@rryando/arcs 3.10.0 → 3.11.0

package/dist/web-server/routes/sessions.js

@@ -0,0 +1,442 @@
+/**
+ * Session routes — full CRUD over the per-project session index.
+ *
+ * Sessions are runtime records for agent sessions (opencode, claude-code)
+ * attached to a project. All mutations go through the locked session-store,
+ * so the opencode discovery bridge and the web UI cannot clobber each other.
+ *
+ * `POST /sessions/:id/message` is the one route that reaches outside the store:
+ * it proxies a prompt into the live runtime (opencode) or queues it for the
+ * session to collect itself (claude-code). Every route here is browser-facing
+ * and therefore already behind the global loopback-only `secureLocalRequest`
+ * middleware — no per-route auth.
+ */
+import { randomUUID } from "node:crypto";
+import { stat, unlink } from "node:fs/promises";
+import { resolve } from "node:path";
+import { Hono } from "hono";
+import { z } from "zod";
+import { appendReferenceTurn, appendSessionTurn, mirrorSessionTranscript, readSessionTurns, sessionTranscriptPath, } from "../../utils/claude-transcript.js";
+import { DagError } from "../../utils/errors.js";
+import { readJsonSafe } from "../../utils/json.js";
+import { createSession, deleteSession, enqueueSessionMessage, getSession, listSessions, SESSION_LINKED_NODE_TYPES, SESSION_RUNTIME_TYPES, SESSION_STATUSES, updateSession, upsertSession, } from "../../utils/session-store.js";
+import { isRunLive, runClaudeJob } from "../claude-runner.js";
+import { createOpencodeSession, readOpencodeConfig, sendOpencodeMessage, } from "../opencode-client.js";
+import { parseBody, requireProjectDir, respond } from "../respond.js";
+export const sessionsRoute = new Hono();
+const createSessionSchema = z.object({
+    runtimeType: z.enum(SESSION_RUNTIME_TYPES),
+    runtimeSessionId: z.string().min(1),
+    status: z.enum(SESSION_STATUSES).optional(),
+    startedAt: z.string().optional(),
+    lastMessageAt: z.string().optional(),
+    userEmail: z.string().optional(),
+    metadata: z.record(z.unknown()).optional(),
+});
+const updateSessionSchema = z.object({
+    status: z.enum(SESSION_STATUSES).optional(),
+    lastMessageAt: z.string().nullable().optional(),
+    userEmail: z.string().nullable().optional(),
+    metadata: z.record(z.unknown()).nullable().optional(),
+    /** `null` on either linkage field unlinks the session entirely. */
+    linkedNodeType: z.enum(SESSION_LINKED_NODE_TYPES).nullable().optional(),
+    linkedNodeId: z.string().nullable().optional(),
+});
+/** A document section the caller is pointing the session at. When present, the
+ *  delivery call is followed by an ARCS-authored reference turn in the session's
+ *  transcript sidecar (see appendReferenceTurn). Shared by POST /message and
+ *  POST /run so both routes accept byte-identical reference payloads. */
+const sessionReferenceSchema = z.object({
+    section: z.object({
+        depth: z.number(),
+        text: z.string(),
+        id: z.string(),
+        startOffset: z.number(),
+        endOffset: z.number(),
+    }),
+    text: z.string(),
+    source: z.object({
+        kind: z.enum(["overview", "knowledge", "plan"]),
+        label: z.string(),
+        doc: z.string().optional(),
+        id: z.string().optional(),
+    }),
+});
+const sendMessageSchema = z.object({
+    message: z.string().min(1),
+    reference: sessionReferenceSchema.optional(),
+});
+/** Payload for POST /sessions/:id/run — a headless `claude -p` targeting mode.
+ *  `threadId` is the stable-mode thread to reuse; when absent (and the
+ *  referenced session is not itself an ARCS-owned thread) one is minted. */
+const runClaudeMessageSchema = z.object({
+    mode: z.enum(["resume", "oneshot", "stable"]),
+    message: z.string().min(1),
+    threadId: z.string().optional(),
+    reference: sessionReferenceSchema.optional(),
+});
+const createOpencodeSessionSchema = z.object({
+    title: z.string().min(1).optional(),
+});
+function sessionDirectory(session) {
+    const directory = session.metadata?.directory;
+    return typeof directory === "string" && directory ? directory : undefined;
+}
+function requireOpencodeConfig() {
+    const config = readOpencodeConfig();
+    if (!config) {
