@bevel-software/platform-core-backend 0.25.2 → 0.27.0

package/dist/modules/embed/embed.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/embed/embed.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAS1D,OAAO,4BAA4B,CAAC;AAEpC;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CA0I7E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAwDjF;AAqBD,mEAAmE;AACnE,eAAO,MAAM,cAAc,qEACyC,CAAC"}

package/dist/modules/embed/embed.routes.js

@@ -0,0 +1,343 @@
+import express from 'express';
+import { EmbedAccessError, EmbedLockedError, EmbedNodeNotFoundError, EmbedTokenError, } from './embed.errors.js';
+import { EmbedRefParseError } from './embed-link.js';
+import { rawExtensionOf, rawMimeFor } from '../workspace/file-readers/raw-mime.js';
+import '../auth/auth.middleware.js'; // Express Request augmentation
+/**
+ * What `/api/embed/raw` answers as `Content-Type`, by extension — the types a
+ * renderer draws from a URL. Anything else is bytes the renderer parses
+ * itself (a workbook, a deck), served as the octet stream it is.
+ */
+/**
+ * The embed surface: a token-minted, pseudonymous, short-lived page that
+ * renders ONE knowledge-base file with the app's own renderer, inside
+ * somebody else's frame — an MCP App's sandbox in a chat, an Atlassian issue
+ * panel. Two routers, with deliberately different auth stories:
+ *
+ *  - {@link createEmbedRoutes} (mounted at the app root, ahead of the JWT
+ *    middleware): the connector's shared-secret mint, and the TOKEN-ONLY data
+ *    routes the SPA `/embed` page calls. Also stamps the framing headers on
+ *    the two SPA routes.
+ *  - {@link createEmbedLinkRoutes} (mounted under the JWT middleware): links
+ *    the viewer's outside account to their just-authenticated Hexis user.
+ *
+ * Mounted before the production static catch-all, so the framing headers are
+ * stamped before `index.html` is served for `/embed*`.
+ *
+ * ── Why the data routes take the token and NOTHING else ───────────────────
+ *
+ * The embed page is framed by any site (see the framing headers below), which
+ * is what makes it work in every host's sandbox without an admin entry per
+ * host. The security of the embed therefore rests entirely on the token:
+ * short-lived, scoped to one file and one identity, pseudonymous. A session
+ * FALLBACK would hand that away — a hostile page could frame `/embed`, and
+ * the browser would attach the visitor's own cookie to every data request the
+ * page made, so the attacker's frame would read and write as the victim. So
+ * every route here reads `token` and never `req.userId`: a request carrying a
+ * perfectly valid session and no token is refused.
+ *
+ * ── Cross-origin callers ──────────────────────────────────────────────────
+ *
+ * The MCP App view runs the embed inside a chat host's SANDBOX — another
+ * origin, unknowable in advance (a hash subdomain under Claude's content
+ * domain, a URL-derived one under ChatGPT's) — and calls the token routes
+ * from there. Nothing here has to allow that: the server's app-wide CORS
+ * (`create-core-server.ts`, mounted ahead of this router) already reflects
+ * any origin and answers the preflight, for every route. That is safe on the
+ * token routes for the reason the token-only rule exists: CORS guards a
+ * browser's ambient credentials, these routes take none, and the token in
+ * the request is the whole credential. The routes test mounts the same CORS
+ * to pin that a cross-origin caller gets through.
+ */
+export function createEmbedRoutes(embedService) {
+    const router = express.Router();
+    // ── framing ──────────────────────────────────────────────────────────────
+    //
+    // The embed page: NO framing restriction at all, so any host may frame it.
+    // `X-Frame-Options` is removed rather than merely not set, so a header added
+    // globally later (by this app or by a proxy in front of it) cannot silently
+    // break every host's embed — the one route that must be frameable says so
+    // itself.
+    router.get('/embed', (_req, res, next) => {
+        res.removeHeader('X-Frame-Options');
+        // Only the framing directive goes: a policy's other directives (scripts,
+        // objects, connections) protect the page whoever frames it, and stay.
+        const csp = res.getHeader('Content-Security-Policy');
+        if (typeof csp === 'string') {
+            const kept = csp
+                .split(';')
+                .map((d) => d.trim())
+                .filter((d) => d !== '' && !/^frame-ancestors\b/i.test(d));
+            if (kept.length > 0)
+                res.setHeader('Content-Security-Policy', kept.join('; '));
+            else
+                res.removeHeader('Content-Security-Policy');
+        }
+        next();
+    });
+    // The account-link page is the opposite: it acts under the viewer's own
+    // SESSION, so a page that could frame it could link a foreign account to
+    // whoever happened to be signed in. Refused for EVERY ancestor — the modern
+    // directive and the legacy header, since not every browser honours both.
