@seele00/seele 0.1.92 → 1.0.0

package/scripts/deploy/prepare-proxy.sh

@@ -1,273 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# prepare-proxy.sh
-#
-# Prepare a clean LOCAL no-auth proxy entrypoint for Codex.
-#
-# Why this exists:
-#   Some Codex HTTP clients (models refresh, MCP / ps/mcp) issue a bare
-#   HTTP CONNECT to the configured proxy WITHOUT forwarding proxy credentials.
-#   If the upstream proxy requires authentication it answers 407 and resets
-#   the stream, surfacing as `stream disconnected before completion` /
-#   `Transport channel closed`. The main response path uses SOCKS5 with creds
-#   and works, which is why only those two auxiliary features break.
-#
-# Fix (no Codex change, purely at the proxy layer):
-#   Run a LOCAL no-auth proxy listener. Codex sends its bare CONNECT to this
-#   local listener (no auth required -> accepted). The local listener then
-#   forwards upstream WITH the credentials taken from SEELE_UPSTREAM_PROXY.
-#
-#   codex --bare CONNECT (no creds)--> 127.0.0.1:<port> (no auth)
-#         --with creds--> SEELE_UPSTREAM_PROXY (socks5 exit) --> OpenAI
-#
-# IMPORTANT config model:
-#   The Seele server injects SEELE_PROXY into the Codex environment
-#   (ALL_PROXY/HTTP_PROXY/...). So Codex uses SEELE_PROXY directly. Therefore:
-#     SEELE_PROXY           = the LOCAL no-auth entrypoint (http://127.0.0.1:<port>)
-#     SEELE_UPSTREAM_PROXY  = the real credentialed upstream (socks5 exit)
-#   Codex talks to the local no-auth entrypoint; only this script holds the
-#   upstream credentials and forwards to the real exit.
-#
-# After running this, the Codex runtime (via SEELE_PROXY) and any other script
-# can simply use:
-#   http://127.0.0.1:<port>
-# as their proxy, without ever handling credentials themselves.
-#
-# This replaces all the network-layer workarounds explored earlier
-# (WireGuard tunnel, MTU tweaks, custom routes): none of them are needed,
-# the upstream SOCKS5 exit is directly reachable.
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$ROOT_DIR"
-
-ENV_FILE=""
-ACTION="start"
-
-usage() {
-  cat <<'EOF'
-Usage: ./scripts/deploy/prepare-proxy.sh [--env PATH] [--status|--stop]
-
-Prepares a local no-auth proxy entrypoint that forwards to the credentialed
-upstream (SEELE_UPSTREAM_PROXY), so Codex (via SEELE_PROXY) and other scripts
-can use http://127.0.0.1:<port> without handling credentials.
-
-Options:
-  --env PATH   Load configuration from an env file (e.g. ./seele.env).
-  --status     Show whether the local proxy is running and exit.
-  --stop       Stop the local proxy and exit.
-  -h, --help   Show this help.
-
-Relevant variables (from --env file or environment):
-  SEELE_UPSTREAM_PROXY     Real upstream proxy WITH credentials (required).
-                           Format: scheme://user:pass@host:port
-                           e.g. socks5h://user:pass@47.77.237.69:28888
-  SEELE_LOCAL_PROXY_PORT   Local listen port for the no-auth entrypoint.
-                           Default: 55860
-  SEELE_LOCAL_PROXY_ADDR   Local proxy URL other components should use.
-                           Default: http://127.0.0.1:<SEELE_LOCAL_PROXY_PORT>
-                           Set SEELE_PROXY to this value so Codex uses it.
-  SEELE_GOST_BIN           Path to the gost binary. Default: looked up on
-                           PATH, then $SEELE_ROOT/gost, then ./gost.
-  SEELE_PROXY_PID_FILE     PID file. Default: $SEELE_ROOT/.runtime/prepare-proxy.pid
-                           (falls back to /tmp/seele-prepare-proxy.pid).
