTF-8''${encodeURIComponent(filename)}`;\n\n    return reply\n      .status(200)\n      .type(contentType)\n      .header(\"Content-Disposition\", contentDisposition)\n      .header(\"Access-Control-Allow-Origin\", \"*\")\n      .send(buf);\n  }\n\n  private async _execApi(\n    record: ShareRecord,\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    // Get or start sandbox\n    let sandbox: any;\n    try {\n      sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n        assistant_id: record.assistantId ?? \"\",\n        thread_id: \"\",\n        tenantId: record.tenantId,\n        workspaceId: record.workspaceId,\n        projectId: record.projectId,\n      });\n    } catch (err) {\n      this.deps.logger.error(\"[share] sandbox start failed for API\", { error: (err as Error).message });\n      return reply.status(502).send({ error: \"Sandbox unavailable\" });\n    }\n\n    // Build the command: node /project/api/hello.js or python3 /project/api/hello.py\n    const scriptPath = `/project/${apiSubPath}`;  // e.g., /project/api/hello.js\n    const cmd = ext === \"py\"\n      ? `python3 ${scriptPath}`\n      : `node ${scriptPath}`;\n\n    // Pass query params and body via environment\n    const queryStr = request.url.includes(\"?\") ? (request.url as string).split(\"?\")[1] : \"\";\n    const queryObj: Record<string, string> = {};\n    if (queryStr) {\n      for (const [k, v] of new URLSearchParams(queryStr)) {\n        queryObj[k] = v;\n      }\n    }\n\n    const bodyStr = (request.body as string) ?? \"\";\n\n    const envVars = [\n      `export API_QUERY='${JSON.stringify(queryObj).replace(/'/g, \"'\\\\''\")}'`,\n      `export API_BODY='${bodyStr.replace(/'/g, \"'\\\\''\")}'`,\n      `export API_METHOD='${request.method}'`,\n      `export API_GATEWAY_URL='${request.protocol}://${request.hostname}'`,\n      `export API_TENANT_ID='${record.tenantId}'`,\n      `export API_ASSISTANT_ID='${record.assistantId || \"\"}'`,\n    ].join(\" && \");\n\n    const fullCmd = `${envVars} && ${cmd}`;\n\n    this.deps.logger.info(\"[share] API exec\", { token: record.token, cmd: cmd, scriptPath });\n\n    try {\n      const result = await sandbox.shell.exec(fullCmd);\n      // Parse stdout as JSON\n      let data: unknown;\n      try {\n        data = JSON.parse(result.stdout.trim() || \"{}\");\n      } catch {\n        // If stdout is not JSON, wrap it\n        data = { output: result.stdout.trim() };\n      }\n      return reply.status(200).type(\"application/json\").send(data);\n    } catch (err) {\n      this.deps.logger.warn(\"[share] API exec failed\", { token: record.token, cmd, error: (err as Error).message });\n      // Try to extract error from stderr\n      const msg = (err as any)?.stderr || (err as Error).message;\n      return reply.status(500).send({ error: msg });\n    }\n  }\n\n  private _resolveSafeSubPath(entryFile: string, subPath: string): string {\n    if (!subPath) return entryFile;\n    if (subPath.includes(\"..\")) throw new Error(\"Path traversal denied\");\n    // If entry is a file (has extension), strip filename to get directory.\n    // If entry is a directory (no extension), keep it as base.