@axiom-lattice/gateway 4.2.1 → 4.2.3

package/dist/{resources-SRQRKW5G.mjs → resources-JFKAPS45.mjs}

@@ -1,6 +1,7 @@
 import {
-  getContentTypeFromFilename
-} from "./chunk-LHQY46YB.mjs";
+  getContentTypeFromFilename,
+  sendBufferWithRange
+} from "./chunk-EMYRCJOI.mjs";
 import {
   init_openToken,
   openToken_exports
@@ -127,7 +128,7 @@ var ResourceController = class {
     const cached = this.deps.cache.get(token);
     if (cached && !cached.requiresUnlock) {
       this.deps.logger.info("[share] cache hit", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });
-      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: "default", workspaceId: "", projectId: "", assistantId: null }, reply);
+      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: "default", workspaceId: "", projectId: "", assistantId: null }, reply, request.headers.range);
     }
     this.deps.logger.info("[share] cache miss, querying DB", { token });
     const record = await this.deps.store.findByToken(token);
@@ -179,7 +180,7 @@ var ResourceController = class {
       requiresUnlock: record.visibility === "password" && !isInternal,
       sandboxConfig
     });
-    return this._serveFile(record.address, token, subPath, sandboxConfig, reply);
+    return this._serveFile(record.address, token, subPath, sandboxConfig, reply, request.headers.range);
   }
   /**
    * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}
@@ -211,7 +212,8 @@ var ResourceController = class {
       subPath,
       reply,
       `/f/${tenantId}/${workspaceId}/${projectId}`,
-      { tenantId, workspaceId, projectId, assistantId: null }
+      { tenantId, workspaceId, projectId, assistantId: null },
+      request.headers.range
     );
   }
   async unlockShare(request, reply) {
@@ -262,7 +264,7 @@ var ResourceController = class {
   /**
    * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.
    */
-  async _resolveAndServe(volume, resourcePath, reply, baseTagPrefix, sandboxConfig) {
+  async _resolveAndServe(volume, resourcePath, reply, baseTagPrefix, sandboxConfig, rangeHeader) {
     const cleanPath = resourcePath.replace(/\/+$/, "");
     const entryPath = !cleanPath ? "index.html" : this._isFilePath(cleanPath) ? cleanPath : `${cleanPath}/index.html`;
     const address = { volume, resourcePath: "" };
@@ -298,16 +300,20 @@ var ResourceController = class {
         );
       }
     }
-    return reply.status(200).type(contentType).header("Content-Disposition", `inline; filename*=UTF-8''${encodeURIComponent(filename)}`).header("Access-Control-Allow-Origin", "*").send(buf);
+    return sendBufferWithRange(reply, buf, contentType, rangeHeader, {
+      "Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(filename)}`,
+      "Access-Control-Allow-Origin": "*"
+    });
   }
-  async _serveFile(address, token, subPath, sandboxConfig, reply) {
+  async _serveFile(address, token, subPath, sandboxConfig, reply, rangeHeader) {
     const resourcePath = subPath ? this._resolveSafeSubPath(address.resourcePath, subPath) : address.resourcePath;
     return this._resolveAndServe(
       address.volume,
       resourcePath,
       reply,
       `/s/${token}`,
-      sandboxConfig
+      sandboxConfig,
+      rangeHeader
     );
   }
   async _execApi(record, apiSubPath, ext, request, reply) {
@@ -401,4 +407,4 @@ var ResourceController = class {
 export {
   ResourceController
 };
-//# sourceMappingURL=resources-SRQRKW5G.mjs.map
+//# sourceMappingURL=resources-JFKAPS45.mjs.map

package/dist/resources-JFKAPS45.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/resources.ts","../src/services/open/sandboxGrants.ts"],"sourcesContent":["import { FastifyRequest, FastifyReply } from \"fastify\";\nimport type { ResourceAddress, ShareRecord, SharedResourceStore } from \"@axiom-lattice/protocols\";\nimport bcrypt from \"bcryptjs\";\nimport {\n  generateToken,\n  createSharePayload,\n  TokenCache,\n  SandboxLatticeManager,\n  buildNamedVolumeName,\n} from \"@axiom-lattice/core\";\nimport { getContentTypeFromFilename } from \"../utils/mime\";\nimport { sendBufferWithRange } from \"../utils/http-range\";\nimport { sanitizeShareOpenGrants } from \"../services/open/sandboxGrants\";\n\ninterface ResourceControllerDeps {\n  store: SharedResourceStore;\n  sandboxManager: SandboxLatticeManager;\n  cache: TokenCache;\n  logger: { info: (msg: string, obj?: object) => void; warn: (msg: string, obj?: object) => void; error: (msg: string, obj?: object) => void };\n}\n\nexport class ResourceController {\n  constructor(private deps: ResourceControllerDeps) {}\n\n  async createShare(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const workspaceId = request.headers[\"x-workspace-id\"] as string;\n    const projectId = request.headers[\"x-project-id\"] as string;\n    const body = request.body as any;\n\n    if (!workspaceId || !projectId) {\n      return reply.status(400).send({ error: \"x-workspace-id and x-project-id headers required\" });\n    }\n\n    const payload = createSharePayload(\n      tenantId,\n      workspaceId,\n      projectId,\n      userId as string,\n      body,\n    );\n    const token = generateToken();\n\n    try {\n      await this.deps.store.create({ ...payload, token });\n      this.deps.logger.info(\n        \"[share] created\",\n        { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId },\n      );\n    } catch {\n      return reply.status(500).send({ error: \"Failed to create share\" });\n    }\n\n    return reply.status(201).send({ token, url: `/s/${token}` });\n  }\n\n  async listShares(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const shares = await this.deps.store.listByUser(tenantId, userId as string);\n    return reply.send(shares.filter((r: any) => (r as any).visibility !== \"internal\"));\n  }\n\n  async updateShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const patch = request.body as any;\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, patch);\n\n    if (patch.revoked) {\n      this.deps.cache.invalidate(token);\n    }\n\n    return reply.send({ ok: true });\n  }\n\n  async revokeShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, { revoked: true });\n    this.deps.cache.invalidate(token);\n\n    return reply.send({ ok: true });\n  }\n\n  async resolveResource(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { token: string; \"*\"?: string };\n    const { token } = params;\n    const subPath = params[\"*\"] ?? \"\";\n\n    this.deps.logger.info(\"[share] resolve start\", { token, subPath });\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime — proxy to sandbox. Detected by /api/ anywhere in subPath.\n    if (isApi) {\n      const record = await this.deps.store.findByToken(token);\n      if (!record || record.revoked) return reply.status(404).send(\"Not found\");\n      if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n        return reply.status(410).send(\"Expired\");\n      }\n      // Auth check for API calls (same as file access)\n      if (!this._isInternalRequest(request)) {\n        if (record.visibility === \"internal\") {\n          return reply.status(401).send({ error: \"Internal access only\" });\n        }\n        if (record.visibility === \"password\") {\n          if (!this._isUnlocked(request, token)) {\n            return reply.status(401).send({ error: \"Password required\" });\n          }\n        }\n      }\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApi(record, subPath, ext, request, reply);\n    }\n\n    // 1. Check cache\n    const cached = this.deps.cache.get(token);\n    if (cached && !cached.requiresUnlock) {\n      this.deps.logger.info(\"[share] cache hit\", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });\n      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: \"default\", workspaceId: \"\", projectId: \"\", assistantId: null }, reply, request.headers.range);\n    }\n    this.deps.logger.info(\"[share] cache miss, querying DB\", { token });\n\n    // 2. Single DB lookup\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.revoked) {\n      this.deps.logger.warn(\"[share] token not found or revoked\", { token, found: !!record, revoked: record?.revoked });\n      return reply.status(404).send(\"Not found\");\n    }\n    if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n      this.deps.logger.info(\"[share] token expired\", { token, expiresAt: record.expiresAt });\n      return reply.status(410).send(\"Expired\");\n    }\n\n    this.deps.logger.info(\"[share] record found\", {\n      token,\n      volume: record.address.volume,\n      resourcePath: record.address.resourcePath,\n      visibility: record.visibility,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n    });\n\n    // 3. Auth\n    const isInternal = this._isInternalRequest(request);\n    if (!isInternal) {\n      // Internal shares: must be logged in\n      if (record.visibility === \"internal\") {\n        return reply.status(401).send({ error: \"Internal access only\" });\n      }\n      if (record.visibility === \"password\") {\n        const unlocked = this._isUnlocked(request, token);\n        if (!unlocked) {\n          this.deps.logger.info(\"[share] password protected, returning password page\", { token });\n          this.deps.cache.set(token, {\n            address: record.address,\n            requiresUnlock: true,\n            sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId },\n          });\n          return reply.type(\"text/html\").send(this._passwordPage(token));\n        }\n        this.deps.logger.info(\"[share] password unlocked\", { token });\n      }\n    }\n\n    // 4. Access count\n    if (record.maxAccess !