+        throw new DagError("OPENCODE_NOT_CONFIGURED", "No opencode endpoint configured — set OPENCODE_PORT (or ARCS_OPENCODE_URL) " +
+            "so ARCS can reach a running `opencode serve`.");
+    }
+    return config;
+}
+/**
+ * The worktree a newly created session should run in.
+ *
+ * Guessing is not an option: opencode happily creates a session in its own
+ * working directory when no directory is supplied, which would silently point
+ * the agent at the wrong repository. An unregistered project is an error.
+ */
+async function primaryWorkspacePath(projectDir, slug) {
+    const meta = await readJsonSafe(resolve(projectDir, "meta.json"));
+    const directory = meta?.workspacePaths?.[0];
+    if (!directory) {
+        throw new DagError("PROJECT_WORKSPACE_UNSET", `Project "${slug}" has no registered workspace path, so there is no directory to ` +
+            `create a session in — run \`arcs project update-paths ${slug} --add <path>\` first.`);
+    }
+    return directory;
+}
+function parseFilters(status, runtimeType) {
+    const filters = {};
+    if (status && SESSION_STATUSES.includes(status)) {
+        filters.status = status;
+    }
+    if (runtimeType && SESSION_RUNTIME_TYPES.includes(runtimeType)) {
+        filters.runtimeType = runtimeType;
+    }
+    return filters;
+}
+/**
+ * Mode-1 write-back (T005): the callback the route registers on runClaudeJob,
+ * invoked by the runner after the headless child fully exits — on every outcome
+ * (success/error/timeout/killed).
+ *
+ * - resume: mirrors the resumed session's runtime transcript into its sidecar
+ *   via the persisted metadata.transcriptPath (hook-events T004 persists it at
+ *   its checkpoints). The path is re-read fresh from the store — it may have
+ *   been updated between the 202 and the run's exit. An absent path is a no-op;
+ *   mirrorSessionTranscript is offset-idempotent and never throws, so repeated
+ *   write-backs never duplicate and failures are inert.
+ * - oneshot/stable: never mirror — their sidecars are appendSessionTurn-owned.
+ *   On a success outcome the captured reply is appended as an assistant turn
+ *   (every reply lands in the sidecar); error/timeout outcomes append nothing.
+ *
+ * Every path finalizes metadata.run with the settled record (pid/startedAt/
+ * mode plus endedAt/outcome/error/replyChars) so the panel shows the true
+ * result. Best-effort by contract: the runner swallows any error thrown here,
+ * so a failed write-back never surfaces on the accepted 202.
+ */
+async function writeBackRun(projectDir, ctx, record) {
+    if (ctx.mode === "resume") {
+        let target = ctx.writeTarget;
+        try {
+            target = await getSession(projectDir, ctx.writeTarget.normalizedId);
+        }
+        catch {
+            // Session deleted mid-run — fall back to the write-target captured at 202.
+        }
+        const transcriptPath = target.metadata?.transcriptPath;
+        if (typeof transcriptPath === "string" && transcriptPath !== "") {
+            await mirrorSessionTranscript(projectDir, ctx.writeTarget.normalizedId, transcriptPath);
+        }
+    }
+    else if (record.outcome === "success" && record.replyText !== undefined) {
+        // Modes 2/3 on success: the captured reply lands in the sidecar as an
+        // assistant turn (minted in the shared negative id space after the user
+        // turn and any reference). Error/timeout outcomes append nothing.
+        await appendSessionTurn(projectDir, ctx.writeTarget.normalizedId, {
+            type: "assistant",
+            text: record.replyText,
+        });
+    }
+    const run = {
+        pid: record.pid,
+        startedAt: record.startedAt,
+        mode: ctx.mode,
+        ...(record.endedAt !== undefined && { endedAt: record.endedAt }),
+        outcome: record.outcome,
+        ...(record.error !== undefined && { error: record.error }),
+        ...(record.replyChars !== undefined && { replyChars: record.replyChars }),
+    };
+    const runMetadata = { run };
+    if (ctx.mode === "stable" && ctx.firstStableSpawn && record.outcome === "success") {
+        runMetadata.threadInitialized = true;
+    }
+    await updateSession(projectDir, {
+        id: ctx.writeTarget.normalizedId,
+        metadata: runMetadata,
+    });
+}
