@chainingintention/pi-web-cn 1.202606.4 → 1.202606.6

package/dist/server/machines/machinePluginProxyRoutes.js

@@ -0,0 +1,179 @@
+import { machineScopedPluginId, parseMachineScopedPluginId } from "../../shared/machinePluginIds.js";
+import { isPiWebPluginId } from "../../shared/pluginIds.js";
+import { RemoteMachineRequestError } from "./machineClient.js";
+import { MachineService } from "./machineService.js";
+const MACHINE_PLUGIN_MANIFEST_TIMEOUT_MS = 10_000;
+const SAFE_RESPONSE_HEADERS = new Set([
+    "content-type",
+    "content-length",
+    "cache-control",
+    "last-modified",
+    "etag",
+    "content-security-policy",
+    "x-content-type-options",
+]);
+export function registerMachinePluginProxyRoutes(app, machines = new MachineService()) {
+    app.get("/api/machines/:machineId/pi-web-plugins/manifest.json", async (request, reply) => {
+        if (request.params.machineId === "local")
+            return { plugins: [] };
+        const client = await machines.remoteClient(request.params.machineId);
+        if (client === undefined)
+            return reply.code(404).send({ error: "Machine not found" });
+        try {
+            const response = await client.requestJson("GET", "/pi-web-plugins/manifest.json", undefined, { timeoutMs: MACHINE_PLUGIN_MANIFEST_TIMEOUT_MS });
+            if (response.statusCode === 404)
+                return { plugins: [] };
+            if (response.statusCode < 200 || response.statusCode >= 300)
+                return await reply.code(response.statusCode).send(response.body);
+            return rewriteRemotePluginManifest(request.params.machineId, parseRemoteManifest(response.body));
+        }
+        catch (error) {
+            return sendGatewayError(reply, request.params.machineId, error);
+        }
+    });
+}
+export async function proxyMachinePluginAsset(machines, scopedPluginId, assetPath, requestUrl, reply) {
+    const remotePlugin = parseMachineScopedPluginId(scopedPluginId);
+    if (remotePlugin === undefined)
+        return false;
+    const client = await machines.remoteClient(remotePlugin.machineId);
+    if (client === undefined) {
+        await reply.code(404).send({ error: "Machine not found" });
+        return true;
+    }
+    const requestPath = remotePluginAssetRequestPath(remotePlugin, assetPath, requestUrl);
+    if (requestPath === undefined) {
+        await reply.code(400).send({ error: "Invalid remote PI WEB plugin asset path" });
+        return true;
+    }
+    try {
+        const upstream = await client.request("GET", requestPath);
+        reply.code(upstream.statusCode);
+        applySafeHeaders(reply, upstream.headers);
+        if (upstream.body === undefined)
+            await reply.send();
+        else
+            await reply.send(upstream.body);
+        return true;
+    }
+    catch (error) {
+        sendGatewayError(reply, remotePlugin.machineId, error);
+        return true;
+    }
+}
+function rewriteRemotePluginManifest(machineId, manifest) {
+    return {
+        plugins: manifest.plugins.flatMap((plugin) => {
+            const modulePath = remotePluginModulePath(plugin.id, plugin.module);
+            if (modulePath === undefined)
+                return [];
+            return [{
+                    ...plugin,
+                    module: `/pi-web-plugins/${encodeURIComponent(machineScopedPluginId(machineId, plugin.id))}/${modulePath.path}${modulePath.query}`,
+                }];
+        }),
+    };
+}
+function remotePluginModulePath(pluginId, module) {
+    if (!isPiWebPluginId(pluginId))
+        return undefined;
+    const prefix = `/pi-web-plugins/${encodeURIComponent(pluginId)}/`;
+    const base = new URL(prefix, "http://pi-web.local");
+    try {
+        const url = new URL(module, base);
+        if (url.origin !== base.origin || !url.pathname.startsWith(prefix))
+            return undefined;
+        const path = safeRemotePluginAssetPath(url.pathname.slice(prefix.length));
+        return path === undefined ? undefined : { path, query: url.search };
+    }
+    catch {
+        return undefined;
+    }
+}
+function remotePluginAssetRequestPath(remotePlugin, assetPath, requestUrl) {
+    const path = safeRemotePluginAssetPath(assetPath);
+    if (path === undefined)
+        return undefined;
+    const query = requestUrl.includes("?") ? requestUrl.slice(requestUrl.indexOf("?")) : "";
+    return `/pi-web-plugins/${encodeURIComponent(remotePlugin.pluginId)}/${path}${query}`;
+}
+function safeRemotePluginAssetPath(path) {
