@nodetool-ai/websocket 0.7.0-rc.22 → 0.8.1

package/dist/lib/public-routes.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The auth-exemption allowlist predicates used by the server's `onRequest`
+ * hook.
+ *
+ * These live in their own module so they are testable without booting the
+ * server (`server.ts` is an entry point: importing it opens the database and
+ * binds a port). Getting an entry wrong here is an unauthenticated read of
+ * someone's data, so each predicate is deliberately an allowlist of exact
+ * paths or prefixes that carry no per-caller state.
+ */
+/**
+ * Read-only workflow GETs that carry no per-user data: the shipped example
+ * templates and workflows the owner explicitly marked `access: "public"`.
+ *
+ * Nothing that reads the *caller's* library belongs here. The REST handlers
+ * resolve identity from the (server-set) `x-user-id` header and fall back to
+ * user "1" when it is absent, so an auth-exempt route serves the local user's
+ * private workflows — full graph included — to anyone who can reach the port.
+ * That is exactly the disclosure the "Remote access requires authentication"
+ * 401 exists to prevent, so `/api/workflows`, `/api/workflows/:id`,
+ * `/api/workflows/names`, `/api/workflows/tools`, and `:id/dsl-export` all
+ * stay behind auth. A genuinely public workflow is still reachable
+ * unauthenticated at `/api/workflows/public/:id`.
+ */
+export declare function isPublicWorkflowMetadataRequest(pathname: string, method: string): boolean;
+/**
+ * OAuth paths reachable without a session. Only the two browser redirect
+ * targets qualify: the identity provider sends the user back with no
+ * `Authorization` header, and the handlers authenticate the callback through
+ * the single-use PKCE `state` they minted at `/start`.
+ *
+ * Every other `/api/oauth/*` path reads or mutates stored credentials for the
+ * caller's user id, so exempting the whole prefix let an unauthenticated
+ * caller enumerate linked accounts (`/tokens`), pull the linked third-party
+ * profile and email (`/hf/whoami`, `/github/user`), force token refreshes, and
+ * delete credentials (`/openai/disconnect`) as user "1". The OpenAI (Codex)
+ * flow needs no entry: it redirects to a loopback listener this process binds,
+ * not to a server route.
+ */
+export declare function isPublicOAuthRequest(pathname: string): boolean;
+/**
+ * The MCP OAuth 2.1 authorization-server + resource-metadata surface
+ * (`docs/mcp-oauth-design.md`, `routes/oauth-as.ts`). Every one of these
+ * paths authenticates on its own terms — well-known documents carry no
+ * per-caller state, and `/oauth/authorize|token|register|revoke` validate a
+ * client, a PKCE verifier, or a bearer token, never a session. The two
+ * well-known prefixes are matched with `startsWith` so the path-aware form
+ * (`…/oauth-protected-resource/mcp`) and the root form
+ * (`…/oauth-protected-resource`) both clear under one entry, same as the
+ * file's other prefix rules.
+ *
+ * `/oauth/consent` is deliberately absent: it is an SPA page, not an API
+ * route, and its data comes from an authenticated tRPC call
+ * (`agentAccess.getOauthRequest`) that goes through the normal auth hook.
+ * Exempting it here would serve the page's HTML shell to a caller with no
+ * session, which is fine, but the shell carries no data — the tRPC calls it
+ * makes still require login, so there is nothing to gain and a naming
+ * collision with the four API paths to avoid.
+ */
+export declare function isPublicMcpOauthAsRequest(pathname: string): boolean;
+/**
+ * The two routes a deployed mini app is served from: read the app, and mint
+ * the short-lived session its runs go through. Both take the deployment token
+ * from the path, and that token is the credential — an unguessable 24-byte
+ * secret its owner minted and can revoke.
+ *
+ * The prefix is exact and shallow (`/api/apps/`, not `/api/applications/`) so
+ * it can never widen onto the owner-scoped application routes, which read the
+ * caller's own library and stay behind auth. Nothing here reads a caller's
+ * identity: both handlers resolve everything from the token, and both refuse
+ * outside production, where the surface does not exist at all.
+ */
+export declare function isPublicAppDeploymentRequest(pathname: string, method: string): boolean;
+/**
+ * The fal callback authenticates itself with the provider's Ed25519
+ * signature. Only POSTs to the exact callback shape are exempt; neighbouring
+ * provider routes and arbitrary path suffixes remain behind session auth.
+ */
+export declare function isPublicFalWebhookRequest(pathname: string, method: string): boolean;
+/**
+ * The AtlasCloud callback authenticates itself with the provider's Ed25519
+ * signature over the raw body. Only POSTs to the exact callback path are
+ * exempt; neighbouring provider routes stay behind session auth.
+ */
+export declare function isPublicAtlasCloudWebhookRequest(pathname: string, method: string): boolean;
+/**
+ * Paths that skip session auth in the server's `onRequest` hook. Every entry
+ * must carry no per-caller private state, or authenticate on its own (webhook
+ * secret, OAuth PKCE state, KIE webhook signature, fal and AtlasCloud Ed25519
+ * signatures).
+ * All of these are still
+ * covered by the global `@fastify/rate-limit` plugin registered before auth.
+ */
+export declare function isPublicAuthExemptRoute(pathname: string, method: string): boolean;
+//# sourceMappingURL=public-routes.d.ts.map

