@overlordai/server 1.0.1

package/dist/web/worker-channel.gateway.js

@@ -0,0 +1,283 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var WorkerChannelGateway_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkerChannelGateway = void 0;
+const websockets_1 = require("@nestjs/websockets");
+const common_1 = require("@nestjs/common");
+const ws_1 = require("ws");
+const protocol_1 = require("@overlordai/protocol");
+const auth_service_1 = require("../auth/auth.service");
+const worker_connection_manager_1 = require("../dispatcher/worker-connection.manager");
+const heartbeat_service_1 = require("../dispatcher/heartbeat.service");
+const reconciler_1 = require("../dispatcher/reconciler");
+const task_log_batcher_1 = require("../dispatcher/task-log-batcher");
+const dedup_service_1 = require("../dispatcher/dedup.service");
+const machine_repository_1 = require("../database/repositories/machine.repository");
+const task_repository_1 = require("../database/repositories/task.repository");
+const worker_token_repository_1 = require("../database/repositories/worker-token.repository");
+const notifier_service_1 = require("../notifier/notifier.service");
+const protocol_2 = require("@overlordai/protocol");
+let WorkerChannelGateway = WorkerChannelGateway_1 = class WorkerChannelGateway {
+    authService;
+    workerConnectionManager;
+    heartbeatService;
+    reconciler;
+    taskLogBatcher;
+    dedupService;
+    machineRepo;
+    taskRepo;
+    workerTokenRepo;
+    notifierService;
+    logger = new common_1.Logger(WorkerChannelGateway_1.name);
+    authedSockets = new Map();
+    AUTH_TIMEOUT_MS = 10_000;
+    constructor(authService, workerConnectionManager, heartbeatService, reconciler, taskLogBatcher, dedupService, machineRepo, taskRepo, workerTokenRepo, notifierService) {
+        this.authService = authService;
+        this.workerConnectionManager = workerConnectionManager;
+        this.heartbeatService = heartbeatService;
+        this.reconciler = reconciler;
+        this.taskLogBatcher = taskLogBatcher;
+        this.dedupService = dedupService;
+        this.machineRepo = machineRepo;
+        this.taskRepo = taskRepo;
+        this.workerTokenRepo = workerTokenRepo;
+        this.notifierService = notifierService;
+    }
+    handleConnection(client, _req) {
+        this.logger.debug('New worker channel connection, awaiting auth frame');
+        // Set auth timeout - disconnect if no auth frame within 10s
+        const authTimeout = setTimeout(() => {
+            if (!this.authedSockets.has(client)) {
+                this.logger.warn('Worker channel auth timeout, closing connection');
+                client.close(4001, 'Auth timeout');
+            }
+        }, this.AUTH_TIMEOUT_MS);
+        client.on('message', (rawData) => {
+            let frame;
+            try {
+                const str = typeof rawData === 'string' ? rawData : rawData.toString('utf8');
+                frame = JSON.parse(str);
+            }
+            catch {
+                this.logger.warn('Invalid JSON from worker channel');
+                client.close(4002, 'Invalid JSON');
+                return;
+            }
+            const authed = this.authedSockets.get(client);
+            if (!authed) {
+                // First message must be auth
+                if (frame.type !== 'auth') {
+                    this.logger.warn(`Expected auth frame, got ${frame.type}; closing`);
+                    client.close(4003, 'Expected auth frame');
+                    return;
+                }
+                clearTimeout(authTimeout);
+                this.handleAuth(client, frame);
+                return;
+            }
+            // Dispatch authenticated frames
+            switch (frame.type) {
+                case 'heartbeat':
+                    this.handleHeartbeat(authed, frame);
+                    break;
+                case 'ack':
+                    this.handleAck(frame);
+                    break;
+                case 'reconnect':
+                    void this.handleReconnect(authed, frame);
+                    break;
+                case 'progress':