+    const segments = [];
+    for (const rawSegment of path.split("/")) {
+        const segment = safeRemotePluginAssetPathSegment(rawSegment);
+        if (segment === undefined)
+            return undefined;
+        if (segment === "")
+            continue;
+        segments.push(segment);
+    }
+    if (segments.length === 0)
+        return undefined;
+    return segments.map((segment) => encodeURIComponent(segment)).join("/");
+}
+function safeRemotePluginAssetPathSegment(rawSegment) {
+    if (rawSegment === "" || rawSegment === ".")
+        return "";
+    if (/%(?:2f|5c)/iu.test(rawSegment))
+        return undefined;
+    let segment;
+    try {
+        segment = decodeURIComponent(rawSegment);
+    }
+    catch {
+        return undefined;
+    }
+    if (segment === "" || segment === ".")
+        return "";
+    if (segment === ".." || segment.includes("/") || segment.includes("\\") || hasControlCharacter(segment))
+        return undefined;
+    return segment;
+}
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function parseRemoteManifest(value) {
+    if (!isRecord(value) || !Array.isArray(value["plugins"]))
+        throw new Error("Invalid remote PI WEB plugin manifest");
+    return {
+        plugins: value["plugins"].map((entry) => {
+            if (!isRecord(entry) || typeof entry["id"] !== "string" || !isPiWebPluginId(entry["id"]) || typeof entry["module"] !== "string" || entry["module"] === "") {
+                throw new Error("Invalid remote PI WEB plugin manifest entry");
+            }
+            return {
+                id: entry["id"],
+                module: entry["module"],
+                ...(typeof entry["source"] === "string" ? { source: entry["source"] } : {}),
+                ...(typeof entry["scope"] === "string" ? { scope: entry["scope"] } : {}),
+            };
+        }),
+    };
+}
+function applySafeHeaders(reply, headers) {
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        if (!SAFE_RESPONSE_HEADERS.has(name.toLowerCase()))
+            continue;
+        reply.header(name, value);
+    }
+}
+function sendGatewayError(reply, machineId, error) {
+    const statusCode = error instanceof RemoteMachineRequestError ? error.statusCode : 502;
+    const label = statusCode === 504 ? "Remote machine timeout" : "Remote machine unavailable";
+    return reply.code(statusCode).send({
+        error: label,
+        machineId,
+        statusCode,
+        detail: error instanceof Error ? error.message : String(error),
+    });
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=machinePluginProxyRoutes.js.map

package/dist/server/machines/machinePluginProxyRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machinePluginProxyRoutes.js","sourceRoot":"","sources":["../../../src/server/machines/machinePluginProxyRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAmC,MAAM,kCAAkC,CAAC;AACtI,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAsB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAiBrD,MAAM,kCAAkC,GAAG,MAAM,CAAC;AAElD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,MAAM;IACN,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC,CAAC,GAAoB,EAAE,WAAuC,IAAI,cAAc,EAAE;IAChI,GAAG,CAAC,GAAG,CAAoC,uDAAuD,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3H,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAEjE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAEtF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,+BAA+B,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAChJ,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACxD,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG;gBAAE,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9H,OAAO,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAoC,EAAE,cAAsB,EAAE,SAAiB,EAAE,UAAkB,EAAE,KAAmB;IACpK,MAAM,YAAY,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,4BAA4B,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACtF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;;YAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,SAAiB,EAAE,QAA8B;IACpF,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC3C,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACpE,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACxC,OAAO,CAAC;oBACN,GAAG,MAAM;oBACT,MAAM,EAAE,mBAAmB,kBAAkB,CAAC,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE;iBACnI,CAAC,CAAC;QACL,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,MAAc;IAC9D,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,MAAM,GAAG,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACrF,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,YAAwC,EAAE,SAAiB,EAAE,UAAkB;IACnH,MAAM,IAAI,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,OAAO,mBAAmB,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,gCAAgC,CAAC,UAAkB;IAC1D,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvD,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1H,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACnH,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC1J,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC;gBACf,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;gBACvB,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,OAAsD;IACnG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC7D,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,SAAiB,EAAE,KAAc;IAC9E,MAAM,UAAU,GAAG,KAAK,YAAY,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;IACvF,MAAM,KAAK,GAAG,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B,CAAC;IAC3F,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;QACjC,KAAK,EAAE,KAAK;QACZ,SAAS;QACT,UAAU;QACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/server/machines/machineProxyRoutes.js

@@ -7,6 +7,7 @@ export const REMOTE_WEBSOCKET_ROUTES = FEDERATED_WEBSOCKET_ROUTES;
 const SAFE_RESPONSE_HEADERS = new Set([
     "content-type",
     "content-length",
+    "content-disposition",
     "cache-control",
     "last-modified",
     "etag",

package/dist/server/machines/machineProxyRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"machineProxyRoutes.js","sourceRoot":"","sources":["../../../src/server/machines/machineProxyRoutes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,MAAM;IACN,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAEH,MAAM,UAAU,0BAA0B,CAAC,GAAoB,EAAE,QAAQ,GAAG,IAAI,cAAc,EAAE;IAC9F,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,CAAmD;YAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,2BAA2B,IAAI,CAAC,IAAI,EAAE;YAC3C,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpI,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAoC,2BAA2B,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YAC3H,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAwB,EAAE,SAAiB,EAAE,MAAc,EAAE,UAAkB,EAAE,IAAa,EAAE,KAAmB;IACjJ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1F,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAwB,EAAE,SAAiB,EAAE,UAAkB,EAAE,MAAiB;IAC9G,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yDAAyD,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,UAAkB;IAC1D,MAAM,aAAa,GAAG,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5G,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;IACxE,OAAO,OAAO,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,OAAsD;IACnG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC7D,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,SAAiB,EAAE,KAAc;IAC9E,MAAM,UAAU,GAAG,KAAK,YAAY,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;IACvF,MAAM,KAAK,GAAG,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B,CAAC;IAC3F,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;QACjC,KAAK,EAAE,KAAK;QACZ,SAAS;QACT,UAAU;QACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"machineProxyRoutes.js","sourceRoot":"","sources":["../../../src/server/machines/machineProxyRoutes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,gBAAgB;IAChB,qBAAqB;IACrB,eAAe;IACf,eAAe;IACf,MAAM;IACN,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAEH,MAAM,UAAU,0BAA0B,CAAC,GAAoB,EAAE,QAAQ,GAAG,IAAI,cAAc,EAAE;IAC9F,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,CAAmD;YAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,2BAA2B,IAAI,CAAC,IAAI,EAAE;YAC3C,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpI,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAoC,2BAA2B,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YAC3H,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAwB,EAAE,SAAiB,EAAE,MAAc,EAAE,UAAkB,EAAE,IAAa,EAAE,KAAmB;IACjJ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1F,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAwB,EAAE,SAAiB,EAAE,UAAkB,EAAE,MAAiB;IAC9G,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yDAAyD,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,UAAkB;IAC1D,MAAM,aAAa,GAAG,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5G,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;IACxE,OAAO,OAAO,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,OAAsD;IACnG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAC7D,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,SAAiB,EAAE,KAAc;IAC9E,MAAM,UAAU,GAAG,KAAK,YAAY,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;IACvF,MAAM,KAAK,GAAG,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B,CAAC;IAC3F,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;QACjC,KAAK,EAAE,KAAK;QACZ,SAAS;QACT,UAAU;QACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC"}