== null) {\n      const ok = await this.deps.store.atomicIncrementAccess(token);\n      if (!ok) return reply.status(410).send(\"Access limit reached\");\n    } else {\n      this.deps.store.incrementAccess(token).catch(() => {});\n    }\n\n    // 5. Cache\n    const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };\n    this.deps.cache.set(token, {\n      address: record.address,\n      requiresUnlock: record.visibility === \"password\" && !isInternal,\n      sandboxConfig,\n    });\n\n    return this._serveFile(record.address, token, subPath, sandboxConfig, reply, request.headers.range);\n  }\n\n  /**\n   * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}\n   * Decodes 3 UUIDs (no dashes, 96 hex chars), ensures internal share, 302 redirects.\n   */\n  async resolveDirectFile(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { tid: string; wid: string; pid: string; \"*\"?: string };\n    const tenantId = params.tid;\n    const workspaceId = params.wid;\n    const projectId = params.pid;\n    const subPath = (params[\"*\"] ?? \"\");\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime\n    if (isApi) {\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApiCore({\n        tenantId, workspaceId, projectId, assistantId: \"\",\n        resourcePath: subPath,\n      }, subPath, ext, request, reply);\n    }\n\n    const volume = buildNamedVolumeName(\"p\", \"project\", tenantId, workspaceId, projectId);\n    return this._resolveAndServe(volume, subPath, reply, `/f/${tenantId}/${workspaceId}/${projectId}`,\n      { tenantId, workspaceId, projectId, assistantId: null },\n      request.headers.range,\n    );\n  }\n\n  async unlockShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const { password } = request.body as unknown as { password: string };\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || !record.passwordHash) {\n      return reply.status(404).send({ error: \"Invalid request\" });\n    }\n\n    const valid = await bcrypt.compare(password, record.passwordHash!);\n    if (!valid) {\n      return reply.status(401).send({ error: \"Incorrect password\" });\n    }\n\n    const cookieOpts = [\n      `share_unlock_${token}=1`,\n      \"Max-Age=86400\",\n      `Path=/s/${token}`,\n      \"SameSite=Lax\",\n      \"HttpOnly\",\n    ];\n    if (request.protocol === \"https\") {\n      cookieOpts.push(\"Secure\");\n    }\n    reply.header(\"Set-Cookie\", cookieOpts.join(\"; \"));\n    return reply.send({ ok: true });\n  }\n\n  private _isInternalRequest(request: FastifyRequest): boolean {\n    const user = (request as any).user;\n    if (user && user.id) return true;\n    // Fallback: same-origin browser request (iframe/img embed — no Auth header)\n    const origin = request.headers.origin || request.headers.referer;\n    if (origin) {\n      try {\n        const { hostname } = new URL(origin);\n        if (hostname === request.hostname) return true;\n      } catch { /* malformed */ }\n    }\n    return false;\n  }\n\n  private _isUnlocked(request: FastifyRequest, token: string): boolean {\n    const cookie = request.headers.cookie ?? \"\";\n    return cookie.includes(`share_unlock_${token}=1`);\n  }\n\n  /** Returns true if the path has a file extension indicating it's a file, not a directory */\n  private _isFilePath(path: string): boolean {\n    return /\\.[a-zA-Z0-9]+$/.test(path);\n  }\n\n  /**\n   * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.\n   */\n  private async _resolveAndServe(\n    volume: string,\n    resourcePath: string,\n    reply: FastifyReply,\n    baseTagPrefix: string,\n    sandboxConfig?: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    rangeHeader?: string,\n  ) {\n    const cleanPath = resourcePath.replace(/\\/+$/, \"\");\n    const entryPath = !cleanPath\n      ? \"index.html\"\n      : this._isFilePath(cleanPath)\n        ? cleanPath\n        : `${cleanPath}/index.html`;\n\n    const address: ResourceAddress = { volume, resourcePath: \"\" };\n\n    let buf: Buffer;\n    try {\n      // Volume FS first\n      const provider = this.deps.sandboxManager.getDefaultProvider();\n      buf = await provider.getResourceResolver().resolve({ ...address, resourcePath: entryPath });\n    } catch {\n      // Sandbox fallback\n      if (!sandboxConfig) return reply.status(404).send(\"File not found\");\n      try {\n        const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n          assistant_id: sandboxConfig.assistantId ?? \"\",\n          thread_id: \"\",\n          tenantId: sandboxConfig.tenantId,\n          workspaceId: sandboxConfig.workspaceId,\n          projectId: sandboxConfig.projectId,\n        });\n        buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });\n      } catch {\n        return reply.status(404).send(\"File not found\");\n      }\n    }\n\n    const filename = entryPath.split(\"/\").pop() || \"download\";\n    const contentType = getContentTypeFromFilename(filename);\n\n    // Inject base tag for HTML\n    if (/\\.(html|htm)$/i.test(filename)) {\n      const baseDir = cleanPath\n        ? (this._isFilePath(cleanPath) ? cleanPath.replace(/[^/]+$/, \"\") : cleanPath)\n        : \"\";\n      const html = buf.toString(\"utf-8\");\n      if (!/<base\\b/i.test(html)) {\n        const baseTag = `<base href=\"${baseTagPrefix}${baseDir ? \"/\" + baseDir : \"\"}/\">`;\n        buf = Buffer.from(\n          html.includes(\"<head>\") ? html.replace(\"<head>\", `<head>${baseTag}`) : baseTag + html,\n          \"utf-8\"\n        );\n      }\n    }\n\n    return sendBufferWithRange(reply, buf, contentType, rangeHeader, {\n      \"Content-Disposition\": `inline; filename*=UTF-8''${encodeURIComponent(filename)}`,\n      \"Access-Control-Allow-Origin\": \"*\",\n    });\n  }\n\n  private async _serveFile(\n    address: ResourceAddress,\n    token: string,\n    subPath: string,\n    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    reply: FastifyReply,\n    rangeHeader: string | undefined,\n  ) {\n    const resourcePath = subPath\n      ? this._resolveSafeSubPath(address.resourcePath, subPath)\n      : address.resourcePath;\n    return this._resolveAndServe(\n      address.volume,\n      resourcePath,\n      reply,\n      `/s/${token}`,\n      sandboxConfig,\n      rangeHeader,\n    );\n  }\n\n  private async _execApi(\n    record: ShareRecord,\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    const basePath = this._isFilePath(record.address.resourcePath)\n      ? \"\"\n      : `${record.address.resourcePath}/`;\n    return this._execApiCore({\n      tenantId: record.tenantId,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n      assistantId: record.assistantId,\n      resourcePath: basePath + apiSubPath,\n      openGrants: record.openGrants,\n    }, apiSubPath, ext, request, reply);\n  }\n\n  private async _execApiCore(\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      assistantId?: string | null;\n      resourcePath: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    let sandbox: any;\n    try {\n      sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n        assistant_id: config.assistantId ?? \"\",\n        thread_id: \"\",\n        tenantId: config.tenantId,\n        workspaceId: config.workspaceId,\n        projectId: config.projectId,\n      });\n    } catch (err) {\n      this.deps.logger.error(\"[share] sandbox start failed for API\", { error: (err as Error).message });\n      return reply.status(502).send({ error: \"Sandbox unavailable\" });\n    }\n\n    const scriptPath = `/project/${config.resourcePath}`;\n    const cmd = ext === \"py\" ? `python3 ${scriptPath}` : `node ${scriptPath}`;\n\n    // Pass query params and body via environment\n    const queryStr = request.url.includes(\"?\") ? (request.url as string).split(\"?\")[1] : \"\";\n    const queryObj: Record<string, string> = {};\n    if (queryStr) {\n      for (const [k, v] of new URLSearchParams(queryStr)) {\n        queryObj[k] = v;\n      }\n    }\n\n    const bodyStr = (request.body as string) ?? \"\";\n\n    const envVars = [\n      `export API_QUERY='${JSON.stringify(queryObj).replace(/'/g, \"'\\\\''\")}'`,\n      `export API_BODY='${bodyStr.replace(/'/g, \"'\\\\''\")}'`,\n      `export API_METHOD='${request.method}'`,\n      `export API_GATEWAY_URL='${request.protocol}://${request.headers[\"x-forwarded-host\"] ?? request.headers.host ?? request.hostname}'`,\n      `export API_TENANT_ID='${config.tenantId}'`,\n      `export API_ASSISTANT_ID='${config.assistantId || \"\"}'`,\n      `export OPEN_API_TOKEN='${this._mintSandboxToken(sandbox.name, config)}'`,\n    ].join(\" && \");\n\n    const fullCmd = `${envVars} && ${cmd}`;\n\n    this.deps.logger.info(\"[api] exec\", { scriptPath, cmd: cmd.substring(0, 80) });\n\n    try {\n      const result = await sandbox.shell.execCommand({ command: fullCmd });\n      // Parse stdout as JSON\n      let data: unknown;\n      try {\n        data = JSON.parse(result.output?.trim() || \"{}\");\n      } catch {\n        data = { output: result.output?.trim() || \"\" };\n      }\n      return reply.status(200).type(\"application/json\").send(data);\n    } catch (err) {\n      this.deps.logger.warn(\"[api] exec failed\", { scriptPath, error: (err as Error).message });\n      return reply.status(500).send({ error: (err as Error).message });\n    }\n  }\n\n  private _resolveSafeSubPath(entryFile: string, subPath: string): string {\n    if (!subPath) return entryFile;\n    if (subPath.includes(\"..