package/dist/lib/public-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-routes.d.ts","sourceRoot":"","sources":["../../src/lib/public-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAQT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CASnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAST;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAKT;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAIT;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAwBT"}

package/dist/lib/public-routes.js

@@ -0,0 +1,154 @@
+/**
+ * The auth-exemption allowlist predicates used by the server's `onRequest`
+ * hook.
+ *
+ * These live in their own module so they are testable without booting the
+ * server (`server.ts` is an entry point: importing it opens the database and
+ * binds a port). Getting an entry wrong here is an unauthenticated read of
+ * someone's data, so each predicate is deliberately an allowlist of exact
+ * paths or prefixes that carry no per-caller state.
+ */
+/**
+ * Read-only workflow GETs that carry no per-user data: the shipped example
+ * templates and workflows the owner explicitly marked `access: "public"`.
+ *
+ * Nothing that reads the *caller's* library belongs here. The REST handlers
+ * resolve identity from the (server-set) `x-user-id` header and fall back to
+ * user "1" when it is absent, so an auth-exempt route serves the local user's
+ * private workflows — full graph included — to anyone who can reach the port.
+ * That is exactly the disclosure the "Remote access requires authentication"
+ * 401 exists to prevent, so `/api/workflows`, `/api/workflows/:id`,
+ * `/api/workflows/names`, `/api/workflows/tools`, and `:id/dsl-export` all
+ * stay behind auth. A genuinely public workflow is still reachable
+ * unauthenticated at `/api/workflows/public/:id`.
+ */
+export function isPublicWorkflowMetadataRequest(pathname, method) {
+    if (method !== "GET")
+        return false;
+    return (pathname === "/api/workflows/public" ||
+        pathname.startsWith("/api/workflows/public/") ||
+        pathname === "/api/workflows/examples" ||
+        pathname.startsWith("/api/workflows/examples/"));
+}
+/**
+ * OAuth paths reachable without a session. Only the two browser redirect
+ * targets qualify: the identity provider sends the user back with no
+ * `Authorization` header, and the handlers authenticate the callback through
+ * the single-use PKCE `state` they minted at `/start`.
+ *
+ * Every other `/api/oauth/*` path reads or mutates stored credentials for the
+ * caller's user id, so exempting the whole prefix let an unauthenticated
+ * caller enumerate linked accounts (`/tokens`), pull the linked third-party
+ * profile and email (`/hf/whoami`, `/github/user`), force token refreshes, and
+ * delete credentials (`/openai/disconnect`) as user "1". The OpenAI (Codex)
+ * flow needs no entry: it redirects to a loopback listener this process binds,
+ * not to a server route.
+ */
+export function isPublicOAuthRequest(pathname) {
+    return (pathname === "/api/oauth/hf/callback" ||
+        pathname === "/api/oauth/github/callback");
+}
+/**
+ * The MCP OAuth 2.1 authorization-server + resource-metadata surface
+ * (`docs/mcp-oauth-design.md`, `routes/oauth-as.ts`). Every one of these
+ * paths authenticates on its own terms — well-known documents carry no
+ * per-caller state, and `/oauth/authorize|token|register|revoke` validate a
+ * client, a PKCE verifier, or a bearer token, never a session. The two
+ * well-known prefixes are matched with `startsWith` so the path-aware form
+ * (`…/oauth-protected-resource/mcp`) and the root form
+ * (`…/oauth-protected-resource`) both clear under one entry, same as the
+ * file's other prefix rules.
+ *
+ * `/oauth/consent` is deliberately absent: it is an SPA page, not an API
+ * route, and its data comes from an authenticated tRPC call
+ * (`agentAccess.getOauthRequest`) that goes through the normal auth hook.
+ * Exempting it here would serve the page's HTML shell to a caller with no
+ * session, which is fine, but the shell carries no data — the tRPC calls it
+ * makes still require login, so there is nothing to gain and a naming