package/dist/server/managementEmbed.js

@@ -0,0 +1,205 @@
+import { mkdir, realpath } from "node:fs/promises";
+import { join, relative, resolve, sep, isAbsolute } from "node:path";
+export const MANAGEMENT_EMBED_MODE_HEADER = "x-pi-web-embed-mode";
+export const MANAGEMENT_EMBED_TOKEN_HEADER = "x-pi-web-embed-token";
+export const MANAGEMENT_EMBED_CONTEXT_HEADER = "x-pi-web-management-context";
+const MANAGEMENT_FORCE_DENY_TOOLS = new Set(["bash", "shell", "terminal", "terminal-command-runs"]);
+export function readManagementEmbedRequest(headers, query) {
+    const modeHeader = firstHeader(headers[MANAGEMENT_EMBED_MODE_HEADER]);
+    const tokenHeader = firstHeader(headers[MANAGEMENT_EMBED_TOKEN_HEADER]);
+    const embedQuery = typeof query?.["embed"] === "string" ? query["embed"].trim() : undefined;
+    const tokenQuery = typeof query?.["token"] === "string" ? query["token"].trim() : undefined;
+    const isManagement = modeHeader === "management" || embedQuery === "management" || tokenHeader !== undefined || tokenQuery !== undefined;
+    const token = tokenHeader ?? tokenQuery;
+    return {
+        ...(isManagement ? { mode: "management" } : {}),
+        ...(token === undefined ? {} : { token }),
+    };
+}
+export async function managementContextForRequest(request, runtime) {
+    const embed = readManagementEmbedRequest(request.headers, isRecord(request.query) ? request.query : undefined);
+    if (embed.mode !== "management")
+        return undefined;
+    if (runtime?.enabled !== true)
+        throw new Error("Management embed mode is not configured");
+    if (embed.token === undefined || embed.token === "")
+        throw new Error("Management embed token is required");
+    return runtime.authenticate(embed.token);
+}
+export function createManagementEmbedRuntime(config, env = process.env) {
+    if (config?.enabled !== true)
+        return undefined;
+    const introspectionUrl = config.auth?.introspectionUrl?.trim();
+    const configuredServiceSecretEnv = config.auth?.serviceSecretEnv?.trim();
+    const serviceSecretEnv = configuredServiceSecretEnv !== undefined && configuredServiceSecretEnv !== "" ? configuredServiceSecretEnv : "PI_WEB_MANAGEMENT_EMBED_SERVICE_TOKEN";
+    const serviceSecret = env[serviceSecretEnv]?.trim();
+    if (introspectionUrl === undefined || introspectionUrl === "" || serviceSecret === undefined || serviceSecret === "") {
+        return {
+            enabled: true,
+            projectRoot: config.projectRoot ?? "/root/Piweb",
+            authenticate: () => Promise.reject(new Error("Management embed auth is not configured")),
+        };
+    }
+    return {
+        enabled: true,
+        projectRoot: config.projectRoot ?? "/root/Piweb",
+        authenticate: async (token) => introspectManagementToken(introspectionUrl, serviceSecret, token),
+    };
+}
+export async function managedProjectPath(projectRoot, rootUserId, projectId) {
+    const root = await ensureRealDirectory(projectRoot);
+    const requested = join(root, safePathSegment(rootUserId), safePathSegment(projectId));
+    ensureInside(root, requested);
+    await mkdir(requested, { recursive: true });
+    const target = await realpath(requested);
+    ensureInside(root, target);
+    return target;
+}
+export async function projectFromManagedEmbedContext(projectRoot, context, projectId) {
+    const entry = context.projects.find((project) => project.id === projectId);
+    if (entry === undefined)
+        throw new Error("Project is not authorized for this management session");
+    const entryRoot = entry.root?.trim();
+    const path = entryRoot !== undefined && entryRoot !== ""
+        ? await assertManagedCwd(projectRoot, context, entryRoot)
+        : await managedProjectPath(projectRoot, context.user.rootUserId, entry.id);
+    return { id: entry.id, name: entry.name !== "" ? entry.name : entry.id, path, createdAt: new Date(0).toISOString() };
+}
+export async function projectsFromManagedEmbedContext(projectRoot, context) {
+    return Promise.all(context.projects.map((project) => projectFromManagedEmbedContext(projectRoot, context, project.id)));