+                    this.handleProgress(frame);
+                    break;
+                case 'recovery_secret_ack':
+                    this.handleRecoverySecretAck(authed, frame);
+                    break;
+                case 'stage_confirm_request':
+                    void this.handleStageConfirmRequest(frame);
+                    break;
+                default:
+                    this.logger.debug(`Unknown frame type: ${frame.type}`);
+            }
+        });
+    }
+    handleDisconnect(client) {
+        const authed = this.authedSockets.get(client);
+        if (authed) {
+            clearInterval(authed.revalidationTimer);
+            this.workerConnectionManager.unregister(authed.machineId);
+            this.authedSockets.delete(client);
+            this.logger.log(`Worker ${authed.machineId} disconnected`);
+        }
+    }
+    handleAuth(client, frame) {
+        // Validate JWT
+        let payload;
+        try {
+            payload = this.authService.verifyWorkerJwt(frame.token);
+        }
+        catch {
+            this.logger.warn('Worker auth failed: invalid JWT');
+            client.close(4004, 'Invalid JWT');
+            return;
+        }
+        // Validate protocol version (major must match)
+        const clientMajor = frame.protocolVersion.split('.')[0];
+        const serverMajor = protocol_1.PROTOCOL_VERSION.split('.')[0];
+        if (clientMajor !== serverMajor) {
+            this.logger.warn(`Protocol version mismatch: client=${frame.protocolVersion}, server=${protocol_1.PROTOCOL_VERSION}`);
+            client.close(4005, 'Protocol version mismatch');
+            return;
+        }
+        // Validate token against machine record
+        const machine = this.machineRepo.findById(payload.sub);
+        if (!machine) {
+            this.logger.warn(`Auth failed: machine ${payload.sub} not found`);
+            client.close(4006, 'Machine not found');
+            return;
+        }
+        if (machine.tokenId !== payload.tokenId) {
+            this.logger.warn(`Auth failed: tokenId mismatch for machine ${payload.sub}`);
+            client.close(4007, 'Token ID mismatch');
+            return;
+        }
+        // Validate worker token is active
+        const workerToken = this.workerTokenRepo.findById(payload.tokenId);
+        if (!workerToken || workerToken.status !== 'active') {
+            this.logger.warn(`Auth failed: worker token ${payload.tokenId} not active`);
+            client.close(4008, 'Worker token not active');
+            return;
+        }
+        // Register connection
+        this.workerConnectionManager.register(payload.sub, client);
+        // Mark machine online
+        this.machineRepo.updateStatus(payload.sub, protocol_1.MachineStatus.ONLINE);
+        // Set up periodic revalidation
+        const revalidationTimer = setInterval(() => {
+            this.revalidateWorkerJwt(client, payload.sub, payload.tokenId);
+        }, protocol_1.TOKEN_REVALIDATION_INTERVAL_MS);
+        const authedSocket = {
+            ws: client,
+            machineId: payload.sub,
+            tokenId: payload.tokenId,
+            authedAt: Date.now(),
+            revalidationTimer,
+        };
+        this.authedSockets.set(client, authedSocket);
+        this.logger.log(`Worker ${payload.sub} authenticated`);
+    }
+    handleHeartbeat(authed, frame) {
+        this.heartbeatService.processHeartbeat(authed.machineId, {
+            cpuUsage: frame.metrics.cpuUsage,
+            memoryUsage: frame.metrics.memoryUsage,
+            diskUsage: frame.metrics.diskUsage,
+            activeSlots: frame.metrics.activeSlots,
+        }, frame.capabilities);
+        // Send heartbeat_ack
+        const ack = {
+            type: 'heartbeat_ack',
+            timestamp: frame.timestamp,
+            serverTime: new Date().toISOString(),
+        };
+        if (authed.ws.readyState === ws_1.WebSocket.OPEN) {
+            authed.ws.send(JSON.stringify(ack));
+        }
+    }
+    handleAck(frame) {
+        this.workerConnectionManager.handleAck(frame.msgId, frame.payload);
+    }
+    async handleReconnect(authed, frame) {