+sessionsRoute.get("/api/p/:slug/sessions", async (c) => respond(c, async () => {
+    const projectDir = requireProjectDir(c.req.param("slug"));
+    const sessions = await listSessions(projectDir, parseFilters(c.req.query("status"), c.req.query("runtimeType")));
+    return { sessions };
+}));
+sessionsRoute.post("/api/p/:slug/sessions", async (c) => respond(c, async () => {
+    const projectDir = requireProjectDir(c.req.param("slug"));
+    const input = await parseBody(c, createSessionSchema);
+    return createSession(projectDir, input);
+}, 201));
+/**
+ * Creates a live opencode session in the project's primary workspace.
+ *
+ * The new session is mirrored into the index straight away rather than waiting
+ * for the discovery stream to notice it, so the caller can select and message
+ * it immediately. The stream's own `session.created` event lands moments later
+ * and merges into the same record.
+ *
+ * There is deliberately no claude-code counterpart: a Claude Code session only
+ * exists once a user runs `claude` in a linked directory, so there is nothing
+ * for ARCS to create remotely.
+ */
+sessionsRoute.post("/api/p/:slug/sessions/opencode/new", async (c) => respond(c, async () => {
+    const slug = c.req.param("slug");
+    const projectDir = requireProjectDir(slug);
+    const { title } = await parseBody(c, createOpencodeSessionSchema);
+    const directory = await primaryWorkspacePath(projectDir, slug);
+    const config = requireOpencodeConfig();
+    const created = await createOpencodeSession(config, {
+        directory,
+        ...(title && { title }),
+    });
+    return upsertSession(projectDir, {
+        runtimeType: "opencode",
+        runtimeSessionId: created.runtimeSessionId,
+        status: "active",
+        metadata: { directory, ...(created.title && { title: created.title }) },
+    });
+}, 201));
+sessionsRoute.get("/api/p/:slug/sessions/:id", async (c) => respond(c, async () => {
+    const projectDir = requireProjectDir(c.req.param("slug"));
+    return getSession(projectDir, c.req.param("id"));
+}));
+sessionsRoute.patch("/api/p/:slug/sessions/:id", async (c) => respond(c, async () => {
+    const projectDir = requireProjectDir(c.req.param("slug"));
+    const input = await parseBody(c, updateSessionSchema);
+    return updateSession(projectDir, { id: c.req.param("id"), ...input });
+}));
+/**
+ * Sends a message to the runtime behind a session.
+ *
+ * Delivery is asymmetric by runtime, and deliberately so: opencode sessions get
+ * live injection (the running agent picks the prompt up mid-turn), while Claude
+ * Code sessions get queued delivery (the session itself drains the queue at its
+ * next hook checkpoint — Claude Code exposes no live channel to inject into).
+ * Both answer with the updated session, so the caller can tell them apart by
+ * `messageQueue` rather than by branching on `runtimeType` itself.
+ *
+ * A `reference` body field appends an ARCS-authored reference turn to the
+ * session's transcript sidecar, but only after delivery has succeeded — a
+ * failed send must never leave a dangling reference behind. The append is a
+ * swallowed no-op on failure (the message itself was already delivered).
+ */
+sessionsRoute.post("/api/p/:slug/sessions/:id/message", async (c) => respond(c, async () => {
+    const projectDir = requireProjectDir(c.req.param("slug"));
+    const { message, reference } = await parseBody(c, sendMessageSchema);
+    const session = await getSession(projectDir, c.req.param("id"));
+    let updated;
+    if (session.runtimeType === "claude-code") {
+        // Queued, not sent: `lastMessageAt` stays untouched until the session
+        // actually drains this at a checkpoint.
+        updated = await enqueueSessionMessage(projectDir, session.normalizedId, message);
+    }
+    else {
+        await sendOpencodeMessage(requireOpencodeConfig(), {
+            runtimeSessionId: session.runtimeSessionId,
+            ...(sessionDirectory(session) && { directory: sessionDirectory(session) }),
+        }, message);
+        updated = await updateSession(projectDir, {
+            id: session.normalizedId,
+            lastMessageAt: new Date().toISOString(),
+        });
+    }
+    // Delivery succeeded (or was accepted into the queue) — record the
