@mastra/factory 0.2.0-alpha.0 → 0.2.1-alpha.0

package/dist/routes/fs.js

@@ -1,12 +1,16 @@
 // src/routes/fs.ts
 import { lstat, open, readdir, realpath, stat } from "fs/promises";
 import { homedir } from "os";
-import { isAbsolute, join, resolve, sep } from "path";
+import { isAbsolute, join, posix as posixPath, resolve, sep } from "path";
+import { SandboxFilesystem } from "@mastra/code-sdk/agents/sandbox-filesystem";
 import { detectProject, getResourceIdOverride } from "@mastra/code-sdk/utils/project";
 import { registerApiRoute } from "@mastra/core/server";
 var MAX_TEXT_FILE_BYTES = 512 * 1024;
 var TEXT_DECODER = new TextDecoder("utf-8", { fatal: true });
 var APPROVED_RENDERED_ROOTS = /* @__PURE__ */ new Set([".artifacts"]);
+function loose(c) {
+  return c;
+}
 function resolveFsRoot(root) {
   return resolve(root && root.trim() ? root : homedir());
 }
@@ -187,6 +191,91 @@ async function listArtifacts(root, workspacePath) {
     entries: listing.entries
   };
 }
+async function resolveAuthorizedSession(c, deps, workspacePath) {
+  if (!deps) return null;
+  const session = await deps.sessions.getBySessionId(workspacePath);
+  if (!session) return null;
+  if (deps.auth.enabled()) {
+    await deps.auth.ensureUser(c);
+    const tenant = deps.auth.tenant(c);
+    if (!tenant || tenant.orgId !== session.orgId || tenant.userId !== session.userId) {
+      throw new Error("Session is not available to the current user");
+    }
+  }
+  return session;
+}
+async function sessionSandbox(fleet, session) {
+  if (!fleet.enabled || !session.sandboxId || !session.sandboxWorkdir) return null;
+  let sandbox;
+  try {
+    sandbox = await fleet.reattachSandbox(session.sandboxId, { workingDirectory: session.sandboxWorkdir });
+  } catch {
+    return null;
+  }
+  return {
+    sandbox,
+    filesystem: new SandboxFilesystem({ sandbox, workdir: session.sandboxWorkdir }),
+    workdir: session.sandboxWorkdir
+  };
+}
+async function listSessionRenderedPath(fleet, session, renderedRoot) {
+  const safeRoot = assertApprovedRenderedRoot(renderedRoot);
+  const rootPath = posixPath.join(session.sandboxWorkdir ?? "", safeRoot);
+  const empty = { workspacePath: session.sessionId, root: safeRoot, rootPath, entries: [] };
+  const handle = await sessionSandbox(fleet, session);
+  if (!handle) return empty;
+  const quotedRoot = `'${rootPath.replace(/'/g, `'\\''`)}'`;
+  const result = await handle.sandbox.executeCommand(
+    "sh",
+    [
+      "-c",
+      `test -d ${quotedRoot} && find ${quotedRoot} -mindepth 1 -printf '%y\\t%s\\t%T@\\t%p\\n' 2>/dev/null || true`
+    ],
+    { timeout: 3e4 }
+  );
+  if (result.exitCode !== 0) return empty;
+  const entries = [];
+  for (const line of result.stdout.split("\n")) {
+    if (!line) continue;
+    const [type, sizeStr, mtimeStr, ...pathParts] = line.split("	");
+    const fullPath = pathParts.join("	");
+    if (!fullPath || !fullPath.startsWith(`${rootPath}/`)) continue;
+    const relativePath = fullPath.slice(rootPath.length + 1);
+    entries.push({
+      name: posixPath.basename(relativePath),
+      path: relativePath,
+      type: type === "d" ? "directory" : "file",
+      size: type === "d" ? 0 : Number(sizeStr) || 0,
+      updatedAt: new Date((Number(mtimeStr) || 0) * 1e3).toISOString()
+    });
+  }
+  entries.sort((a, b) => a.path.localeCompare(b.path));
+  return { workspacePath: session.sessionId, root: safeRoot, rootPath, entries };
+}
+async function readSessionWorkspaceFile(fleet, session, path) {
+  const safePath = assertRelativePath(path, "path");
+  assertApprovedRenderedRoot(safePath.split("/")[0] ?? "");
+  const handle = await sessionSandbox(fleet, session);
+  if (!handle) throw new Error("Session workspace is not available");
+  const { filesystem } = handle;
+  const info = await filesystem.stat(safePath);
+  if (info.type === "directory") throw new Error("Path is a directory");
+  const buffer = await filesystem.readFile(safePath);
+  const truncated = buffer.length > MAX_TEXT_FILE_BYTES;
+  const base = {
+    workspacePath: session.sessionId,
+    path: safePath,
+    name: posixPath.basename(safePath),
+    size: buffer.length,
+    updatedAt: info.modifiedAt.toISOString()
+  };
+  try {
+    const content = TEXT_DECODER.decode(truncated ? buffer.subarray(0, MAX_TEXT_FILE_BYTES) : buffer);
+    return { ...base, contentType: "text", content, truncated };
+  } catch {
+    return { ...base, contentType: "unsupported" };
+  }
+}
 function resolveCodebase(projectPath) {
   const info = detectProject(projectPath);
   const override = getResourceIdOverride(info.rootPath);
@@ -200,6 +289,7 @@ function resolveCodebase(projectPath) {
 }
 function buildFsRoutes(options = {}) {
   const root = resolveFsRoot(options.root);
+  const sessionFs = options.sessionFs;
   return [
     registerApiRoute("/web/fs/list", {
       method: "GET",
@@ -239,10 +329,14 @@ function buildFsRoutes(options = {}) {
         if (!workspacePath) return c.json({ error: "Missing required query param: workspacePath" }, 400);
         if (!renderedRoot) return c.json({ error: "Missing required query param: root" }, 400);
         try {
+          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);
+          if (session && sessionFs) {
+            return c.json(await listSessionRenderedPath(sessionFs.fleet, session, renderedRoot));
+          }
           return c.json(await listWorkspaceRenderedPath(root, workspacePath, renderedRoot));
         } catch (error) {
           const message = error instanceof Error ? error.message : String(error);
-          const status = message.includes("outside") || message.includes("relative") || message.includes("escapes") || message.includes("not approved") ? 403 : 500;
+          const status = message.includes("outside") || message.includes("relative") || message.includes("escapes") || message.includes("not approved") || message.includes("not available") ? 403 : 500;
           return c.json({ error: message }, status);
         }
       }
@@ -256,10 +350,14 @@ function buildFsRoutes(options = {}) {
         if (!workspacePath) return c.json({ error: "Missing required query param: workspacePath" }, 400);
         if (!path) return c.json({ error: "Missing required query param: path" }, 400);
         try {
+          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);
+          if (session && sessionFs) {
+            return c.json(await readSessionWorkspaceFile(sessionFs.fleet, session, path));
+          }
           return c.json(await readWorkspaceFile(root, workspacePath, path));
         } catch (error) {
           const message = error instanceof Error ? error.message : String(error);
-          const status = message.includes("outside") || message.includes("relative") || message.includes("escapes") || message.includes("not approved") ? 403 : message.includes("directory") ? 400 : 500;
+          const status = message.includes("outside") || message.includes("relative") || message.includes("escapes") || message.includes("not approved") || message.includes("not available") ? 403 : message.includes("directory") ? 400 : message.includes("not found") ? 404 : 500;
           return c.json({ error: message }, status);
         }
       }
@@ -286,7 +384,9 @@ export {
   buildFsRoutes,
   listArtifacts,
   listDirectory,
+  listSessionRenderedPath,
   listWorkspaceRenderedPath,
+  readSessionWorkspaceFile,
   readWorkspaceFile,
   resolveCodebase,
   resolveFsRoot