+        this.logger.log(`Worker ${authed.machineId} reconnecting with ${frame.tasks.length} task(s)`);
+        // Update machine status to online
+        this.machineRepo.updateStatus(authed.machineId, protocol_1.MachineStatus.ONLINE);
+        // Forward to reconciler
+        await this.reconciler.handleReconnect(authed.machineId, frame.tasks);
+    }
+    handleProgress(frame) {
+        this.taskLogBatcher.add(frame.taskId, protocol_2.TaskLogType.STAGE_CHANGE, `Stage: ${frame.stage} - ${frame.status}${frame.message ? `: ${frame.message}` : ''}`);
+    }
+    handleRecoverySecretAck(authed, _frame) {
+        this.logger.log(`Worker ${authed.machineId} acknowledged recovery secret bootstrap`);
+    }
+    async handleStageConfirmRequest(frame) {
+        const { taskId, stageIndex, mode, prompt, choices, timeout } = frame;
+        this.logger.log(`Stage confirm request for task #${taskId}, stage ${stageIndex}, mode=${mode}`);
+        // Store pending confirm in Redis via DedupService
+        const confirmKey = `stage:${taskId}:${stageIndex}`;
+        await this.dedupService.storePendingConfirm(confirmKey, {
+            taskId,
+            stageIndex,
+            mode,
+            prompt,
+            choices,
+            timeout,
+            createdAt: new Date().toISOString(),
+        });
+        // Notify web clients via the notification channel
+        const task = this.taskRepo.findById(taskId);
+        if (task) {
+            await this.notifierService.notifyStageConfirmRequired(task, `stage_${stageIndex}`);
+        }
+        else {
+            this.logger.warn(`Task #${taskId} not found when processing stage confirm request`);
+        }
+    }
+    /**
+     * Periodically revalidate Worker JWT. Disconnect if token is invalid,
+     * machine tokenId changed, or worker token is revoked/expired.
+     * Honors a 2-minute grace period for old JWTs during token refresh.
+     */
+    revalidateWorkerJwt(client, machineId, tokenId) {
+        // Check machine still exists and tokenId matches
+        const machine = this.machineRepo.findById(machineId);
+        if (!machine) {
+            this.logger.warn(`Revalidation failed: machine ${machineId} not found, disconnecting`);
+            client.close(4010, 'Machine not found');
+            return;
+        }
+        if (machine.tokenId !== tokenId) {
+            // Check grace period
+            const authed = this.authedSockets.get(client);
+            if (authed) {
+                const elapsed = Date.now() - authed.authedAt;
+                if (elapsed < protocol_1.WORKER_JWT_GRACE_PERIOD_MS) {
+                    this.logger.debug(`TokenId mismatch for ${machineId} but within grace period (${elapsed}ms)`);
+                    return;
+                }
+            }
+            this.logger.warn(`Revalidation failed: tokenId mismatch for machine ${machineId}, disconnecting`);
+            client.close(4011, 'Token ID mismatch');
+            return;
+        }
+        // Check worker token is still active
+        const workerToken = this.workerTokenRepo.findById(tokenId);
+        if (!workerToken || workerToken.status !== 'active') {
+            this.logger.warn(`Revalidation failed: worker token ${tokenId} not active, disconnecting`);
+            client.close(4012, 'Worker token not active');
+            return;
+        }
+    }
+};
+exports.WorkerChannelGateway = WorkerChannelGateway;
+exports.WorkerChannelGateway = WorkerChannelGateway = WorkerChannelGateway_1 = __decorate([
+    (0, websockets_1.WebSocketGateway)({ path: '/api/workers/channel' }),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        worker_connection_manager_1.WorkerConnectionManager,
+        heartbeat_service_1.HeartbeatService,
+        reconciler_1.Reconciler,
+        task_log_batcher_1.TaskLogBatcher,
+        dedup_service_1.DedupService,
+        machine_repository_1.MachineRepository,
+        task_repository_1.TaskRepository,
+        worker_token_repository_1.WorkerTokenRepository,
+        notifier_service_1.NotifierService])
+], WorkerChannelGateway);
+//# sourceMappingURL=worker-channel.gateway.js.map