-  SEELE_PROXY_LOG_FILE     Log file. Default: $SEELE_ROOT/.runtime/prepare-proxy.log
-                           (falls back to /tmp/seele-prepare-proxy.log).
-EOF
-}
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --env)
-      ENV_FILE="${2:-}"
-      shift 2
-      ;;
-    --status)
-      ACTION="status"
-      shift
-      ;;
-    --stop)
-      ACTION="stop"
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "Unknown option: $1" >&2
-      usage >&2
-      exit 1
-      ;;
-  esac
-done
-
-if [ -n "$ENV_FILE" ]; then
-  if [ ! -f "$ENV_FILE" ]; then
-    echo "Environment file not found: $ENV_FILE" >&2
-    exit 1
-  fi
-  set -a
-  # shellcheck disable=SC1090
-  . "$ENV_FILE"
-  set +a
-fi
-
-LOCAL_PORT="${SEELE_LOCAL_PROXY_PORT:-55860}"
-LOCAL_ADDR="${SEELE_LOCAL_PROXY_ADDR:-http://127.0.0.1:${LOCAL_PORT}}"
-
-# Choose a writable runtime location for pid/log.
-RUNTIME_BASE=""
-if [ -n "${SEELE_ROOT:-}" ] && [ -d "${SEELE_ROOT}/.runtime" ]; then
-  RUNTIME_BASE="${SEELE_ROOT}/.runtime"
-elif [ -n "${SEELE_RUNTIME_DIR:-}" ] && [ -d "${SEELE_RUNTIME_DIR}" ]; then
-  RUNTIME_BASE="${SEELE_RUNTIME_DIR}"
-fi
-if [ -n "$RUNTIME_BASE" ]; then
-  PID_FILE="${SEELE_PROXY_PID_FILE:-${RUNTIME_BASE}/prepare-proxy.pid}"
-  LOG_FILE="${SEELE_PROXY_LOG_FILE:-${RUNTIME_BASE}/prepare-proxy.log}"
-else
-  PID_FILE="${SEELE_PROXY_PID_FILE:-/tmp/seele-prepare-proxy.pid}"
-  LOG_FILE="${SEELE_PROXY_LOG_FILE:-/tmp/seele-prepare-proxy.log}"
-fi
-
-is_running() {
-  # Returns 0 if a local proxy we manage is still alive.
-  if [ -f "$PID_FILE" ]; then
-    local pid
-    pid="$(cat "$PID_FILE" 2>/dev/null || true)"
-    if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
-      return 0
-    fi
-  fi
-  return 1
-}
-
-port_listening() {
-  if command -v ss >/dev/null 2>&1; then
-    ss -tlnH "( sport = :${LOCAL_PORT} )" 2>/dev/null | grep -q ":${LOCAL_PORT}"
-  else
-    return 1
-  fi
-}
-
-stop_proxy() {
-  if is_running; then
-    local pid
-    pid="$(cat "$PID_FILE")"
-    kill "$pid" 2>/dev/null || true
-    sleep 1
-    kill -9 "$pid" 2>/dev/null || true
-  fi
-  rm -f "$PID_FILE"
-}
-
-case "$ACTION" in
-  status)
-    if is_running; then
-      echo "local proxy: RUNNING (pid $(cat "$PID_FILE"), $LOCAL_ADDR)"
-      exit 0
-    fi
-    if port_listening; then
-      echo "local proxy: port ${LOCAL_PORT} is listening but not managed by this script"
-      exit 0
-    fi
-    echo "local proxy: NOT running"
-    exit 1
-    ;;
-  stop)
-    stop_proxy
-    echo "local proxy: stopped"
-    exit 0
-    ;;
-esac
-
-# --- start ---
-
-if [ -z "${SEELE_UPSTREAM_PROXY:-}" ]; then
-  echo "SEELE_UPSTREAM_PROXY is required (real upstream proxy WITH credentials)." >&2
-  echo "Set it in seele.env, e.g.:" >&2
-  echo "  SEELE_UPSTREAM_PROXY=socks5h://user:password@47.77.237.69:28888" >&2
-  echo "And set SEELE_PROXY to the local entrypoint so Codex uses it:" >&2
-  echo "  SEELE_PROXY=${LOCAL_ADDR}" >&2
-  exit 1
-fi
-
-# Guard against a misconfiguration where the upstream points back at the
-# local entrypoint (would create a forwarding loop).