+}
+export async function assertManagedCwd(projectRoot, context, cwd) {
+    const root = await ensureRealDirectory(projectRoot);
+    const requested = await realpath(resolve(cwd));
+    ensureInside(root, requested);
+    const authorizedRoots = await Promise.all(context.projects.map(async (project) => {
+        const projectRootOverride = project.root?.trim();
+        if (projectRootOverride !== undefined && projectRootOverride !== "")
+            return realpath(resolve(projectRootOverride));
+        return managedProjectPath(root, context.user.rootUserId, project.id);
+    }));
+    if (!authorizedRoots.some((authorized) => isInside(authorized, requested))) {
+        throw new Error("Path is outside the managed project sandbox");
+    }
+    return requested;
+}
+export function managementToolAllowed(context, tool) {
+    if (MANAGEMENT_FORCE_DENY_TOOLS.has(tool))
+        return false;
+    const deny = new Set(context.tools?.deny ?? []);
+    if (deny.has(tool))
+        return false;
+    const allow = context.tools?.allow;
+    return allow === undefined || allow.length === 0 || allow.includes(tool);
+}
+export function encodeManagementContext(context) {
+    return Buffer.from(JSON.stringify(context), "utf8").toString("base64url");
+}
+export function decodeManagementContext(value) {
+    if (value === undefined || value === "")
+        return undefined;
+    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    if (!isRecord(parsed))
+        throw new Error("Invalid management embed context");
+    return parseIntrospectionPayload({ active: true, ...parsed });
+}
+async function introspectManagementToken(url, serviceSecret, token) {
+    const response = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-pi-web-embed-secret": serviceSecret },
+        body: JSON.stringify({ token }),
+    });
+    const payload = await response.json().catch(() => undefined);
+    if (!response.ok || !isRecord(payload) || payload["active"] !== true)
+        throw new Error("Management embed token is invalid");
+    return parseIntrospectionPayload(payload);
+}
+function parseIntrospectionPayload(payload) {
+    const user = payload["user"];
+    const projects = payload["projects"];
+    if (!isRecord(user) || !Array.isArray(projects))
+        throw new Error("Management embed introspection response is invalid");
+    const context = {
+        user: {
+            id: stringField(user, "id"),
+            rootUserId: stringField(user, "rootUserId"),
+            roles: stringArray(user["roles"]),
+            permissions: stringArray(user["permissions"]),
+        },
+        projects: projects.map(parseProjectEntry),
+    };
+    if (isRecord(payload["tools"]))
+        context.tools = parseTools(payload["tools"]);
+    if (isRecord(payload["sandbox"]))
+        context.sandbox = parseSandbox(payload["sandbox"]);
+    if (typeof payload["expiresAt"] === "string")
+        context.expiresAt = payload["expiresAt"];
+    return context;
+}
+function parseTools(value) {
+    return {
+        ...(Array.isArray(value["allow"]) ? { allow: stringArray(value["allow"]) } : {}),
+        ...(Array.isArray(value["deny"]) ? { deny: stringArray(value["deny"]) } : {}),
+        ...(isRecord(value["permissions"]) ? { permissions: booleanRecord(value["permissions"]) } : {}),
+    };
+}
+function parseSandbox(value) {
+    return {
+        ...(typeof value["pythonExecutable"] === "string" ? { pythonExecutable: value["pythonExecutable"] } : {}),
+        ...(isRecord(value["env"]) ? { env: stringRecord(value["env"]) } : {}),
+    };
+}
+function parseProjectEntry(value) {
+    if (!isRecord(value))
+        throw new Error("Management embed project entry is invalid");
+    return {
+        id: stringField(value, "id"),
+        name: stringField(value, "name"),
+        ...(typeof value["role"] === "string" ? { role: value["role"] } : {}),
+        ...(typeof value["root"] === "string" ? { root: value["root"] } : {}),
+    };
+}
+async function ensureRealDirectory(path) {
+    await mkdir(path, { recursive: true });
+    return realpath(path);
+}
+function firstHeader(value) {
+    const header = Array.isArray(value) ? value[0] : value;
+    const normalized = header?.trim();
+    return normalized === "" ? undefined : normalized;
+}
+function safePathSegment(value) {
+    const segment = value.trim().replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+    return segment === "" ? "unknown" : segment;
+}
+function ensureInside(root, target) {