+ * collision with the four API paths to avoid.
+ */
+export function isPublicMcpOauthAsRequest(pathname) {
+    return (pathname.startsWith("/.well-known/oauth-protected-resource") ||
+        pathname.startsWith("/.well-known/oauth-authorization-server") ||
+        pathname === "/oauth/authorize" ||
+        pathname === "/oauth/token" ||
+        pathname === "/oauth/register" ||
+        pathname === "/oauth/revoke");
+}
+/**
+ * The two routes a deployed mini app is served from: read the app, and mint
+ * the short-lived session its runs go through. Both take the deployment token
+ * from the path, and that token is the credential — an unguessable 24-byte
+ * secret its owner minted and can revoke.
+ *
+ * The prefix is exact and shallow (`/api/apps/`, not `/api/applications/`) so
+ * it can never widen onto the owner-scoped application routes, which read the
+ * caller's own library and stay behind auth. Nothing here reads a caller's
+ * identity: both handlers resolve everything from the token, and both refuse
+ * outside production, where the surface does not exist at all.
+ */
+export function isPublicAppDeploymentRequest(pathname, method) {
+    if (!pathname.startsWith("/api/apps/"))
+        return false;
+    const segments = pathname.slice("/api/apps/".length).split("/");
+    if (segments[0] === "")
+        return false;
+    if (method === "GET")
+        return segments.length === 1;
+    if (method === "POST") {
+        return segments.length === 2 && segments[1] === "session";
+    }
+    return false;
+}
+/**
+ * The fal callback authenticates itself with the provider's Ed25519
+ * signature. Only POSTs to the exact callback shape are exempt; neighbouring
+ * provider routes and arbitrary path suffixes remain behind session auth.
+ */
+export function isPublicFalWebhookRequest(pathname, method) {
+    const prefix = "/api/providers/fal/webhook/";
+    if (method !== "POST" || !pathname.startsWith(prefix))
+        return false;
+    const token = pathname.slice(prefix.length);
+    return token.length > 0 && !token.includes("/");
+}
+/**
+ * The AtlasCloud callback authenticates itself with the provider's Ed25519
+ * signature over the raw body. Only POSTs to the exact callback path are
+ * exempt; neighbouring provider routes stay behind session auth.
+ */
+export function isPublicAtlasCloudWebhookRequest(pathname, method) {
+    return (method === "POST" && pathname === "/api/providers/atlascloud/webhook");
+}
+/**
+ * Paths that skip session auth in the server's `onRequest` hook. Every entry
+ * must carry no per-caller private state, or authenticate on its own (webhook
+ * secret, OAuth PKCE state, KIE webhook signature, fal and AtlasCloud Ed25519
+ * signatures).
+ * All of these are still
+ * covered by the global `@fastify/rate-limit` plugin registered before auth.
+ */
+export function isPublicAuthExemptRoute(pathname, method) {
+    return (pathname === "/health" ||
+        pathname === "/ready" ||
+        pathname === "/api/health" ||
+        pathname === "/api/config" ||
+        isPublicOAuthRequest(pathname) ||
+        pathname === "/api/assets/packages" ||
+        pathname.startsWith("/api/assets/packages/") ||
+        pathname === "/api/nodes/metadata" ||
+        pathname.startsWith("/api/kie/webhook") ||
+        pathname.startsWith("/api/webhooks/") ||
+        // Messaging-integration identity routes. Like the webhook routes, they
+        // authenticate themselves — every handler requires the server's
+        // NODETOOL_INTEGRATION_TOKEN, compared in constant time — and they carry
+        // no per-caller session. Without that env var they are not registered at
+        // all, so the exemption reaches a 404.
+        pathname.startsWith("/api/integrations/") ||
+        isPublicWorkflowMetadataRequest(pathname, method) ||
+        isPublicAppDeploymentRequest(pathname, method) ||
+        isPublicFalWebhookRequest(pathname, method) ||
+        isPublicAtlasCloudWebhookRequest(pathname, method) ||
+        isPublicMcpOauthAsRequest(pathname));
+}
+//# sourceMappingURL=public-routes.js.map