-case "$SEELE_UPSTREAM_PROXY" in
-  *127.0.0.1:${LOCAL_PORT}*|*localhost:${LOCAL_PORT}*)
-    echo "SEELE_UPSTREAM_PROXY must point at the real upstream exit, not the" >&2
-    echo "local entrypoint (${LOCAL_ADDR}). Fix seele.env." >&2
-    exit 1
-    ;;
-esac
-
-# Normalize the upstream URL into a gost -F forward URL.
-# gost forwarder does not understand the "h" suffix (socks5h); it always
-# resolves the destination at the proxy side, so socks5h -> socks5.
-UPSTREAM="$SEELE_UPSTREAM_PROXY"
-case "$UPSTREAM" in
-  socks5h://*) UPSTREAM="socks5://${UPSTREAM#socks5h://}" ;;
-esac
-
-# Locate gost binary.
-GOST_BIN="${SEELE_GOST_BIN:-}"
-if [ -z "$GOST_BIN" ]; then
-  if command -v gost >/dev/null 2>&1; then
-    GOST_BIN="$(command -v gost)"
-  elif [ -n "${SEELE_ROOT:-}" ] && [ -x "${SEELE_ROOT}/gost" ]; then
-    GOST_BIN="${SEELE_ROOT}/gost"
-  elif [ -x "${ROOT_DIR}/gost" ]; then
-    GOST_BIN="${ROOT_DIR}/gost"
-  fi
-fi
-if [ -z "$GOST_BIN" ] || [ ! -x "$GOST_BIN" ]; then
-  echo "gost binary not found." >&2
-  echo "Install gost and either put it on PATH, set SEELE_GOST_BIN," >&2
-  echo "or place it at \$SEELE_ROOT/gost." >&2
-  exit 1
-fi
-
-# Idempotent: if already running, restart cleanly to pick up config changes.
-if is_running; then
-  echo "local proxy already running (pid $(cat "$PID_FILE")), restarting..."
-  stop_proxy
-fi
-
-if port_listening; then
-  echo "Port ${LOCAL_PORT} is already in use by another process." >&2
-  echo "Set SEELE_LOCAL_PROXY_PORT to a free port, or stop the other process." >&2
-  exit 1
-fi
-
-# Start the local no-auth HTTP+SOCKS entrypoint (-L=http://:PORT has no creds)
-# forwarding to the credentialed upstream (-F).
-nohup "$GOST_BIN" -L="http://:${LOCAL_PORT}" -F="$UPSTREAM" \
-  > "$LOG_FILE" 2>&1 &
-echo $! > "$PID_FILE"
-
-# Wait for the listener to come up.
-ok=0
-for _ in 1 2 3 4 5 6 7 8 9 10; do
-  if port_listening; then ok=1; break; fi
-  sleep 0.3
-done
-
-if [ "$ok" != "1" ]; then
-  echo "local proxy failed to start; see $LOG_FILE" >&2
-  tail -n 20 "$LOG_FILE" >&2 || true
-  exit 1
-fi
-
-echo "local proxy ready."