\")) throw new Error(\"Path traversal denied\");\n    if (subPath.startsWith(entryFile + \"/\") || subPath === entryFile) return subPath;\n    const entryDir = this._isFilePath(entryFile)\n      ? entryFile.replace(/[^/]+$/, \"\")\n      : entryFile + \"/\";\n    return (entryDir + subPath).replace(/\\/+/g, \"/\");\n  }\n\n  private _passwordPage(token: string): string {\n    return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class=\"card\"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id=\"f\"><input type=\"password\" id=\"p\" placeholder=\"Enter password\" required><button type=\"submit\">Unlock</button><div class=\"error\" id=\"e\">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;\n  }\n\n  private _mintSandboxToken(\n    sandboxName: string,\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n  ): string {\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const { signOpenToken } = require(\"../services/open/openToken\") as {\n      signOpenToken: (p: unknown) => string;\n    };\n    return signOpenToken({\n      kind: \"sandbox_token\",\n      tenantId: config.tenantId,\n      workspaceId: config.workspaceId,\n      projectId: config.projectId,\n      sandboxName,\n      grants: [\n        {\n          domain: \"sandbox\",\n          items: [\"files_read\", \"files_list\", \"files_write\", \"shell_exec\"],\n        },\n        ...sanitizeShareOpenGrants(config.openGrants),\n      ],\n    });\n  }\n}\n","/**\n * Sandbox-token grant sanitation.\n *\n * Sandbox tokens always carry the self-binding sandbox grant (resolved from\n * the credential's tenant/workspace/project). Shares may append extra\n * Open-door grants, but only within the V1 whitelist: read-only kb access.\n * Anything else is dropped server-side (the share creator cannot widen scope).\n */\n\nimport type { OpenGrant } from \"@axiom-lattice/protocols\";\n\n/** V1 allowlist: domain → permitted (read-only) actions. */\nconst ALLOWED: Record<string, string[]> = {\n  kb: [\"search\", \"entries_read\"],\n};\n\nexport function sanitizeShareOpenGrants(grants: OpenGrant[] | undefined): OpenGrant[] {\n  const out: OpenGrant[] = [];\n  for (const grant of grants ?? []) {\n    const allowed = ALLOWED[grant.domain];\n    if (!allowed) continue;\n    const items =\n      grant.items && grant.items.length > 0\n        ? grant.items.filter((item) => allowed.includes(item))\n        : allowed;\n    if (items.length > 0) out.push({ domain: grant.domain, items });\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;AAEA,OAAO,YAAY;AACnB;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OACK;;;ACGP,IAAM,UAAoC;AAAA,EACxC,IAAI,CAAC,UAAU,cAAc;AAC/B;AAEO,SAAS,wBAAwB,QAA8C;AACpF,QAAM,MAAmB,CAAC;AAC1B,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,UAAM,UAAU,QAAQ,MAAM,MAAM;AACpC,QAAI,CAAC,QAAS;AACd,UAAM,QACJ,MAAM,SAAS,MAAM,MAAM,SAAS,IAChC,MAAM,MAAM,OAAO,CAAC,SAAS,QAAQ,SAAS,IAAI,CAAC,IACnD;AACN,QAAI,MAAM,SAAS,EAAG,KAAI,KAAK,EAAE,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAAA,EAChE;AACA,SAAO;AACT;;;ADPO,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAAoB,MAA8B;AAA9B;AAAA,EAA+B;AAAA,EAEnD,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,cAAc,QAAQ,QAAQ,gBAAgB;AACpD,UAAM,YAAY,QAAQ,QAAQ,cAAc;AAChD,UAAM,OAAO,QAAQ;AAErB,QAAI,CAAC,eAAe,CAAC,WAAW;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC7F;AAEA,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAE5B,QAAI;AACF,YAAM,KAAK,KAAK,MAAM,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC;AAClD,WAAK,KAAK,OAAO;AAAA,QACf;AAAA,QACA,EAAE,OAAO,cAAc,KAAK,cAAc,gBAAgB,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,QAAQ,OAAO;AAAA,MACjI;AAAA,IACF,QAAQ;AACN,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAM,WAAW,SAAyB,OAAqB;AAC7D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,WAAW,UAAU,MAAgB;AAC1E,WAAO,MAAM,KAAK,OAAO,OAAO,CAAC,MAAY,EAAU,eAAe,UAAU,CAAC;AAAA,EACnF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,QAAQ,QAAQ;AAEtB,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,KAAK;AAEzC,QAAI,MAAM,SAAS;AACjB,WAAK,KAAK,MAAM,WAAW,KAAK;AAAA,IAClC;AAEA,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AAEJ,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AACrD,SAAK,KAAK,MAAM,WAAW,KAAK;AAEhC,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,gBAAgB,SAAyB,OAAqB;AAClE,UAAM,SAAS,QAAQ;AACvB,UAAM,EAAE,MAAM,IAAI;AAClB,UAAM,UAAU,OAAO,GAAG,KAAK;AAE/B,SAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,QAAQ,CAAC;AAEjE,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAMA,UAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,UAAI,CAACA,WAAUA,QAAO,QAAS,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AACxE,UAAIA,QAAO,aAAa,IAAI,KAAKA,QAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,MACzC;AAEA,UAAI,CAAC,KAAK,mBAAmB,OAAO,GAAG;AACrC,YAAIA,QAAO,eAAe,YAAY;AACpC,iBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,QACjE;AACA,YAAIA,QAAO,eAAe,YAAY;AACpC,cAAI,CAAC,KAAK,YAAY,SAAS,KAAK,GAAG;AACrC,mBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,UAC9D;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,SAASA,SAAQ,SAAS,KAAK,SAAS,KAAK;AAAA,IAC3D;AAGA,UAAM,SAAS,KAAK,KAAK,MAAM,IAAI,KAAK;AACxC,QAAI,UAAU,CAAC,OAAO,gBAAgB;AACpC,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,cAAc,OAAO,QAAQ,aAAa,CAAC;AAC9H,aAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,iBAAiB,EAAE,UAAU,WAAW,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,GAAG,OAAO,QAAQ,QAAQ,KAAK;AAAA,IACzL;AACA,SAAK,KAAK,OAAO,KAAK,mCAAmC,EAAE,MAAM,CAAC;AAGlE,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,WAAK,KAAK,OAAO,KAAK,sCAAsC,EAAE,OAAO,OAAO,CAAC,CAAC,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AAChH,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AAAA,IAC3C;AACA,QAAI,OAAO,aAAa,IAAI,KAAK,OAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,WAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,WAAW,OAAO,UAAU,CAAC;AACrF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,IACzC;AAEA,SAAK,KAAK,OAAO,KAAK,wBAAwB;AAAA,MAC5C;AAAA,MACA,QAAQ,OAAO,QAAQ;AAAA,MACvB,cAAc,OAAO,QAAQ;AAAA,MAC7B,YAAY,OAAO;AAAA,MACnB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,IACpB,CAAC;AAGD,UAAM,aAAa,KAAK,mBAAmB,OAAO;AAClD,QAAI,CAAC,YAAY;AAEf,UAAI,OAAO,eAAe,YAAY;AACpC,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MACjE;AACA,UAAI,OAAO,eAAe,YAAY;AACpC,cAAM,WAAW,KAAK,YAAY,SAAS,KAAK;AAChD,YAAI,CAAC,UAAU;AACb,eAAK,KAAK,OAAO,KAAK,uDAAuD,EAAE,MAAM,CAAC;AACtF,eAAK,KAAK,MAAM,IAAI,OAAO;AAAA,YACzB,SAAS,OAAO;AAAA,YAChB,gBAAgB;AAAA,YAChB,eAAe,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AAAA,UAC5I,CAAC;AACD,iBAAO,MAAM,KAAK,WAAW,EAAE,KAAK,KAAK,cAAc,KAAK,CAAC;AAAA,QAC/D;AACA,aAAK,KAAK,OAAO,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,MAAM;AAC7B,YAAM,KAAK,MAAM,KAAK,KAAK,MAAM,sBAAsB,KAAK;AAC5D,UAAI,CAAC,GAAI,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,sBAAsB;AAAA,IAC/D,OAAO;AACL,WAAK,KAAK,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACvD;AAGA,UAAM,gBAAgB,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AACjJ,SAAK,KAAK,MAAM,IAAI,OAAO;AAAA,MACzB,SAAS,OAAO;AAAA,MAChB,gBAAgB,OAAO,eAAe,cAAc,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAED,WAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,eAAe,OAAO,QAAQ,QAAQ,KAAK;AAAA,EACpG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,SAAyB,OAAqB;AACpE,UAAM,SAAS,QAAQ;AACvB,UAAM,WAAW,OAAO;AACxB,UAAM,cAAc,OAAO;AAC3B,UAAM,YAAY,OAAO;AACzB,UAAM,UAAW,OAAO,GAAG,KAAK;AAEhC,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,aAAa;AAAA,QACvB;AAAA,QAAU;AAAA,QAAa;AAAA,QAAW,aAAa;AAAA,QAC/C,cAAc;AAAA,MAChB,GAAG,SAAS,KAAK,SAAS,KAAK;AAAA,IACjC;AAEA,UAAM,SAAS,qBAAqB,KAAK,WAAW,UAAU,aAAa,SAAS;AACpF,WAAO,KAAK;AAAA,MAAiB;AAAA,MAAQ;AAAA,MAAS;AAAA,MAAO,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS;AAAA,MAC7F,EAAE,UAAU,aAAa,WAAW,aAAa,KAAK;AAAA,MACtD,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,CAAC,OAAO,cAAc;AACnC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,QAAQ,MAAM,OAAO,QAAQ,UAAU,OAAO,YAAa;AACjE,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAEA,UAAM,aAAa;AAAA,MACjB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,iBAAW,KAAK,QAAQ;AAAA,IAC1B;AACA,UAAM,OAAO,cAAc,WAAW,KAAK,IAAI,CAAC;AAChD,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEQ,mBAAmB,SAAkC;AAC3D,UAAM,OAAQ,QAAgB;AAC9B,QAAI,QAAQ,KAAK,GAAI,QAAO;AAE5B,UAAM,SAAS,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AACzD,QAAI,QAAQ;AACV,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,MAAM;AACnC,YAAI,aAAa,QAAQ,SAAU,QAAO;AAAA,MAC5C,QAAQ;AAAA,MAAkB;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,YAAY,SAAyB,OAAwB;AACnE,UAAM,SAAS,QAAQ,QAAQ,UAAU;AACzC,WAAO,OAAO,SAAS,gBAAgB,KAAK,IAAI;AAAA,EAClD;AAAA;AAAA,EAGQ,YAAY,MAAuB;AACzC,WAAO,kBAAkB,KAAK,IAAI;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBACZ,QACA,cACA,OACA,eACA,eACA,aACA;AACA,UAAM,YAAY,aAAa,QAAQ,QAAQ,EAAE;AACjD,UAAM,YAAY,CAAC,YACf,eACA,KAAK,YAAY,SAAS,IACxB,YACA,GAAG,SAAS;AAElB,UAAM,UAA2B,EAAE,QAAQ,cAAc,GAAG;AAE5D,QAAI;AACJ,QAAI;AAEF,YAAM,WAAW,KAAK,KAAK,eAAe,mBAAmB;AAC7D,YAAM,MAAM,SAAS,oBAAoB,EAAE,QAAQ,EAAE,GAAG,SAAS,cAAc,UAAU,CAAC;AAAA,IAC5F,QAAQ;AAEN,UAAI,CAAC,cAAe,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAClE,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,UAClE,cAAc,cAAc,eAAe;AAAA,UAC3C,WAAW;AAAA,UACX,UAAU,cAAc;AAAA,UACxB,aAAa,cAAc;AAAA,UAC3B,WAAW,cAAc;AAAA,QAC3B,CAAC;AACD,cAAM,MAAM,QAAQ,KAAK,aAAa,EAAE,MAAM,YAAY,SAAS,GAAG,CAAC;AAAA,MACzE,QAAQ;AACN,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAAA,MAChD;AAAA,IACF;AAEA,UAAM,WAAW,UAAU,MAAM,GAAG,EAAE,IAAI,KAAK;AAC/C,UAAM,cAAc,2BAA2B,QAAQ;AAGvD,QAAI,iBAAiB,KAAK,QAAQ,GAAG;AACnC,YAAM,UAAU,YACX,KAAK,YAAY,SAAS,IAAI,UAAU,QAAQ,UAAU,EAAE,IAAI,YACjE;AACJ,YAAM,OAAO,IAAI,SAAS,OAAO;AACjC,UAAI,CAAC,WAAW,KAAK,IAAI,GAAG;AAC1B,cAAM,UAAU,eAAe,aAAa,GAAG,UAAU,MAAM,UAAU,EAAE;AAC3E,cAAM,OAAO;AAAA,UACX,KAAK,SAAS,QAAQ,IAAI,KAAK,QAAQ,UAAU,SAAS,OAAO,EAAE,IAAI,UAAU;AAAA,UACjF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,oBAAoB,OAAO,KAAK,aAAa,aAAa;AAAA,MAC/D,uBAAuB,4BAA4B,mBAAmB,QAAQ,CAAC;AAAA,MAC/E,+BAA+B;AAAA,IACjC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,SACA,OACA,SACA,eACA,OACA,aACA;AACA,UAAM,eAAe,UACjB,KAAK,oBAAoB,QAAQ,cAAc,OAAO,IACtD,QAAQ;AACZ,WAAO,KAAK;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,SACZ,QACA,YACA,KACA,SACA,OACA;AACA,UAAM,WAAW,KAAK,YAAY,OAAO,QAAQ,YAAY,IACzD,KACA,GAAG,OAAO,QAAQ,YAAY;AAClC,WAAO,KAAK,aAAa;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,cAAc,WAAW;AAAA,MACzB,YAAY,OAAO;AAAA,IACrB,GAAG,YAAY,KAAK,SAAS,KAAK;AAAA,EACpC;AAAA,EAEA,MAAc,aACZ,QAQA,YACA,KACA,SACA,OACA;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,QAC5D,cAAc,OAAO,eAAe;AAAA,QACpC,WAAW;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,MAAM,wCAAwC,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAChG,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAA,IAChE;AAEA,UAAM,aAAa,YAAY,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,OAAO,WAAW,UAAU,KAAK,QAAQ,UAAU;AAGvE,UAAM,WAAW,QAAQ,IAAI,SAAS,GAAG,IAAK,QAAQ,IAAe,MAAM,GAAG,EAAE,CAAC,IAAI;AACrF,UAAM,WAAmC,CAAC;AAC1C,QAAI,UAAU;AACZ,iBAAW,CAAC,GAAG,CAAC,KAAK,IAAI,gBAAgB,QAAQ,GAAG;AAClD,iBAAS,CAAC,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,UAAW,QAAQ,QAAmB;AAE5C,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK,UAAU,QAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,MACpE,oBAAoB,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAAA,MAClD,sBAAsB,QAAQ,MAAM;AAAA,MACpC,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,kBAAkB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,MAChI,yBAAyB,OAAO,QAAQ;AAAA,MACxC,4BAA4B,OAAO,eAAe,EAAE;AAAA,MACpD,0BAA0B,KAAK,kBAAkB,QAAQ,MAAM,MAAM,CAAC;AAAA,IACxE,EAAE,KAAK,MAAM;AAEb,UAAM,UAAU,GAAG,OAAO,OAAO,GAAG;AAEpC,SAAK,KAAK,OAAO,KAAK,cAAc,EAAE,YAAY,KAAK,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;AAE7E,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,MAAM,YAAY,EAAE,SAAS,QAAQ,CAAC;AAEnE,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,KAAK,IAAI;AAAA,MACjD,QAAQ;AACN,eAAO,EAAE,QAAQ,OAAO,QAAQ,KAAK,KAAK,GAAG;AAAA,MAC/C;AACA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,kBAAkB,EAAE,KAAK,IAAI;AAAA,IAC7D,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,YAAY,OAAQ,IAAc,QAAQ,CAAC;AACxF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,oBAAoB,WAAmB,SAAyB;AACtE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACnE,QAAI,QAAQ,WAAW,YAAY,GAAG,KAAK,YAAY,UAAW,QAAO;AACzE,UAAM,WAAW,KAAK,YAAY,SAAS,IACvC,UAAU,QAAQ,UAAU,EAAE,IAC9B,YAAY;AAChB,YAAQ,WAAW,SAAS,QAAQ,QAAQ,GAAG;AAAA,EACjD;AAAA,EAEQ,cAAc,OAAuB;AAC3C,WAAO,8tCAA8tC,KAAK;AAAA,EAC5uC;AAAA,EAEQ,kBACN,aACA,QAMQ;AAER,UAAM,EAAE,cAAc,IAAI;AAG1B,WAAO,cAAc;AAAA,MACnB,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,OAAO,CAAC,cAAc,cAAc,eAAe,YAAY;AAAA,QACjE;AAAA,QACA,GAAG,wBAAwB,OAAO,UAAU;AAAA,MAC9C;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":["record"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/gateway",
-  "version": "4.2.1",
+  "version": "4.2.3",
   "main": "dist/index.js",
   "files": [
     "dist"
@@ -46,12 +46,13 @@
     "redis": "^5.0.1",
     "tar": "^7.5.22",
     "uuid": "^9.0.1",
+    "web-push": "^3.6.7",
     "zod": "3.25.76",
-    "@axiom-lattice/cli-a2a": "0.2.7",
-    "@axiom-lattice/core": "4.2.9",
-    "@axiom-lattice/pg-stores": "3.1.9",
-    "@axiom-lattice/protocols": "4.2.1",
-    "@axiom-lattice/queue-redis": "1.1.7"
+    "@axiom-lattice/cli-a2a": "0.2.8",
+    "@axiom-lattice/core": "4.2.11",
+    "@axiom-lattice/pg-stores": "3.1.11",
+    "@axiom-lattice/protocols": "4.2.2",
+    "@axiom-lattice/queue-redis": "1.1.8"
   },
   "devDependencies": {
     "@types/bcrypt": "^6.0.0",
@@ -61,6 +62,7 @@
     "@types/node": "^20.19.13",
     "@types/pg": "^8.11.0",
     "@types/uuid": "^9.0.8",
+    "@types/web-push": "^3.6.4",
     "@types/ws": "^8.18.1",
     "@typescript-eslint/eslint-plugin": "^7.2.0",
     "@typescript-eslint/parser": "^7.2.0",
@@ -72,7 +74,7 @@
     "tsconfig-paths": "^4.2.0",
     "tsup": "^8.5.0",
     "typescript": "^5.8.2",
-    "@axiom-lattice/react-sdk": "4.1.0"
+    "@axiom-lattice/react-sdk": "4.1.3"
   },
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean --sourcemap && pnpm copy:embed-assets",

package/dist/chunk-J4BK77PA.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/services/workspace-file-service.ts","../src/utils/path-containment.ts","../src/services/files/task-file-refs.ts"],"sourcesContent":["import * as fs from \"fs/promises\";\nimport * as path from \"path\";\nimport { getStoreLattice, getSandBoxManager } from \"@axiom-lattice/core\";\nimport { isPathWithinRoot } from \"../utils/path-containment\";\n\n/** Binary file extensions handled as raw bytes rather than UTF-8 text. */\nconst BINARY_EXTENSIONS = new Set([\n  \"pdf\", \"xlsx\", \"xls\", \"docx\", \"doc\", \"pptx\", \"ppt\",\n  \"png\", \"jpg\", \"jpeg\", \"gif\", \"bmp\", \"ico\", \"webp\",\n  \"mp3\", \"mp4\", \"webm\", \"ogg\", \"wav\", \"avi\", \"mov\",\n  \"zip\", \"tar\", \"gz\", \"rar\", \"7z\",\n]);\n\n/**\n * Whether a filename denotes a binary (non-UTF-8) payload, used to choose the\n * raw-bytes write path in sandbox volume backends.\n */\nexport function isBinaryContentType(filename: string): boolean {\n  const ext = filename.split(\".\").pop()?.toLowerCase() || \"\";\n  return BINARY_EXTENSIONS.has(ext);\n}\n\n/**\n * Filesystem root directory for a project, mirroring the layout used by the\n * workspace file backend (`/lattice_store/tenants/:tenant/workspaces/:ws/:project`).\n */\nexport function filesystemRootDirectory(\n  tenantId: string,\n  workspaceId: string,\n  projectId: string,\n): string {\n  return `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`;\n}\n\n/** Raised when a file write request is rejected for path/name safety reasons. */\nexport class ProjectFileValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ProjectFileValidationError\";\n  }\n}\n\n/** Parameters for writing a file into a project's workspace storage. */\nexport interface SaveProjectFileParams {\n  tenantId: string;\n  projectId: string;\n  /**\n   * Pre-resolved workspace id. When omitted it is derived from the project via\n   * the project store (needed by callers that only know the project, e.g. A2A).\n   */\n  workspaceId?: string;\n  name: string;\n  bytes: Uint8Array;\n  mimeType?: string;\n  /** Relative subdirectory under the project root; sandbox defaults to `/project/uploads`. */\n  path?: string;\n  assistantId?: string;\n}\n\n/** Result of a successful project-file write. */\nexport interface SavedProjectFile {\n  /** Storage path usable as a `TaskFileRef.uri` (e.g. `/project/uploads/a.pdf`). */\n  uri: string;\n  name: string;\n  size: number;\n}\n\n/**\n * Persist file bytes into a project's workspace storage and return a URI to it.\n *\n * Supports both sandbox-backed workspaces (delegating to the sandbox/volume\n * upload API) and filesystem-backed workspaces (writing under the project root).\n * The returned URI is the storage path agents reference via {@link TaskFileRef}.\n */\nexport async function saveProjectFile(\n  params: SaveProjectFileParams,\n): Promise<SavedProjectFile> {\n  const workspaceStore = getStoreLattice(\"default\", \"workspace\").store;\n  const projectStore = getStoreLattice(\"default\", \"project\").store;\n\n  let workspaceId = params.workspaceId;\n  if (!workspaceId) {\n    const project = await projectStore.getProjectById(\n      params.tenantId,\n      params.projectId,\n    );\n    if (!project) {\n      throw new Error(\"Project not found\");\n    }\n    workspaceId = project.workspaceId;\n  }\n\n  const workspace = await workspaceStore.getWorkspaceById(\n    params.tenantId,\n    workspaceId,\n  );\n  if (!workspace) {\n    throw new Error(\"Workspace not found\");\n  }\n\n  const buffer = Buffer.from(params.bytes);\n  const filename = params.name || \"file\";\n  const pathValue = params.path;\n\n  // Validate the untrusted filename before any path join or disk I/O, equally\n  // for sandbox and filesystem branches: reject anything that is not a bare\n  // basename on either path flavor (blocks \"../../etc/passwd\", \"a\\\\b\", \"..\").\n  if (\n    path.basename(filename) !== filename ||\n    path.posix.basename(filename) !== filename ||\n    filename === \"..\"\n  ) {\n    throw new ProjectFileValidationError(\"Invalid filename\");\n  }\n\n  if (workspace.storageType === \"sandbox\") {\n    const sandboxManager = getSandBoxManager();\n    const volumeConfig = {\n      assistant_id: params.assistantId || \"\",\n      thread_id: \"\",\n      tenantId: params.tenantId,\n      workspaceId,\n      projectId: params.projectId,\n    };\n\n    const relativePath = pathValue\n      ? path.posix.join(pathValue, filename)\n      : path.posix.join(\"/project/uploads\", filename);\n\n    const isBinary = isBinaryContentType(filename);\n    const volumeBackend = await sandboxManager.getVolumeBackendForPath(\n      volumeConfig,\n      relativePath,\n    );\n    if (volumeBackend && !isBinary) {\n      await volumeBackend.write(relativePath, buffer.toString(\"utf-8\"));\n    } else if (volumeBackend && volumeBackend.writeBinary) {\n      await volumeBackend.writeBinary(relativePath, buffer);\n    } else {\n      const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);\n      await sandbox.file.uploadFile({ file: relativePath, data: buffer });\n    }\n\n    return { uri: relativePath, name: filename, size: buffer.length };\n  }\n\n  const rootDir = filesystemRootDirectory(\n    params.tenantId,\n    workspaceId,\n    params.projectId,\n  );\n  await fs.mkdir(rootDir, { recursive: true });\n  const relativeDirectory = pathValue?.replace(/^[/\\\\]+/, \"\") || \".