package/dist/lib/public-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-routes.js","sourceRoot":"","sources":["../../src/lib/public-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,MAAc;IAEd,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,CACL,QAAQ,KAAK,uBAAuB;QACpC,QAAQ,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAC7C,QAAQ,KAAK,yBAAyB;QACtC,QAAQ,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,CACL,QAAQ,KAAK,wBAAwB;QACrC,QAAQ,KAAK,4BAA4B,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,uCAAuC,CAAC;QAC5D,QAAQ,CAAC,UAAU,CAAC,yCAAyC,CAAC;QAC9D,QAAQ,KAAK,kBAAkB;QAC/B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,eAAe,CAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,MAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,MAAc;IAEd,MAAM,MAAM,GAAG,6BAA6B,CAAC;IAC7C,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAgB,EAChB,MAAc;IAEd,OAAO,CACL,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,mCAAmC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,MAAc;IAEd,OAAO,CACL,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,QAAQ;QACrB,QAAQ,KAAK,aAAa;QAC1B,QAAQ,KAAK,aAAa;QAC1B,oBAAoB,CAAC,QAAQ,CAAC;QAC9B,QAAQ,KAAK,sBAAsB;QACnC,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAC5C,QAAQ,KAAK,qBAAqB;QAClC,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACvC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACrC,uEAAuE;QACvE,gEAAgE;QAChE,yEAAyE;QACzE,yEAAyE;QACzE,uCAAuC;QACvC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACzC,+BAA+B,CAAC,QAAQ,EAAE,MAAM,CAAC;QACjD,4BAA4B,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC9C,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC3C,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC;QAClD,yBAAyB,CAAC,QAAQ,CAAC,CACpC,CAAC;AACJ,CAAC"}

package/dist/lib/runtime-detection.d.ts

@@ -0,0 +1,17 @@
+/** The runtimes a client gets when it asks for no particular ones. */
+export declare const KNOWN_RUNTIMES: readonly ["python", "nodejs", "ffmpeg", "ffprobe", "pandoc", "pdftotext", "pdftoppm", "yt-dlp"];
+/** Whether `command` resolves to an executable on PATH. */
+export declare function hasExecutable(command: string): Promise<boolean>;
+export interface RuntimeStatus {
+    id: string;
+    installed: boolean;
+}
+/**
+ * Report install status for each runtime id. Unknown-but-safe ids are probed
+ * under their own name; an id that isn't a bare command name reports
+ * `installed: false` rather than touching the filesystem with it.
+ */
+export declare function detectRuntimes(ids?: readonly string[]): Promise<RuntimeStatus[]>;
+/** Drop cached probe results (tests, and after an install changes PATH). */
+export declare function clearRuntimeDetectionCache(): void;
+//# sourceMappingURL=runtime-detection.d.ts.map