+    // reference turn against the session's transcript sidecar, carrying the
+    // section/source payload verbatim so the web UI can render click-through.
+    if (reference !== undefined) {
+        await appendReferenceTurn(projectDir, session.normalizedId, {
+            text: reference.text,
+            ts: new Date().toISOString(),
+            section: reference.section,
+            source: reference.source,
+        });
+    }
+    return updated;
+}));
+/**
+ * Starts a headless `claude -p` job in one of three targeting modes and answers
+ * 202 with the write-target session — the record the run's transcript and reply
+ * land on. The 202 is the acceptance: the run proceeds out-of-band in the
+ * runner, whose exit-time write-back (T005) then settles the run — finalizing
+ * `metadata.run` with the outcome on every path and, for resume mode, mirroring
+ * the resumed session's transcript into its sidecar.
+ *
+ * - resume: the referenced session must be a claude-code session that is not
+ *   currently active; the run resumes its runtime thread in the session's own
+ *   directory.
+ * - oneshot: the run targets a deterministic ARCS-owned session
+ *   (`arcs-oneshot-<slug>`) recreated idempotently on every call, in the
+ *   project's primary workspace.
+ * - stable: the run targets a persistent ARCS-owned thread (`arcs-thread-<slug>-
+ *   <uuid4>` minted once then reused) so a conversation accumulates in one
+ *   sidecar; the first successful spawn seeds the thread (`--session-id`),
+ *   later spawns resume it (`--resume` + `--session-id`).
+ *
+ * Modes 2/3 append the user turn (and optional reference) to the write-target
+ * sidecar immediately — the panel shows the prompt before the run ends, with
+ * delivery-first ordering (user turn before reference). Mode 1 never appends:
+ * its transcript write-back happens at exit (T005).
+ *
+ * Concurrency: one live run per write-target. The runner's beginRun is the
+ * atomic claim; the read-only isRunLive probe here answers the common
+ * overlapping case with a proper 409 before anything is appended or spawned
+ * (a rare race between probe and claim is still refused by the runner itself).
+ */
+sessionsRoute.post("/api/p/:slug/sessions/:id/run", async (c) => respond(c, async () => {
+    const slug = c.req.param("slug");
+    const projectDir = requireProjectDir(slug);
+    const { mode, message, threadId, reference } = await parseBody(c, runClaudeMessageSchema);
+    const session = await getSession(projectDir, c.req.param("id"));
+    let writeTarget;
+    let dir;
+    let runThreadId;
+    let firstStableSpawn = false;
+    if (mode === "resume") {
+        if (session.runtimeType !== "claude-code") {
+            throw new DagError("CLAUDE_RUN_TARGET_INVALID", `cannot resume session "${session.normalizedId}": only claude-code sessions can be run headlessly`);
+        }
+        if (session.status === "active") {
+            throw new DagError("CLAUDE_SESSION_ACTIVE", `cannot resume session "${session.normalizedId}": the session is still active`);
+        }
+        writeTarget = session;
+        dir = sessionDirectory(session) ?? (await primaryWorkspacePath(projectDir, slug));
+    }
+    else {
+        dir = await primaryWorkspacePath(projectDir, slug);
+        if (mode === "oneshot") {
+            writeTarget = await upsertSession(projectDir, {
+                runtimeType: "claude-code",
+                runtimeSessionId: `arcs-oneshot-${slug}`,
+                metadata: { control: "arcs-owned", directory: dir },
+            });
+        }
+        else {
+            // stable — reuse the referenced session's own thread when ARCS owns
+            // it, otherwise take the payload threadId or mint a fresh one.
+            const thread = (session.metadata?.control === "arcs-owned" && session.runtimeSessionId) ||
+                threadId ||
+                `arcs-thread-${slug}-${randomUUID()}`;
+            runThreadId = thread;
+            writeTarget = await upsertSession(projectDir, {
+                runtimeType: "claude-code",
+                runtimeSessionId: thread,
+                metadata: { control: "arcs-owned", directory: dir },
+            });
+            firstStableSpawn = writeTarget.metadata?.threadInitialized !== true;