+    router.get('/embed/link', (_req, res, next) => {
+        res.setHeader('Content-Security-Policy', "frame-ancestors 'none'");
+        res.setHeader('X-Frame-Options', 'DENY');
+        next();
+    });
+    // ── the connector's mint (server-to-server, shared secret) ───────────────
+    router.post('/api/embed/token', async (req, res) => {
+        if (!embedService.sharedSecretConfigured()) {
+            res.status(404).json({ error: 'The shared-secret mint is not configured' });
+            return;
+        }
+        if (!embedService.verifySharedSecret(req.header('x-embed-secret') ?? undefined)) {
+            res.status(401).json({ error: 'Invalid embed secret' });
+            return;
+        }
+        const b = req.body;
+        if (typeof b?.accountId !== 'string' || typeof b?.reference !== 'string') {
+            res.status(400).json({ error: 'accountId and reference are required' });
+            return;
+        }
+        try {
+            res.json(await embedService.mintToken({
+                accountId: b.accountId,
+                email: typeof b.email === 'string' ? b.email : undefined,
+                reference: b.reference,
+            }));
+        }
+        catch (err) {
+            sendJsonError(res, err);
+        }
+    });
+    // ── token-only data routes ───────────────────────────────────────────────
+    // The file to render, plus the viewer's read/write status.
+    router.get('/api/embed/load', async (req, res) => {
+        const token = queryToken(req, res);
+        if (token === null)
+            return;
+        // Protected text and a token-bearing link URL: as with `/raw`, nothing
+        // may keep the answer past the access it was computed under.
+        res.setHeader('Cache-Control', 'no-store, private');
+        try {
+            res.json(await embedService.loadFile(token));
+        }
+        catch (err) {
+            sendJsonError(res, err);
+        }
+    });
+    // The file's BYTES, for the app renderers that read bytes rather than a
+    // text buffer: an image, a PDF, a Word document — and the pictures a
+    // markdown page references, which arrive as `path`.
+    router.get('/api/embed/raw', async (req, res) => {
+        // The token is in the URL, so no shared cache may keep ANY answer from
+        // it — a refusal included, which is why this is set before the token is
+        // even looked at.
+        res.setHeader('Cache-Control', 'no-store, private');
+        const token = queryToken(req, res);
+        if (token === null)
+            return;
+        const path = typeof req.query.path === 'string' ? req.query.path : undefined;
+        try {
+            const { bytes, path: served } = await embedService.readBytes(token, path);
+            // The type from the extension, the one table the workspace raw route
+            // serves from: under `nosniff` a browser draws an `<img>` only from an
+            // `image/*` answer, and never sniffs SVG at all, so an octet-stream
+            // picture is a broken image.
+            res.setHeader('Content-Type', rawMimeFor(served));
+            // An SVG can carry scripts; drawn through `<img>` they never run, but a
+            // tab opened on this address would run them under the app's origin.
+            if (rawExtensionOf(served) === '.svg')
+                res.setHeader('Content-Security-Policy', 'sandbox');
+            // Never a download, always bytes for a renderer to draw: an embed is a
+            // view, and `download:` is a separate verb the app's own route gates.
+            res.setHeader('Content-Disposition', 'inline');
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+            res.setHeader('X-Embed-Path', encodeURIComponent(served));
+            res.end(bytes);
+        }
+        catch (err) {
+            sendJsonError(res, err);
+        }
+    });
+    // Lock lifecycle: Edit → lock, timer → heartbeat, Cancel/close → cancel.
+    router.post('/api/embed/lock', tokenHandler(async (token) => embedService.acquireLock(token)));
+    router.post('/api/embed/heartbeat', tokenHandler(async (token) => {
+        await embedService.heartbeat(token);
+        return null;
+    }));
+    router.post('/api/embed/cancel', tokenHandler(async (token) => {
+        await embedService.cancel(token);
+        return null;
+    }));
+    // Save to the default branch (a writer), or propose (anybody else).
+    router.post('/api/embed/save', contentHandler(async (token, content) => {
+        await embedService.save(token, content);
+        return null;
+    }));
+    router.post('/api/embed/propose', contentHandler(async (token, content) => embedService.propose(token, content)));
+    return router;
+}
+/**
+ * Links the authenticated Hexis user to the outside account the embed token
+ * carries. JWT-protected — `req.userId` is the user we link TO, which is why
+ * the page it is called from refuses every framing ancestor.