package/dist/lib/runtime-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-detection.d.ts","sourceRoot":"","sources":["../../src/lib/runtime-detection.ts"],"names":[],"mappings":"AA2BA,sEAAsE;AACtE,eAAO,MAAM,cAAc,YACzB,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,UAAU,EACV,QAAQ,CACA,CAAC;AAuBX,2DAA2D;AAC3D,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQrE;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,GAAG,GAAE,SAAS,MAAM,EAAmB,GACtC,OAAO,CAAC,aAAa,EAAE,CAAC,CAc1B;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/dist/lib/runtime-detection.js

@@ -0,0 +1,90 @@
+/**
+ * Detects which external runtimes (ffmpeg, pandoc, yt-dlp, …) are present on
+ * the machine running the server.
+ *
+ * The desktop app answers this over Electron IPC, because it also installs the
+ * runtimes. A browser client — the web build, and every Docker/Fly deployment —
+ * has no such channel, so without this it assumed nothing was installed and
+ * showed "Requires FFmpeg" on nodes that run fine, since the container ships
+ * ffmpeg.
+ *
+ * Detection is a PATH scan for an executable file, not a spawn: it costs a few
+ * `access()` calls, cannot hang, and cannot run client-supplied strings.
+ * Results are cached briefly so a canvas full of video nodes probes once.
+ */
+import { constants as fsConstants, promises as fs } from "node:fs";
+import path from "node:path";
+/**
+ * Runtime ids whose executable is named differently from the id. Ids not
+ * listed here are probed under their own name (`ffmpeg`, `pandoc`, `yt-dlp`, …).
+ */
+const RUNTIME_COMMANDS = {
+    nodejs: "node",
+    pdftotext: "pdftotext",
+    pdftoppm: "pdftoppm"
+};
+/** The runtimes a client gets when it asks for no particular ones. */
+export const KNOWN_RUNTIMES = [
+    "python",
+    "nodejs",
+    "ffmpeg",
+    "ffprobe",
+    "pandoc",
+    "pdftotext",
+    "pdftoppm",
+    "yt-dlp"
+];
+/** Ids that are safe to probe: a bare command name, nothing path-like. */
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+const CACHE_TTL_MS = 30_000;
+const cache = new Map();
+function candidateNames(command) {
+    if (process.platform !== "win32")
+        return [command];
+    const exts = (process.env["PATHEXT"] ?? ".EXE;.CMD;.BAT;.COM").split(";");
+    return [command, ...exts.filter(Boolean).map((ext) => command + ext)];
+}
+async function isExecutable(file) {
+    try {
+        await fs.access(file, fsConstants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether `command` resolves to an executable on PATH. */
+export async function hasExecutable(command) {
+    const dirs = (process.env["PATH"] ?? "").split(path.delimiter).filter(Boolean);
+    for (const dir of dirs) {
+        for (const name of candidateNames(command)) {
+            if (await isExecutable(path.join(dir, name)))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Report install status for each runtime id. Unknown-but-safe ids are probed
+ * under their own name; an id that isn't a bare command name reports
+ * `installed: false` rather than touching the filesystem with it.
+ */
+export async function detectRuntimes(ids = KNOWN_RUNTIMES) {
+    const now = Date.now();
+    return Promise.all(ids.map(async (id) => {
+        if (!SAFE_ID.test(id))
+            return { id, installed: false };
+        const cached = cache.get(id);
+        if (cached && now - cached.at < CACHE_TTL_MS) {
+            return { id, installed: cached.installed };
+        }
+        const installed = await hasExecutable(RUNTIME_COMMANDS[id] ?? id);
+        cache.set(id, { installed, at: now });
+        return { id, installed };
+    }));
+}
+/** Drop cached probe results (tests, and after an install changes PATH). */
+export function clearRuntimeDetectionCache() {
+    cache.clear();
+}
+//# sourceMappingURL=runtime-detection.js.map