package/dist/routes/fs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/fs.ts"],"sourcesContent":["import { lstat, open, readdir, realpath, stat } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { isAbsolute, join, resolve, sep } from 'node:path';\n\nimport { detectProject, getResourceIdOverride } from '@mastra/code-sdk/utils/project';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { ApiRoute } from '@mastra/core/server';\n\n/**\n * Server-side directory browser for the web project picker.\n *\n * The browser cannot read absolute filesystem paths (the File System Access API\n * only exposes a directory *name*), so the picker must ask the server — which\n * does have filesystem access — to enumerate directories. The result is real\n * absolute paths the user can select without typing.\n *\n * All access is confined to a configured `root` (default: the user's home\n * directory). Requests that try to escape the root via `..` or symlinks are\n * clamped back to the root.\n */\n\nexport interface DirectoryEntry {\n  name: string;\n  /** Absolute path to the entry. */\n  path: string;\n}\n\nexport interface DirectoryListing {\n  /** The allowed root; clients cannot browse above this. */\n  root: string;\n  /** The absolute path that was listed. */\n  path: string;\n  /** Parent directory path, or null when `path` is the root. */\n  parent: string | null;\n  /** Subdirectories of `path` (directories only, sorted, hidden excluded). */\n  entries: DirectoryEntry[];\n}\n\nexport interface WorkspaceRenderedEntry {\n  name: string;\n  /** Path relative to the configured rendered root. */\n  path: string;\n  type: 'file' | 'directory';\n  size: number;\n  updatedAt: string;\n}\n\nexport interface WorkspaceRenderedListing {\n  /** The confined workspace/project root. */\n  workspacePath: string;\n  /** Configured workspace-relative rendered root, e.g. `.artifacts`. */\n  root: string;\n  /** The confined absolute path for the rendered root. */\n  rootPath: string;\n  entries: WorkspaceRenderedEntry[];\n}\n\nexport interface WorkspaceFile {\n  /** The confined workspace/project root. */\n  workspacePath: string;\n  /** Workspace-relative file path. */\n  path: string;\n  name: string;\n  size: number;\n  updatedAt: string;\n  contentType: 'text' | 'unsupported';\n  content?: string;\n  truncated?: boolean;\n}\n\nexport type ArtifactEntry = WorkspaceRenderedEntry;\n\nexport interface ArtifactListing {\n  /** The confined workspace/project root. */\n  rootPath: string;\n  /** The workspace artifact directory. */\n  artifactsPath: string;\n  entries: ArtifactEntry[];\n}\n\nconst MAX_TEXT_FILE_BYTES = 512 * 1024;\nconst TEXT_DECODER = new TextDecoder('utf-8', { fatal: true });\nconst APPROVED_RENDERED_ROOTS = new Set(['.artifacts']);\n\n/** Resolve the browsable root, defaulting to the user's home directory. */\nexport function resolveFsRoot(root?: string): string {\n  return resolve(root && root.trim() ? root : homedir());\n}\n\n/** True when `candidate` is `root` or nested under it. */\nfunction isWithinRoot(candidate: string, root: string): boolean {\n  if (candidate === root) return true;\n  const rootWithSep = root.endsWith(sep) ? root : root + sep;\n  return candidate.startsWith(rootWithSep);\n}\n\nasync function realOrResolved(path: string): Promise<string> {\n  try {\n    return await realpath(path);\n  } catch {\n    return path;\n  }\n}\n\n/**\n * Resolve a path's real location (following symlinks) and confirm it stays\n * within `root`. Returns the real path when confined, or `null` when it escapes\n * the root or does not exist. Used so a symlink inside the root that points\n * outside it cannot be browsed or selected.\n */\nasync function realPathWithinRoot(candidate: string, root: string): Promise<string | null> {\n  try {\n    const real = await realpath(candidate);\n    return isWithinRoot(real, root) ? real : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction assertRelativePath(path: string, label: string): string {\n  const trimmed = path.trim();\n  if (!trimmed) throw new Error(`Missing required query param: ${label}`);\n  if (isAbsolute(trimmed)) throw new Error(`${label} must be relative`);\n  if (trimmed.split(/[\\\\/]+/).includes('..')) throw new Error(`${label} escapes workspace`);\n  const normalized = resolve('/', trimmed).slice(1);\n  if (!normalized || normalized === '..' || normalized.startsWith(`..${sep}`))\n    throw new Error(`${label} escapes workspace`);\n  return normalized;\n}\n\nfunction assertApprovedRenderedRoot(renderedRoot: string): string {\n  const safeRoot = assertRelativePath(renderedRoot, 'root');\n  if (!APPROVED_RENDERED_ROOTS.has(safeRoot)) throw new Error('Root is not approved for rendered workspace access');\n  return safeRoot;\n}\n\nasync function confinedWorkspacePath(\n  root: string,\n  workspacePath: string,\n): Promise<{ resolvedRoot: string; workspace: string }> {\n  const resolvedRoot = await realOrResolved(resolveFsRoot(root));\n  const candidate = isAbsolute(workspacePath) ? resolve(workspacePath) : resolve(resolvedRoot, workspacePath);\n  const workspace = await realPathWithinRoot(candidate, resolvedRoot);\n  if (!workspace) throw new Error('Path is outside the browsable root');\n  return { resolvedRoot, workspace };\n}\n\nasync function confinedWorkspaceRelativePath(\n  root: string,\n  workspacePath: string,\n  relativePath: string,\n): Promise<{ workspace: string; path: string; relativePath: string }> {\n  const safeRelativePath = assertRelativePath(relativePath, 'path');\n  const { workspace } = await confinedWorkspacePath(root, workspacePath);\n  const candidate = resolve(workspace, safeRelativePath);\n  if (!isWithinRoot(candidate, workspace)) throw new Error('Path escapes workspace');\n  const confinedPath = await realPathWithinRoot(candidate, workspace);\n  if (!confinedPath) throw new Error('Path is outside the workspace');\n  return { workspace, path: confinedPath, relativePath: safeRelativePath };\n}\n\n/**\n * List the directories inside `requestedPath`, confined to `root`. An absent or\n * out-of-root path is clamped to the root, so the worst a malicious client can\n * do is browse within the allowed root.\n */\nexport async function listDirectory(root: string, requestedPath?: string): Promise<DirectoryListing> {\n  // Resolve the root through symlinks so all confinement checks compare real\n  // paths; a symlink that escapes the root is then reliably detectable.\n  const resolvedRoot = await realOrResolved(resolveFsRoot(root));\n\n  let target = resolvedRoot;\n  if (requestedPath && requestedPath.trim()) {\n    const candidate = isAbsolute(requestedPath) ? resolve(requestedPath) : resolve(resolvedRoot, requestedPath);\n    // Follow symlinks and re-confirm the real target stays within the root.\n    target = (await realPathWithinRoot(candidate, resolvedRoot)) ?? resolvedRoot;\n  }\n\n  // Confirm the target is a real directory; fall back to root otherwise.\n  try {\n    const info = await stat(target);\n    if (!info.isDirectory()) target = resolvedRoot;\n  } catch {\n    target = resolvedRoot;\n  }\n\n  const dirents = await readdir(target, { withFileTypes: true });\n  const entries: DirectoryEntry[] = [];\n  for (const dirent of dirents) {\n    if (dirent.name.startsWith('.')) continue; // skip dotfiles/dirs\n    const entryPath = join(target, dirent.name);\n    let isDir = dirent.isDirectory();\n    if (dirent.isSymbolicLink()) {\n      // Only surface symlinks whose real target is a directory inside the root,\n      // so a link pointing outside the root can't be browsed or selected.\n      const real = await realPathWithinRoot(entryPath, resolvedRoot);\n      isDir = real ? (await stat(real).catch(() => null))?.isDirectory() === true : false;\n    }\n    if (isDir) entries.push({ name: dirent.name, path: entryPath });\n  }\n  entries.sort((a, b) => a.name.localeCompare(b.name));\n\n  const parent = target === resolvedRoot ? null : resolve(target, '..');\n\n  return { root: resolvedRoot, path: target, parent, entries };\n}\n\nasync function listRenderedEntries(rootPath: string, currentPath = rootPath): Promise<WorkspaceRenderedEntry[]> {\n  const dirents = await readdir(currentPath, { withFileTypes: true });\n  const entries: WorkspaceRenderedEntry[] = [];\n\n  for (const dirent of dirents) {\n    const entryPath = join(currentPath, dirent.name);\n    const info = await lstat(entryPath);\n    const relativePath = entryPath.slice(rootPath.length + 1);\n\n    if (info.isDirectory()) {\n      entries.push({\n        name: dirent.name,\n        path: relativePath,\n        type: 'directory',\n        size: info.size,\n        updatedAt: info.mtime.toISOString(),\n      });\n      entries.push(...