+        }
+    }
+    // One live run per write-target — refuse before appending anything.
+    if (isRunLive(writeTarget.normalizedId)) {
+        throw new DagError("CLAUDE_RUN_IN_PROGRESS", `a claude run for "${writeTarget.normalizedId}" is already in progress`);
+    }
+    if (mode !== "resume") {
+        await appendSessionTurn(projectDir, writeTarget.normalizedId, {
+            type: "user",
+            text: message,
+        });
+        if (reference !== undefined) {
+            await appendReferenceTurn(projectDir, writeTarget.normalizedId, {
+                text: reference.text,
+                ts: new Date().toISOString(),
+                section: reference.section,
+                source: reference.source,
+            });
+        }
+    }
+    // NOTE: no "--cwd" flag — claude >= 2.x rejects it ("error: unknown
+    // option '--cwd'"), settling every headless run as outcome:error. The
+    // spawn applies the working directory via options.cwd below instead.
+    let argv;
+    if (mode === "resume") {
+        argv = ["-p", message, "--resume", session.runtimeSessionId, "--output-format", "json"];
+    }
+    else if (mode === "oneshot") {
+        argv = ["-p", message, "--output-format", "json"];
+    }
+    else {
+        const thread = runThreadId;
+        argv = firstStableSpawn
+            ? ["-p", message, "--session-id", thread, "--output-format", "json"]
+            : ["-p", message, "--resume", thread, "--session-id", thread, "--output-format", "json"];
+    }
+    // Fire-and-forget: the run proceeds out-of-band. The runner invokes the
+    // registered write-back after the child fully exits (it resolves on
+    // `close`) on every outcome path; write-back failures are swallowed by
+    // the runner, so a failed mirror/finalize never surfaces on the accepted
+    // 202. The trailing catch is defensive — the runner never rejects.
+    runClaudeJob({
+        argv,
+        cwd: dir,
+        writeTargetKey: writeTarget.normalizedId,
+        onSettled: (record) => writeBackRun(projectDir, { mode, writeTarget, firstStableSpawn }, record),
+    }).catch(() => {
+        // Best-effort — the write-back lives inside the runner's onSettled.
+    });
+    return {
+        session: writeTarget,
+        run: {
+            accepted: true,
+            mode,
+            ...(mode === "stable" && { threadId: runThreadId }),
+        },
+    };
+}, 202));
+sessionsRoute.delete("/api/p/:slug/sessions/:id", async (c) => respond(c, async () => {
+    const projectDir = requireProjectDir(c.req.param("slug"));
+    // Resolve through the index first: the sidecar filename keys on the
+    // session's canonical normalizedId, so a non-slugified route id must not
+    // re-derive the filename (deleteSession alone would orphan the sidecar).
+    const session = await getSession(projectDir, c.req.param("id"));
+    await deleteSession(projectDir, session.normalizedId);
+    try {
+        await unlink(sessionTranscriptPath(projectDir, session.normalizedId));
+    }
+    catch {
+        // Sidecar may not exist — a failed unlink is a swallowed no-op.
+    }
+    return { deleted: true };
+}));
+/**
+ * Reads the session's transcript sidecar (mirrored Claude Code lines plus
+ * ARCS-authored reference turns) into the read-model the web UI renders.
+ * An absent sidecar answers an empty transcript with `mirroredAt: null`; once
+ * the sidecar exists, `mirroredAt` is the file mtime so the UI can show how
+ * fresh the mirror is.
+ */
+sessionsRoute.get("/api/p/:slug/sessions/:id/transcript", async (c) => respond(c, async () => {
+    const projectDir = requireProjectDir(c.req.param("slug"));
+    const session = await getSession(projectDir, c.req.param("id"));
+    let mirroredAt = null;
+    try {
+        const info = await stat(sessionTranscriptPath(projectDir, session.normalizedId));
+        if (info.isFile())
+            mirroredAt = info.mtime.toISOString();
+    }
+    catch {
+        // No sidecar yet — empty transcript, nothing mirrored.
+    }
+    if (mirroredAt === null)
+        return { turns: [], mirroredAt: null };
+    return { turns: await readSessionTurns(projectDir, session.normalizedId), mirroredAt };
+}));
+//# sourceMappingURL=sessions.js.map

