@bevel-software/platform-core-backend 0.26.0 → 0.27.0

package/dist/modules/workspace/agent-download.builder.js

@@ -0,0 +1,238 @@
+import { createHash } from 'node:crypto';
+import AdmZip from 'adm-zip';
+import { hasHttpStatus, ToolError } from '../tool-helpers/tool.contract.js';
+import { isAbsence } from '../../shared/fs.contract.js';
+/** Why a requested path was left out. The first two are the only verdicts the access rules give. */
+export const NOT_FOUND = 'not found';
+export const DOWNLOAD_PERMISSION_REQUIRED = 'download permission required';
+const EMPTY_FOLDER = 'the folder holds no files';
+/** The refusal a request over the size limit gets: the total and the limit, and no link. */
+export function downloadTooLarge(total, maxBytes) {
+    return new ToolError(`Those files total ${total} bytes uncompressed, over this deployment's ${maxBytes} byte download limit, so no ` +
+        'link was issued. Ask for fewer paths at a time.', 413, { kind: 'download-too-large', totalBytes: total, maxBytes });
+}
+/** The refusal a request naming more files than one request may carry gets: no link. */
+export function downloadTooManyFiles(maxFiles) {
+    return new ToolError(`Those paths hold more than ${maxFiles} files, the most one download request may carry, so no link was ` +
+        'issued. Ask for fewer or smaller folders at a time.', 413, { kind: 'download-too-many-files', maxFiles });
+}
+/**
+ * The refusal a request gets when its folders' zips together would carry more
+ * than the limit — a file inside two requested folders (`a/` and `a/b/`) is
+ * packed into both, so the zips can outgrow the files they hold.
+ */
+function zipsTooLarge(total, maxBytes) {
+    return new ToolError(`The requested folders' zips would total ${total} bytes uncompressed (a file inside two requested folders ` +
+        `is packed into each), over this deployment's ${maxBytes} byte download limit, so no link was issued. Ask ` +
+        'for fewer or non-overlapping folders at a time.', 413, { kind: 'download-too-large', totalBytes: total, maxBytes });
+}
+/**
+ * Judge every file of a download request on its own, and capture the ones
+ * that pass.
+ *
+ * A requested folder is expanded with the explorer's walk, and each file in
+ * it is judged exactly as a file named directly is: included only when the
+ * caller holds BOTH `read` and `download` on THAT file. `download` on the
+ * folder is not enough — a file's own frontmatter or a nested `access.md` can
+ * withhold it, and the app's folder zip once packed such files.
+ *
+ * A file the caller NAMED and may not read is `not found`, the same answer
+ * as a path with nothing at it; a file met inside a requested folder that
+ * they may not read is left out without a word — its name is what the read
+ * model hides, and the explorer leaves it out the same way — and a folder
+ * the explorer would drop (one they may not read, with nothing readable
+ * beneath it) is `not found` too, while a folder they may read that holds
+ * nothing they may read "holds no files", as the explorer keeps it. A
+ * readable file they may not download is `download permission
+ * required`, named either way: the explorer shows it. The file count a
+ * request is held to counts only what the caller may read, so no refusal
+ * tells them how many files they cannot see. Every included file then goes to the deployment's read
+ * hook once, as a `read_file` of it would, and one the hook refuses is listed
+ * with the hook's own words. One refused path never stops the others.
+ *
+ * The size limit is checked on the sizes on disk BEFORE any file is read, and
+ * again on what was read; past it the whole request is refused. It holds twice
+ * over: once on the distinct files (each file's own link), and once on the
+ * folders' zips together, where a file is counted in every zip that packs it —
+ * so what one request stores is bounded by twice the limit, however its
+ * folders overlap. A request holding more than `maxFiles` readable files is
+ * refused before any of them is read.
+ */
+export async function buildDownload(requested, deps) {
+    const { kbDirName } = deps;
+    const toWs = (rel) => (rel ? `${kbDirName}/${rel}` : kbDirName);
+    const refused = [];
+    const refusedPaths = new Set();
+    const refuse = (path, reason) => {
+        if (refusedPaths.has(path))
+            return;
+        refusedPaths.add(path);
+        refused.push({ path, reason });
+    };
+    /** Every candidate file, named directly or found in a folder, once, in the order first met. */
+    const sizes = new Map();
+    /** The files named directly, and each requested folder's files, before any verdict. */
+    const direct = [];
+    const candidates = [];
+    for (const wsPath of [...new Set(requested)]) {
+        let found;
+        try {
+            found = await deps.candidatesAt(wsPath);
+        }
+        catch (err) {
+            // A spelling the reads refuse (the git folder, a link) is a path the
+            // caller may not read: answered as nothing there, like any other.