package/dist/web/worker-channel.gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-channel.gateway.js","sourceRoot":"","sources":["../../src/web/worker-channel.gateway.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,mDAI4B;AAC5B,2CAAwC;AAExC,2BAA+B;AAE/B,mDAK8B;AAa9B,uDAAmD;AACnD,uFAAkF;AAClF,uEAAmE;AACnE,yDAAsD;AACtD,qEAAgE;AAChE,+DAA2D;AAC3D,oFAAgF;AAChF,8EAA0E;AAC1E,8FAAyF;AACzF,mEAA+D;AAC/D,mDAAmD;AAW5C,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAQZ;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAdF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAC/C,aAAa,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC1D,eAAe,GAAG,MAAM,CAAC;IAE1C,YACmB,WAAwB,EACxB,uBAAgD,EAChD,gBAAkC,EAClC,UAAsB,EACtB,cAA8B,EAC9B,YAA0B,EAC1B,WAA8B,EAC9B,QAAwB,EACxB,eAAsC,EACtC,eAAgC;QAThC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAmB;QAC9B,aAAQ,GAAR,QAAQ,CAAgB;QACxB,oBAAe,GAAf,eAAe,CAAuB;QACtC,oBAAe,GAAf,eAAe,CAAiB;IAChD,CAAC;IAEJ,gBAAgB,CAAC,MAAiB,EAAE,IAAqB;QACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAExE,4DAA4D;QAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;gBACpE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEzB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,EAAE;YAChD,IAAI,KAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,GACP,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACrD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAE9C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,6BAA6B;gBAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,KAAK,CAAC,IAAI,WAAW,CAClD,CAAC;oBACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBACD,YAAY,CAAC,WAAW,CAAC,CAAC;gBAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAwB,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YAED,gCAAgC;YAChC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAA6B,CAAC,CAAC;oBAC5D,MAAM;gBACR,KAAK,KAAK;oBACR,IAAI,CAAC,SAAS,CAAC,KAAuB,CAAC,CAAC;oBACxC,MAAM;gBACR,KAAK,WAAW;oBACd,KAAK,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAA6B,CAAC,CAAC;oBACjE,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,cAAc,CAAC,KAA4B,CAAC,CAAC;oBAClD,MAAM;gBACR,KAAK,qBAAqB;oBACxB,IAAI,CAAC,uBAAuB,CAC1B,MAAM,EACN,KAAqC,CACtC,CAAC;oBACF,MAAM;gBACR,KAAK,uBAAuB;oBAC1B,KAAK,IAAI,CAAC,yBAAyB,CACjC,KAAiC,CAClC,CAAC;oBACF,MAAM;gBACR;oBACE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAwB,KAA0B,CAAC,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,MAAiB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACxC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,SAAS,eAAe,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAiB,EAAE,KAAsB;QAC1D,eAAe;QACf,IAAI,OAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,+CAA+C;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,2BAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,KAAK,CAAC,eAAe,YAAY,2BAAgB,EAAE,CACzF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,wCAAwC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC;YAClE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6CAA6C,OAAO,CAAC,GAAG,EAAE,CAC3D,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,kCAAkC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,OAAO,CAAC,OAAO,aAAa,CAC1D,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE3D,sBAAsB;QACtB,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,wBAAa,CAAC,MAAM,CAAC,CAAC;QAEjE,+BAA+B;QAC/B,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE;YACzC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC,EAAE,yCAA8B,CAAC,CAAC;QAEnC,MAAM,YAAY,GAAwB;YACxC,EAAE,EAAE,MAAM;YACV,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,iBAAiB;SAClB,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,GAAG,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAEO,eAAe,CACrB,MAA2B,EAC3B,KAA2B;QAE3B,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CACpC,MAAM,CAAC,SAAS,EAChB;YACE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;YACtC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;SACvC,EACD,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,qBAAqB;QACrB,MAAM,GAAG,GAAsB;YAC7B,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QAEF,IAAI,MAAM,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAAqB;QACrC