package/dist/web-server/routes/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/web-server/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,UAAU,EACV,YAAY,EACZ,yBAAyB,EACzB,qBAAqB,EACrB,gBAAgB,EAGhB,aAAa,EACb,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAwB,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC;AAExC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,mEAAmE;IACnE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH;;;yEAGyE;AACzE,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC1B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH;;4EAE4E;AAC5E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC9C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAChB,yBAAyB,EACzB,6EAA6E;YAC3E,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CAAC,UAAkB,EAAE,IAAY;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAgC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,yBAAyB,EACzB,YAAY,IAAI,kEAAkE;YAChF,yDAAyD,IAAI,wBAAwB,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B,EAAE,WAA+B;IAC/E,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,MAAM,IAAK,gBAAsC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,MAAM,GAAG,MAAkC,CAAC;IACtD,CAAC;IACD,IAAI,WAAW,IAAK,qBAA2C,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,WAAW,GAAG,WAA4C,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,YAAY,CACzB,UAAkB,EAClB,GAAwB,EACxB,MAAuB;IAEvB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;QACvD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,uBAAuB,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,iBAAiB,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE;YAChE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,MAAM,CAAC,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAA4B;QACnC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAChE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;KAC1E,CAAC;IACF,MAAM,WAAW,GAA4B,EAAE,GAAG,EAAE,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClF,WAAW,CAAC,iBAAiB,GAAG,IAAI,CAAC;IACvC,CAAC;IACD,MAAM,aAAa,CAAC,UAAU,EAAE;QAC9B,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,YAAY;QAChC,QAAQ,EAAE,WAAW;KACtB,CAAC,CAAC;AACL,CAAC;AAED,aAAa,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACrD,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,UAAU,EACV,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAChE,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC,CAAC,CACH,CAAC;AAEF,aAAa,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACtD,OAAO,CACL,CAAC,EACD,KAAK,IAAI,EAAE;IACT,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACtD,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC,EACD,GAAG,CACJ,CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,aAAa,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACnE,OAAO,CACL,CAAC,EACD,KAAK,IAAI,EAAE;IACT,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IAEvC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE;QAClD,SAAS;QACT,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;KACxB,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,UAAU,EAAE;QAC/B,WAAW,EAAE,UAAU;QACvB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE;KACxE,CAAC,CAAC;AACL,CAAC,EACD,GAAG,CACJ,CACF,CAAC;AAEF,aAAa,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACzD,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACH,CAAC;AAEF,aAAa,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC3D,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACtD,OAAO,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC,CACH,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,aAAa,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAClE,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,IAAI,OAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;QAC1C,sEAAsE;QACtE,wCAAwC;QACxC,OAAO,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,MAAM,mBAAmB,CACvB,qBAAqB,EAAE,EACvB;YACE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;SAC3E,EACD,OAAO,CACR,CAAC;QAEF,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;YACxC,EAAE,EAAE,OAAO,CAAC,YAAY;YACxB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,mEAAmE;IACnE,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE;YAC1D,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,aAAa,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC9D,OAAO,CACL,CAAC,EACD,KAAK,IAAI,EAAE;IACT,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,IAAI,WAAwB,CAAC;IAC7B,IAAI,GAAW,CAAC;IAChB,IAAI,WAA+B,CAAC;IACpC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC1C,MAAM,IAAI,QAAQ,CAChB,2BAA2B,EAC3B,0BAA0B,OAAO,CAAC,YAAY,oDAAoD,CACnG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,QAAQ,CAChB,uBAAuB,EACvB,0BAA0B,OAAO,CAAC,YAAY,gCAAgC,CAC/E,CAAC;QACJ,CAAC;QACD,WAAW,GAAG,OAAO,CAAC;QACtB,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;gBAC5C,WAAW,EAAE,aAAa;gBAC1B,gBAAgB,EAAE,gBAAgB,IAAI,EAAE;gBACxC,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,MAAM,GACV,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,gBAAgB,CAAC;gBACxE,QAAQ;gBACR,eAAe,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;YACxC,WAAW,GAAG,MAAM,CAAC;YACrB,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;gBAC5C,WAAW,EAAE,aAAa;gBAC1B,gBAAgB,EAAE,MAAM;gBACxB,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE;aACpD,CAAC,CAAC;YACH,gBAAgB,GAAG,WAAW,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC;QACtE,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IAAI,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAChB,wBAAwB,EACxB,qBAAqB,WAAW,CAAC,YAAY,0BAA0B,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;YAC5D,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,EAAE;gBAC9D,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,IAAc,CAAC;IACnB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,WAAqB,CAAC;QACrC,IAAI,GAAG,gBAAgB;YACrB,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC;YACpE,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC7F,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,yEAAyE;IACzE,mEAAmE;IACnE,YAAY,CAAC;QACX,IAAI;QACJ,GAAG,EAAE,GAAG;QACR,cAAc,EAAE,WAAW,CAAC,YAAY;QACxC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CACpB,YAAY,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE,MAAM,CAAC;KAC5E,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACZ,oEAAoE;IACtE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,GAAG,EAAE;YACH,QAAQ,EAAE,IAAI;YACd,IAAI;YACJ,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;SACpD;KACF,CAAC;AACJ,CAAC,EACD,GAAG,CACJ,CACF,CAAC;AAEF,aAAa,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC5D,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,oEAAoE;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC,CACH,CAAC;AAEF;;;;;;GAMG;AACH,aAAa,CAAC,GAAG,CAAC,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACpE,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IACD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;AACzF,CAAC,CAAC,CACH,CAAC"}