\";\n  const targetDir = path.resolve(rootDir, relativeDirectory);\n  if (!isPathWithinRoot(path.resolve(rootDir), targetDir)) {\n    throw new ProjectFileValidationError(\n      \"Upload path must stay within the project directory\",\n    );\n  }\n  await fs.mkdir(targetDir, { recursive: true });\n\n  const [resolvedRoot, resolvedTargetDir] = await Promise.all([\n    fs.realpath(rootDir),\n    fs.realpath(targetDir),\n  ]);\n  if (!isPathWithinRoot(resolvedRoot, resolvedTargetDir)) {\n    throw new ProjectFileValidationError(\n      \"Upload path must stay within the project directory\",\n    );\n  }\n\n  const targetPath = path.join(resolvedTargetDir, filename);\n  await fs.writeFile(targetPath, buffer);\n  const stat = await fs.stat(targetPath);\n\n  const uri = path.posix.join(\"/\", relativeDirectory, filename);\n  return { uri, name: filename, size: stat.size };\n}\n","import * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nexport class PathOutsideRootError extends Error {\n  constructor(\n    public readonly rootPath: string,\n    public readonly targetPath: string,\n  ) {\n    super(`Path is outside the allowed root: ${targetPath}`);\n    this.name = \"PathOutsideRootError\";\n  }\n}\n\nexport function isPathWithinRoot(rootPath: string, targetPath: string): boolean {\n  const relative = path.relative(rootPath, targetPath);\n  return (\n    relative === \"\" ||\n    (relative !== \"..\" &&\n      !relative.startsWith(`..${path.sep}`) &&\n      !path.isAbsolute(relative))\n  );\n}\n\nexport async function resolvePathWithinRoot(\n  rootPath: string,\n  targetPath: string,\n): Promise<{ rootPath: string; targetPath: string }> {\n  const [resolvedRoot, resolvedTarget] = await Promise.all([\n    fs.realpath(rootPath),\n    fs.realpath(targetPath),\n  ]);\n\n  if (!isPathWithinRoot(resolvedRoot, resolvedTarget)) {\n    throw new PathOutsideRootError(resolvedRoot, resolvedTarget);\n  }\n\n  return { rootPath: resolvedRoot, targetPath: resolvedTarget };\n}\n","import type { TaskFileRef } from \"@axiom-lattice/protocols\";\n\n/** Render task file references for Agent-visible message text. */\nexport function formatFileRefsSection(refs: TaskFileRef[]): string {\n  const lines = refs.map((ref) => {\n    const label = ref.name ?? ref.uri;\n    const mime = ref.mimeType ? ` (${ref.mimeType})` : \"\";\n    return `- ${label}${mime}: ${ref.uri}`;\n  });\n  return [\"[附件]\", ...lines].join(\"\\n\");\n}\n"],"mappings":";AAAA,YAAYA,SAAQ;AACpB,YAAYC,WAAU;AACtB,SAAS,iBAAiB,yBAAyB;;;ACFnD,YAAY,QAAQ;AACpB,YAAY,UAAU;AAEf,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YACkB,UACA,YAChB;AACA,UAAM,qCAAqC,UAAU,EAAE;AAHvC;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,iBAAiB,UAAkB,YAA6B;AAC9E,QAAMC,YAAgB,cAAS,UAAU,UAAU;AACnD,SACEA,cAAa,MACZA,cAAa,QACZ,CAACA,UAAS,WAAW,KAAU,QAAG,EAAE,KACpC,CAAM,gBAAWA,SAAQ;AAE/B;AAEA,eAAsB,sBACpB,UACA,YACmD;AACnD,QAAM,CAAC,cAAc,cAAc,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpD,YAAS,QAAQ;AAAA,IACjB,YAAS,UAAU;AAAA,EACxB,CAAC;AAED,MAAI,CAAC,iBAAiB,cAAc,cAAc,GAAG;AACnD,UAAM,IAAI,qBAAqB,cAAc,cAAc;AAAA,EAC7D;AAEA,SAAO,EAAE,UAAU,cAAc,YAAY,eAAe;AAC9D;;;AD/BA,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAC7C;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAC3C;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAC3C;AAAA,EAAO;AAAA,EAAO;AAAA,EAAM;AAAA,EAAO;AAC7B,CAAC;AAMM,SAAS,oBAAoB,UAA2B;AAC7D,QAAM,MAAM,SAAS,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACxD,SAAO,kBAAkB,IAAI,GAAG;AAClC;AAMO,SAAS,wBACd,UACA,aACA,WACQ;AACR,SAAO,0BAA0B,QAAQ,eAAe,WAAW,IAAI,SAAS;AAClF;AAGO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAkCA,eAAsB,gBACpB,QAC2B;AAC3B,QAAM,iBAAiB,gBAAgB,WAAW,WAAW,EAAE;AAC/D,QAAM,eAAe,gBAAgB,WAAW,SAAS,EAAE;AAE3D,MAAI,cAAc,OAAO;AACzB,MAAI,CAAC,aAAa;AAChB,UAAM,UAAU,MAAM,aAAa;AAAA,MACjC,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,mBAAmB;AAAA,IACrC;AACA,kBAAc,QAAQ;AAAA,EACxB;AAEA,QAAM,YAAY,MAAM,eAAe;AAAA,IACrC,OAAO;AAAA,IACP;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,QAAM,SAAS,OAAO,KAAK,OAAO,KAAK;AACvC,QAAM,WAAW,OAAO,QAAQ;AAChC,QAAM,YAAY,OAAO;AAKzB,MACO,eAAS,QAAQ,MAAM,YACvB,YAAM,SAAS,QAAQ,MAAM,YAClC,aAAa,MACb;AACA,UAAM,IAAI,2BAA2B,kBAAkB;AAAA,EACzD;AAEA,MAAI,UAAU,gBAAgB,WAAW;AACvC,UAAM,iBAAiB,kBAAkB;AACzC,UAAM,eAAe;AAAA,MACnB,cAAc,OAAO,eAAe;AAAA,MACpC,WAAW;AAAA,MACX,UAAU,OAAO;AAAA,MACjB;AAAA,MACA,WAAW,OAAO;AAAA,IACpB;AAEA,UAAM,eAAe,YACZ,YAAM,KAAK,WAAW,QAAQ,IAC9B,YAAM,KAAK,oBAAoB,QAAQ;AAEhD,UAAM,WAAW,oBAAoB,QAAQ;AAC7C,UAAM,gBAAgB,MAAM,eAAe;AAAA,MACzC;AAAA,MACA;AAAA,IACF;AACA,QAAI,iBAAiB,CAAC,UAAU;AAC9B,YAAM,cAAc,MAAM,cAAc,OAAO,SAAS,OAAO,CAAC;AAAA,IAClE,WAAW,iBAAiB,cAAc,aAAa;AACrD,YAAM,cAAc,YAAY,cAAc,MAAM;AAAA,IACtD,OAAO;AACL,YAAM,UAAU,MAAM,eAAe,qBAAqB,YAAY;AACtE,YAAM,QAAQ,KAAK,WAAW,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,IACpE;AAEA,WAAO,EAAE,KAAK,cAAc,MAAM,UAAU,MAAM,OAAO,OAAO;AAAA,EAClE;AAEA,QAAM,UAAU;AAAA,IACd,OAAO;AAAA,IACP;AAAA,IACA,OAAO;AAAA,EACT;AACA,QAAS,UAAM,SAAS,EAAE,WAAW,KAAK,CAAC;AAC3C,QAAM,oBAAoB,WAAW,QAAQ,WAAW,EAAE,KAAK;AAC/D,QAAM,YAAiB,cAAQ,SAAS,iBAAiB;AACzD,MAAI,CAAC,iBAAsB,cAAQ,OAAO,GAAG,SAAS,GAAG;AACvD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAS,UAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAE7C,QAAM,CAAC,cAAc,iBAAiB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACvD,aAAS,OAAO;AAAA,IAChB,aAAS,SAAS;AAAA,EACvB,CAAC;AACD,MAAI,CAAC,iBAAiB,cAAc,iBAAiB,GAAG;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAkB,WAAK,mBAAmB,QAAQ;AACxD,QAAS,cAAU,YAAY,MAAM;AACrC,QAAMC,QAAO,MAAS,SAAK,UAAU;AAErC,QAAM,MAAW,YAAM,KAAK,KAAK,mBAAmB,QAAQ;AAC5D,SAAO,EAAE,KAAK,MAAM,UAAU,MAAMA,MAAK,KAAK;AAChD;;;AE9KO,SAAS,sBAAsB,MAA6B;AACjE,QAAM,QAAQ,KAAK,IAAI,CAAC,QAAQ;AAC9B,UAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,UAAM,OAAO,IAAI,WAAW,KAAK,IAAI,QAAQ,MAAM;AACnD,WAAO,KAAK,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG;AAAA,EACtC,CAAC;AACD,SAAO,CAAC,kBAAQ,GAAG,KAAK,EAAE,KAAK,IAAI;AACrC;","names":["fs","path","relative","stat"]}

package/dist/chunk-LHQY46YB.mjs

@@ -1,47 +0,0 @@
-// src/utils/mime.ts
-var EXT_TO_MIME = {
-  ".txt": "text/plain",
-  ".md": "text/markdown",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".mjs": "application/javascript",
-  ".json": "application/json",
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".ico": "image/x-icon",
-  ".zip": "application/zip",
-  ".csv": "text/csv",
-  ".xml": "application/xml",
-  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  ".xls": "application/vnd.ms-excel",
-  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  ".ppt": "application/vnd.ms-powerpoint",
-  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  ".doc": "application/msword",
-  ".mp4": "video/mp4",
-  ".webm": "video/webm",
-  ".mp3": "audio/mpeg",
-  ".wav": "audio/wav",
-  ".ogg": "audio/ogg"
-};
-function getContentTypeFromFilename(filename) {
-  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
-  return EXT_TO_MIME[ext] ?? "application/octet-stream";
-}
-function getFilenameFromPath(path) {
-  const segments = path.replace(/\/+$/, "").split("/");
-  return segments[segments.length - 1] || "download";
-}
-
-export {
-  getContentTypeFromFilename,
-  getFilenameFromPath
-};
-//# sourceMappingURL=chunk-LHQY46YB.mjs.map

package/dist/chunk-LHQY46YB.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/mime.ts"],"sourcesContent":["const EXT_TO_MIME: Record<string, string> = {\n  \".txt\": \"text/plain\",\n  \".md\": \"text/markdown\",\n  \".html\": \"text/html\",\n  \".htm\": \"text/html\",\n  \".css\": \"text/css\",\n  \".js\": \"application/javascript\",\n  \".mjs\": \"application/javascript\",\n  \".json\": \"application/json\",\n  \".pdf\": \"application/pdf\",\n  \".png\": \"image/png\",\n  \".jpg\": \"image/jpeg\",\n  \".jpeg\": \"image/jpeg\",\n  \".gif\": \"image/gif\",\n  \".webp\": \"image/webp\",\n  \".svg\": \"image/svg+xml\",\n  \".ico\": \"image/x-icon\",\n  \".zip\": \"application/zip\",\n  \".csv\": \"text/csv\",\n  \".xml\": \"application/xml\",\n  \".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n  \".xls\": \"application/vnd.ms-excel\",\n  \".pptx\": \"application/vnd.openxmlformats-officedocument.presentationml.presentation\",\n  \".ppt\": \"application/vnd.ms-powerpoint\",\n  \".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n  \".doc\": \"application/msword\",\n  \".mp4\": \"video/mp4\",\n  \".webm\": \"video/webm\",\n  \".mp3\": \"audio/mpeg\",\n  \".wav\": \"audio/wav\",\n  \".ogg\": \"audio/ogg\",\n};\n\nexport function getContentTypeFromFilename(filename: string): string {\n  const ext = filename.includes(\".\")\n    ? filename.slice(filename.lastIndexOf(\".\")).toLowerCase()\n    : \"\";\n  return EXT_TO_MIME[ext] ?? \"application/octet-stream\";\n}\n\nexport function getFilenameFromPath(path: string): string {\n  const segments = path.replace(/\\/+$/, \"\").split(\"/\");\n  return segments[segments.length - 1] || \"download\";\n}\n"],"mappings":";AAAA,IAAM,cAAsC;AAAA,EAC1C,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,2BAA2B,UAA0B;AACnE,QAAM,MAAM,SAAS,SAAS,GAAG,IAC7B,SAAS,MAAM,SAAS,YAAY,GAAG,CAAC,EAAE,YAAY,IACtD;AACJ,SAAO,YAAY,GAAG,KAAK;AAC7B;AAEO,SAAS,oBAAoB,MAAsB;AACxD,QAAM,WAAW,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG;AACnD,SAAO,SAAS,SAAS,SAAS,CAAC,KAAK;AAC1C;","names":[]}