\n    const entryDir = this._isFilePath(entryFile)\n      ? entryFile.replace(/[^/]+$/, \"\")\n      : entryFile + \"/\";\n    return (entryDir + subPath).replace(/\\/+/g, \"/\");\n  }\n\n  private _injectBaseTag(buf: Buffer, token: string): Buffer {\n    const html = buf.toString(\"utf-8\");\n    if (/<base\\b/i.test(html)) return buf;\n    const baseTag = `<base href=\"/s/${token}/\">`;\n    if (html.includes(\"</head>\")) {\n      return Buffer.from(html.replace(\"</head>\", `${baseTag}</head>`), \"utf-8\");\n    }\n    // No </head> — insert after <head> or <html> or after <!doctype>\n    if (html.includes(\"<head>\")) {\n      return Buffer.from(html.replace(\"<head>\", `<head>${baseTag}`), \"utf-8\");\n    }\n    if (html.includes(\"<html>\")) {\n      return Buffer.from(html.replace(\"<html>\", `<html>${baseTag}`), \"utf-8\");\n    }\n    // Fallback: prepend (will be after <!doctype> if present since html starts with <!doctype)\n    return Buffer.from(baseTag + html, \"utf-8\");\n  }\n\n  private _passwordPage(token: string): string {\n    return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class=\"card\"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id=\"f\"><input type=\"password\" id=\"p\" placeholder=\"Enter password\" required><button type=\"submit\">Unlock</button><div class=\"error\" id=\"e\">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;\n  }\n}\n"],"mappings":";;;;;;AAEA,OAAO,YAAY;AACnB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAUA,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAAoB,MAA8B;AAA9B;AAAA,EAA+B;AAAA,EAEnD,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,cAAc,QAAQ,QAAQ,gBAAgB;AACpD,UAAM,YAAY,QAAQ,QAAQ,cAAc;AAChD,UAAM,OAAO,QAAQ;AAErB,QAAI,CAAC,eAAe,CAAC,WAAW;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC7F;AAEA,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAE5B,QAAI;AACF,YAAM,KAAK,KAAK,MAAM,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC;AAClD,WAAK,KAAK,OAAO;AAAA,QACf;AAAA,QACA,EAAE,OAAO,cAAc,KAAK,cAAc,gBAAgB,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,QAAQ,OAAO;AAAA,MACjI;AAAA,IACF,QAAQ;AACN,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAM,WAAW,SAAyB,OAAqB;AAC7D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,WAAW,UAAU,MAAgB;AAC1E,WAAO,MAAM,KAAK,MAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,QAAQ,QAAQ;AAEtB,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,KAAK;AAEzC,QAAI,MAAM,SAAS;AACjB,WAAK,KAAK,MAAM,WAAW,KAAK;AAAA,IAClC;AAEA,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AAEJ,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AACrD,SAAK,KAAK,MAAM,WAAW,KAAK;AAEhC,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,gBAAgB,SAAyB,OAAqB;AAClE,UAAM,SAAS,QAAQ;AACvB,UAAM,EAAE,MAAM,IAAI;AAClB,UAAM,UAAU,OAAO,GAAG,KAAK;AAE/B,SAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,QAAQ,CAAC;AAGjE,QAAI,YAAY,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK,MAAM,QAAQ,WAAW,MAAM,GAAG;AACjG,YAAMA,UAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,UAAI,CAACA,WAAUA,QAAO,QAAS,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AACxE,UAAIA,QAAO,aAAa,IAAI,KAAKA,QAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,MACzC;AAEA,UAAI,CAAC,KAAK,mBAAmB,OAAO,KAAKA,QAAO,eAAe,YAAY;AACzE,YAAI,CAAC,KAAK,YAAY,SAAS,KAAK,GAAG;AACrC,iBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,QAC9D;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,SAASA,SAAQ,SAAS,KAAK,SAAS,KAAK;AAAA,IAC3D;AAGA,UAAM,SAAS,KAAK,KAAK,MAAM