(await listRenderedEntries(rootPath, entryPath)));\n      continue;\n    }\n\n    if (info.isFile()) {\n      entries.push({\n        name: dirent.name,\n        path: relativePath,\n        type: 'file',\n        size: info.size,\n        updatedAt: info.mtime.toISOString(),\n      });\n    }\n  }\n\n  return entries.sort((a, b) => a.path.localeCompare(b.path));\n}\n\nexport async function listWorkspaceRenderedPath(\n  root: string,\n  workspacePath: string,\n  renderedRoot: string,\n): Promise<WorkspaceRenderedListing> {\n  const safeRoot = assertApprovedRenderedRoot(renderedRoot);\n  const { workspace } = await confinedWorkspacePath(root, workspacePath);\n  const renderedPath = resolve(workspace, safeRoot);\n  if (!isWithinRoot(renderedPath, workspace)) throw new Error('Root escapes workspace');\n\n  const confinedRootPath = await realPathWithinRoot(renderedPath, workspace);\n  if (!confinedRootPath) return { workspacePath: workspace, root: safeRoot, rootPath: renderedPath, entries: [] };\n\n  const info = await stat(confinedRootPath);\n  if (!info.isDirectory()) return { workspacePath: workspace, root: safeRoot, rootPath: confinedRootPath, entries: [] };\n\n  return {\n    workspacePath: workspace,\n    root: safeRoot,\n    rootPath: confinedRootPath,\n    entries: await listRenderedEntries(confinedRootPath),\n  };\n}\n\nexport async function readWorkspaceFile(root: string, workspacePath: string, path: string): Promise<WorkspaceFile> {\n  const safePath = assertRelativePath(path, 'path');\n  const relativeRoot = safePath.split('/')[0] ?? '';\n  assertApprovedRenderedRoot(relativeRoot);\n  const {\n    workspace,\n    path: confinedPath,\n    relativePath,\n  } = await confinedWorkspaceRelativePath(root, workspacePath, path);\n  const info = await lstat(confinedPath);\n  if (info.isDirectory()) throw new Error('Path is a directory');\n  if (!info.isFile()) throw new Error('Unsupported file type');\n\n  const bytesToRead = Math.min(info.size, MAX_TEXT_FILE_BYTES);\n  const contentBuffer = Buffer.alloc(bytesToRead);\n  const handle = await open(confinedPath, 'r');\n  try {\n    await handle.read(contentBuffer, 0, bytesToRead, 0);\n  } finally {\n    await handle.close();\n  }\n\n  try {\n    const content = TEXT_DECODER.decode(contentBuffer);\n    return {\n      workspacePath: workspace,\n      path: relativePath,\n      name: relativePath.split('/').pop() ?? relativePath,\n      size: info.size,\n      updatedAt: info.mtime.toISOString(),\n      contentType: 'text',\n      content,\n      truncated: info.size > MAX_TEXT_FILE_BYTES,\n    };\n  } catch {\n    return {\n      workspacePath: workspace,\n      path: relativePath,\n      name: relativePath.split('/').pop() ?? relativePath,\n      size: info.size,\n      updatedAt: info.mtime.toISOString(),\n      contentType: 'unsupported',\n    };\n  }\n}\n\nexport async function listArtifacts(root: string, workspacePath: string): Promise<ArtifactListing> {\n  const listing = await listWorkspaceRenderedPath(root, workspacePath, '.artifacts');\n  return {\n    rootPath: listing.workspacePath,\n    artifactsPath: listing.rootPath,\n    entries: listing.entries,\n  };\n}\n\nexport interface ResolvedCodebase {\n  /**\n   * The resourceId the TUI would use for this path — derived identically so a\n   * project opened in the terminal and in the web app resolve to the SAME\n   * session (and therefore the same threads).\n   */\n  resourceId: string;\n  name: string;\n  rootPath: string;\n  gitUrl?: string;\n  gitBranch?: string;\n}\n\n/**\n * Resolve a project path to the same resourceId the TUI uses. Mirrors\n * `createMastraCode`: detect the project, then apply any resourceId override\n * (MASTRA_RESOURCE_ID env var or `.mastracode/database.json`). This is the\n * shared continuity point — start in the TUI, continue on the web, same path\n * → same resourceId → same session.\n */\nexport function resolveCodebase(projectPath: string): ResolvedCodebase {\n  const info = detectProject(projectPath);\n  const override = getResourceIdOverride(info.rootPath);\n  return {\n    resourceId: override ?? info.resourceId,\n    name: info.name,\n    rootPath: info.rootPath,\n    gitUrl: info.gitUrl,\n    gitBranch: info.gitBranch,\n  };\n}\n\n/**\n * Build the web filesystem routes as Mastra `apiRoutes`:\n *   - `GET /web/fs/list?path=...`        — browse directories (confined to root)\n *   - `GET /web/codebase/resolve?path=...` — TUI-compatible codebase resourceId\n */\nexport function buildFsRoutes(options: { root?: string } = {}): ApiRoute[] {\n  const root = resolveFsRoot(options.root);\n\n  return [\n    registerApiRoute('/web/fs/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        try {\n          const listing = await listDirectory(root, path);\n          return c.json(listing);\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, 500);\n        }\n      },\n    }),\n    registerApiRoute('/web/artifacts/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          return c.json(await listArtifacts(root, path));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status = message === 'Path is outside the browsable root' ? 403 : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/rendered/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const renderedRoot = c.req.query('root');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!renderedRoot) return c.json({ error: 'Missing required query param: root' }, 400);\n        try {\n          return c.json(await listWorkspaceRenderedPath(root, workspacePath, renderedRoot));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('outside') ||\n            message.includes('relative') ||\n            message.includes('escapes') ||\n            message.includes('not approved')\n              ? 403\n              : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/file', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const path = c.req.query('path');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          return c.json(await readWorkspaceFile(root, workspacePath, path));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('outside') ||\n            message.includes('relative') ||\n            message.includes('escapes') ||\n            message.includes('not approved')\n              ? 403\n              : message.includes('directory')\n                ? 400\n                : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/codebase/resolve', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        // Confine resolution to the browsable root (following symlinks), so this\n        // endpoint can't be used to probe arbitrary filesystem paths. The web UI\n        // only ever resolves directories the user picked via the root-confined\n        // browser, so legitimate requests are always within the root.\n        const confined = await realPathWithinRoot(isAbsolute(path) ? resolve(path) : resolve(root, path), root);\n        if (!confined) return c.json({ error: 'Path is outside the browsable root' }, 403);\n        try {\n          return c.json(resolveCodebase(confined));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, 500);\n        }\n      },\n    }),\n  ];\n}\n"],"mappings":";AAAA,SAAS,OAAO,MAAM,SAAS,UAAU,YAAY;AACrD,SAAS,eAAe;AACxB,SAAS,YAAY,MAAM,SAAS,WAAW;AAE/C,SAAS,eAAe,6BAA6B;AACrD,SAAS,wBAAwB;AA2EjC,IAAM,sBAAsB,MAAM;AAClC,IAAM,eAAe,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAC7D,IAAM,0BAA0B,oBAAI,IAAI,CAAC,YAAY,CAAC;AAG/C,SAAS,cAAc,MAAuB;AACnD,SAAO,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC;AACvD;AAGA,SAAS,aAAa,WAAmB,MAAuB;AAC9D,MAAI,cAAc,KAAM,QAAO;AAC/B,QAAM,cAAc,KAAK,SAAS,GAAG,IAAI,OAAO,OAAO;AACvD,SAAO,UAAU,WAAW,WAAW;AACzC;AAEA,eAAe,eAAe,MAA+B;AAC3D,MAAI;AACF,WAAO,MAAM,SAAS,IAAI;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAe,mBAAmB,WAAmB,MAAsC;AACzF,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,SAAS;AACrC,WAAO,aAAa,MAAM,IAAI,IAAI,OAAO;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,iCAAiC,KAAK,EAAE;AACtE,MAAI,WAAW,OAAO,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB;AACpE,MAAI,QAAQ,MAAM,QAAQ,EAAE,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,oBAAoB;AACxF,QAAM,aAAa,QAAQ,KAAK,OAAO,EAAE,MAAM,CAAC;AAChD,MAAI,CAAC,cAAc,eAAe,QAAQ,WAAW,WAAW,KAAK,GAAG,EAAE;AACxE,UAAM,IAAI,MAAM,GAAG,KAAK,oBAAoB;AAC9C,SAAO;AACT;AAEA,SAAS,2BAA2B,cAA8B;AAChE,QAAM,WAAW,mBAAmB,cAAc,MAAM;AACxD,MAAI,CAAC,wBAAwB,IAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,oDAAoD;AAChH,SAAO;AACT;AAEA,eAAe,sBACb,MACA,eACsD;AACtD,QAAM,eAAe,MAAM,eAAe,cAAc,IAAI,CAAC;AAC7D,QAAM,YAAY,WAAW,aAAa,IAAI,QAAQ,aAAa,IAAI,QAAQ,cAAc,aAAa;AAC1G,QAAM,YAAY,MAAM,mBAAmB,WAAW,YAAY;AAClE,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,oCAAoC;AACpE,SAAO,EAAE,cAAc,UAAU;AACnC;AAEA,eAAe,8BACb,MACA,eACA,cACoE;AACpE,QAAM,mBAAmB,mBAAmB,cAAc,MAAM;AAChE,QAAM,EAAE,UAAU,IAAI,MAAM,sBAAsB,MAAM,aAAa;AACrE,QAAM,YAAY,QAAQ,WAAW,gBAAgB;AACrD,MAAI,CAAC,aAAa,WAAW,SAAS,EAAG,OAAM,IAAI,MAAM,wBAAwB;AACjF,QAAM,eAAe,MAAM,mBAAmB,WAAW,SAAS;AAClE,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,+BAA+B;AAClE,SAAO,EAAE,WAAW,MAAM,cAAc,cAAc,iBAAiB;AACzE;AAOA,eAAsB,cAAc,MAAc,eAAmD;AAGnG,QAAM,eAAe,MAAM,eAAe,cAAc,IAAI,CAAC;AAE7D,MAAI,SAAS;AACb,MAAI,iBAAiB,cAAc,KAAK,GAAG;AACzC,UAAM,YAAY,WAAW,aAAa,IAAI,QAAQ,aAAa,IAAI,QAAQ,cAAc,aAAa;AAE1G,aAAU,MAAM,mBAAmB,WAAW,YAAY,KAAM;AAAA,EAClE;AAGA,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,MAAM;AAC9B,QAAI,CAAC,KAAK,YAAY,EAAG,UAAS;AAAA,EACpC,QAAQ;AACN,aAAS;AAAA,EACX;AAEA,QAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,eAAe,KAAK,CAAC;AAC7D,QAAM,UAA4B,CAAC;AACnC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,KAAK,WAAW,GAAG,EAAG;AACjC,UAAM,YAAY,KAAK,QAAQ,OAAO,IAAI;AAC1C,QAAI,QAAQ,OAAO,YAAY;AAC/B,QAAI,OAAO,eAAe,GAAG;AAG3B,YAAM,OAAO,MAAM,mBAAmB,WAAW,YAAY;AAC7D,cAAQ,QAAQ,MAAM,KAAK,IAAI,EAAE,MAAM,MAAM,IAAI,IAAI,YAAY,MAAM,OAAO;AAAA,IAChF;AACA,QAAI,MAAO,SAAQ,KAAK,EAAE,MAAM,OAAO,MAAM,MAAM,UAAU,CAAC;AAAA,EAChE;AACA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAEnD,QAAM,SAAS,WAAW,eAAe,OAAO,QAAQ,QAAQ,IAAI;AAEpE,SAAO,EAAE,MAAM,cAAc,MAAM,QAAQ,QAAQ,QAAQ;AAC7D;AAEA,eAAe,oBAAoB,UAAkB,cAAc,UAA6C;AAC9G,QAAM,UAAU,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC;AAClE,QAAM,UAAoC,CAAC;AAE3C,aAAW,UAAU,SAAS;AAC5B,UAAM,YAAY,KAAK,aAAa,OAAO,IAAI;AAC/C,UAAM,OAAO,MAAM,MAAM,SAAS;AAClC,UAAM,eAAe,UAAU,MAAM,SAAS,SAAS,CAAC;AAExD,QAAI,KAAK,YAAY,GAAG;AACtB,cAAQ,KAAK;AAAA,QACX,MAAM,OAAO;AAAA,QACb,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,WAAW,KAAK,MAAM,YAAY;AAAA,MACpC,CAAC;AACD,cAAQ,KAAK,GAAI,MAAM,oBAAoB,UAAU,SAAS,CAAE;AAChE;AAAA,IACF;AAEA,QAAI,KAAK,OAAO,GAAG;AACjB,cAAQ,KAAK;AAAA,QACX,MAAM,OAAO;AAAA,QACb,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,WAAW,KAAK,MAAM,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC5D;AAEA,eAAsB,0BACpB,MACA,eACA,cACmC;AACnC,QAAM,WAAW,2BAA2B,YAAY;AACxD,QAAM,EAAE,UAAU,IAAI,MAAM,sBAAsB,MAAM,aAAa;AACrE,QAAM,eAAe,QAAQ,WAAW,QAAQ;AAChD,MAAI,CAAC,aAAa,cAAc,SAAS,EAAG,OAAM,IAAI,MAAM,wBAAwB;AAEpF,QAAM,mBAAmB,MAAM,mBAAmB,cAAc,SAAS;AACzE,MAAI,CAAC,iBAAkB,QAAO,EAAE,eAAe,WAAW,MAAM,UAAU,UAAU,cAAc,SAAS,CAAC,EAAE;AAE9G,QAAM,OAAO,MAAM,KAAK,gBAAgB;AACxC,MAAI,CAAC,KAAK,YAAY,EAAG,QAAO,EAAE,eAAe,WAAW,MAAM,UAAU,UAAU,kBAAkB,SAAS,CAAC,EAAE;AAEpH,SAAO;AAAA,IACL,eAAe;AAAA,IACf,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS,MAAM,oBAAoB,gBAAgB;AAAA,EACrD;AACF;AAEA,eAAsB,kBAAkB,MAAc,eAAuB,MAAsC;AACjH,QAAM,WAAW,mBAAmB,MAAM,MAAM;AAChD,QAAM,eAAe,SAAS,MAAM,GAAG,EAAE,CAAC,KAAK;AAC/C,6BAA2B,YAAY;AACvC,QAAM;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,IACN;AAAA,EACF,IAAI,MAAM,8BAA8B,MAAM,eAAe,IAAI;AACjE,QAAM,OAAO,MAAM,MAAM,YAAY;AACrC,MAAI,KAAK,YAAY,EAAG,OAAM,IAAI,MAAM,qBAAqB;AAC7D,MAAI,CAAC,KAAK,OAAO,EAAG,OAAM,IAAI,MAAM,uBAAuB;AAE3D,QAAM,cAAc,KAAK,IAAI,KAAK,MAAM,mBAAmB;AAC3D,QAAM,gBAAgB,OAAO,MAAM,WAAW;AAC9C,QAAM,SAAS,MAAM,KAAK,cAAc,GAAG;AAC3C,MAAI;AACF,UAAM,OAAO,KAAK,eAAe,GAAG,aAAa,CAAC;AAAA,EACpD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AAEA,MAAI;AACF,UAAM,UAAU,aAAa,OAAO,aAAa;AACjD,WAAO;AAAA,MACL,eAAe;AAAA,MACf,MAAM;AAAA,MACN,MAAM,aAAa,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,MACvC,MAAM,KAAK;AAAA,MACX,WAAW,KAAK,MAAM,YAAY;AAAA,MAClC,aAAa;AAAA,MACb;AAAA,MACA,WAAW,KAAK,OAAO;AAAA,IACzB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,eAAe;AAAA,MACf,MAAM;AAAA,MACN,MAAM,aAAa,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,MACvC,MAAM,KAAK;AAAA,MACX,WAAW,KAAK,MAAM,YAAY;AAAA,MAClC,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAAc,eAAiD;AACjG,QAAM,UAAU,MAAM,0BAA0B,MAAM,eAAe,YAAY;AACjF,SAAO;AAAA,IACL,UAAU,QAAQ;AAAA,IAClB,eAAe,QAAQ;AAAA,IACvB,SAAS,QAAQ;AAAA,EACnB;AACF;AAsBO,SAAS,gBAAgB,aAAuC;AACrE,QAAM,OAAO,cAAc,WAAW;AACtC,QAAM,WAAW,sBAAsB,KAAK,QAAQ;AACpD,SAAO;AAAA,IACL,YAAY,YAAY,KAAK;AAAA,IAC7B,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK;AAAA,EAClB;AACF;AAOO,SAAS,cAAc,UAA6B,CAAC,GAAe;AACzE,QAAM,OAAO,cAAc,QAAQ,IAAI;AAEvC,SAAO;AAAA,IACL,iBAAiB,gBAAgB;AAAA,MAC/B,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,YAAI;AACF,gBAAM,UAAU,MAAM,cAAc,MAAM,IAAI;AAC9C,iBAAO,EAAE,KAAK,OAAO;AAAA,QACvB,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,iBAAiB,uBAAuB;AAAA,MACtC,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,YAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AAC7E,YAAI;AACF,iBAAO,EAAE,KAAK,MAAM,cAAc,MAAM,IAAI,CAAC;AAAA,QAC/C,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,gBAAM,SAAS,YAAY,uCAAuC,MAAM;AACxE,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,iBAAiB,gCAAgC;AAAA,MAC/C,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;AACjD,cAAM,eAAe,EAAE,IAAI,MAAM,MAAM;AACvC,YAAI,CAAC,cAAe,QAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;AAC/F,YAAI,CAAC,aAAc,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACrF,YAAI;AACF,iBAAO,EAAE,KAAK,MAAM,0BAA0B,MAAM,eAAe,YAAY,CAAC;AAAA,QAClF,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,gBAAM,SACJ,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,UAAU,KAC3B,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,IAC3B,MACA;AACN,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,iBAAiB,uBAAuB;AAAA,MACtC,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;AACjD,cAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,YAAI,CAAC,cAAe,QAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;AAC/F,YAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AAC7E,YAAI;AACF,iBAAO,EAAE,KAAK,MAAM,kBAAkB,MAAM,eAAe,IAAI,CAAC;AAAA,QAClE,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,gBAAM,SACJ,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,UAAU,KAC3B,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,IAC3B,MACA,QAAQ,SAAS,WAAW,IAC1B,MACA;AACR,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,iBAAiB,yBAAyB;AAAA,MACxC,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,YAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AAK7E,cAAM,WAAW,MAAM,mBAAmB,WAAW,IAAI,IAAI,QAAQ,IAAI,IAAI,QAAQ,MAAM,IAAI,GAAG,IAAI;AACtG,YAAI,CAAC,SAAU,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACjF,YAAI;AACF,iBAAO,EAAE,KAAK,gBAAgB,QAAQ,CAAC;AAAA,QACzC,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}
+{"version":3,"sources":["../../src/routes/fs.ts"],"sourcesContent":["import { lstat, open, readdir, realpath, stat } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { isAbsolute, join, posix as posixPath, resolve, sep } from 'node:path';\n\nimport { SandboxFilesystem } from '@mastra/code-sdk/agents/sandbox-filesystem';\nimport { detectProject, getResourceIdOverride } from '@mastra/code-sdk/utils/project';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { SandboxFleet } from '../sandbox/fleet.js';\nimport type { SourceControlSession } from '../storage/domains/source-control/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * Server-side directory browser for the web project picker.\n *\n * The browser cannot read absolute filesystem paths (the File System Access API\n * only exposes a directory *name*), so the picker must ask the server — which\n * does have filesystem access — to enumerate directories. The result is real\n * absolute paths the user can select without typing.\n *\n * All access is confined to a configured `root` (default: the user's home\n * directory). Requests that try to escape the root via `..` or symlinks are\n * clamped back to the root.