-echo "  listen  : ${LOCAL_ADDR}  (no auth)"
-echo "  upstream: ${UPSTREAM%%@*}@***  (creds from SEELE_UPSTREAM_PROXY)"
-echo "  pid     : $(cat "$PID_FILE")"
-echo "  log     : ${LOG_FILE}"
-echo
-echo "Make sure seele.env has SEELE_PROXY pointing at this entrypoint:"
-echo "  SEELE_PROXY=${LOCAL_ADDR}"
-echo
-echo "Other scripts can use this proxy directly:"
-echo "  export HTTP_PROXY=${LOCAL_ADDR} HTTPS_PROXY=${LOCAL_ADDR} ALL_PROXY=${LOCAL_ADDR}"

package/scripts/deploy/seele.env.example

@@ -1,83 +0,0 @@
-# Copy this file to seele.env and edit it on the target Linux host or pod.
-# Do not commit seele.env. It can contain proxy credentials and Codex auth data.
-
-# Confirm these with the package owner or target-environment owner before
-# running bootstrap.sh. Do not invent them.
-#
-# Public listen address and port for the single Seele Codex service.
-# Use 0.0.0.0 only when the service must be reachable from outside the pod.
-SEELE_CODEX_HOST=0.0.0.0
-SEELE_CODEX_PORT=3000
-
-# Used only by the cloud Seele to bootstrap its first administrator. Member
-# deployments authenticate against the cloud and ignore these values.
-# Store the password in the cloud secret store or uncommitted seele.env file.
-SEELE_AUTH_USERNAME=admin
-SEELE_AUTH_PASSWORD=
-# SEELE_AUTH_SESSION_TTL_SECONDS=2592000
-
-# Public base path used by the reverse proxy. Use "/" only when exposed at
-# domain root. If exposed under a subpath, use the actual externally visible
-# prefix confirmed by the deployment owner.
-SEELE_PUBLIC_BASE_PATH=/
-
-# Required trust root for deployment authorization. Use the cloud Seele's
-# externally or internally reachable base URL, including its public base path.
-# The cloud Seele must point this to its own reachable URL.
-SEELE_CLOUD_URL=
-
-# Required: confirm this with the package owner or target-environment owner.
-# SEELE_ROOT is the single root directory for this Seele deployment:
-#   Codex runtime state: $SEELE_ROOT/.runtime
-#   Seele workspace data: $SEELE_ROOT/workspaces
-SEELE_ROOT=
-
-# Advanced overrides. Leave these unset unless the package owner confirms a
-# different layout.
-# SEELE_RUNTIME_DIR=$SEELE_ROOT/.runtime
-# SEELE_CODEX_WORKSPACE_ROOT=$SEELE_ROOT/workspaces
-
-# SEELE_PROXY is injected into the Codex subprocess (ALL_PROXY/HTTP_PROXY/...).
-# Some Codex HTTP clients (models refresh / MCP) issue a bare HTTP CONNECT
-# WITHOUT proxy credentials; an upstream proxy that requires auth replies 407
-# and resets the stream (models/MCP fail while the main answer still works).
-#
-# Solution: point SEELE_PROXY at a LOCAL no-auth entrypoint, and let
-# scripts/deploy/prepare-proxy.sh run a local gost that forwards to the real
-# authenticated upstream. Run prepare-proxy.sh before start.sh.
-#
-#   SEELE_PROXY           -> local no-auth entrypoint Codex talks to
-#   SEELE_UPSTREAM_PROXY  -> real upstream with credentials (only the script holds it)
-#
-# Default local entrypoint port is 55860 (override via SEELE_LOCAL_PROXY_PORT).
-SEELE_PROXY=http://127.0.0.1:55860
-
-# Real upstream proxy with credentials. Used ONLY by prepare-proxy.sh as the
-# gost forward target (-F). Ask the package owner for the exact value.
-# Format: scheme://username:password@host:port  (socks5h:// or http:// etc.)
-# Example:
-# SEELE_UPSTREAM_PROXY=socks5h://user:password@proxy.example.com:28888
-SEELE_UPSTREAM_PROXY=
-NO_PROXY=127.0.0.1,localhost,.svc,.cluster.local
-
-# Authentication mode for bootstrap.sh. Members must use none because their
-# Codex credentials are installed from the cloud after authorization. The
-# other modes are only for seeding the cloud deployment:
-#   device    Run `codex login --device-auth` if CODEX_HOME/auth.json is missing.