+    if (!isInside(root, target))
+        throw new Error("Path is outside the managed project sandbox");
+}
+function isInside(root, target) {
+    const rel = relative(root, target);
+    if (rel === "")
+        return true;
+    if (rel.startsWith("..") || isAbsolute(rel))
+        return false;
+    return sep === "/" || !rel.split(sep).includes("..");
+}
+function stringField(value, key) {
+    const field = value[key];
+    if (typeof field !== "string" || field.trim() === "")
+        throw new Error(`Management embed ${key} is required`);
+    return field.trim();
+}
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string" && item.trim() !== "").map((item) => item.trim()) : [];
+}
+function stringRecord(value) {
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function booleanRecord(value) {
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "boolean"));
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=managementEmbed.js.map

package/dist/server/managementEmbed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managementEmbed.js","sourceRoot":"","sources":["../../src/server/managementEmbed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAKrE,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAC7E,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC;AA0BpG,MAAM,UAAU,0BAA0B,CAAC,OAAsD,EAAE,KAA+B;IAChI,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,YAAY,GAAG,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,YAAY,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC;IACzI,MAAM,KAAK,GAAG,WAAW,IAAI,UAAU,CAAC;IACxC,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAuB,EAAE,OAA2C;IACpH,MAAM,KAAK,GAAG,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/G,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,OAAO,EAAE,OAAO,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC3G,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAA8C,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC/H,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,0BAA0B,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,gBAAgB,GAAG,0BAA0B,KAAK,SAAS,IAAI,0BAA0B,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uCAAuC,CAAC;IAC9K,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,EAAE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACrH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,aAAa;YAChD,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;SACzF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,aAAa;QAChD,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,gBAAgB,EAAE,aAAa,EAAE,KAAK,CAAC;KACjG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAE,UAAkB,EAAE,SAAiB;IACjG,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACtF,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,WAAmB,EAAE,OAA+B,EAAE,SAAiB;IAC1H,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QACtD,CAAC,CAAC,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC;QACzD,CAAC,CAAC,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,WAAmB,EAAE,OAA+B;IACxG,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,8BAA8B,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB,EAAE,OAA+B,EAAE,GAAW;IACtG,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/E,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACnH,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAE,IAAY;IACjF,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;IACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3E,OAAO,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,GAAW,EAAE,aAAqB,EAAE,KAAa;IACxF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,EAAE;QACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3H,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvH,MAAM,OAAO,GAA2B;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;YAC3B,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC;YAC3C,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;SAC9C;QACD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;KAC1C,CAAC;IACF,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B;IAChD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC;QAC5B,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;QAChC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAClC,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,GAAW;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,cAAc,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvJ,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;AAChI,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/server/sessiond/sessionProxyRoutes.js