package/dist/lib/runtime-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-detection.js","sourceRoot":"","sources":["../../src/lib/runtime-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;GAGG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,MAAM,EAAE,MAAM;IACd,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,WAAW;IACX,UAAU;IACV,QAAQ;CACA,CAAC;AAEX,0EAA0E;AAC1E,MAAM,OAAO,GAAG,oCAAoC,CAAC;AAErD,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8C,CAAC;AAEpE,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAG,GAAsB,cAAc;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO,OAAO,CAAC,GAAG,CAChB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACnB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B;IACxC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/lib/storage-access.d.ts

@@ -0,0 +1,21 @@
+export declare function isRuntimeScratchKey(key: string): boolean;
+/**
+ * Derive the owning asset id from a storage key. Asset files are stored flat
+ * as `<assetId>.<ext>` and `<assetId>_thumb.jpg`.
+ */
+export declare function assetIdFromKey(key: string): string | null;
+/**
+ * Whether `userId` owns the asset a key refers to. Fails closed: a key that
+ * maps to no asset row, or a lookup that throws, is not owned.
+ */
+export declare function callerOwnsStorageKey(userId: string, key: string): Promise<boolean>;
+/**
+ * Whether `userId` may read the bytes at `key`.
+ *
+ * Owner-prefixed keys (`<userId>/<assetId>.<ext>`) are settled by the prefix
+ * alone — no database round trip, and the same rule a Supabase RLS policy or
+ * bucket policy applies to the object itself. Legacy flat keys, written
+ * before that layout, still need the `assets` lookup.
+ */
+export declare function canReadStorageKey(userId: string, key: string): Promise<boolean>;
+//# sourceMappingURL=storage-access.d.ts.map

package/dist/lib/storage-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-access.d.ts","sourceRoot":"","sources":["../../src/lib/storage-access.ts"],"names":[],"mappings":"AA+BA,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKxD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKzD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAKlB"}