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,MAA2B,EAC3B,KAA2B;QAE3B,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,UAAU,MAAM,CAAC,SAAS,sBAAsB,KAAK,CAAC,KAAK,CAAC,MAAM,UAAU,CAC7E,CAAC;QAEF,kCAAkC;QAClC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,wBAAa,CAAC,MAAM,CAAC,CAAC;QAEtE,wBAAwB;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAEO,cAAc,CAAC,KAA0B;QAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CACrB,KAAK,CAAC,MAAM,EACZ,sBAAW,CAAC,YAAY,EACxB,UAAU,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtF,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAC7B,MAA2B,EAC3B,MAAoC;QAEpC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,UAAU,MAAM,CAAC,SAAS,yCAAyC,CACpE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,KAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mCAAmC,MAAM,WAAW,UAAU,UAAU,IAAI,EAAE,CAC/E,CAAC;QAEF,kDAAkD;QAClD,MAAM,UAAU,GAAG,SAAS,MAAM,IAAI,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,UAAU,EAAE;YACtD,MAAM;YACN,UAAU;YACV,IAAI;YACJ,MAAM;YACN,OAAO;YACP,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QAEH,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,eAAe,CAAC,0BAA0B,CACnD,IAAI,EACJ,SAAS,UAAU,EAAE,CACtB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,SAAS,MAAM,kDAAkD,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,mBAAmB,CACzB,MAAiB,EACjB,SAAiB,EACjB,OAAe;QAEf,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gCAAgC,SAAS,2BAA2B,CACrE,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAChC,qBAAqB;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC7C,IAAI,OAAO,GAAG,qCAA0B,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wBAAwB,SAAS,6BAA6B,OAAO,KAAK,CAC3E,CAAC;oBACF,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qDAAqD,SAAS,iBAAiB,CAChF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,qCAAqC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,OAAO,4BAA4B,CACzE,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;IACH,CAAC;CACF,CAAA;AA/TY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,6BAAgB,EAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;qCASjB,0BAAW;QACC,mDAAuB;QAC9B,oCAAgB;QACtB,uBAAU;QACN,iCAAc;QAChB,4BAAY;QACb,sCAAiB;QACpB,gCAAc;QACP,+CAAqB;QACrB,kCAAe;GAjBxC,oBAAoB,CA+ThC"}

package/dist/web/worker.controller.d.ts

@@ -0,0 +1,14 @@
+import type { WorkerRegisterRequest, WorkerRegisterResponse, WorkerRefreshRequest, WorkerRefreshResponse, WorkerRecoveryRequest, WorkerRecoveryResponse } from '@overlordai/protocol';
+import { DispatcherService } from '../dispatcher/dispatcher.service';
+import { AuthService } from '../auth/auth.service';
+export declare class WorkerController {
+    private readonly dispatcher;
+    private readonly authService;
+    constructor(dispatcher: DispatcherService, authService: AuthService);
+    register(body: WorkerRegisterRequest): Promise<WorkerRegisterResponse>;
+    refreshToken(body: WorkerRefreshRequest, req: {
+        headers?: Record<string, string>;
+    }): Promise<WorkerRefreshResponse>;
+    recover(body: WorkerRecoveryRequest): Promise<WorkerRecoveryResponse>;
+}
+//# sourceMappingURL=worker.controller.d.ts.map

package/dist/web/worker.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.controller.d.ts","sourceRoot":"","sources":["../../src/web/worker.controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,qBACa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,UAAU,EAAE,iBAAiB,EAC7B,WAAW,EAAE,WAAW;IAKrC,QAAQ,CACJ,IAAI,EAAE,qBAAqB,GAClC,OAAO,CAAC,sBAAsB,CAAC;IAK5B,YAAY,CACR,IAAI,EAAE,oBAAoB,EAC3B,GAAG,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC/C,OAAO,CAAC,qBAAqB,CAAC;IAY3B,OAAO,CACH,IAAI,EAAE,qBAAqB,GAClC,OAAO,CAAC,sBAAsB,CAAC;CAGnC"}

package/dist/web/worker.controller.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkerController = void 0;
+const common_1 = require("@nestjs/common");
+const dispatcher_service_1 = require("../dispatcher/dispatcher.service");
+const auth_service_1 = require("../auth/auth.service");
+const rate_limit_guard_1 = require("../common/rate-limit.guard");
+let WorkerController = class WorkerController {
+    dispatcher;
+    authService;
+    constructor(dispatcher, authService) {