+ */
+export function createEmbedLinkRoutes(embedService) {
+    const router = express.Router();
+    router.post('/embed/link', async (req, res) => {
+        if (!req.userId) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        const b = req.body;
+        if (typeof b?.token !== 'string') {
+            res.status(400).json({ error: 'token is required' });
+            return;
+        }
+        try {
+            await embedService.linkAccount(b.token, req.userId);
+            res.status(204).end();
+        }
+        catch (err) {
+            sendJsonError(res, err);
+        }
+    });
+    // Connected-apps management (list + disconnect). A person's ability to see
+    // and remove their OWN link — self-service erasure — must not depend on
+    // whether the shared-secret mint happens to be configured today.
+    router.get('/embed/links', async (req, res) => {
+        if (!req.userId) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        try {
+            res.json(await embedService.listLinkedAccounts(req.userId));
+        }
+        catch (err) {
+            sendJsonError(res, err);
+        }
+    });
+    router.delete('/embed/links/:accountId', async (req, res) => {
+        if (!req.userId) {
+            res.status(401).json({ error: 'Unauthenticated' });
+            return;
+        }
+        try {
+            const removed = await embedService.unlinkAccount(req.userId, req.params.accountId);
+            if (!removed) {
+                // Not linked to THIS user (absent, or somebody else's) — the same 404
+                // either way, so the endpoint cannot probe other people's links.
+                res.status(404).json({ error: 'No such connected app' });
+                return;
+            }
+            res.status(204).end();
+        }
+        catch (err) {
+            sendJsonError(res, err);
+        }
+    });
+    return router;
+}
+// ── helpers ─────────────────────────────────────────────────────────────────
+/**
+ * The `token` query parameter, or null after answering 401.
+ *
+ * 401, not 400: a request with no token is a request with no CREDENTIAL here,
+ * whatever else it carries. Saying "unauthorized" is what tells a session-only
+ * caller — the case the token-only rule exists for — that it was refused for
+ * who it is rather than for how it was spelled.
+ */
+function queryToken(req, res) {
+    const token = typeof req.query.token === 'string' ? req.query.token : '';
+    if (!token) {
+        res.status(401).json({ error: TOKEN_REQUIRED });
+        return null;
+    }
+    return token;
+}
+/** What a tokenless request is told, on every embed data route. */
+export const TOKEN_REQUIRED = 'This view needs its embed token. A session is not accepted here.';
+/** Build a handler for a `{ token }`-body endpoint; a null result → 204. */
+function tokenHandler(run) {
+    return async (req, res) => {
+        const token = req.body?.token;
+        if (typeof token !== 'string' || token === '') {
+            res.status(401).json({ error: TOKEN_REQUIRED });
+            return;
+        }
+        try {
+            const result = await run(token);
+            if (result === null || result === undefined)
+                res.status(204).end();
+            else
+                res.json(result);
+        }
+        catch (err) {
+            sendJsonError(res, err);
+        }
+    };
+}
+/** Build a handler for a `{ token, content }`-body endpoint. */
+function contentHandler(run) {
+    return async (req, res) => {
+        const b = req.body;
+        if (typeof b?.token !== 'string' || b.token === '') {
+            res.status(401).json({ error: TOKEN_REQUIRED });
+            return;
+        }
+        if (typeof b?.content !== 'string') {
+            res.status(400).json({ error: 'content is required' });
+            return;
+        }
+        try {
+            const result = await run(b.token, b.content);
+            if (result === null || result === undefined)
+                res.status(204).end();
+            else
+                res.json(result);
+        }
+        catch (err) {
+            sendJsonError(res, err);
+        }
+    };
+}
+function statusFor(err) {
+    if (err instanceof EmbedTokenError)
+        return 401;
+    if (err instanceof EmbedAccessError)
+        return 403;
+    if (err instanceof EmbedNodeNotFoundError)
+        return 404;
+    if (err instanceof EmbedLockedError)
+        return 409;
+    if (err instanceof EmbedRefParseError)
+        return 400;
+    // A domain error from the workflow layer (a protected-branch refusal, a
+    // duplicate request) already carries the status it deserves.