package/dist/lib/storage-access.js

@@ -0,0 +1,74 @@
+/**
+ * Ownership rules for `/api/storage/<key>`.
+ *
+ * The local storage backend is a single shared directory with no per-user
+ * prefix: an asset's bytes live at `<assetId>.<ext>` (thumbnail:
+ * `<assetId>_thumb.jpg`), whoever created it. The only thing that ties a key
+ * to a user is the `assets` row, so every read has to go through it — without
+ * that check any authenticated caller could read (and, when PUT was open,
+ * overwrite) another tenant's asset bytes by id alone.
+ *
+ * The tRPC `storage.signUrl` procedure already gated on this; these helpers
+ * are the shared implementation so REST and tRPC can't drift apart again.
+ */
+import path from "node:path";
+import { Asset } from "@nodetool-ai/models";
+import { assetKeyOwner } from "@nodetool-ai/storage";
+/**
+ * Key prefixes the runtime writes to directly, with no `assets` row behind
+ * them: `temp/<uuid>.<ext>` (temp_url asset outputs) and `assets/<uuid>.<ext>`
+ * (storage_url outputs, binary tool results). They are capability keys — a
+ * random v4 UUID minted per run and handed only to the caller who triggered
+ * it — so they stay readable without an ownership record. Nothing can
+ * overwrite them: `/api/storage` no longer accepts writes at all.
+ */
+const RUNTIME_SCRATCH_PREFIXES = ["temp/", "assets/"];
+function normalizeKey(key) {
+    return key.replace(/\\/g, "/").replace(/^\/+/, "");
+}
+export function isRuntimeScratchKey(key) {
+    const normalized = normalizeKey(key);
+    return RUNTIME_SCRATCH_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+/**
+ * Derive the owning asset id from a storage key. Asset files are stored flat
+ * as `<assetId>.<ext>` and `<assetId>_thumb.jpg`.
+ */
+export function assetIdFromKey(key) {
+    const base = path.basename(normalizeKey(key));
+    const withoutExt = base.replace(/\.[^.]+$/, "");
+    const id = withoutExt.replace(/_thumb$/, "");
+    return id || null;
+}
+/**
+ * Whether `userId` owns the asset a key refers to. Fails closed: a key that
+ * maps to no asset row, or a lookup that throws, is not owned.
+ */
+export async function callerOwnsStorageKey(userId, key) {
+    const assetId = assetIdFromKey(key);
+    if (!assetId)
+        return false;
+    try {
+        return (await Asset.find(userId, assetId)) !== null;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether `userId` may read the bytes at `key`.
+ *
+ * Owner-prefixed keys (`<userId>/<assetId>.<ext>`) are settled by the prefix
+ * alone — no database round trip, and the same rule a Supabase RLS policy or
+ * bucket policy applies to the object itself. Legacy flat keys, written
+ * before that layout, still need the `assets` lookup.
+ */
+export async function canReadStorageKey(userId, key) {
+    if (isRuntimeScratchKey(key))
+        return true;
+    const owner = assetKeyOwner(key);
+    if (owner !== null)
+        return owner === userId;
+    return callerOwnsStorageKey(userId, key);
+}
+//# sourceMappingURL=storage-access.js.map

package/dist/lib/storage-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-access.js","sourceRoot":"","sources":["../../src/lib/storage-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAEtD,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9C,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,IAAI,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,GAAW;IAEX,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,GAAW;IAEX,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,KAAK,MAAM,CAAC;IAC5C,OAAO,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC"}

package/dist/lib/storage.d.ts

@@ -0,0 +1,9 @@
+import { type StorageAdapter } from "@nodetool-ai/storage";
+/**
+ * The asset store. On the local file backend it also resolves external
+ * assets, whose bytes stay at their original path outside the storage root.
+ * Server-built `ProcessingContext`s receive this instance as `assetStorage`.
+ */
+export declare function getAssetAdapter(): StorageAdapter;
+export declare function getTempAdapter(): StorageAdapter;
+//# sourceMappingURL=storage.d.ts.map

package/dist/lib/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/lib/storage.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAM9B;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,cAAc,CAWhD;AAED,wBAAgB,cAAc,IAAI,cAAc,CAG/C"}

package/dist/lib/storage.js

@@ -0,0 +1,28 @@
+import { loadAssetStorageConfig, loadTempStorageConfig } from "@nodetool-ai/config";
+import { createStorageAdapter, FileStorageAdapter } from "@nodetool-ai/storage";
+import { lookupExternalAssetPath } from "./external-asset-lookup.js";
+let _assetAdapter = null;
+let _tempAdapter = null;
+/**
+ * The asset store. On the local file backend it also resolves external
+ * assets, whose bytes stay at their original path outside the storage root.
+ * Server-built `ProcessingContext`s receive this instance as `assetStorage`.
+ */
+export function getAssetAdapter() {
+    if (!_assetAdapter) {
+        const config = loadAssetStorageConfig();
+        _assetAdapter =
+            config.kind === "file"
+                ? new FileStorageAdapter(config.rootDir, {
+                    externalPathLookup: lookupExternalAssetPath
+                })
+                : createStorageAdapter(config);
+    }
+    return _assetAdapter;
+}
+export function getTempAdapter() {
+    if (!_tempAdapter)
+        _tempAdapter = createStorageAdapter(loadTempStorageConfig());
+    return _tempAdapter;
+}
+//# sourceMappingURL=storage.js.map

package/dist/lib/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/lib/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,IAAI,aAAa,GAA0B,IAAI,CAAC;AAChD,IAAI,YAAY,GAA0B,IAAI,CAAC;AAE/C;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACxC,aAAa;YACX,MAAM,CAAC,IAAI,KAAK,MAAM;gBACpB,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;oBACrC,kBAAkB,EAAE,uBAAuB;iBAC5C,CAAC;gBACJ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,YAAY;QAAE,YAAY,GAAG,oBAAoB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAChF,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/lib/storyboard-export.d.ts