package/dist/web-server/security.d.ts

@@ -0,0 +1,7 @@
+import type { MiddlewareHandler } from "hono";
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Local-server hardening against DNS rebinding and browser CSRF.
+ */
+export declare const secureLocalRequest: MiddlewareHandler;
+//# sourceMappingURL=security.d.ts.map

package/dist/web-server/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/web-server/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAK9C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpD;AAOD;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,iBA8BhC,CAAC"}

package/dist/web-server/security.js

@@ -0,0 +1,41 @@
+import { fail } from "./respond.js";
+const MUTATION_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+export function isLoopbackHost(host) {
+    const normalized = host.toLowerCase().replace(/^\[|\]$/g, "");
+    return (normalized === "localhost" || normalized === "::1" || /^127(?:\.\d{1,3}){3}$/.test(normalized));
+}
+function hostnameFromHostHeader(value) {
+    if (value.startsWith("["))
+        return value.slice(1, value.indexOf("]"));
+    return value.split(":", 1)[0] ?? "";
+}
+/**
+ * Local-server hardening against DNS rebinding and browser CSRF.
+ */
+export const secureLocalRequest = async (c, next) => {
+    const host = hostnameFromHostHeader(c.req.header("host") ?? "");
+    if (!isLoopbackHost(host)) {
+        return c.json(fail("forbidden_host", "ARCS web only accepts loopback requests"), 403);
+    }
+    const origin = c.req.header("origin");
+    if (origin) {
+        let originHost = "";
+        try {
+            originHost = new URL(origin).hostname;
+        }
+        catch {
+            return c.json(fail("forbidden_origin", "Invalid request origin"), 403);
+        }
+        if (!isLoopbackHost(originHost)) {
+            return c.json(fail("forbidden_origin", "Cross-site mutations are not allowed"), 403);
+        }
+    }
+    if (MUTATION_METHODS.has(c.req.method)) {
+        const contentType = c.req.header("content-type") ?? "";
+        if (!contentType.toLowerCase().startsWith("application/json")) {
+            return c.json(fail("unsupported_media_type", "Mutations require Content-Type: application/json"), 415);
+        }
+    }
+    await next();
+};
+//# sourceMappingURL=security.js.map

package/dist/web-server/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/web-server/security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,CACL,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,CAAC,IAAI,CACX,IAAI,CAAC,wBAAwB,EAAE,kDAAkD,CAAC,EAClF,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC"}

package/dist/web-server/static.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Static client bundle serving with SPA fallback.
+ *
+ * The Vite build output lives at dist/web-client (resolved by the caller).
+ * If the bundle is missing, the server runs API-only and explains how to
+ * build the client.
+ */
+import type { Hono } from "hono";
+export declare function registerStaticServing(app: Hono, root: string): void;
+//# sourceMappingURL=static.d.ts.map

package/dist/web-server/static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/web-server/static.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAMjC,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAuBnE"}