\n */\n\nexport interface DirectoryEntry {\n  name: string;\n  /** Absolute path to the entry. */\n  path: string;\n}\n\nexport interface DirectoryListing {\n  /** The allowed root; clients cannot browse above this. */\n  root: string;\n  /** The absolute path that was listed. */\n  path: string;\n  /** Parent directory path, or null when `path` is the root. */\n  parent: string | null;\n  /** Subdirectories of `path` (directories only, sorted, hidden excluded). */\n  entries: DirectoryEntry[];\n}\n\nexport interface WorkspaceRenderedEntry {\n  name: string;\n  /** Path relative to the configured rendered root. */\n  path: string;\n  type: 'file' | 'directory';\n  size: number;\n  updatedAt: string;\n}\n\nexport interface WorkspaceRenderedListing {\n  /** The confined workspace/project root. */\n  workspacePath: string;\n  /** Configured workspace-relative rendered root, e.g. `.artifacts`. */\n  root: string;\n  /** The confined absolute path for the rendered root. */\n  rootPath: string;\n  entries: WorkspaceRenderedEntry[];\n}\n\nexport interface WorkspaceFile {\n  /** The confined workspace/project root. */\n  workspacePath: string;\n  /** Workspace-relative file path. */\n  path: string;\n  name: string;\n  size: number;\n  updatedAt: string;\n  contentType: 'text' | 'unsupported';\n  content?: string;\n  truncated?: boolean;\n}\n\nexport type ArtifactEntry = WorkspaceRenderedEntry;\n\nexport interface ArtifactListing {\n  /** The confined workspace/project root. */\n  rootPath: string;\n  /** The workspace artifact directory. */\n  artifactsPath: string;\n  entries: ArtifactEntry[];\n}\n\nconst MAX_TEXT_FILE_BYTES = 512 * 1024;\nconst TEXT_DECODER = new TextDecoder('utf-8', { fatal: true });\nconst APPROVED_RENDERED_ROOTS = new Set(['.artifacts']);\n\n/** Erase a route handler's path-parameterized context to a plain `Context`. */\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/** Resolve the browsable root, defaulting to the user's home directory. */\nexport function resolveFsRoot(root?: string): string {\n  return resolve(root && root.trim() ? root : homedir());\n}\n\n/** True when `candidate` is `root` or nested under it. */\nfunction isWithinRoot(candidate: string, root: string): boolean {\n  if (candidate === root) return true;\n  const rootWithSep = root.endsWith(sep) ? root : root + sep;\n  return candidate.startsWith(rootWithSep);\n}\n\nasync function realOrResolved(path: string): Promise<string> {\n  try {\n    return await realpath(path);\n  } catch {\n    return path;\n  }\n}\n\n/**\n * Resolve a path's real location (following symlinks) and confirm it stays\n * within `root`. Returns the real path when confined, or `null` when it escapes\n * the root or does not exist. Used so a symlink inside the root that points\n * outside it cannot be browsed or selected.\n */\nasync function realPathWithinRoot(candidate: string, root: string): Promise<string | null> {\n  try {\n    const real = await realpath(candidate);\n    return isWithinRoot(real, root) ? real : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction assertRelativePath(path: string, label: string): string {\n  const trimmed = path.trim();\n  if (!trimmed) throw new Error(`Missing required query param: ${label}`);\n  if (isAbsolute(trimmed)) throw new Error(`${label} must be relative`);\n  if (trimmed.split(/[\\\\/]+/).includes('..')) throw new Error(`${label} escapes workspace`);\n  const normalized = resolve('/', trimmed).slice(1);\n  if (!normalized || normalized === '..' || normalized.startsWith(`..${sep}`))\n    throw new Error(`${label} escapes workspace`);\n  return normalized;\n}\n\nfunction assertApprovedRenderedRoot(renderedRoot: string): string {\n  const safeRoot = assertRelativePath(renderedRoot, 'root');\n  if (!APPROVED_RENDERED_ROOTS.has(safeRoot)) throw new Error('Root is not approved for rendered workspace access');\n  return safeRoot;\n}\n\nasync function confinedWorkspacePath(\n  root: string,\n  workspacePath: string,\n): Promise<{ resolvedRoot: string; workspace: string }> {\n  const resolvedRoot = await realOrResolved(resolveFsRoot(root));\n  const candidate = isAbsolute(workspacePath) ? resolve(workspacePath) : resolve(resolvedRoot, workspacePath);\n  const workspace = await realPathWithinRoot(candidate, resolvedRoot);\n  if (!workspace) throw new Error('Path is outside the browsable root');\n  return { resolvedRoot, workspace };\n}\n\nasync function confinedWorkspaceRelativePath(\n  root: string,\n  workspacePath: string,\n  relativePath: string,\n): Promise<{ workspace: string; path: string; relativePath: string }> {\n  const safeRelativePath = assertRelativePath(relativePath, 'path');\n  const { workspace } = await confinedWorkspacePath(root, workspacePath);\n  const candidate = resolve(workspace, safeRelativePath);\n  if (!isWithinRoot(candidate, workspace)) throw new Error('Path escapes workspace');\n  const confinedPath = await realPathWithinRoot(candidate, workspace);\n  if (!confinedPath) throw new Error('Path is outside the workspace');\n  return { workspace, path: confinedPath, relativePath: safeRelativePath };\n}\n\n/**\n * List the directories inside `requestedPath`, confined to `root`. An absent or\n * out-of-root path is clamped to the root, so the worst a malicious client can\n * do is browse within the allowed root.\n */\nexport async function listDirectory(root: string, requestedPath?: string): Promise<DirectoryListing> {\n  // Resolve the root through symlinks so all confinement checks compare real\n  // paths; a symlink that escapes the root is then reliably detectable.\n  const resolvedRoot = await realOrResolved(resolveFsRoot(root));\n\n  let target = resolvedRoot;\n  if (requestedPath && requestedPath.trim()) {\n    const candidate = isAbsolute(requestedPath) ? resolve(requestedPath) : resolve(resolvedRoot, requestedPath);\n    // Follow symlinks and re-confirm the real target stays within the root.\n    target = (await realPathWithinRoot(candidate, resolvedRoot)) ?? resolvedRoot;\n  }\n\n  // Confirm the target is a real directory; fall back to root otherwise.\n  try {\n    const info = await stat(target);\n    if (!info.isDirectory()) target = resolvedRoot;\n  } catch {\n    target = resolvedRoot;\n  }\n\n  const dirents = await readdir(target, { withFileTypes: true });\n  const entries: DirectoryEntry[] = [];\n  for (const dirent of dirents) {\n    if (dirent.name.startsWith('.')) continue; // skip dotfiles/dirs\n    const entryPath = join(target, dirent.name);\n    let isDir = dirent.isDirectory();\n    if (dirent.isSymbolicLink()) {\n      // Only surface symlinks whose real target is a directory inside the root,\n      // so a link pointing outside the root can't be browsed or selected.\n      const real = await realPathWithinRoot(entryPath, resolvedRoot);\n      isDir = real ? (await stat(real).catch(() => null))?.isDirectory() === true : false;\n    }\n    if (isDir) entries.push({ name: dirent.name, path: entryPath });\n  }\n  entries.sort((a, b) => a.name.localeCompare(b.name));\n\n  const parent = target === resolvedRoot ? null : resolve(target, '..');\n\n  return { root: resolvedRoot, path: target, parent, entries };\n}\n\nasync function listRenderedEntries(rootPath: string, currentPath = rootPath): Promise<WorkspaceRenderedEntry[]> {\n  const dirents = await readdir(currentPath, { withFileTypes: true });\n  const entries: WorkspaceRenderedEntry[] = [];\n\n  for (const dirent of dirents) {\n    const entryPath = join(currentPath, dirent.name);\n    const info = await lstat(entryPath);\n    const relativePath = entryPath.slice(rootPath.length + 1);\n\n    if (info.isDirectory()) {\n      entries.push({\n        name: dirent.name,\n        path: relativePath,\n        type: 'directory',\n        size: info.size,\n        updatedAt: info.mtime.toISOString(),\n      });\n      entries.push(...