package/dist/resources-SRQRKW5G.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/controllers/resources.ts","../src/services/open/sandboxGrants.ts"],"sourcesContent":["import { FastifyRequest, FastifyReply } from \"fastify\";\nimport type { ResourceAddress, ShareRecord, SharedResourceStore } from \"@axiom-lattice/protocols\";\nimport bcrypt from \"bcryptjs\";\nimport {\n  generateToken,\n  createSharePayload,\n  TokenCache,\n  SandboxLatticeManager,\n  buildNamedVolumeName,\n} from \"@axiom-lattice/core\";\nimport { getContentTypeFromFilename } from \"../utils/mime\";\nimport { sanitizeShareOpenGrants } from \"../services/open/sandboxGrants\";\n\ninterface ResourceControllerDeps {\n  store: SharedResourceStore;\n  sandboxManager: SandboxLatticeManager;\n  cache: TokenCache;\n  logger: { info: (msg: string, obj?: object) => void; warn: (msg: string, obj?: object) => void; error: (msg: string, obj?: object) => void };\n}\n\nexport class ResourceController {\n  constructor(private deps: ResourceControllerDeps) {}\n\n  async createShare(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const workspaceId = request.headers[\"x-workspace-id\"] as string;\n    const projectId = request.headers[\"x-project-id\"] as string;\n    const body = request.body as any;\n\n    if (!workspaceId || !projectId) {\n      return reply.status(400).send({ error: \"x-workspace-id and x-project-id headers required\" });\n    }\n\n    const payload = createSharePayload(\n      tenantId,\n      workspaceId,\n      projectId,\n      userId as string,\n      body,\n    );\n    const token = generateToken();\n\n    try {\n      await this.deps.store.create({ ...payload, token });\n      this.deps.logger.info(\n        \"[share] created\",\n        { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId },\n      );\n    } catch {\n      return reply.status(500).send({ error: \"Failed to create share\" });\n    }\n\n    return reply.status(201).send({ token, url: `/s/${token}` });\n  }\n\n  async listShares(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const shares = await this.deps.store.listByUser(tenantId, userId as string);\n    return reply.send(shares.filter((r: any) => (r as any).visibility !== \"internal\"));\n  }\n\n  async updateShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const patch = request.body as any;\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, patch);\n\n    if (patch.revoked) {\n      this.deps.cache.invalidate(token);\n    }\n\n    return reply.send({ ok: true });\n  }\n\n  async revokeShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, { revoked: true });\n    this.deps.cache.invalidate(token);\n\n    return reply.send({ ok: true });\n  }\n\n  async resolveResource(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { token: string; \"*\"?: string };\n    const { token } = params;\n    const subPath = params[\"*\"] ?? \"\";\n\n    this.deps.logger.info(\"[share] resolve start\", { token, subPath });\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime — proxy to sandbox. Detected by /api/ anywhere in subPath.\n    if (isApi) {\n      const record = await this.deps.store.findByToken(token);\n      if (!record || record.revoked) return reply.status(404).send(\"Not found\");\n      if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n        return reply.status(410).send(\"Expired\");\n      }\n      // Auth check for API calls (same as file access)\n      if (!this._isInternalRequest(request)) {\n        if (record.visibility === \"internal\") {\n          return reply.status(401).send({ error: \"Internal access only\" });\n        }\n        if (record.visibility === \"password\") {\n          if (!this._isUnlocked(request, token)) {\n            return reply.status(401).send({ error: \"Password required\" });\n          }\n        }\n      }\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApi(record, subPath, ext, request, reply);\n    }\n\n    // 1. Check cache\n    const cached = this.deps.cache.get(token);\n    if (cached && !cached.requiresUnlock) {\n      this.deps.logger.info(\"[share] cache hit\", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });\n      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: \"default\", workspaceId: \"\", projectId: \"\", assistantId: null }, reply);\n    }\n    this.deps.logger.info(\"[share] cache miss, querying DB\", { token });\n\n    // 2. Single DB lookup\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.revoked) {\n      this.deps.logger.warn(\"[share] token not found or revoked\", { token, found: !!record, revoked: record?.revoked });\n      return reply.status(404).send(\"Not found\");\n    }\n    if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n      this.deps.logger.info(\"[share] token expired\", { token, expiresAt: record.expiresAt });\n      return reply.status(410).send(\"Expired\");\n    }\n\n    this.deps.logger.info(\"[share] record found\", {\n      token,\n      volume: record.address.volume,\n      resourcePath: record.address.resourcePath,\n      visibility: record.visibility,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n    });\n\n    // 3. Auth\n    const isInternal = this._isInternalRequest(request);\n    if (!isInternal) {\n      // Internal shares: must be logged in\n      if (record.visibility === \"internal\") {\n        return reply.status(401).send({ error: \"Internal access only\" });\n      }\n      if (record.visibility === \"password\") {\n        const unlocked = this._isUnlocked(request, token);\n        if (!unlocked) {\n          this.deps.logger.info(\"[share] password protected, returning password page\", { token });\n          this.deps.cache.set(token, {\n            address: record.address,\n            requiresUnlock: true,\n            sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId },\n          });\n          return reply.type(\"text/html\").send(this._passwordPage(token));\n        }\n        this.deps.logger.info(\"[share] password unlocked\", { token });\n      }\n    }\n\n    // 4. Access count\n    if (record.maxAccess !== null) {\n      const ok = await this.deps.store.atomicIncrementAccess(token);\n      if (!ok) return reply.status(410).send(\"Access limit reached\");\n    } else {\n      this.deps.store.incrementAccess(token).catch(() => {});\n    }\n\n    // 5. Cache\n    const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };\n    this.deps.cache.set(token, {\n      address: record.address,\n      requiresUnlock: record.visibility === \"password\" && !isInternal,\n      sandboxConfig,\n    });\n\n    return this._serveFile(record.address, token, subPath, sandboxConfig, reply);\n  }\n\n  /**\n   * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}\n   * Decodes 3 UUIDs (no dashes, 96 hex chars), ensures internal share, 302 redirects.\n   */\n  async resolveDirectFile(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { tid: string; wid: string; pid: string; \"*\"?: string };\n    const tenantId = params.tid;\n    const workspaceId = params.wid;\n    const projectId = params.pid;\n    const subPath = (params[\"*\"] ?? \"\");\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime\n    if (isApi) {\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApiCore({\n        tenantId, workspaceId, projectId, assistantId: \"\",\n        resourcePath: subPath,\n      }, subPath, ext, request, reply);\n    }\n\n    const volume = buildNamedVolumeName(\"p\", \"project\", tenantId, workspaceId, projectId);\n    return this._resolveAndServe(volume, subPath, reply, `/f/${tenantId}/${workspaceId}/${projectId}`,\n      { tenantId, workspaceId, projectId, assistantId: null },\n    );\n  }\n\n  async unlockShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const { password } = request.body as unknown as { password: string };\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || !record.passwordHash) {\n      return reply.status(404).send({ error: \"Invalid request\" });\n    }\n\n    const valid = await bcrypt.compare(password, record.passwordHash!);\n    if (!valid) {\n      return reply.status(401).send({ error: \"Incorrect password\" });\n    }\n\n    const cookieOpts = [\n      `share_unlock_${token}=1`,\n      \"Max-Age=86400\",\n      `Path=/s/${token}`,\n      \"SameSite=Lax\",\n      \"HttpOnly\",\n    ];\n    if (request.protocol === \"https\") {\n      cookieOpts.push(\"Secure\");\n    }\n    reply.header(\"Set-Cookie\", cookieOpts.join(\"; \"));\n    return reply.send({ ok: true });\n  }\n\n  private _isInternalRequest(request: FastifyRequest): boolean {\n    const user = (request as any).user;\n    if (user && user.id) return true;\n    // Fallback: same-origin browser request (iframe/img embed — no Auth header)\n    const origin = request.headers.origin || request.headers.referer;\n    if (origin) {\n      try {\n        const { hostname } = new URL(origin);\n        if (hostname === request.hostname) return true;\n      } catch { /* malformed */ }\n    }\n    return false;\n  }\n\n  private _isUnlocked(request: FastifyRequest, token: string): boolean {\n    const cookie = request.headers.cookie ?? \"\";\n    return cookie.includes(`share_unlock_${token}=1`);\n  }\n\n  /** Returns true if the path has a file extension indicating it's a file, not a directory */\n  private _isFilePath(path: string): boolean {\n    return /\\.