@@ -1,9 +1,12 @@
 import { WebSocket } from "ws";
 import { SessionDaemonClient } from "../../sessiond/sessionDaemonClient.js";
-export function registerSessionProxyRoutes(app, daemon = new SessionDaemonClient(), prefix = "/api") {
+import { assertManagedCwd, encodeManagementContext, managementContextForRequest, MANAGEMENT_EMBED_CONTEXT_HEADER } from "../managementEmbed.js";
+export function registerSessionProxyRoutes(app, daemon = new SessionDaemonClient(), prefix = "/api", managementEmbed) {
     const proxy = async (request, reply) => {
         try {
-            const upstream = await daemon.request(request.method, stripPrefix(request.url, prefix), request.body);
+            const managementContext = await managementContextForRequest(request, managementEmbed);
+            const body = await managementBody(request.url, request.body, managementContext, managementEmbed);
+            const upstream = await daemon.request(request.method, stripPrefix(request.url, prefix), body, managementHeaders(managementContext));
             reply.code(upstream.statusCode);
             const contentType = upstream.headers["content-type"];
             if (contentType !== undefined && contentType !== "")
@@ -15,15 +18,40 @@ export function registerSessionProxyRoutes(app, daemon = new SessionDaemonClient
             return undefined;
         }
     };
-    app.get(`${prefix}/sessiond/health`, (_request, reply) => proxy({ method: "GET", url: `${prefix}/health` }, reply));
+    app.get(`${prefix}/sessiond/health`, async (_request, reply) => {
+        try {
+            const upstream = await daemon.request("GET", "/health");
+            reply.code(upstream.statusCode);
+            const contentType = upstream.headers["content-type"];
+            if (contentType !== undefined && contentType !== "")
+                reply.header("content-type", contentType);
+            return upstream.body !== "" ? parseJson(upstream.body) : undefined;
+        }
+        catch (error) {
+            requestFailed(reply, error);
+            return undefined;
+        }
+    });
     app.get(`${prefix}/sessions/:sessionId/events`, { websocket: true }, (socket, request) => {
-        bridgeSockets(socket, daemon.connectWebSocket(`/sessions/${request.params.sessionId}/events`));
+        void managementContextForRequest(request, managementEmbed).then((context) => {
+            bridgeSockets(socket, daemon.connectWebSocket(`/sessions/${request.params.sessionId}/events`, managementHeaders(context)));
+        }).catch((error) => {
+            closeSocketWithError(socket, error);
+        });
     });
-    app.get(`${prefix}/sessions/events`, { websocket: true }, (socket) => {
-        bridgeSockets(socket, daemon.connectWebSocket("/sessions/events"));
+    app.get(`${prefix}/sessions/events`, { websocket: true }, (socket, request) => {
+        void managementContextForRequest(request, managementEmbed).then((context) => {
+            bridgeSockets(socket, daemon.connectWebSocket("/sessions/events", managementHeaders(context)));
+        }).catch((error) => {
+            closeSocketWithError(socket, error);
+        });
     });
-    app.get(`${prefix}/events`, { websocket: true }, (socket) => {
-        bridgeSockets(socket, daemon.connectWebSocket("/events"));
+    app.get(`${prefix}/events`, { websocket: true }, (socket, request) => {
+        void managementContextForRequest(request, managementEmbed).then((context) => {
+            bridgeSockets(socket, daemon.connectWebSocket("/events", managementHeaders(context)));
+        }).catch((error) => {
+            closeSocketWithError(socket, error);
+        });
     });
     app.all(`${prefix}/activity`, (request, reply) => proxy(request, reply));
     app.all(`${prefix}/auth`, (request, reply) => proxy(request, reply));
@@ -31,6 +59,29 @@ export function registerSessionProxyRoutes(app, daemon = new SessionDaemonClient
     app.all(`${prefix}/sessions`, (request, reply) => proxy(request, reply));
     app.all(`${prefix}/sessions/*`, (request, reply) => proxy(request, reply));
 }
+async function managementBody(url, body, context, managementEmbed) {
+    if (context === undefined)
+        return body;
+    const path = stripPrefix(url, "");
+    if (path.startsWith("/sessions?")) {
+        const cwd = new URL(`http://local${path}`).searchParams.get("cwd");
+        if (cwd !== null)
+            await assertManagedCwd(managementProjectRoot(managementEmbed), context, cwd);