+            if (hasHttpStatus(err) || isAbsence(err)) {
+                refuse(wsPath, NOT_FOUND);
+                continue;
+            }
+            throw err;
+        }
+        if (found.kind === 'missing') {
+            refuse(wsPath, NOT_FOUND);
+            continue;
+        }
+        for (const f of found.files)
+            if (!sizes.has(f.path))
+                sizes.set(f.path, f.bytes);
+        if (found.kind === 'folder')
+            candidates.push({ path: wsPath, files: found.files.map((f) => f.path) });
+        else
+            direct.push(...found.files.map((f) => f.path));
+    }
+    // READ first, over everything found — the files and the requested folders
+    // themselves (the root is every caller's) — before any other answer is
+    // given. One batch, the primitive the explorer tree judges with.
+    const relOfFolder = (wsPath) => wsPath === kbDirName ? '' : wsPath.startsWith(`${kbDirName}/`) ? wsPath.slice(kbDirName.length + 1) : wsPath;
+    const folderRels = candidates.map((f) => relOfFolder(f.path)).filter((rel) => rel !== '');
+    const asked = [...new Set([...sizes.keys(), ...folderRels])];
+    const readable = asked.length > 0 ? await deps.canReadBatch(asked) : new Map();
+    // The count the caller is held to is the count of what they may read: a
+    // refusal that counted hidden files would tell them how many there are.
+    const visibleCount = [...sizes.keys()].filter((p) => readable.get(p) === true).length;
+    if (visibleCount > deps.maxFiles)
+        throw downloadTooManyFiles(deps.maxFiles);
+    // A folder is answered as the explorer shows it. The explorer keeps a
+    // folder the caller may read — left empty when its files are filtered, it
+    // stays, "holds no files" — and a folder with something readable beneath
+    // it; one that is neither it drops outright, so here it is `not found`,
+    // the answer a folder that is not there gets. Only a folder with files to
+    // pack is then asked for its own `download`: a zip of it is asked for as
+    // the app's folder download is, before any file inside is judged — a
+    // file's own grant must not open a folder its rules deny.
+    const folders = [];
+    for (const folder of candidates) {
+        const rel = relOfFolder(folder.path);
+        const folderReadable = rel === '' || readable.get(rel) === true;
+        const somethingReadable = folder.files.some((f) => readable.get(f) === true);
+        if (!folderReadable && !somethingReadable)
+            refuse(folder.path, NOT_FOUND);
+        else if (!somethingReadable)
+            refuse(folder.path, EMPTY_FOLDER);
+        else if (deps.canDownloadFolder && !(await deps.canDownloadFolder(folder.path))) {
+            refuse(folder.path, DOWNLOAD_PERMISSION_REQUIRED);
+        }
+        else
+            folders.push(folder);
+    }
+    // Every file judged on its own: the named ones and the kept folders' —
+    // read first, download on what may be read.
+    const all = [...new Set([...direct, ...folders.flatMap((f) => f.files)])];
+    const visible = all.filter((p) => readable.get(p) === true);
+    const downloadable = visible.length > 0 ? await deps.canDownloadBatch(visible) : new Map();
+    const named = new Set(requested);
+    const allowed = [];
+    for (const rel of all) {
+        if (readable.get(rel) !== true) {
+            // Named by the caller: answered as nothing there. Found inside a folder:
+            // not answered at all — listing it as refused would hand the caller the
+            // name of a file the read model hides from them.
+            if (named.has(toWs(rel)))
+                refuse(toWs(rel), NOT_FOUND);
+        }
+        else if (downloadable.get(rel) !== true)
+            refuse(toWs(rel), DOWNLOAD_PERMISSION_REQUIRED);
+        else
+            allowed.push(rel);
+    }
+    // The read hook, once per file that would be included.
+    const passed = [];
+    for (const rel of allowed) {
+        try {
+            await deps.notifyRead(toWs(rel));
+            passed.push(rel);
+        }
+        catch (err) {
+            if (!hasHttpStatus(err))
+                throw err;
+            refuse(toWs(rel), err.message);
+        }
+    }
+    // The limit, on the sizes on disk, before a byte is read.