+    const status = err?.status;
+    if (typeof status === 'number' && status >= 400 && status < 600)
+        return status;
+    return 500;
+}
+function messageFor(err) {
+    if (err instanceof EmbedTokenError ||
+        err instanceof EmbedAccessError ||
+        err instanceof EmbedNodeNotFoundError ||
+        err instanceof EmbedLockedError ||
+        err instanceof EmbedRefParseError) {
+        return err.message;
+    }
+    const status = err?.status;
+    if (typeof status === 'number' && status >= 400 && status < 500 && err instanceof Error) {
+        return err.message;
+    }
+    return 'Something went wrong.';
+}
+function sendJsonError(res, err) {
+    const status = statusFor(err);
+    if (status === 500)
+        console.error('[embed] unexpected error:', err);
+    res.status(status).json({ error: messageFor(err) });
+}
+//# sourceMappingURL=embed.routes.js.map

package/dist/modules/embed/embed.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed.routes.js","sourceRoot":"","sources":["../../../src/modules/embed/embed.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,4BAA4B,CAAC,CAAC,+BAA+B;AAEpE;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,MAAM,UAAU,iBAAiB,CAAC,YAA2B;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,4EAA4E;IAC5E,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,UAAU;IACV,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,GAAG,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACpC,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,GAAG;iBACb,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;;gBAC1E,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5C,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;QACnE,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAqE,CAAC;QACpF,IAAI,OAAO,CAAC,EAAE,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CACN,MAAM,YAAY,CAAC,SAAS,CAAC;gBAC3B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACxD,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAE5E,2DAA2D;IAC3D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAC3B,uEAAuE;QACvE,6DAA6D;QAC7D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,qEAAqE;IACrE,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,uEAAuE;QACvE,wEAAwE;QACxE,kBAAkB;QAClB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1E,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,6BAA6B;YAC7B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,wEAAwE;YACxE,oEAAoE;YACpE,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,MAAM;gBAAE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;YAC3F,uEAAuE;YACvE,sEAAsE;YACtE,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;YAC/C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CAAC;IAEF,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrE,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACxE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CACrC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAA2B;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAA2B,CAAC;QAC1C,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,sEAAsE;gBACtE,iEAAiE;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAqB;IAC7D,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GACzB,kEAAkE,CAAC;AAErE,4EAA4E;AAC5E,SAAS,YAAY,CAAC,GAAwC;IAC5D,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,KAAK,GAAI,GAAG,CAAC,IAA4B,EAAE,KAAK,CAAC;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;;gBAC9D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CACrB,GAAyD;IAEzD,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,IAA8C,CAAC;QAC7D,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;;gBAC9D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,YAAY,eAAe;QAAE,OAAO,GAAG,CAAC;IAC/C,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,GAAG,CAAC;IAChD,IAAI,GAAG,YAAY,sBAAsB;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,GAAG,CAAC;IAChD,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,GAAG,CAAC;IAClD,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,MAAM,GAAI,GAA4B,EAAE,MAAM,CAAC;IACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IACE,GAAG,YAAY,eAAe;QAC9B,GAAG,YAAY,gBAAgB;QAC/B,GAAG,YAAY,sBAAsB;QACrC,GAAG,YAAY,gBAAgB;QAC/B,GAAG,YAAY,kBAAkB,EACjC,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAI,GAA4B,EAAE,MAAM,CAAC;IACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACxF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,GAAqB,EAAE,GAAY;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IACpE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/modules/embed/embed.service.d.ts

@@ -0,0 +1,169 @@
+import type { IGitService, IWorkflowService } from '@bevel-software/platform-shared';
+import type { KbContext } from '../../shared/kb-context.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { FileReaderRegistry } from '../workspace/file-readers/file-reader.js';
+import type { WriteValidator } from '../kb-fs/locking-filesystem.js';
+import type { EmbedAuthPort, EmbedFileView, EmbedLinkedAccount, EmbedLockResult, EmbedNodeIdResolver, EmbedWorkspacePort, EmbedProposalResult, EmbedTokenResult, IEmbedService } from './embed.interface.js';
+import type { IAccountLinkService } from './account-link.service.js';
+/**
+ * Token lifetime — long enough for a view left open in a chat, short enough
+ * that a token copied out of a transcript stops working on its own. The
+ * token rides in `open_page`'s result, so it sits in the chat transcript, and
+ * whoever holds it reads and edits that one file as the token's user until
+ * it expires. One hour (Razvan, 2026-10-09; the embed used two before): a
+ * page left open in a chat is still covered, and the window is halved. A
+ * view older than that shows the expired sentence and the agent opens the
+ * page again.