+        this.dispatcher = dispatcher;
+        this.authService = authService;
+    }
+    async register(body) {
+        return this.dispatcher.registerWorker(body);
+    }
+    async refreshToken(body, req) {
+        const authHeader = req.headers?.authorization;
+        if (!authHeader?.startsWith('Bearer ')) {
+            throw new common_1.UnauthorizedException('Missing or invalid Authorization header');
+        }
+        const token = authHeader.slice(7);
+        const payload = this.authService.verifyWorkerJwt(token);
+        return this.dispatcher.refreshWorkerToken(body, { sub: payload.sub, tokenId: payload.tokenId });
+    }
+    async recover(body) {
+        return this.dispatcher.recoverWorker(body);
+    }
+};
+exports.WorkerController = WorkerController;
+__decorate([
+    (0, common_1.Post)('register'),
+    (0, rate_limit_guard_1.RateLimit)({ limit: 5, windowMs: 60_000, byIp: true }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], WorkerController.prototype, "register", null);
+__decorate([
+    (0, common_1.Post)('refresh-token'),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], WorkerController.prototype, "refreshToken", null);
+__decorate([
+    (0, common_1.Post)('recover'),
+    (0, rate_limit_guard_1.RateLimit)({ limit: 5, windowMs: 60_000, byIp: true }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], WorkerController.prototype, "recover", null);
+exports.WorkerController = WorkerController = __decorate([
+    (0, common_1.Controller)('api/workers'),
+    __metadata("design:paramtypes", [dispatcher_service_1.DispatcherService,
+        auth_service_1.AuthService])
+], WorkerController);
+//# sourceMappingURL=worker.controller.js.map

package/dist/web/worker.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.controller.js","sourceRoot":"","sources":["../../src/web/worker.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAMwB;AASxB,yEAAqE;AACrE,uDAAmD;AACnD,iEAAuD;AAGhD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAER;IACA;IAFnB,YACmB,UAA6B,EAC7B,WAAwB;QADxB,eAAU,GAAV,UAAU,CAAmB;QAC7B,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAIE,AAAN,KAAK,CAAC,QAAQ,CACJ,IAA2B;QAEnC,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACR,IAA0B,EAC3B,GAAyC;QAEhD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9C,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CACH,IAA2B;QAEnC,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAnCY,4CAAgB;AAQrB;IAFL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,4BAAS,EAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEnD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;gDAGR;AAGK;IADL,IAAA,aAAI,EAAC,eAAe,CAAC;IAEnB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDASP;AAIK;IAFL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,4BAAS,EAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEnD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;+CAGR;2BAlCU,gBAAgB;IAD5B,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAGO,sCAAiB;QAChB,0BAAW;GAHhC,gBAAgB,CAmC5B"}

package/dist/web/workspace.controller.d.ts

@@ -0,0 +1,109 @@
+import { WorkspaceRepository } from '../database/repositories/workspace.repository';
+import { TaskRepository } from '../database/repositories/task.repository';
+import { WorkerConnectionManager } from '../dispatcher/worker-connection.manager';
+/**
+ * Tunnel lifecycle states:
+ *   IDLE -> STARTING -> CONNECTED -> EXPIRED -> CLOSING -> CLOSED
+ *                          |                       ^
+ *                          +--- (manual stop) -----+
+ */
+type TunnelStatus = 'IDLE' | 'STARTING' | 'CONNECTED' | 'EXPIRED' | 'CLOSING' | 'CLOSED';
+export declare class WorkspaceController {
+    private readonly workspaceRepo;
+    private readonly taskRepo;
+    private readonly workerConnectionManager;
+    private readonly logger;
+    /**
+     * In-memory tunnel state per taskId.
+     * NOTE: This state is lost on server restart. This is acceptable because
+     * tunnels have a TTL and self-expire, and Workers will detect stale tunnels
+     * via heartbeat. After a restart, getTunnelStatus returns 'IDLE' which
+     * allows clients to start a new tunnel.