+    const declared = passed.reduce((sum, rel) => sum + (sizes.get(rel) ?? 0), 0);
+    if (declared > deps.maxBytes)
+        throw downloadTooLarge(declared, deps.maxBytes);
+    const passedSet = new Set(passed);
+    const zipsDeclared = folders.reduce((sum, folder) => sum + folder.files.reduce((n, rel) => n + (passedSet.has(rel) ? (sizes.get(rel) ?? 0) : 0), 0), 0);
+    if (zipsDeclared > deps.maxBytes)
+        throw zipsTooLarge(zipsDeclared, deps.maxBytes);
+    const files = [];
+    const artifacts = [];
+    const captured = new Map();
+    let total = 0;
+    for (const rel of passed) {
+        const wsPath = toWs(rel);
+        let data;
+        try {
+            data = await deps.readFile(wsPath);
+        }
+        catch (err) {
+            // Gone between the walk and the read: what a read a moment later says.
+            if (isAbsence(err) || hasHttpStatus(err)) {
+                refuse(wsPath, NOT_FOUND);
+                continue;
+            }
+            throw err;
+        }
+        // Again on what was read: a file may have grown since it was measured.
+        total += data.byteLength;
+        if (total > deps.maxBytes)
+            throw downloadTooLarge(total, deps.maxBytes);
+        captured.set(rel, data);
+        files.push({ path: wsPath, bytes: data.byteLength, sha256: createHash('sha256').update(data).digest('hex') });
+        artifacts.push({ data, contentType: deps.contentTypeOf(wsPath, data), filename: baseName(rel) || 'file' });
+    }
+    // One zip per requested folder that kept at least one file, its entries at
+    // their full repository paths, so an upload of it at the repository root
+    // lands every file where it came from.
+    // Again on what was read, before a zip is built.
+    const kept = folders.map((folder) => folder.files.filter((rel) => captured.has(rel)));
+    const zipsTotal = kept.flat().reduce((sum, rel) => sum + captured.get(rel).byteLength, 0);
+    if (zipsTotal > deps.maxBytes)
+        throw zipsTooLarge(zipsTotal, deps.maxBytes);
+    const zipped = [];
+    for (const [i, folder] of folders.entries()) {
+        const files = kept[i];
+        if (files.length === 0)
+            continue;
+        const zip = new AdmZip();
+        let bytes = 0;
+        for (const rel of files) {
+            const data = captured.get(rel);
+            zip.addFile(rel, data);
+            bytes += data.byteLength;
+        }
+        zipped.push({ path: folder.path, bytes, files: files.map(toWs) });
+        const rel = folder.path === kbDirName ? '' : folder.path.slice(kbDirName.length + 1).replace(/\/+$/, '');
+        artifacts.push({
+            data: zip.toBuffer(),
+            contentType: 'application/zip',
+            filename: `${baseName(rel) || kbDirName}.zip`,
+        });
+    }
+    return { files, folders: zipped, refused, artifacts };
+}
+function baseName(rel) {
+    return rel.split('/').filter(Boolean).pop() ?? '';
+}
+//# sourceMappingURL=agent-download.builder.js.map

package/dist/modules/workspace/agent-download.builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-download.builder.js","sourceRoot":"","sources":["../../../src/modules/workspace/agent-download.builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAGxD,oGAAoG;AACpG,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAC3E,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAgEjD,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB;IAC9D,OAAO,IAAI,SAAS,CAClB,qBAAqB,KAAK,+CAA+C,QAAQ,8BAA8B;QAC7G,iDAAiD,EACnD,GAAG,EACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,IAAI,SAAS,CAClB,8BAA8B,QAAQ,kEAAkE;QACtG,qDAAqD,EACvD,GAAG,EACH,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAC9C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,QAAgB;IACnD,OAAO,IAAI,SAAS,CAClB,2CAA2C,KAAK,2DAA2D;QACzG,gDAAgD,QAAQ,mDAAmD;QAC3G,iDAAiD,EACnD,GAAG,EACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAmB,EAAE,IAAuB;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,MAAc,EAAQ,EAAE;QACpD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACnC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,+FAA+F;IAC/F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,uFAAuF;IACvF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAwC,EAAE,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC7C,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;YACjG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAC7C,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/G,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;IAChG,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACtF,IAAI,YAAY,GAAG,IAAI,CAAC,QAAQ;QAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE5E,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;QAChE,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc,IAAI,CAAC,iBAAiB;