(await listRenderedEntries(rootPath, entryPath)));\n      continue;\n    }\n\n    if (info.isFile()) {\n      entries.push({\n        name: dirent.name,\n        path: relativePath,\n        type: 'file',\n        size: info.size,\n        updatedAt: info.mtime.toISOString(),\n      });\n    }\n  }\n\n  return entries.sort((a, b) => a.path.localeCompare(b.path));\n}\n\nexport async function listWorkspaceRenderedPath(\n  root: string,\n  workspacePath: string,\n  renderedRoot: string,\n): Promise<WorkspaceRenderedListing> {\n  const safeRoot = assertApprovedRenderedRoot(renderedRoot);\n  const { workspace } = await confinedWorkspacePath(root, workspacePath);\n  const renderedPath = resolve(workspace, safeRoot);\n  if (!isWithinRoot(renderedPath, workspace)) throw new Error('Root escapes workspace');\n\n  const confinedRootPath = await realPathWithinRoot(renderedPath, workspace);\n  if (!confinedRootPath) return { workspacePath: workspace, root: safeRoot, rootPath: renderedPath, entries: [] };\n\n  const info = await stat(confinedRootPath);\n  if (!info.isDirectory()) return { workspacePath: workspace, root: safeRoot, rootPath: confinedRootPath, entries: [] };\n\n  return {\n    workspacePath: workspace,\n    root: safeRoot,\n    rootPath: confinedRootPath,\n    entries: await listRenderedEntries(confinedRootPath),\n  };\n}\n\nexport async function readWorkspaceFile(root: string, workspacePath: string, path: string): Promise<WorkspaceFile> {\n  const safePath = assertRelativePath(path, 'path');\n  const relativeRoot = safePath.split('/')[0] ?? '';\n  assertApprovedRenderedRoot(relativeRoot);\n  const {\n    workspace,\n    path: confinedPath,\n    relativePath,\n  } = await confinedWorkspaceRelativePath(root, workspacePath, path);\n  const info = await lstat(confinedPath);\n  if (info.isDirectory()) throw new Error('Path is a directory');\n  if (!info.isFile()) throw new Error('Unsupported file type');\n\n  const bytesToRead = Math.min(info.size, MAX_TEXT_FILE_BYTES);\n  const contentBuffer = Buffer.alloc(bytesToRead);\n  const handle = await open(confinedPath, 'r');\n  try {\n    await handle.read(contentBuffer, 0, bytesToRead, 0);\n  } finally {\n    await handle.close();\n  }\n\n  try {\n    const content = TEXT_DECODER.decode(contentBuffer);\n    return {\n      workspacePath: workspace,\n      path: relativePath,\n      name: relativePath.split('/').pop() ?? relativePath,\n      size: info.size,\n      updatedAt: info.mtime.toISOString(),\n      contentType: 'text',\n      content,\n      truncated: info.size > MAX_TEXT_FILE_BYTES,\n    };\n  } catch {\n    return {\n      workspacePath: workspace,\n      path: relativePath,\n      name: relativePath.split('/').pop() ?? relativePath,\n      size: info.size,\n      updatedAt: info.mtime.toISOString(),\n      contentType: 'unsupported',\n    };\n  }\n}\n\nexport async function listArtifacts(root: string, workspacePath: string): Promise<ArtifactListing> {\n  const listing = await listWorkspaceRenderedPath(root, workspacePath, '.artifacts');\n  return {\n    rootPath: listing.workspacePath,\n    artifactsPath: listing.rootPath,\n    entries: listing.entries,\n  };\n}\n\n// ── Session-backed workspace access ──────────────────────────────────────────\n//\n// The web UI identifies a Factory session workspace by its session id (a UUID),\n// not by a server-local filesystem path — the session's files live inside the\n// session's sandbox (a remote VM on deployed factories). These helpers resolve\n// the session, enforce that the caller owns it, reattach to its sandbox, and\n// serve the approved rendered roots through `SandboxFilesystem`.\n\n/** Dependencies for resolving a `workspacePath` that is a Factory session id. */\nexport interface SessionFsDeps {\n  auth: RouteAuth;\n  fleet: SandboxFleet;\n  sessions: { getBySessionId(sessionId: string): Promise<SourceControlSession | null> };\n}\n\n/**\n * Resolve a `workspacePath` query param as a Factory session id. Returns the\n * session when one exists and the caller owns it, `null` when no session\n * matches (the caller should fall back to local-path handling), and throws\n * when a session exists but belongs to another tenant.\n */\nasync function resolveAuthorizedSession(\n  c: Context,\n  deps: SessionFsDeps | undefined,\n  workspacePath: string,\n): Promise<SourceControlSession | null> {\n  if (!deps) return null;\n  const session = await deps.sessions.getBySessionId(workspacePath);\n  if (!session) return null;\n  if (deps.auth.enabled()) {\n    await deps.auth.ensureUser(c);\n    const tenant = deps.auth.tenant(c);\n    if (!tenant || tenant.orgId !== session.orgId || tenant.userId !== session.userId) {\n      throw new Error('Session is not available to the current user');\n    }\n  }\n  return session;\n}\n\ninterface SessionSandboxHandle {\n  sandbox: { executeCommand(command: string, args?: string[], options?: { timeout?: number }): Promise<unknown> };\n  filesystem: SandboxFilesystem;\n  workdir: string;\n}\n\n/**\n * Reattach to the session's sandbox and wrap its workdir in a\n * `SandboxFilesystem`. Returns `null` when the session has no provisioned\n * sandbox yet (nothing materialized → nothing to list), or when the sandbox\n * can no longer be reattached (e.g. torn down by the provider's idle GC).\n * This is a passive read path, so it never re-provisions: the session's\n * filesystem is preserved in its provider checkpoint and comes back the next\n * time the workspace is actually opened (e.g. by sending a message).\n */\nasync function sessionSandbox(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n): Promise<SessionSandboxHandle | null> {\n  if (!fleet.enabled || !session.sandboxId || !session.sandboxWorkdir) return null;\n  let sandbox: Awaited<ReturnType<SandboxFleet['reattachSandbox']>>;\n  try {\n    sandbox = await fleet.reattachSandbox(session.sandboxId, { workingDirectory: session.sandboxWorkdir });\n  } catch {\n    // Sandbox is gone (idle GC) or unreachable. Degrade to an empty view\n    // rather than surfacing a 500 from a file-viewer panel.\n    return null;\n  }\n  return {\n    sandbox,\n    filesystem: new SandboxFilesystem({ sandbox, workdir: session.sandboxWorkdir }),\n    workdir: session.sandboxWorkdir,\n  };\n}\n\n/** List an approved rendered root inside a Factory session's sandbox workdir. */\nexport async function listSessionRenderedPath(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n  renderedRoot: string,\n): Promise<WorkspaceRenderedListing> {\n  const safeRoot = assertApprovedRenderedRoot(renderedRoot);\n  const rootPath = posixPath.join(session.sandboxWorkdir ?? '', safeRoot);\n  const empty: WorkspaceRenderedListing = { workspacePath: session.sessionId, root: safeRoot, rootPath, entries: [] };\n\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) return empty;\n\n  // One round trip: emit \"type\\tsize\\tmtime\\tpath\" per entry. `safeRoot` comes\n  // from a fixed allowlist so interpolating it (quoted) is safe.\n  const quotedRoot = `'${rootPath.replace(/'/g, `'\\\\''`)}'`;\n  const result = (await handle.sandbox.executeCommand(\n    'sh',\n    [\n      '-c',\n      `test -d ${quotedRoot} && find ${quotedRoot} -mindepth 1 -printf '%y\\\\t%s\\\\t%T@\\\\t%p\\\\n' 2>/dev/null || true`,\n    ],\n    { timeout: 30_000 },\n  )) as { exitCode: number; stdout: string };\n  if (result.exitCode !== 0) return empty;\n\n  const entries: WorkspaceRenderedEntry[] = [];\n  for (const line of result.stdout.split('\\n')) {\n    if (!line) continue;\n    const [type, sizeStr, mtimeStr, ...pathParts] = line.split('\\t');\n    const fullPath = pathParts.join('\\t');\n    if (!fullPath || !fullPath.startsWith(`${rootPath}/`)) continue;\n    const relativePath = fullPath.slice(rootPath.length + 1);\n    entries.push({\n      name: posixPath.basename(relativePath),\n      path: relativePath,\n      type: type === 'd' ? 'directory' : 'file',\n      size: type === 'd' ? 