[a-zA-Z0-9]+$/.test(path);\n  }\n\n  /**\n   * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.\n   */\n  private async _resolveAndServe(\n    volume: string,\n    resourcePath: string,\n    reply: FastifyReply,\n    baseTagPrefix: string,\n    sandboxConfig?: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n  ) {\n    const cleanPath = resourcePath.replace(/\\/+$/, \"\");\n    const entryPath = !cleanPath\n      ? \"index.html\"\n      : this._isFilePath(cleanPath)\n        ? cleanPath\n        : `${cleanPath}/index.html`;\n\n    const address: ResourceAddress = { volume, resourcePath: \"\" };\n\n    let buf: Buffer;\n    try {\n      // Volume FS first\n      const provider = this.deps.sandboxManager.getDefaultProvider();\n      buf = await provider.getResourceResolver().resolve({ ...address, resourcePath: entryPath });\n    } catch {\n      // Sandbox fallback\n      if (!sandboxConfig) return reply.status(404).send(\"File not found\");\n      try {\n        const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n          assistant_id: sandboxConfig.assistantId ?? \"\",\n          thread_id: \"\",\n          tenantId: sandboxConfig.tenantId,\n          workspaceId: sandboxConfig.workspaceId,\n          projectId: sandboxConfig.projectId,\n        });\n        buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });\n      } catch {\n        return reply.status(404).send(\"File not found\");\n      }\n    }\n\n    const filename = entryPath.split(\"/\").pop() || \"download\";\n    const contentType = getContentTypeFromFilename(filename);\n\n    // Inject base tag for HTML\n    if (/\\.(html|htm)$/i.test(filename)) {\n      const baseDir = cleanPath\n        ? (this._isFilePath(cleanPath) ? cleanPath.replace(/[^/]+$/, \"\") : cleanPath)\n        : \"\";\n      const html = buf.toString(\"utf-8\");\n      if (!/<base\\b/i.test(html)) {\n        const baseTag = `<base href=\"${baseTagPrefix}${baseDir ? \"/\" + baseDir : \"\"}/\">`;\n        buf = Buffer.from(\n          html.includes(\"<head>\") ? html.replace(\"<head>\", `<head>${baseTag}`) : baseTag + html,\n          \"utf-8\"\n        );\n      }\n    }\n\n    return reply\n      .status(200)\n      .type(contentType)\n      .header(\"Content-Disposition\", `inline; filename*=UTF-8''${encodeURIComponent(filename)}`)\n      .header(\"Access-Control-Allow-Origin\", \"*\")\n      .send(buf);\n  }\n\n  private async _serveFile(\n    address: ResourceAddress,\n    token: string,\n    subPath: string,\n    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    reply: FastifyReply,\n  ) {\n    const resourcePath = subPath\n      ? this._resolveSafeSubPath(address.resourcePath, subPath)\n      : address.resourcePath;\n    return this._resolveAndServe(\n      address.volume,\n      resourcePath,\n      reply,\n      `/s/${token}`,\n      sandboxConfig,\n    );\n  }\n\n  private async _execApi(\n    record: ShareRecord,\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    const basePath = this._isFilePath(record.address.resourcePath)\n      ? \"\"\n      : `${record.address.resourcePath}/`;\n    return this._execApiCore({\n      tenantId: record.tenantId,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n      assistantId: record.assistantId,\n      resourcePath: basePath + apiSubPath,\n      openGrants: record.openGrants,\n    }, apiSubPath, ext, request, reply);\n  }\n\n  private async _execApiCore(\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      assistantId?: string | null;\n      resourcePath: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    let sandbox: any;\n    try {\n      sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n        assistant_id: config.assistantId ?? \"\",\n        thread_id: \"\",\n        tenantId: config.tenantId,\n        workspaceId: config.workspaceId,\n        projectId: config.projectId,\n      });\n    } catch (err) {\n      this.deps.logger.error(\"[share] sandbox start failed for API\", { error: (err as Error).message });\n      return reply.status(502).send({ error: \"Sandbox unavailable\" });\n    }\n\n    const scriptPath = `/project/${config.resourcePath}`;\n    const cmd = ext === \"py\" ? `python3 ${scriptPath}` : `node ${scriptPath}`;\n\n    // Pass query params and body via environment\n    const queryStr = request.url.includes(\"?\") ? (request.url as string).split(\"?\")[1] : \"\";\n    const queryObj: Record<string, string> = {};\n    if (queryStr) {\n      for (const [k, v] of new URLSearchParams(queryStr)) {\n        queryObj[k] = v;\n      }\n    }\n\n    const bodyStr = (request.body as string) ?? \"\";\n\n    const envVars = [\n      `export API_QUERY='${JSON.stringify(queryObj).replace(/'/g, \"'\\\\''\")}'`,\n      `export API_BODY='${bodyStr.replace(/'/g, \"'\\\\''\")}'`,\n      `export API_METHOD='${request.method}'`,\n      `export API_GATEWAY_URL='${request.protocol}://${request.headers[\"x-forwarded-host\"] ?? request.headers.host ?? request.hostname}'`,\n      `export API_TENANT_ID='${config.tenantId}'`,\n      `export API_ASSISTANT_ID='${config.assistantId || \"\"}'`,\n      `export OPEN_API_TOKEN='${this._mintSandboxToken(sandbox.name, config)}'`,\n    ].join(\" && \");\n\n    const fullCmd = `${envVars} && ${cmd}`;\n\n    this.deps.logger.info(\"[api] exec\", { scriptPath, cmd: cmd.substring(0, 80) });\n\n    try {\n      const result = await sandbox.shell.execCommand({ command: fullCmd });\n      // Parse stdout as JSON\n      let data: unknown;\n      try {\n        data = JSON.parse(result.output?.trim() || \"{}\");\n      } catch {\n        data = { output: result.output?.trim() || \"\" };\n      }\n      return reply.status(200).type(\"application/json\").send(data);\n    } catch (err) {\n      this.deps.logger.warn(\"[api] exec failed\", { scriptPath, error: (err as Error).message });\n      return reply.status(500).send({ error: (err as Error).message });\n    }\n  }\n\n  private _resolveSafeSubPath(entryFile: string, subPath: string): string {\n    if (!subPath) return entryFile;\n    if (subPath.includes(\"..\")) throw new Error(\"Path traversal denied\");\n    if (subPath.startsWith(entryFile + \"/\") || subPath === entryFile) return subPath;\n    const entryDir = this._isFilePath(entryFile)\n      ? entryFile.replace(/[^/]+$/, \"\")\n      : entryFile + \"/\";\n    return (entryDir + subPath).replace(/\\/+/g, \"/\");\n  }\n\n  private _passwordPage(token: string): string {\n    return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class=\"card\"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id=\"f\"><input type=\"password\" id=\"p\" placeholder=\"Enter password\" required><button type=\"submit\">Unlock</button><div class=\"error\" id=\"e\">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;\n  }\n\n  private _mintSandboxToken(\n    sandboxName: string,\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n  ): string {\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const { signOpenToken } = require(\"../services/open/openToken\") as {\n      signOpenToken: (p: unknown) => string;\n    };\n    return signOpenToken({\n      kind: \"sandbox_token\",\n      tenantId: config.tenantId,\n      workspaceId: config.workspaceId,\n      projectId: config.projectId,\n      sandboxName,\n      grants: [\n        {\n          domain: \"sandbox\",\n          items: [\"files_read\", \"files_list\", \"files_write\", \"shell_exec\"],\n        },\n        ...sanitizeShareOpenGrants(config.openGrants),\n      ],\n    });\n  }\n}\n","/**\n * Sandbox-token grant sanitation.\n *\n * Sandbox tokens always carry the self-binding sandbox grant (resolved from\n * the credential's tenant/workspace/project). Shares may append extra\n * Open-door grants, but only within the V1 whitelist: read-only kb access.\n * Anything else is dropped server-side (the share creator cannot widen scope).