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;aACrE,IAAI,CAAC,iBAAiB;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;aAC1D,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;QACpD,CAAC;;YAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;IAC5G,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,yEAAyE;YACzE,wEAAwE;YACxE,iDAAiD;YACjD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,4BAA4B,CAAC,CAAC;;YACtF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,uDAAuD;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ;QAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAC/G,CAAC,CACF,CAAC;IACF,IAAI,YAAY,GAAG,IAAI,CAAC,QAAQ;QAAE,MAAM,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAElF,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,uEAAuE;QACvE,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9G,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,uCAAuC;IACvC,iDAAiD;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC3F,IAAI,SAAS,GAAG,IAAI,CAAC,QAAQ;QAAE,MAAM,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAChC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvB,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzG,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE;YACpB,WAAW,EAAE,iBAAiB;YAC9B,QAAQ,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,MAAM;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC"}

package/dist/modules/workspace/agent-download.routes.d.ts

@@ -0,0 +1,77 @@
+import express from 'express';
+import { type IAgentDownloadStore } from './agent-download.store.js';
+/** The route's own prefix, under `/api`. */
+export declare const AGENT_DOWNLOAD_ROUTE = "/agent/downloads/:token";
+/**
+ * The same endpoint with the token in the `x-download-token` HEADER instead of
+ * the path — the address `downloadUrl` is, without its last segment. For a
+ * caller that would rather its credential not land in an access log or a
+ * shell history, as the upload route's header form is.
+ */
+export declare const AGENT_DOWNLOAD_HEADER_ROUTE = "/agent/downloads";
+export interface AgentDownloadRouteDeps {
+    downloads: IAgentDownloadStore;
+    /**
+     * Every user a fetch identifies itself as, by the credentials this server
+     * recognises — none when it carries none (or none that verifies). The link
+     * is the whole credential, so most fetches carry nothing; this only lets the
+     * route refuse a fetch that says it is SOMEONE ELSE than the user the link
+     * was issued to. Optional: absent, identity is not asked.
+     */
+    identify?: (req: express.Request) => Promise<string[]>;
+}
+/** The verifiers {@link createDownloadFetcherIdentifier} asks, as the composition root has them. */
+export interface DownloadFetcherVerifiers {
+    /** A connection key or internal token (the tool routes' verifier). Never throws for a bad token. */
+    verifyToolToken(token: string): Promise<{
+        ok: true;
+        auth: {
+            userId: string;
+        };
+    } | {
+        ok: false;
+    }>;
+    /** An app session JWT's signature and expiry; throws when it does not verify. */
+    verifySession(token: string): {
+        userId: string;
+    };
+}
+/**
+ * Who a download fetch says it is, by EVERY credential this server issues:
+ * a connection key or internal token, or an app session — as a bearer, or
+ * as the `bevel_token` cookie a browser sends on its own. Every credential
+ * is asked, not the first that verifies: a bearer and a cookie may name two
+ * different users, and either one being someone else must refuse the link.
+ * Empty when it carries none that verifies.
+ *
+ * Every kind, because the question is "is this fetch somebody OTHER than
+ * the user the link was issued to?", and a credential kind left unasked is a
+ * fetch that answers "nobody" while carrying another user's identity. A
+ * session is asked by its signature alone, not whether its account is still
+ * on: a switched-off account still says who it is, and that is all the
+ * route needs to refuse it.
+ */
+export declare function createDownloadFetcherIdentifier(verifiers: DownloadFetcherVerifiers, readCookie: (req: express.Request) => string | null): (req: express.Request) => Promise<string[]>;
+/**
+ * `GET /api/agent/downloads/:token` — the outgoing twin of the agent upload
+ * route, authenticated by a single-use link token and nothing else.
+ *
+ * Everything that decides WHAT is served happened when the link was issued:
+ * `request_file_download` judged every file against the caller's `read` and
+ * `download` rules, ran the deployment's read hook and captured the bytes.
+ * This route only hands those bytes over, once, and deletes them when the
+ * response ends — sent in full, failed, or abandoned by the client. A token
+ * that is unknown, already fetched, expired or another user's gets one 404
+ * that says none of those apart.