+ */
+export declare const EMBED_TOKEN_TTL_SECONDS: number;
+/** What the embed's config needs from the deployment's. */
+export interface EmbedConfig {
+    readonly jwtSecret: string;
+    readonly embedSharedSecret: string;
+    readonly publicFrontendUrl: string;
+    readonly kbDirName: string;
+}
+export declare class EmbedService implements IEmbedService {
+    private readonly config;
+    private readonly kb;
+    private readonly workspaceService;
+    private readonly accessControl;
+    private readonly authService;
+    private readonly workflowService;
+    private readonly gitService;
+    private readonly accountLinks;
+    private readonly readers;
+    /**
+     * The pre-disk write gate every other write surface runs — the file
+     * editor's and the agent tools' `roles.yaml` validity check. An embed
+     * save or proposal writes through `workspaceService.writeFile`, which
+     * puts bytes on disk without one, so the gate is asked here first.
+     */
+    private readonly validateWrite;
+    /** See {@link EmbedNodeIdResolver} — core has none, so core refuses an id reference. */
+    private readonly resolveNodeId;
+    /**
+     * Embed tokens are signed with a key DERIVED from the JWT secret (HMAC with
+     * a fixed label) rather than the secret itself — domain separation, so an
+     * embed token can never be replayed as a session JWT, nor the reverse. The
+     * label is part of the token format: changing it invalidates every live
+     * token, so it does not change.
+     */
+    private readonly signingKey;
+    constructor(config: EmbedConfig, kb: KbContext, workspaceService: EmbedWorkspacePort, accessControl: IAccessControl, authService: EmbedAuthPort, workflowService: IWorkflowService, gitService: IGitService, accountLinks: IAccountLinkService, readers: FileReaderRegistry, 
+    /**
+     * The pre-disk write gate every other write surface runs — the file
+     * editor's and the agent tools' `roles.yaml` validity check. An embed
+     * save or proposal writes through `workspaceService.writeFile`, which
+     * puts bytes on disk without one, so the gate is asked here first.
+     */
+    validateWrite: WriteValidator, 
+    /** See {@link EmbedNodeIdResolver} — core has none, so core refuses an id reference. */
+    resolveNodeId?: EmbedNodeIdResolver | null);
+    sharedSecretConfigured(): boolean;
+    verifySharedSecret(secret: string | undefined): boolean;
+    mintForUser(input: {
+        userId: string;
+        reference: string;
+    }): Promise<EmbedTokenResult>;
+    mintToken(input: {
+        accountId: string;
+        email?: string;
+        reference: string;
+    }): Promise<EmbedTokenResult>;
+    /**
+     * The one mint. Resolves the reference to a path on the default branch,
+     * confirms the FILE EXISTS, and signs the claims.
+     *
+     * Access is NOT checked here and must not be: the two callers check it
+     * their own way — `open_page` has already answered the caller the way
+     * `read_file` would (refusal and all) before it asks for a token, and the
+     * connector's mint is for an account that may not be linked to anyone yet.
+     * The load path gates content on the resolved identity's read access, which
+     * is the gate that decides what anybody sees.
+     */
+    private mint;
+    /** The view's address — what a host frames. */
+    embedUrlFor(token: string): string;
+    /** A file's address in the app — what a link opens in a new tab. */
+    appUrlFor(repoRelative: string, slug?: string): string;
+    loadFile(token: string): Promise<EmbedFileView>;
+    /**
+     * Refuse to write text over a file whose bytes are not text: the reader
+     * that would show it answers a refusal, not the content, and a save would
+     * replace a binary with the viewer's draft.
+     */
+    /** A file a page draws rather than a page: bytes no reader edits as text, or an SVG. */
+    private isAsset;
+    private assertTextEditable;
+    readBytes(token: string, path?: string): Promise<{
+        bytes: Buffer;
+        path: string;
+    }>;
+    acquireLock(token: string): Promise<EmbedLockResult>;
+    heartbeat(token: string): Promise<void>;
+    cancel(token: string): Promise<void>;
+    save(token: string, content: string): Promise<void>;
+    /**
+     * File the edit as a change request authored by the viewer, on their own
+     * personal suggestions branch — the same branch and the same one-request
+     * bundle the app's "Propose changes" uses, so a reader who proposes from a
+     * chat and from the app lands in one place.
+     *
+     * No lock: nothing touches the default branch, and the suggestions branch
+     * is this person's own.
+     *
+     * The write is COMMITTED here, synchronously, before the request is opened.