\n */\n\nimport type { OpenGrant } from \"@axiom-lattice/protocols\";\n\n/** V1 allowlist: domain → permitted (read-only) actions. */\nconst ALLOWED: Record<string, string[]> = {\n  kb: [\"search\", \"entries_read\"],\n};\n\nexport function sanitizeShareOpenGrants(grants: OpenGrant[] | undefined): OpenGrant[] {\n  const out: OpenGrant[] = [];\n  for (const grant of grants ?? []) {\n    const allowed = ALLOWED[grant.domain];\n    if (!allowed) continue;\n    const items =\n      grant.items && grant.items.length > 0\n        ? grant.items.filter((item) => allowed.includes(item))\n        : allowed;\n    if (items.length > 0) out.push({ domain: grant.domain, items });\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;AAEA,OAAO,YAAY;AACnB;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,OACK;;;ACGP,IAAM,UAAoC;AAAA,EACxC,IAAI,CAAC,UAAU,cAAc;AAC/B;AAEO,SAAS,wBAAwB,QAA8C;AACpF,QAAM,MAAmB,CAAC;AAC1B,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,UAAM,UAAU,QAAQ,MAAM,MAAM;AACpC,QAAI,CAAC,QAAS;AACd,UAAM,QACJ,MAAM,SAAS,MAAM,MAAM,SAAS,IAChC,MAAM,MAAM,OAAO,CAAC,SAAS,QAAQ,SAAS,IAAI,CAAC,IACnD;AACN,QAAI,MAAM,SAAS,EAAG,KAAI,KAAK,EAAE,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAAA,EAChE;AACA,SAAO;AACT;;;ADRO,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAAoB,MAA8B;AAA9B;AAAA,EAA+B;AAAA,EAEnD,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,cAAc,QAAQ,QAAQ,gBAAgB;AACpD,UAAM,YAAY,QAAQ,QAAQ,cAAc;AAChD,UAAM,OAAO,QAAQ;AAErB,QAAI,CAAC,eAAe,CAAC,WAAW;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC7F;AAEA,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAE5B,QAAI;AACF,YAAM,KAAK,KAAK,MAAM,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC;AAClD,WAAK,KAAK,OAAO;AAAA,QACf;AAAA,QACA,EAAE,OAAO,cAAc,KAAK,cAAc,gBAAgB,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,QAAQ,OAAO;AAAA,MACjI;AAAA,IACF,QAAQ;AACN,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAM,WAAW,SAAyB,OAAqB;AAC7D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,WAAW,UAAU,MAAgB;AAC1E,WAAO,MAAM,KAAK,OAAO,OAAO,CAAC,MAAY,EAAU,eAAe,UAAU,CAAC;AAAA,EACnF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,QAAQ,QAAQ;AAEtB,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,KAAK;AAEzC,QAAI,MAAM,SAAS;AACjB,WAAK,KAAK,MAAM,WAAW,KAAK;AAAA,IAClC;AAEA,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AAEJ,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AACrD,SAAK,KAAK,MAAM,WAAW,KAAK;AAEhC,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,gBAAgB,SAAyB,OAAqB;AAClE,UAAM,SAAS,QAAQ;AACvB,UAAM,EAAE,MAAM,IAAI;AAClB,UAAM,UAAU,OAAO,GAAG,KAAK;AAE/B,SAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,QAAQ,CAAC;AAEjE,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAMA,UAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,UAAI,CAACA,WAAUA,QAAO,QAAS,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AACxE,UAAIA,QAAO,aAAa,IAAI,KAAKA,QAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,MACzC;AAEA,UAAI,CAAC,KAAK,mBAAmB,OAAO,GAAG;AACrC,YAAIA,QAAO,eAAe,YAAY;AACpC,iBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,QACjE;AACA,YAAIA,QAAO,eAAe,YAAY;AACpC,cAAI,CAAC,KAAK,YAAY,SAAS,KAAK,GAAG;AACrC,mBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,UAC9D;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,SAASA,SAAQ,SAAS,KAAK,SAAS,KAAK;AAAA,IAC3D;AAGA,UAAM,SAAS,KAAK,KAAK,MAAM,IAAI,KAAK;AACxC,QAAI,UAAU,CAAC,OAAO,gBAAgB;AACpC,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,cAAc,OAAO,QAAQ,aAAa,CAAC;AAC9H,aAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,iBAAiB,EAAE,UAAU,WAAW,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,GAAG,KAAK;AAAA,IAClK;AACA,SAAK,KAAK,OAAO,KAAK,mCAAmC,EAAE,MAAM,CAAC;AAGlE,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,WAAK,KAAK,OAAO,KAAK,sCAAsC,EAAE,OAAO,OAAO,CAAC,CAAC,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AAChH,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AAAA,IAC3C;AACA,QAAI,OAAO,aAAa,IAAI,KAAK,OAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,WAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,WAAW,OAAO,UAAU,CAAC;AACrF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,IACzC;AAEA,SAAK,KAAK,OAAO,KAAK,wBAAwB;AAAA,MAC5C;AAAA,MACA,QAAQ,OAAO,QAAQ;AAAA,MACvB,cAAc,OAAO,QAAQ;AAAA,MAC7B,YAAY,OAAO;AAAA,MACnB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,IACpB,CAAC;AAGD,UAAM,aAAa,KAAK,mBAAmB,OAAO;AAClD,QAAI,CAAC,YAAY;AAEf,UAAI,OAAO,eAAe,YAAY;AACpC,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MACjE;AACA,UAAI,OAAO,eAAe,YAAY;AACpC,cAAM,WAAW,KAAK,YAAY,SAAS,KAAK;AAChD,YAAI,CAAC,UAAU;AACb,eAAK,KAAK,OAAO,KAAK,uDAAuD,EAAE,MAAM,CAAC;AACtF,eAAK,KAAK,MAAM,IAAI,OAAO;AAAA,YACzB,SAAS,OAAO;AAAA,YAChB,gBAAgB;AAAA,YAChB,eAAe,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AAAA,UAC5I,CAAC;AACD,iBAAO,MAAM,KAAK,WAAW,EAAE,KAAK,KAAK,cAAc,KAAK,CAAC;AAAA,QAC/D;AACA,aAAK,KAAK,OAAO,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,MAAM;AAC7B,YAAM,KAAK,MAAM,KAAK,KAAK,MAAM,sBAAsB,KAAK;AAC5D,UAAI,CAAC,GAAI,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,sBAAsB;AAAA,IAC/D,OAAO;AACL,WAAK,KAAK,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACvD;AAGA,UAAM,gBAAgB,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AACjJ,SAAK,KAAK,MAAM,IAAI,OAAO;AAAA,MACzB,SAAS,OAAO;AAAA,MAChB,gBAAgB,OAAO,eAAe,cAAc,CAAC;AAAA,MACrD;AAAA,IACF,CAAC;AAED,WAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,eAAe,KAAK;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,SAAyB,OAAqB;AACpE,UAAM,SAAS,QAAQ;AACvB,UAAM,WAAW,OAAO;AACxB,UAAM,cAAc,OAAO;AAC3B,UAAM,YAAY,OAAO;AACzB,UAAM,UAAW,OAAO,GAAG,KAAK;AAEhC,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,aAAa;AAAA,QACvB;AAAA,QAAU;AAAA,QAAa;AAAA,QAAW,aAAa;AAAA,QAC/C,cAAc;AAAA,MAChB,GAAG,SAAS,KAAK,SAAS,KAAK;AAAA,IACjC;AAEA,UAAM,SAAS,qBAAqB,KAAK,WAAW,UAAU,aAAa,SAAS;AACpF,WAAO,KAAK;AAAA,MAAiB;AAAA,MAAQ;AAAA,MAAS;AAAA,MAAO,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS;AAAA,MAC7F,EAAE,UAAU,aAAa,WAAW,aAAa,KAAK;AAAA,IACxD;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,CAAC,OAAO,cAAc;AACnC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,QAAQ,MAAM,OAAO,QAAQ,UAAU,OAAO,YAAa;AACjE,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAEA,UAAM,aAAa;AAAA,MACjB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,iBAAW,KAAK,QAAQ;AAAA,IAC1B;AACA,UAAM,OAAO,cAAc,WAAW,KAAK,IAAI,CAAC;AAChD,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEQ,mBAAmB,SAAkC;AAC3D,UAAM,OAAQ,QAAgB;AAC9B,QAAI,QAAQ,KAAK,GAAI,QAAO;AAE5B,UAAM,SAAS,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AACzD,QAAI,QAAQ;AACV,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,MAAM;AACnC,YAAI,aAAa,QAAQ,SAAU,QAAO;AAAA,MAC5C,QAAQ;AAAA,MAAkB;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,YAAY,SAAyB,OAAwB;AACnE,UAAM,SAAS,QAAQ,QAAQ,UAAU;AACzC,WAAO,OAAO,SAAS,gBAAgB,KAAK,IAAI;AAAA,EAClD;AAAA;AAAA,EAGQ,YAAY,MAAuB;AACzC,WAAO,kBAAkB,KAAK,IAAI;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBACZ,QACA,cACA,OACA,eACA,eACA;AACA,UAAM,YAAY,aAAa,QAAQ,QAAQ,EAAE;AACjD,UAAM,YAAY,CAAC,YACf,eACA,KAAK,YAAY,SAAS,IACxB,YACA,GAAG,SAAS;AAElB,UAAM,UAA2B,EAAE,QAAQ,cAAc,GAAG;AAE5D,QAAI;AACJ,QAAI;AAEF,YAAM,WAAW,KAAK,KAAK,eAAe,mBAAmB;AAC7D,YAAM,MAAM,SAAS,oBAAoB,EAAE,QAAQ,EAAE,GAAG,SAAS,cAAc,UAAU,CAAC;AAAA,IAC5F,QAAQ;AAEN,UAAI,CAAC,cAAe,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAClE,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,UAClE,cAAc,cAAc,eAAe;AAAA,UAC3C,WAAW;AAAA,UACX,UAAU,cAAc;AAAA,UACxB,aAAa,cAAc;AAAA,UAC3B,WAAW,cAAc;AAAA,QAC3B,CAAC;AACD,cAAM,MAAM,QAAQ,KAAK,aAAa,EAAE,MAAM,YAAY,SAAS,GAAG,CAAC;AAAA,MACzE,QAAQ;AACN,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAAA,MAChD;AAAA,IACF;AAEA,UAAM,WAAW,UAAU,MAAM,GAAG,EAAE,IAAI,KAAK;AAC/C,UAAM,cAAc,2BAA2B,QAAQ;AAGvD,QAAI,iBAAiB,KAAK,QAAQ,GAAG;AACnC,YAAM,UAAU,YACX,KAAK,YAAY,SAAS,IAAI,UAAU,QAAQ,UAAU,EAAE,IAAI,YACjE;AACJ,YAAM,OAAO,IAAI,SAAS,OAAO;AACjC,UAAI,CAAC,WAAW,KAAK,IAAI,GAAG;AAC1B,cAAM,UAAU,eAAe,aAAa,GAAG,UAAU,MAAM,UAAU,EAAE;AAC3E,cAAM,OAAO;AAAA,UACX,KAAK,SAAS,QAAQ,IAAI,KAAK,QAAQ,UAAU,SAAS,OAAO,EAAE,IAAI,UAAU;AAAA,UACjF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,MACJ,OAAO,GAAG,EACV,KAAK,WAAW,EAChB,OAAO,uBAAuB,4BAA4B,mBAAmB,QAAQ,CAAC,EAAE,EACxF,OAAO,+BAA+B,GAAG,EACzC,KAAK,GAAG;AAAA,EACb;AAAA,EAEA,MAAc,WACZ,SACA,OACA,SACA,eACA,OACA;AACA,UAAM,eAAe,UACjB,KAAK,oBAAoB,QAAQ,cAAc,OAAO,IACtD,QAAQ;AACZ,WAAO,KAAK;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,SACZ,QACA,YACA,KACA,SACA,OACA;AACA,UAAM,WAAW,KAAK,YAAY,OAAO,QAAQ,YAAY,IACzD,KACA,GAAG,OAAO,QAAQ,YAAY;AAClC,WAAO,KAAK,aAAa;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,cAAc,WAAW;AAAA,MACzB,YAAY,OAAO;AAAA,IACrB,GAAG,YAAY,KAAK,SAAS,KAAK;AAAA,EACpC;AAAA,EAEA,MAAc,aACZ,QAQA,YACA,KACA,SACA,OACA;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,QAC5D,cAAc,OAAO,eAAe;AAAA,QACpC,WAAW;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,MAAM,wCAAwC,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAChG,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAA,IAChE;AAEA,UAAM,aAAa,YAAY,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,OAAO,WAAW,UAAU,KAAK,QAAQ,UAAU;AAGvE,UAAM,WAAW,QAAQ,IAAI,SAAS,GAAG,IAAK,QAAQ,IAAe,MAAM,GAAG,EAAE,CAAC,IAAI;AACrF,UAAM,WAAmC,CAAC;AAC1C,QAAI,UAAU;AACZ,iBAAW,CAAC,GAAG,CAAC,KAAK,IAAI,gBAAgB,QAAQ,GAAG;AAClD,iBAAS,CAAC,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,UAAW,QAAQ,QAAmB;AAE5C,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK,UAAU,QAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,MACpE,oBAAoB,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAAA,MAClD,sBAAsB,QAAQ,MAAM;AAAA,MACpC,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,kBAAkB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,MAChI,yBAAyB,OAAO,QAAQ;AAAA,MACxC,4BAA4B,OAAO,eAAe,EAAE;AAAA,MACpD,0BAA0B,KAAK,kBAAkB,QAAQ,MAAM,MAAM,CAAC;AAAA,IACxE,EAAE,KAAK,MAAM;AAEb,UAAM,UAAU,GAAG,OAAO,OAAO,GAAG;AAEpC,SAAK,KAAK,OAAO,KAAK,cAAc,EAAE,YAAY,KAAK,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;AAE7E,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,MAAM,YAAY,EAAE,SAAS,QAAQ,CAAC;AAEnE,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,KAAK,IAAI;AAAA,MACjD,QAAQ;AACN,eAAO,EAAE,QAAQ,OAAO,QAAQ,KAAK,KAAK,GAAG;AAAA,MAC/C;AACA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,kBAAkB,EAAE,KAAK,IAAI;AAAA,IAC7D,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,YAAY,OAAQ,IAAc,QAAQ,CAAC;AACxF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,oBAAoB,WAAmB,SAAyB;AACtE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACnE,QAAI,QAAQ,WAAW,YAAY,GAAG,KAAK,YAAY,UAAW,QAAO;AACzE,UAAM,WAAW,KAAK,YAAY,SAAS,IACvC,UAAU,QAAQ,UAAU,EAAE,IAC9B,YAAY;AAChB,YAAQ,WAAW,SAAS,QAAQ,QAAQ,GAAG;AAAA,EACjD;AAAA,EAEQ,cAAc,OAAuB;AAC3C,WAAO,8tCAA8tC,KAAK;AAAA,EAC5uC;AAAA,EAEQ,kBACN,aACA,QAMQ;AAER,UAAM,EAAE,cAAc,IAAI;AAG1B,WAAO,cAAc;AAAA,MACnB,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,OAAO,CAAC,cAAc,cAAc,eAAe,YAAY;AAAA,QACjE;AAAA,QACA,GAAG,wBAAwB,OAAO,UAAU;AAAA,MAC9C;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":["record"]}