+ */
+export declare function createAgentDownloadRoutes(deps: AgentDownloadRouteDeps): express.Router;
+/**
+ * `attachment` with the name twice (RFC 6266): an ASCII `filename` for a
+ * client that reads only that — anything outside printable ASCII, and the
+ * quote and backslash, become `_` — and the exact name as RFC 5987
+ * `filename*`, where `encodeURIComponent`'s leftovers `'()*` are encoded
+ * too, as the grammar requires. Without the plain form such a client would
+ * save the file under the URL's last segment: the token.
+ */
+export declare function attachmentDisposition(filename: string): string;
+//# sourceMappingURL=agent-download.routes.d.ts.map

package/dist/modules/workspace/agent-download.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-download.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/agent-download.routes.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIzF,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,mBAAmB,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACxD;AAED,oGAAoG;AACpG,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAA;KAAE,CAAC,CAAC;IAChG,iFAAiF;IACjF,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,wBAAwB,EACnC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,GAAG,IAAI,GAClD,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAuB7C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CA0DtF;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ9D"}

package/dist/modules/workspace/agent-download.routes.js

@@ -0,0 +1,156 @@
+import { createReadStream } from 'node:fs';
+import express from 'express';
+import { logger } from '../../shared/logging.js';
+import { DownloadTokenError } from './agent-download.store.js';
+const log = logger('agent-downloads');
+/** The route's own prefix, under `/api`. */
+export const AGENT_DOWNLOAD_ROUTE = '/agent/downloads/:token';
+/**
+ * The same endpoint with the token in the `x-download-token` HEADER instead of
+ * the path — the address `downloadUrl` is, without its last segment. For a
+ * caller that would rather its credential not land in an access log or a
+ * shell history, as the upload route's header form is.
+ */
+export const AGENT_DOWNLOAD_HEADER_ROUTE = '/agent/downloads';
+/**
+ * Who a download fetch says it is, by EVERY credential this server issues:
+ * a connection key or internal token, or an app session — as a bearer, or
+ * as the `bevel_token` cookie a browser sends on its own. Every credential
+ * is asked, not the first that verifies: a bearer and a cookie may name two
+ * different users, and either one being someone else must refuse the link.
+ * Empty when it carries none that verifies.
+ *
+ * Every kind, because the question is "is this fetch somebody OTHER than
+ * the user the link was issued to?", and a credential kind left unasked is a
+ * fetch that answers "nobody" while carrying another user's identity. A
+ * session is asked by its signature alone, not whether its account is still
+ * on: a switched-off account still says who it is, and that is all the
+ * route needs to refuse it.
+ */
+export function createDownloadFetcherIdentifier(verifiers, readCookie) {
+    return async (req) => {
+        const header = req.headers.authorization;
+        const bearer = typeof header === 'string' && header.toLowerCase().startsWith('bearer ')
+            ? header.slice(header.indexOf(' ') + 1).trim()
+            : '';
+        const users = new Set();
+        for (const token of [bearer, readCookie(req) ?? '']) {
+            if (token === '')
+                continue;
+            const tool = await verifiers.verifyToolToken(token).catch(() => ({ ok: false }));
+            if (tool.ok) {
+                users.add(tool.auth.userId);
+                continue;
+            }
+            try {
+                users.add(verifiers.verifySession(token).userId);
+            }
+            catch {
+                // Not a session either: this credential names nobody.
+            }
+        }
+        return [...users];
+    };
+}
+/**
+ * `GET /api/agent/downloads/:token` — the outgoing twin of the agent upload
+ * route, authenticated by a single-use link token and nothing else.
+ *
+ * Everything that decides WHAT is served happened when the link was issued:
+ * `request_file_download` judged every file against the caller's `read` and
+ * `download` rules, ran the deployment's read hook and captured the bytes.
+ * This route only hands those bytes over, once, and deletes them when the
+ * response ends — sent in full, failed, or abandoned by the client. A token
+ * that is unknown, already fetched, expired or another user's gets one 404
+ * that says none of those apart.
+ */
+export function createAgentDownloadRoutes(deps) {
+    const router = express.Router();
+    const { downloads, identify } = deps;
+    const handle = async (req, res) => {
+        // THE TOKEN FIRST, before anything about the request is answered.