+     * `workspaceService.writeFile` only puts bytes on disk — the app's file
+     * routes commit by releasing the lock they took, which enqueues the commit
+     * for the background worker. Neither is usable here: without a commit the
+     * branch head never moves, and the request opens against a tree identical
+     * to its base — `changedFiles: 0`, and a reviewer told "this pull request
+     * has no file changes to approve" about a proposal that is sitting
+     * uncommitted on disk. An ENQUEUED commit has the same problem with a race
+     * on top of it. `commitChanges` commits and pushes before returning, which
+     * is what the one other server-side propose flow (the plugin join request)
+     * does for exactly this reason.
+     */
+    propose(token: string, content: string): Promise<EmbedProposalResult>;
+    linkAccount(token: string, userId: string): Promise<void>;
+    listLinkedAccounts(userId: string): Promise<EmbedLinkedAccount[]>;
+    unlinkAccount(userId: string, accountId: string): Promise<boolean>;
+    /**
+     * Make sure `user` holds an EDIT lock on `wsPath` on the default branch:
+     * keep it when they already do, take it when nobody does (an expired row
+     * reads as none), refuse with the holder's name when somebody else does.
+     */
+    private ensureHoldsLock;
+    private defaultWorkspaceId;
+    private wsPathFor;
+    /**
+     * A change request's address, through the same builder the workflow tools
+     * use — so a proposal made from a chat and one made by an agent point at
+     * the same place, path prefix of a proxied deployment included.
+     */
+    private changeRequestUrl;
+    /**
+     * Resolve, authorize and locate an edit. Throws `EmbedAccessError` when the
+     * identity does not resolve or may not write. Returns the user (for lock
+     * attribution) and the workspace-relative path.
+     */
+    private requireEditor;
+    /** Resolve the token's identity to a user + read/write verdicts. */
+    private resolveIdentity;
+    /** Whether `repoRelative` is a file on the default branch — a stat, never a read. */
+    private fileExists;
+    /** The typed 404 of {@link readFileBytes}, for a reference, without reading a byte. */
+    private assertExists;
+    private readFileBytes;
+    private verifyToken;
+}
+/**
+ * A path written relative to `from`'s folder, resolved to a repo-relative
+ * path — or null when it escapes the repository or is otherwise unsafe.
+ * A path with a leading slash (`/x`) is taken from the repository root:
+ * that is the form the embed view sends, translating the workspace path a
+ * renderer hands it.
+ */
+export declare function resolveBeside(from: string, path: string): string | null;
+//# sourceMappingURL=embed.service.d.ts.map

package/dist/modules/embed/embed.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed.service.d.ts","sourceRoot":"","sources":["../../../src/modules/embed/embed.service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAY,WAAW,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAI/F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EAEnB,gBAAgB,EAChB,aAAa,EACd,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIrE;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAAU,CAAC;AAE/C,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA6BD,qBAAa,YAAa,YAAW,aAAa;IAW9C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,aAAa;IA3BhC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,MAAM,EAAE,WAAW,EACnB,EAAE,EAAE,SAAS,EACb,gBAAgB,EAAE,kBAAkB,EACpC,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,aAAa,EAC1B,eAAe,EAAE,gBAAgB,EACjC,UAAU,EAAE,WAAW,EACvB,YAAY,EAAE,mBAAmB,EACjC,OAAO,EAAE,kBAAkB;IAC5C;;;;;OAKG;IACc,aAAa,EAAE,cAAc;IAC9C,wFAAwF;IACvE,aAAa,GAAE,mBAAmB,GAAG,IAAW;IASnE,sBAAsB,IAAI,OAAO;IAIjC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAOjD,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKpF,SAAS,CAAC,KAAK,EAAE;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAa7B;;;;;;;;;;OAUG;YACW,IAAI;IAqClB,+CAA+C;IAC/C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIlC,oEAAoE;IACpE,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAWhD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAwCrD;;;;OAIG;IACH,wFAAwF;IACxF,OAAO,CAAC,OAAO;YAID,kBAAkB;IAO1B,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BjF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAapD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCzD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA6ErE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzD,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAQjE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMxE;;;;OAIG;YACW,eAAe;IAa7B,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,SAAS;IAIjB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;OAIG;YACW,aAAa;IAW3B,oEAAoE;YACtD,eAAe;IAoB7B,qFAAqF;YACvE,UAAU;IAUxB,uFAAuF;YACzE,YAAY;YAQZ,aAAa;IAoB3B,OAAO,CAAC,WAAW;CAuBpB;AASD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BvE"}