+        return body;
+    }
+    if (path === "/sessions" && isRecord(body) && typeof body["cwd"] === "string") {
+        return { ...body, cwd: await assertManagedCwd(managementProjectRoot(managementEmbed), context, body["cwd"]) };
+    }
+    return body;
+}
+function managementHeaders(context) {
+    return context === undefined ? undefined : { [MANAGEMENT_EMBED_CONTEXT_HEADER]: encodeManagementContext(context) };
+}
+function managementProjectRoot(managementEmbed) {
+    if (managementEmbed === undefined)
+        throw new Error("Management embed mode is not configured");
+    return managementEmbed.projectRoot;
+}
 function stripPrefix(url, prefix) {
     const path = url.split("?", 1)[0] ?? url;
     const query = url.slice(path.length);
@@ -57,4 +108,11 @@ function sendIfOpen(socket, data) {
         socket.send(data);
     }
 }
+function closeSocketWithError(socket, error) {
+    socket.send(JSON.stringify({ type: "error", message: error instanceof Error ? error.message : String(error) }));
+    socket.close();
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //# sourceMappingURL=sessionProxyRoutes.js.map

package/dist/server/sessiond/sessionProxyRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionProxyRoutes.js","sourceRoot":"","sources":["../../../src/server/sessiond/sessionProxyRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAgB,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAO5E,MAAM,UAAU,0BAA0B,CAAC,GAAoB,EAAE,SAA6B,IAAI,mBAAmB,EAAE,EAAE,MAAM,GAAG,MAAM;IACtI,MAAM,KAAK,GAAG,KAAK,EAAE,OAAwD,EAAE,KAAmB,EAAE,EAAE;QACpG,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACtG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;gBAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC/F,OAAO,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpH,GAAG,CAAC,GAAG,CAAoC,GAAG,MAAM,6BAA6B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC1H,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;QACnE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1D,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACxF,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,KAAc;IACxD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB,EAAE,QAAmB;IAC3D,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAa;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}
+{"version":3,"file":"sessionProxyRoutes.js","sourceRoot":"","sources":["../../../src/server/sessiond/sessionProxyRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAgB,MAAM,IAAI,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,+BAA+B,EAA4D,MAAM,uBAAuB,CAAC;AAO1M,MAAM,UAAU,0BAA0B,CAAC,GAAoB,EAAE,SAA6B,IAAI,mBAAmB,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,eAAwC;IAChL,MAAM,KAAK,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;YACjG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACpI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;gBAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC/F,OAAO,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC7D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACrD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;gBAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC/F,OAAO,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAoC,GAAG,MAAM,6BAA6B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC1H,KAAK,2BAA2B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1E,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7H,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC5E,KAAK,2BAA2B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1E,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QACnE,KAAK,2BAA2B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1E,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,IAAa,EAAE,OAA2C,EAAE,eAAmD;IACxJ,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9E,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA2C;IACpE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,+BAA+B,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;AACrH,CAAC;AAED,SAAS,qBAAqB,CAAC,eAAmD;IAChF,IAAI,eAAe,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC9F,OAAO,eAAe,CAAC,WAAW,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACxF,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,KAAc;IACxD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB,EAAE,QAAmB;IAC3D,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAa;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAiB,EAAE,KAAc;IAC7D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}