+        const token = tokenOf(req);
+        let claimed;
+        try {
+            const fetchers = identify ? await identify(req).catch(() => []) : [];
+            claimed = downloads.claim(token, fetchers);
+        }
+        catch (err) {
+            if (err instanceof DownloadTokenError) {
+                res.setHeader('Cache-Control', 'no-store');
+                res.status(err.status).json({ error: err.message });
+                return;
+            }
+            log.error('download failed:', { err });
+            res.status(500).json({ error: 'Download failed' });
+            return;
+        }
+        // The bytes go when the response ENDS, however it ends: `close` fires
+        // after a complete send, after a failed one, and when the client leaves.
+        let finished = false;
+        const done = () => {
+            if (finished)
+                return;
+            finished = true;
+            void downloads.finish(token);
+        };
+        res.on('close', done);
+        res.setHeader('Content-Type', claimed.contentType);
+        res.setHeader('Content-Length', String(claimed.bytes));
+        res.setHeader('Content-Disposition', attachmentDisposition(claimed.filename));
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        const stream = createReadStream(claimed.absolutePath);
+        stream.on('error', (err) => {
+            // The detail stays in the log: it quotes the store's absolute path.
+            log.error('could not read a stored download:', { err });
+            if (!res.headersSent)
+                res.status(500).json({ error: 'Download failed' });
+            else
+                res.destroy();
+            done();
+        });
+        stream.pipe(res);
+    };
+    // Express answers HEAD with the GET handler, which would spend the link on a
+    // probe that never receives the bytes. A link is for one GET, so HEAD is
+    // refused before the token is looked at.
+    const noHead = (_req, res) => {
+        res.setHeader('Allow', 'GET');
+        res.status(405).end();
+    };
+    router.head(AGENT_DOWNLOAD_ROUTE, noHead);
+    router.head(AGENT_DOWNLOAD_HEADER_ROUTE, noHead);
+    router.get(AGENT_DOWNLOAD_ROUTE, handle);
+    router.get(AGENT_DOWNLOAD_HEADER_ROUTE, handle);
+    return router;
+}
+/**
+ * `attachment` with the name twice (RFC 6266): an ASCII `filename` for a
+ * client that reads only that — anything outside printable ASCII, and the
+ * quote and backslash, become `_` — and the exact name as RFC 5987
+ * `filename*`, where `encodeURIComponent`'s leftovers `'()*` are encoded
+ * too, as the grammar requires. Without the plain form such a client would
+ * save the file under the URL's last segment: the token.
+ */
+export function attachmentDisposition(filename) {
+    const name = filename.replace(/[\r\n]/g, '') || 'download';
+    const ascii = name.replace(/[^\x20-\x7e]|["\\]/g, '_');
+    const encoded = encodeURIComponent(name).replace(/['()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+    return `attachment; filename="${ascii}"; filename*=UTF-8''${encoded}`;
+}
+/**
+ * The token the fetch presented: the `:token` path segment, or the
+ * `x-download-token` header on the bare address. The path wins when both are
+ * present. No token at all is the empty string, which meets the one refusal.
+ */
+function tokenOf(req) {
+    const inPath = req.params.token;
+    if (typeof inPath === 'string' && inPath.trim() !== '')
+        return inPath.trim();
+    const header = req.headers['x-download-token'];
+    if (typeof header === 'string' && header.trim() !== '')
+        return header.trim();
+    return '';
+}
+//# sourceMappingURL=agent-download.routes.js.map

package/dist/modules/workspace/agent-download.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-download.routes.js","sourceRoot":"","sources":["../../../src/modules/workspace/agent-download.routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAA4B,MAAM,2BAA2B,CAAC;AAEzF,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAEtC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAsB9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,+BAA+B,CAC7C,SAAmC,EACnC,UAAmD;IAEnD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YACtE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC3B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAA4B;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAErC,MAAM,MAAM,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,kEAAkE;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9E,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,oEAAoE;YACpE,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;;gBACpE,GAAG,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,6EAA6E;IAC7E,yEAAyE;IACzE,yCAAyC;IACzC,MAAM,MAAM,GAA2B,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnD,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAC9C,SAAS,EACT,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;IACF,OAAO,yBAAyB,KAAK,uBAAuB,OAAO,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,GAAoB;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO,EAAE,CAAC;AACZ,CAAC"}