+     */
+    private readonly tunnels;
+    constructor(workspaceRepo: WorkspaceRepository, taskRepo: TaskRepository, workerConnectionManager: WorkerConnectionManager);
+    getWorkspace(taskId: number, req: {
+        user: {
+            sub: number;
+            role: string;
+        };
+    }): import("@overlordai/protocol").Workspace;
+    /**
+     * Start a Cursor Remote Tunnel for the given task's workspace.
+     * Sends a start_tunnel command to the Worker via the WebSocket control channel.
+     * Only the task owner or an admin can start a tunnel.
+     */
+    startTunnel(taskId: number, req: {
+        user: {
+            sub: number;
+            role: string;
+        };
+    }): Promise<{
+        status: TunnelStatus;
+        taskId: number;
+        tunnelUrl: string | undefined;
+        expiresAt: string | undefined;
+    }>;
+    /**
+     * Stop a running Cursor Remote Tunnel for the given task.
+     * Sends a stop_tunnel command to the Worker.
+     * Only the task owner or an admin can stop a tunnel.
+     */
+    stopTunnel(taskId: number, req: {
+        user: {
+            sub: number;
+            role: string;
+        };
+    }): Promise<{
+        status: string;
+        taskId: number;
+    }>;
+    /**
+     * Get the current tunnel status for a task.
+     * tunnelUrl is only returned when the tunnel is in CONNECTED state.
+     */
+    getTunnelStatus(taskId: number, req: {
+        user: {
+            sub: number;
+            role: string;
+        };
+    }): {
+        status: TunnelStatus;
+        taskId: number;
+        tunnelUrl?: undefined;
+        expiresAt?: undefined;
+    } | {
+        status: TunnelStatus;
+        taskId: number;
+        tunnelUrl: string | undefined;
+        expiresAt: string | undefined;
+    };
+    /**
+     * Handle a tunnel_started event from the Worker (called by WorkerChannelGateway).
+     * Transitions the tunnel state to CONNECTED and starts the expiry timer.
+     */
+    handleTunnelStarted(taskId: number, tunnelUrl: string): void;
+    /**
+     * Handle a tunnel_closed event from the Worker (called by WorkerChannelGateway).
+     * Worker-side tunnel process exited unexpectedly.
+     */
+    handleTunnelClosed(taskId: number, _reason: string): void;
+    /**
+     * Force-close all tunnels for a task (called when task reaches terminal state).
+     */
+    cleanupTunnelForTask(taskId: number, machineId?: string | null): Promise<void>;
+    /**
+     * Transition a tunnel to CONNECTED state with a URL and start the expiry timer.
+     */
+    private transitionToConnected;
+    /**
+     * Handle tunnel expiry: transition to EXPIRED, then send stop_tunnel to Worker.
+     */
+    private handleTunnelExpired;
+    /**
+     * Assert that the requesting user is either the task owner or an admin.
+     */
+    private assertOwnerOrAdmin;
+}
+export {};
+//# sourceMappingURL=workspace.controller.d.ts.map

package/dist/web/workspace.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.controller.d.ts","sourceRoot":"","sources":["../../src/web/workspace.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AASlF;;;;;GAKG;AACH,KAAK,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAUzF,qBAEa,mBAAmB;IAY5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAb1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;gBAGvC,aAAa,EAAE,mBAAmB,EAClC,QAAQ,EAAE,cAAc,EACxB,uBAAuB,EAAE,uBAAuB;IAInE,YAAY,CACqB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE;QAAE,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;IAkBrD;;;;OAIG;IAEG,WAAW,CACgB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE;QAAE,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;;;;;;IAqFrD;;;;OAIG;IAEG,UAAU,CACiB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE;QAAE,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;;;;IA4DrD;;;OAGG;IAEH,eAAe,CACkB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE;QAAE,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;gBAetB,YAAY;;;;;;;;;;IAW3C;;;OAGG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAI5D;;;OAGG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAezD;;OAEG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCpF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAyB7B;;OAEG;YACW,mBAAmB;IAkCjC;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAW3B"}