0 : Number(sizeStr) || 0,\n      updatedAt: new Date((Number(mtimeStr) || 0) * 1000).toISOString(),\n    });\n  }\n  entries.sort((a, b) => a.path.localeCompare(b.path));\n\n  return { workspacePath: session.sessionId, root: safeRoot, rootPath, entries };\n}\n\n/** Read a file under an approved rendered root inside a session's sandbox. */\nexport async function readSessionWorkspaceFile(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n  path: string,\n): Promise<WorkspaceFile> {\n  const safePath = assertRelativePath(path, 'path');\n  assertApprovedRenderedRoot(safePath.split('/')[0] ?? '');\n\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) throw new Error('Session workspace is not available');\n  const { filesystem } = handle;\n  const info = await filesystem.stat(safePath);\n  if (info.type === 'directory') throw new Error('Path is a directory');\n\n  const buffer = (await filesystem.readFile(safePath)) as Buffer;\n  const truncated = buffer.length > MAX_TEXT_FILE_BYTES;\n  const base = {\n    workspacePath: session.sessionId,\n    path: safePath,\n    name: posixPath.basename(safePath),\n    size: buffer.length,\n    updatedAt: info.modifiedAt.toISOString(),\n  };\n  try {\n    const content = TEXT_DECODER.decode(truncated ? buffer.subarray(0, MAX_TEXT_FILE_BYTES) : buffer);\n    return { ...base, contentType: 'text', content, truncated };\n  } catch {\n    return { ...base, contentType: 'unsupported' };\n  }\n}\n\nexport interface ResolvedCodebase {\n  /**\n   * The resourceId the TUI would use for this path — derived identically so a\n   * project opened in the terminal and in the web app resolve to the SAME\n   * session (and therefore the same threads).\n   */\n  resourceId: string;\n  name: string;\n  rootPath: string;\n  gitUrl?: string;\n  gitBranch?: string;\n}\n\n/**\n * Resolve a project path to the same resourceId the TUI uses. Mirrors\n * `createMastraCode`: detect the project, then apply any resourceId override\n * (MASTRA_RESOURCE_ID env var or `.mastracode/database.json`). This is the\n * shared continuity point — start in the TUI, continue on the web, same path\n * → same resourceId → same session.\n */\nexport function resolveCodebase(projectPath: string): ResolvedCodebase {\n  const info = detectProject(projectPath);\n  const override = getResourceIdOverride(info.rootPath);\n  return {\n    resourceId: override ?? info.resourceId,\n    name: info.name,\n    rootPath: info.rootPath,\n    gitUrl: info.gitUrl,\n    gitBranch: info.gitBranch,\n  };\n}\n\n/**\n * Build the web filesystem routes as Mastra `apiRoutes`:\n *   - `GET /web/fs/list?path=...`        — browse directories (confined to root)\n *   - `GET /web/codebase/resolve?path=...` — TUI-compatible codebase resourceId\n */\nexport function buildFsRoutes(options: { root?: string; sessionFs?: SessionFsDeps } = {}): ApiRoute[] {\n  const root = resolveFsRoot(options.root);\n  const sessionFs = options.sessionFs;\n\n  return [\n    registerApiRoute('/web/fs/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        try {\n          const listing = await listDirectory(root, path);\n          return c.json(listing);\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, 500);\n        }\n      },\n    }),\n    registerApiRoute('/web/artifacts/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          return c.json(await listArtifacts(root, path));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status = message === 'Path is outside the browsable root' ? 403 : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/rendered/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const renderedRoot = c.req.query('root');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!renderedRoot) return c.json({ error: 'Missing required query param: root' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (session && sessionFs) {\n            return c.json(await listSessionRenderedPath(sessionFs.fleet, session, renderedRoot));\n          }\n          return c.json(await listWorkspaceRenderedPath(root, workspacePath, renderedRoot));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('outside') ||\n            message.includes('relative') ||\n            message.includes('escapes') ||\n            message.includes('not approved') ||\n            message.includes('not available')\n              ? 403\n              : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/file', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const path = c.req.query('path');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (session && sessionFs) {\n            return c.json(await readSessionWorkspaceFile(sessionFs.fleet, session, path));\n          }\n          return c.json(await readWorkspaceFile(root, workspacePath, path));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('outside') ||\n            message.includes('relative') ||\n            message.includes('escapes') ||\n            message.includes('not approved') ||\n            message.includes('not available')\n              ? 403\n              : message.includes('directory')\n                ? 400\n                : message.includes('not found')\n                  ? 404\n                  : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/codebase/resolve', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        // Confine resolution to the browsable root (following symlinks), so this\n        // endpoint can't be used to probe arbitrary filesystem paths. The web UI\n        // only ever resolves directories the user picked via the root-confined\n        // browser, so legitimate requests are always within the root.\n        const confined = await realPathWithinRoot(isAbsolute(path) ? resolve(path) : resolve(root, path), root);\n        if (!confined) return c.json({ error: 'Path is outside the browsable root' }, 403);\n        try {\n          return c.json(resolveCodebase(confined));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, 500);\n        }\n      },\n    }),\n  ];\n}\n"],"mappings":";AAAA,SAAS,OAAO,MAAM,SAAS,UAAU,YAAY;AACrD,SAAS,eAAe;AACxB,SAAS,YAAY,MAAM,SAAS,WAAW,SAAS,WAAW;AAEnE,SAAS,yBAAyB;AAClC,SAAS,eAAe,6BAA6B;AACrD,SAAS,wBAAwB;AAgFjC,IAAM,sBAAsB,MAAM;AAClC,IAAM,eAAe,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAC7D,IAAM,0BAA0B,oBAAI,IAAI,CAAC,YAAY,CAAC;AAGtD,SAAS,MAAM,GAAqB;AAClC,SAAO;AACT;AAGO,SAAS,cAAc,MAAuB;AACnD,SAAO,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC;AACvD;AAGA,SAAS,aAAa,WAAmB,MAAuB;AAC9D,MAAI,cAAc,KAAM,QAAO;AAC/B,QAAM,cAAc,KAAK,SAAS,GAAG,IAAI,OAAO,OAAO;AACvD,SAAO,UAAU,WAAW,WAAW;AACzC;AAEA,eAAe,eAAe,MAA+B;AAC3D,MAAI;AACF,WAAO,MAAM,SAAS,IAAI;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAe,mBAAmB,WAAmB,MAAsC;AACzF,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,SAAS;AACrC,WAAO,aAAa,MAAM,IAAI,IAAI,OAAO;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,iCAAiC,KAAK,EAAE;AACtE,MAAI,WAAW,OAAO,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB;AACpE,MAAI,QAAQ,MAAM,QAAQ,EAAE,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,oBAAoB;AACxF,QAAM,aAAa,QAAQ,KAAK,OAAO,EAAE,MAAM,CAAC;AAChD,MAAI,CAAC,cAAc,eAAe,QAAQ,WAAW,WAAW,KAAK,GAAG,EAAE;AACxE,UAAM,IAAI,MAAM,GAAG,KAAK,oBAAoB;AAC9C,SAAO;AACT;AAEA,SAAS,2BAA2B,cAA8B;AAChE,QAAM,WAAW,mBAAmB,cAAc,MAAM;AACxD,MAAI,CAAC,wBAAwB,IAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,oDAAoD;AAChH,SAAO;AACT;AAEA,eAAe,sBACb,MACA,eACsD;AACtD,QAAM,eAAe,MAAM,eAAe,cAAc,IAAI,CAAC;AAC7D,QAAM,YAAY,WAAW,aAAa,IAAI,QAAQ,aAAa,IAAI,QAAQ,cAAc,aAAa;AAC1G,QAAM,YAAY,MAAM,mBAAmB,WAAW,YAAY;AAClE,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,oCAAoC;AACpE,SAAO,EAAE,cAAc,UAAU;AACnC;AAEA,eAAe,8BACb,MACA,eACA,cACoE;AACpE,QAAM,mBAAmB,mBAAmB,cAAc,MAAM;AAChE,QAAM,EAAE,UAAU,IAAI,MAAM,sBAAsB,MAAM,aAAa;AACrE,QAAM,YAAY,QAAQ,WAAW,gBAAgB;AACrD,MAAI,CAAC,aAAa,WAAW,SAAS,EAAG,OAAM,IAAI,MAAM,wBAAwB;AACjF,QAAM,eAAe,MAAM,mBAAmB,WAAW,SAAS;AAClE,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,+BAA+B;AAClE,SAAO,EAAE,WAAW,MAAM,cAAc,cAAc,iBAAiB;AACzE;AAOA,eAAsB,cAAc,MAAc,eAAmD;AAGnG,QAAM,eAAe,MAAM,eAAe,cAAc,IAAI,CAAC;AAE7D,MAAI,SAAS;AACb,MAAI,iBAAiB,cAAc,KAAK,GAAG;AACzC,UAAM,YAAY,WAAW,aAAa,IAAI,QAAQ,aAAa,IAAI,QAAQ,cAAc,aAAa;AAE1G,aAAU,MAAM,mBAAmB,WAAW,YAAY,KAAM;AAAA,EAClE;AAGA,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,MAAM;AAC9B,QAAI,CAAC,KAAK,YAAY,EAAG,UAAS;AAAA,EACpC,QAAQ;AACN,aAAS;AAAA,EACX;AAEA,QAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,eAAe,KAAK,CAAC;AAC7D,QAAM,UAA4B,CAAC;AACnC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,KAAK,WAAW,GAAG,EAAG;AACjC,UAAM,YAAY,KAAK,QAAQ,OAAO,IAAI;AAC1C,QAAI,QAAQ,OAAO,YAAY;AAC/B,QAAI,OAAO,eAAe,GAAG;AAG3B,YAAM,OAAO,MAAM,mBAAmB,WAAW,YAAY;AAC7D,cAAQ,QAAQ,MAAM,KAAK,IAAI,EAAE,MAAM,MAAM,IAAI,IAAI,YAAY,MAAM,OAAO;AAAA,IAChF;AACA,QAAI,MAAO,SAAQ,KAAK,EAAE,MAAM,OAAO,MAAM,MAAM,UAAU,CAAC;AAAA,EAChE;AACA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAEnD,QAAM,SAAS,WAAW,eAAe,OAAO,QAAQ,QAAQ,IAAI;AAEpE,SAAO,EAAE,MAAM,cAAc,MAAM,QAAQ,QAAQ,QAAQ;AAC7D;AAEA,eAAe,oBAAoB,UAAkB,cAAc,UAA6C;AAC9G,QAAM,UAAU,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC;AAClE,QAAM,UAAoC,CAAC;AAE3C,aAAW,UAAU,SAAS;AAC5B,UAAM,YAAY,KAAK,aAAa,OAAO,IAAI;AAC/C,UAAM,OAAO,MAAM,MAAM,SAAS;AAClC,UAAM,eAAe,UAAU,MAAM,SAAS,SAAS,CAAC;AAExD,QAAI,KAAK,YAAY,GAAG;AACtB,cAAQ,KAAK;AAAA,QACX,MAAM,OAAO;AAAA,QACb,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,WAAW,KAAK,MAAM,YAAY;AAAA,MACpC,CAAC;AACD,cAAQ,KAAK,GAAI,MAAM,oBAAoB,UAAU,SAAS,CAAE;AAChE;AAAA,IACF;AAEA,QAAI,KAAK,OAAO,GAAG;AACjB,cAAQ,KAAK;AAAA,QACX,MAAM,OAAO;AAAA,QACb,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,WAAW,KAAK,MAAM,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC5D;AAEA,eAAsB,0BACpB,MACA,eACA,cACmC;AACnC,QAAM,WAAW,2BAA2B,YAAY;AACxD,QAAM,EAAE,UAAU,IAAI,MAAM,sBAAsB,MAAM,aAAa;AACrE,QAAM,eAAe,QAAQ,WAAW,QAAQ;AAChD,MAAI,CAAC,aAAa,cAAc,SAAS,EAAG,OAAM,IAAI,MAAM,wBAAwB;AAEpF,QAAM,mBAAmB,MAAM,mBAAmB,cAAc,SAAS;AACzE,MAAI,CAAC,iBAAkB,QAAO,EAAE,eAAe,WAAW,MAAM,UAAU,UAAU,cAAc,SAAS,CAAC,EAAE;AAE9G,QAAM,OAAO,MAAM,KAAK,gBAAgB;AACxC,MAAI,CAAC,KAAK,YAAY,EAAG,QAAO,EAAE,eAAe,WAAW,MAAM,UAAU,UAAU,kBAAkB,SAAS,CAAC,EAAE;AAEpH,SAAO;AAAA,IACL,eAAe;AAAA,IACf,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS,MAAM,oBAAoB,gBAAgB;AAAA,EACrD;AACF;AAEA,eAAsB,kBAAkB,MAAc,eAAuB,MAAsC;AACjH,QAAM,WAAW,mBAAmB,MAAM,MAAM;AAChD,QAAM,eAAe,SAAS,MAAM,GAAG,EAAE,CAAC,KAAK;AAC/C,6BAA2B,YAAY;AACvC,QAAM;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,IACN;AAAA,EACF,IAAI,MAAM,8BAA8B,MAAM,eAAe,IAAI;AACjE,QAAM,OAAO,MAAM,MAAM,YAAY;AACrC,MAAI,KAAK,YAAY,EAAG,OAAM,IAAI,MAAM,qBAAqB;AAC7D,MAAI,CAAC,KAAK,OAAO,EAAG,OAAM,IAAI,MAAM,uBAAuB;AAE3D,QAAM,cAAc,KAAK,IAAI,KAAK,MAAM,mBAAmB;AAC3D,QAAM,gBAAgB,OAAO,MAAM,WAAW;AAC9C,QAAM,SAAS,MAAM,KAAK,cAAc,GAAG;AAC3C,MAAI;AACF,UAAM,OAAO,KAAK,eAAe,GAAG,aAAa,CAAC;AAAA,EACpD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AAEA,MAAI;AACF,UAAM,UAAU,aAAa,OAAO,aAAa;AACjD,WAAO;AAAA,MACL,eAAe;AAAA,MACf,MAAM;AAAA,MACN,MAAM,aAAa,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,MACvC,MAAM,KAAK;AAAA,MACX,WAAW,KAAK,MAAM,YAAY;AAAA,MAClC,aAAa;AAAA,MACb;AAAA,MACA,WAAW,KAAK,OAAO;AAAA,IACzB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,eAAe;AAAA,MACf,MAAM;AAAA,MACN,MAAM,aAAa,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,MACvC,MAAM,KAAK;AAAA,MACX,WAAW,KAAK,MAAM,YAAY;AAAA,MAClC,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAAc,eAAiD;AACjG,QAAM,UAAU,MAAM,0BAA0B,MAAM,eAAe,YAAY;AACjF,SAAO;AAAA,IACL,UAAU,QAAQ;AAAA,IAClB,eAAe,QAAQ;AAAA,IACvB,SAAS,QAAQ;AAAA,EACnB;AACF;AAuBA,eAAe,yBACb,GACA,MACA,eACsC;AACtC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,UAAU,MAAM,KAAK,SAAS,eAAe,aAAa;AAChE,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,KAAK,KAAK,QAAQ,GAAG;AACvB,UAAM,KAAK,KAAK,WAAW,CAAC;AAC5B,UAAM,SAAS,KAAK,KAAK,OAAO,CAAC;AACjC,QAAI,CAAC,UAAU,OAAO,UAAU,QAAQ,SAAS,OAAO,WAAW,QAAQ,QAAQ;AACjF,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAiBA,eAAe,eACb,OACA,SACsC;AACtC,MAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,aAAa,CAAC,QAAQ,eAAgB,QAAO;AAC5E,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,MAAM,gBAAgB,QAAQ,WAAW,EAAE,kBAAkB,QAAQ,eAAe,CAAC;AAAA,EACvG,QAAQ;AAGN,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA,YAAY,IAAI,kBAAkB,EAAE,SAAS,SAAS,QAAQ,eAAe,CAAC;AAAA,IAC9E,SAAS,QAAQ;AAAA,EACnB;AACF;AAGA,eAAsB,wBACpB,OACA,SACA,cACmC;AACnC,QAAM,WAAW,2BAA2B,YAAY;AACxD,QAAM,WAAW,UAAU,KAAK,QAAQ,kBAAkB,IAAI,QAAQ;AACtE,QAAM,QAAkC,EAAE,eAAe,QAAQ,WAAW,MAAM,UAAU,UAAU,SAAS,CAAC,EAAE;AAElH,QAAM,SAAS,MAAM,eAAe,OAAO,OAAO;AAClD,MAAI,CAAC,OAAQ,QAAO;AAIpB,QAAM,aAAa,IAAI,SAAS,QAAQ,MAAM,OAAO,CAAC;AACtD,QAAM,SAAU,MAAM,OAAO,QAAQ;AAAA,IACnC;AAAA,IACA;AAAA,MACE;AAAA,MACA,WAAW,UAAU,YAAY,UAAU;AAAA,IAC7C;AAAA,IACA,EAAE,SAAS,IAAO;AAAA,EACpB;AACA,MAAI,OAAO,aAAa,EAAG,QAAO;AAElC,QAAM,UAAoC,CAAC;AAC3C,aAAW,QAAQ,OAAO,OAAO,MAAM,IAAI,GAAG;AAC5C,QAAI,CAAC,KAAM;AACX,UAAM,CAAC,MAAM,SAAS,UAAU,GAAG,SAAS,IAAI,KAAK,MAAM,GAAI;AAC/D,UAAM,WAAW,UAAU,KAAK,GAAI;AACpC,QAAI,CAAC,YAAY,CAAC,SAAS,WAAW,GAAG,QAAQ,GAAG,EAAG;AACvD,UAAM,eAAe,SAAS,MAAM,SAAS,SAAS,CAAC;AACvD,YAAQ,KAAK;AAAA,MACX,MAAM,UAAU,SAAS,YAAY;AAAA,MACrC,MAAM;AAAA,MACN,MAAM,SAAS,MAAM,cAAc;AAAA,MACnC,MAAM,SAAS,MAAM,IAAI,OAAO,OAAO,KAAK;AAAA,MAC5C,WAAW,IAAI,MAAM,OAAO,QAAQ,KAAK,KAAK,GAAI,EAAE,YAAY;AAAA,IAClE,CAAC;AAAA,EACH;AACA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAEnD,SAAO,EAAE,eAAe,QAAQ,WAAW,MAAM,UAAU,UAAU,QAAQ;AAC/E;AAGA,eAAsB,yBACpB,OACA,SACA,MACwB;AACxB,QAAM,WAAW,mBAAmB,MAAM,MAAM;AAChD,6BAA2B,SAAS,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE;AAEvD,QAAM,SAAS,MAAM,eAAe,OAAO,OAAO;AAClD,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,oCAAoC;AACjE,QAAM,EAAE,WAAW,IAAI;AACvB,QAAM,OAAO,MAAM,WAAW,KAAK,QAAQ;AAC3C,MAAI,KAAK,SAAS,YAAa,OAAM,IAAI,MAAM,qBAAqB;AAEpE,QAAM,SAAU,MAAM,WAAW,SAAS,QAAQ;AAClD,QAAM,YAAY,OAAO,SAAS;AAClC,QAAM,OAAO;AAAA,IACX,eAAe,QAAQ;AAAA,IACvB,MAAM;AAAA,IACN,MAAM,UAAU,SAAS,QAAQ;AAAA,IACjC,MAAM,OAAO;AAAA,IACb,WAAW,KAAK,WAAW,YAAY;AAAA,EACzC;AACA,MAAI;AACF,UAAM,UAAU,aAAa,OAAO,YAAY,OAAO,SAAS,GAAG,mBAAmB,IAAI,MAAM;AAChG,WAAO,EAAE,GAAG,MAAM,aAAa,QAAQ,SAAS,UAAU;AAAA,EAC5D,QAAQ;AACN,WAAO,EAAE,GAAG,MAAM,aAAa,cAAc;AAAA,EAC/C;AACF;AAsBO,SAAS,gBAAgB,aAAuC;AACrE,QAAM,OAAO,cAAc,WAAW;AACtC,QAAM,WAAW,sBAAsB,KAAK,QAAQ;AACpD,SAAO;AAAA,IACL,YAAY,YAAY,KAAK;AAAA,IAC7B,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,WAAW,KAAK;AAAA,EAClB;AACF;AAOO,SAAS,cAAc,UAAwD,CAAC,GAAe;AACpG,QAAM,OAAO,cAAc,QAAQ,IAAI;AACvC,QAAM,YAAY,QAAQ;AAE1B,SAAO;AAAA,IACL,iBAAiB,gBAAgB;AAAA,MAC/B,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,YAAI;AACF,gBAAM,UAAU,MAAM,cAAc,MAAM,IAAI;AAC9C,iBAAO,EAAE,KAAK,OAAO;AAAA,QACvB,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,iBAAiB,uBAAuB;AAAA,MACtC,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,YAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AAC7E,YAAI;AACF,iBAAO,EAAE,KAAK,MAAM,cAAc,MAAM,IAAI,CAAC;AAAA,QAC/C,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,gBAAM,SAAS,YAAY,uCAAuC,MAAM;AACxE,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,iBAAiB,gCAAgC;AAAA,MAC/C,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;AACjD,cAAM,eAAe,EAAE,IAAI,MAAM,MAAM;AACvC,YAAI,CAAC,cAAe,QAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;AAC/F,YAAI,CAAC,aAAc,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACrF,YAAI;AACF,gBAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;AACjF,cAAI,WAAW,WAAW;AACxB,mBAAO,EAAE,KAAK,MAAM,wBAAwB,UAAU,OAAO,SAAS,YAAY,CAAC;AAAA,UACrF;AACA,iBAAO,EAAE,KAAK,MAAM,0BAA0B,MAAM,eAAe,YAAY,CAAC;AAAA,QAClF,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,gBAAM,SACJ,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,UAAU,KAC3B,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,eAAe,IAC5B,MACA;AACN,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,iBAAiB,uBAAuB;AAAA,MACtC,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;AACjD,cAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,YAAI,CAAC,cAAe,QAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;AAC/F,YAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AAC7E,YAAI;AACF,gBAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;AACjF,cAAI,WAAW,WAAW;AACxB,mBAAO,EAAE,KAAK,MAAM,yBAAyB,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,UAC9E;AACA,iBAAO,EAAE,KAAK,MAAM,kBAAkB,MAAM,eAAe,IAAI,CAAC;AAAA,QAClE,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,gBAAM,SACJ,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,UAAU,KAC3B,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,eAAe,IAC5B,MACA,QAAQ,SAAS,WAAW,IAC1B,MACA,QAAQ,SAAS,WAAW,IAC1B,MACA;AACV,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,iBAAiB,yBAAyB;AAAA,MACxC,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,SAAS,OAAM,MAAK;AAClB,cAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,YAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AAK7E,cAAM,WAAW,MAAM,mBAAmB,WAAW,IAAI,IAAI,QAAQ,IAAI,IAAI,QAAQ,MAAM,IAAI,GAAG,IAAI;AACtG,YAAI,CAAC,SAAU,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACjF,YAAI;AACF,iBAAO,EAAE,KAAK,gBAAgB,QAAQ,CAAC;AAAA,QACzC,SAAS,OAAO;AACd,gBAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,iBAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}