,IAAI,KAAK;AACxC,QAAI,UAAU,CAAC,OAAO,gBAAgB;AACpC,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,cAAc,OAAO,QAAQ,aAAa,CAAC;AAC9H,aAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,iBAAiB,EAAE,UAAU,WAAW,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,GAAG,KAAK;AAAA,IAClK;AACA,SAAK,KAAK,OAAO,KAAK,mCAAmC,EAAE,MAAM,CAAC;AAGlE,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,WAAK,KAAK,OAAO,KAAK,sCAAsC,EAAE,OAAO,OAAO,CAAC,CAAC,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AAChH,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AAAA,IAC3C;AACA,QAAI,OAAO,aAAa,IAAI,KAAK,OAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,WAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,WAAW,OAAO,UAAU,CAAC;AACrF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,IACzC;AAEA,SAAK,KAAK,OAAO,KAAK,wBAAwB;AAAA,MAC5C;AAAA,MACA,QAAQ,OAAO,QAAQ;AAAA,MACvB,cAAc,OAAO,QAAQ;AAAA,MAC7B,YAAY,OAAO;AAAA,MACnB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,IACpB,CAAC;AAGD,UAAM,aAAa,KAAK,mBAAmB,OAAO;AAClD,QAAI,CAAC,YAAY;AACf,UAAI,OAAO,eAAe,YAAY;AACpC,cAAM,WAAW,KAAK,YAAY,SAAS,KAAK;AAChD,YAAI,CAAC,UAAU;AACb,eAAK,KAAK,OAAO,KAAK,uDAAuD,EAAE,MAAM,CAAC;AACtF,eAAK,KAAK,MAAM,IAAI,OAAO;AAAA,YACzB,SAAS,OAAO;AAAA,YAChB,gBAAgB;AAAA,YAChB,eAAe,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AAAA,UAC5I,CAAC;AACD,iBAAO,MAAM,KAAK,WAAW,EAAE,KAAK,KAAK,cAAc,KAAK,CAAC;AAAA,QAC/D;AACA,aAAK,KAAK,OAAO,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,MAAM;AAC7B,YAAM,KAAK,MAAM,KAAK,KAAK,MAAM,sBAAsB,KAAK;AAC5D,UAAI,CAAC,GAAI,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,sBAAsB;AAAA,IAC/D,OAAO;AACL,WAAK,KAAK,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACvD;AAGA,UAAM,gBAAgB,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AACjJ,SAAK,KAAK,MAAM,IAAI,OAAO;AAAA,MACzB,SAAS,OAAO;AAAA,MAChB,gBAAgB,OAAO,eAAe,cAAc,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAED,WAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,eAAe,KAAK;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,CAAC,OAAO,cAAc;AACnC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,QAAQ,MAAM,OAAO,QAAQ,UAAU,OAAO,YAAa;AACjE,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAEA,UAAM,aAAa;AAAA,MACjB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,iBAAW,KAAK,QAAQ;AAAA,IAC1B;AACA,UAAM,OAAO,cAAc,WAAW,KAAK,IAAI,CAAC;AAChD,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEQ,mBAAmB,SAAkC;AAE3D,UAAM,OAAQ,QAAgB;AAC9B,WAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK;AAAA,EAC1B;AAAA,EAEQ,YAAY,SAAyB,OAAwB;AACnE,UAAM,SAAS,QAAQ,QAAQ,UAAU;AACzC,WAAO,OAAO,SAAS,gBAAgB,KAAK,IAAI;AAAA,EAClD;AAAA;AAAA,EAGQ,YAAY,MAAuB;AACzC,WAAO,kBAAkB,KAAK,IAAI;AAAA,EACpC;AAAA,EAEA,MAAc,WACZ,SACA,OACA,SACA,eACA,OACA;AACA,UAAM,WAAW,KAAK,KAAK,eAAe,mBAAmB;AAC7D,UAAM,WAAW,SAAS,oBAAoB;AAC9C,UAAM,cAAc,UAChB,KAAK,oBAAoB,QAAQ,cAAc,OAAO,IACtD,QAAQ;AAEZ,UAAM,YAAa,CAAC,WAAW,CAAC,KAAK,YAAY,WAAW,IACxD,GAAG,WAAW,gBACd;AAEJ,SAAK,KAAK,OAAO,KAAK,wBAAwB;AAAA,MAC5C;AAAA,MAAO,QAAQ,QAAQ;AAAA,MAAQ,aAAa;AAAA,MAAW,SAAS,WAAW;AAAA,MAC3E,UAAU,cAAc;AAAA,MAAU,aAAa,cAAc;AAAA,MAAa,WAAW,cAAc;AAAA,IACrG,CAAC;AAED,QAAI;AACJ,QAAI;AAEF,YAAM,MAAM,SAAS,QAAQ,EAAE,GAAG,SAAS,cAAc,UAAU,CAAC;AACpE,WAAK,KAAK,OAAO,KAAK,kCAAkC,EAAE,OAAO,MAAM,IAAI,OAAO,CAAC;AAAA,IACrF,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,KAAK,qDAAqD;AAAA,QACzE;AAAA,QAAO,MAAM;AAAA,QAAW,OAAQ,IAAc;AAAA,MAChD,CAAC;AACD,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,UAClE,cAAc,cAAc,eAAe;AAAA,UAC3C,WAAW;AAAA,UACX,UAAU,cAAc;AAAA,UACxB,aAAa,cAAc;AAAA,UAC3B,WAAW,cAAc;AAAA,QAC3B,CAAC;AACD,cAAM,MAAM,QAAQ,KAAK,aAAa,EAAE,MAAM,YAAY,SAAS,GAAG,CAAC;AACvE,aAAK,KAAK,OAAO,KAAK,yCAAyC,EAAE,OAAO,MAAM,IAAI,OAAO,CAAC;AAAA,MAC5F,SAASC,MAAK;AACZ,aAAK,KAAK,OAAO,KAAK,0CAA0C,EAAE,OAAO,cAAc,WAAW,OAAQA,KAAc,QAAQ,CAAC;AACjI,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAAA,MAChD;AAAA,IACF;AAEA,UAAM,WAAW;AACjB,UAAM,WAAW,oBAAoB,QAAQ;AAC7C,UAAM,SAAS,CAAC,WAAW,iBAAiB,KAAK,QAAQ;AAEzD,QAAI,QAAQ;AACV,YAAM,KAAK,eAAe,KAAK,KAAK;AAAA,IACtC;AAEA,UAAM,cAAc,2BAA2B,QAAQ;AACvD,UAAM,qBAAqB,qBAAqB,SAAS,QAAQ,MAAM,KAAK,CAAC,uBAAuB,mBAAmB,QAAQ,CAAC;AAEhI,WAAO,MACJ,OAAO,GAAG,EACV,KAAK,WAAW,EAChB,OAAO,uBAAuB,kBAAkB,EAChD,OAAO,+BAA+B,GAAG,EACzC,KAAK,GAAG;AAAA,EACb;AAAA,EAEA,MAAc,SACZ,QACA,YACA,KACA,SACA,OACA;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,QAC5D,cAAc,OAAO,eAAe;AAAA,QACpC,WAAW;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,MAAM,wCAAwC,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAChG,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAA,IAChE;AAGA,UAAM,aAAa,YAAY,UAAU;AACzC,UAAM,MAAM,QAAQ,OAChB,WAAW,UAAU,KACrB,QAAQ,UAAU;AAGtB,UAAM,WAAW,QAAQ,IAAI,SAAS,GAAG,IAAK,QAAQ,IAAe,MAAM,GAAG,EAAE,CAAC,IAAI;AACrF,UAAM,WAAmC,CAAC;AAC1C,QAAI,UAAU;AACZ,iBAAW,CAAC,GAAG,CAAC,KAAK,IAAI,gBAAgB,QAAQ,GAAG;AAClD,iBAAS,CAAC,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,UAAW,QAAQ,QAAmB;AAE5C,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK,UAAU,QAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,MACpE,oBAAoB,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAAA,MAClD,sBAAsB,QAAQ,MAAM;AAAA,MACpC,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,QAAQ;AAAA,MACjE,yBAAyB,OAAO,QAAQ;AAAA,MACxC,4BAA4B,OAAO,eAAe,EAAE;AAAA,IACtD,EAAE,KAAK,MAAM;AAEb,UAAM,UAAU,GAAG,OAAO,OAAO,GAAG;AAEpC,SAAK,KAAK,OAAO,KAAK,oBAAoB,EAAE,OAAO,OAAO,OAAO,KAAU,WAAW,CAAC;AAEvF,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,MAAM,KAAK,OAAO;AAE/C,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,IAAI;AAAA,MAChD,QAAQ;AAEN,eAAO,EAAE,QAAQ,OAAO,OAAO,KAAK,EAAE;AAAA,MACxC;AACA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,kBAAkB,EAAE,KAAK,IAAI;AAAA,IAC7D,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,KAAK,2BAA2B,EAAE,OAAO,OAAO,OAAO,KAAK,OAAQ,IAAc,QAAQ,CAAC;AAE5G,YAAM,MAAO,KAAa,UAAW,IAAc;AACnD,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC;AAAA,IAC9C;AAAA,EACF;AAAA,EAEQ,oBAAoB,WAAmB,SAAyB;AACtE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AAGnE,UAAM,WAAW,KAAK,YAAY,SAAS,IACvC,UAAU,QAAQ,UAAU,EAAE,IAC9B,YAAY;AAChB,YAAQ,WAAW,SAAS,QAAQ,QAAQ,GAAG;AAAA,EACjD;AAAA,EAEQ,eAAe,KAAa,OAAuB;AACzD,UAAM,OAAO,IAAI,SAAS,OAAO;AACjC,QAAI,WAAW,KAAK,IAAI,EAAG,QAAO;AAClC,UAAM,UAAU,kBAAkB,KAAK;AACvC,QAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,aAAO,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG,OAAO,SAAS,GAAG,OAAO;AAAA,IAC1E;AAEA,QAAI,KAAK,SAAS,QAAQ,GAAG;AAC3B,aAAO,OAAO,KAAK,KAAK,QAAQ,UAAU,SAAS,OAAO,EAAE,GAAG,OAAO;AAAA,IACxE;AACA,QAAI,KAAK,SAAS,QAAQ,GAAG;AAC3B,aAAO,OAAO,KAAK,KAAK,QAAQ,UAAU,SAAS,OAAO,EAAE,GAAG,OAAO;AAAA,IACxE;AAEA,WAAO,OAAO,KAAK,UAAU,MAAM,OAAO;AAAA,EAC5C;AAAA,EAEQ,cAAc,OAAuB;AAC3C,WAAO,8tCAA8tC,KAAK;AAAA,EAC5uC;AACF;","names":["record","err"]}