@@ -0,0 +1,64 @@
+import type { Shot } from "@nodetool-ai/protocol";
+import { type ExportSource, type ZipStreamWriter } from "./zip-stream.js";
+/** The board fields the export reads, as `Storyboard.toDocument()` holds them. */
+export interface StoryboardExportInput {
+    name: string;
+    title?: string;
+    logline?: string;
+    brief?: string;
+    style?: string;
+    aspectRatio?: string;
+    narration?: string;
+    musicPrompt?: string;
+    shots: Shot[];
+}
+/** What the archive holds for one shot: a packed path, or why it holds none. */
+interface ShotMedia {
+    still?: string;
+    clip?: string;
+    /** Refs the shot named that the export could not turn into bytes. */
+    unresolved?: Array<{
+        kind: "still" | "clip";
+        source: string;
+    }>;
+}
+/**
+ * The locator to resolve bytes from, or null when the ref carries none.
+ *
+ * A stored `asset_id` beats the ref's own `uri` when that uri is not something
+ * the server can fetch — a `blob:` or `file://` source is the browser's
+ * handle on the bytes, not the server's, and the asset id names the same
+ * media in terms the storage adapter understands.
+ */
+export declare function mediaRefSource(ref: unknown): string | null;
+/**
+ * Render the board as Markdown. `media` maps a shot id to the archive-relative
+ * paths packed for it; a shot missing from it renders without media links.
+ */
+export declare function renderStoryboardMarkdown(board: StoryboardExportInput, media: ReadonlyMap<string, ShotMedia>): string;
+export interface PackStoryboardZipOptions {
+    board: StoryboardExportInput;
+    /**
+     * Resolve a media ref uri (`asset://…`, `/api/storage/…`) to bytes or a
+     * local file, which is streamed from disk.
+     */
+    fetchAssetSource: (ref: string) => Promise<ExportSource | null>;
+}
+export interface WriteStoryboardZipResult {
+    /** Archive-relative paths written, `storyboard.md` first. */
+    files: string[];
+    /** Refs that named media the export could not resolve. */
+    missing: string[];
+}
+export interface PackStoryboardZipResult extends WriteStoryboardZipResult {
+    bytes: Uint8Array;
+}
+/**
+ * Write the zip to `writer`: every resolvable shot asset as it is read, then
+ * the Markdown document, which names what was found.
+ */
+export declare function writeStoryboardZip(options: PackStoryboardZipOptions, writer: ZipStreamWriter): Promise<WriteStoryboardZipResult>;
+/** Build the zip in memory. The HTTP export streams instead. */
+export declare function packStoryboardZip(options: PackStoryboardZipOptions): Promise<PackStoryboardZipResult>;
+export {};
+//# sourceMappingURL=storyboard-export.d.ts.map

package/dist/lib/storyboard-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storyboard-export.d.ts","sourceRoot":"","sources":["../../src/lib/storyboard-export.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAGzB,kFAAkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AAED,gFAAgF;AAChF,UAAU,SAAS;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE;AAkBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAS1D;AAqCD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,EAC5B,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,GACpC,MAAM,CA+CR;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,qBAAqB,CAAC;IAC7B;;;OAGG;IACH,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,KAAK,EAAE,UAAU,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,wBAAwB,CAAC,CAmEnC;AAED,gEAAgE;AAChE,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAOlC"}