package/dist/web-server/static.js

@@ -0,0 +1,36 @@
+/**
+ * Static client bundle serving with SPA fallback.
+ *
+ * The Vite build output lives at dist/web-client (resolved by the caller).
+ * If the bundle is missing, the server runs API-only and explains how to
+ * build the client.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { fail } from "./respond.js";
+const NOT_BUILT_HINT = "ARCS web client is not built. Run `npm run build:web` in the arcs repo (or reinstall @rryando/arcs).";
+export function registerStaticServing(app, root) {
+    if (!existsSync(join(root, "index.html"))) {
+        app.notFound((c) => {
+            if (c.req.path.startsWith("/api/")) {
+                return c.json(fail("not_found", `No route: ${c.req.method} ${c.req.path}`), 404);
+            }
+            return c.text(NOT_BUILT_HINT, 404);
+        });
+        return;
+    }
+    app.use("*", async (c, next) => {
+        if (c.req.path.startsWith("/api/"))
+            return next();
+        return serveStatic({ root })(c, next);
+    });
+    app.notFound((c) => {
+        if (c.req.path.startsWith("/api/")) {
+            return c.json(fail("not_found", `No route: ${c.req.method} ${c.req.path}`), 404);
+        }
+        // SPA fallback — client-side routing takes over.
+        return serveStatic({ path: join(root, "index.html") })(c, async () => { });
+    });
+}
+//# sourceMappingURL=static.js.map

package/dist/web-server/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/web-server/static.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpC,MAAM,cAAc,GAClB,sGAAsG,CAAC;AAEzG,MAAM,UAAU,qBAAqB,CAAC,GAAS,EAAE,IAAY;IAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;YACjB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAClD,OAAO,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,iDAAiD;QACjD,OAAO,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,CAAsB,CAAC;IACjG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web-server/storage.d.ts

@@ -0,0 +1,17 @@
+/** Lock-safe, atomic filesystem mutations used by the web server. */
+import { type RootMeta } from "../utils/dag.js";
+export { writeTextAtomic } from "../utils/storage-utils.js";
+/** Atomically replace a text file while holding its advisory lock. */
+export declare function writeTextLocked(filePath: string, content: string): Promise<void>;
+/** Remove a file while holding the same advisory lock writers use. */
+export declare function removeFileLocked(filePath: string): Promise<void>;
+/**
+ * Acquire several file locks in deterministic lexical order to avoid deadlock.
+ */
+export declare function withFileLocks<T>(filePaths: string[], fn: () => T | Promise<T>): Promise<T>;
+/**
+ * Read-modify-write root meta.json while holding one lock for the whole
+ * validation and mutation transaction.
+ */
+export declare function mutateRootMetaLocked<T>(dataDir: string, mutate: (rootMeta: RootMeta) => T | Promise<T>): Promise<T>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/web-server/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/web-server/storage.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAIrE,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AAI9D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,sEAAsE;AACtE,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED,sEAAsE;AACtE,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAUhG;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAQZ"}

package/dist/web-server/storage.js

@@ -0,0 +1,42 @@
+/** Lock-safe, atomic filesystem mutations used by the web server. */
+import { unlink } from "node:fs/promises";
+import { resolve } from "node:path";
+import { readRootMeta } from "../utils/dag.js";
+import { withLock } from "../utils/file-lock.js";
+import { writeTextAtomic } from "../utils/storage-utils.js";
+export { writeTextAtomic } from "../utils/storage-utils.js";
+/** Atomically replace a text file while holding its advisory lock. */
+export async function writeTextLocked(filePath, content) {
+    await withLock(filePath, () => writeTextAtomic(filePath, content));
+}
+/** Remove a file while holding the same advisory lock writers use. */
+export async function removeFileLocked(filePath) {
+    await withLock(filePath, () => unlink(filePath).catch(() => { }));
+}
+/**
+ * Acquire several file locks in deterministic lexical order to avoid deadlock.
+ */
+export async function withFileLocks(filePaths, fn) {
+    const ordered = [...new Set(filePaths)].sort();
+    const acquire = async (index) => {
+        const filePath = ordered[index];
+        if (filePath === undefined)
+            return fn();
+        return withLock(filePath, () => acquire(index + 1));
+    };
+    return acquire(0);
+}
+/**
+ * Read-modify-write root meta.json while holding one lock for the whole
+ * validation and mutation transaction.
+ */
+export async function mutateRootMetaLocked(dataDir, mutate) {
+    const rootMetaPath = resolve(dataDir, "meta.json");
+    return withLock(rootMetaPath, async () => {
+        const rootMeta = await readRootMeta(dataDir);
+        const result = await mutate(rootMeta);
+        await writeTextAtomic(rootMetaPath, `${JSON.stringify(rootMeta, null, 2)}\n`);
+        return result;
+    });
+}
+//# sourceMappingURL=storage.js.map