-#   auth-json Copy CODEX_AUTH_JSON into CODEX_HOME/auth.json.
-#   token     Pipe CODEX_ACCESS_TOKEN to `codex login --with-access-token`.
-#   none      Skip local Codex authentication (default).
-SEELE_DEPLOY_AUTH_MODE=none
-
-# Required only for SEELE_DEPLOY_AUTH_MODE=auth-json.
-# CODEX_AUTH_JSON=/path/to/auth.json
-
-# Required only for SEELE_DEPLOY_AUTH_MODE=token.
-# CODEX_ACCESS_TOKEN=
-
-# Optional Codex home. The managed CLI path is always
-# $SEELE_RUNTIME_DIR/bin/codex so bootstrap and Seele's updater use the same file.
-# CODEX_HOME=$SEELE_ROOT/.runtime/codex-home
-
-# Optional corporate CA bundle for Codex login and HTTPS calls.
-# CODEX_CA_CERTIFICATE=/path/to/company-ca.pem

package/scripts/deploy/start.sh

@@ -1,101 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$ROOT_DIR"
-
-ENV_FILE=""
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --env)
-      ENV_FILE="${2:-}"
-      shift 2
-      ;;
-    -h|--help)
-      echo "Usage: ./scripts/deploy/start.sh [--env PATH]"
-      exit 0
-      ;;
-    *)
-      echo "Unknown option: $1" >&2
-      exit 1
-      ;;
-  esac
-done
-
-if [ -n "$ENV_FILE" ]; then
-  if [ ! -f "$ENV_FILE" ]; then
-    echo "Environment file not found: $ENV_FILE" >&2
-    exit 1
-  fi
-  set -a
-  # shellcheck disable=SC1090
-  . "$ENV_FILE"
-  set +a
-fi
-
-if [ -z "${SEELE_ROOT:-}" ]; then
-  echo "SEELE_ROOT is required." >&2
-  echo "Set it in seele.env to the confirmed Seele root directory." >&2
-  exit 1
-fi
-if [ -z "${SEELE_CLOUD_URL:-}" ]; then
-  echo "SEELE_CLOUD_URL is required." >&2
-  echo "Set it to the reachable base URL of the cloud Seele." >&2
-  exit 1
-fi
-export SEELE_ROOT
-RUNTIME_DIR="${SEELE_RUNTIME_DIR:-$SEELE_ROOT/.runtime}"
-export SEELE_RUNTIME_DIR="$RUNTIME_DIR"
-export SEELE_CODEX_HOST="${SEELE_CODEX_HOST:-0.0.0.0}"
-export SEELE_CODEX_PORT="${SEELE_CODEX_PORT:-3000}"
-export SEELE_CODEX_WORKSPACE_ROOT="${SEELE_CODEX_WORKSPACE_ROOT:-$SEELE_ROOT/workspaces}"
-export SEELE_CODEX_WEB_DIST="${SEELE_CODEX_WEB_DIST:-$ROOT_DIR/web/dist}"
-
-export NO_PROXY="${NO_PROXY:-127.0.0.1,localhost,.svc,.cluster.local}"
-export no_proxy="$NO_PROXY"
-
-SERVER_BIN="${SEELE_SERVER_BIN:-$ROOT_DIR/libexec/seele-server}"
-WORKER_BIN="${SEELE_WORKER_BIN:-$ROOT_DIR/libexec/seele-worker}"
-if [ ! -x "$SERVER_BIN" ] && [ -x "$ROOT_DIR/target/release/seele-server" ]; then
-  SERVER_BIN="$ROOT_DIR/target/release/seele-server"
-fi
-if [ ! -x "$WORKER_BIN" ] && [ -x "$ROOT_DIR/target/release/seele-worker" ]; then
-  WORKER_BIN="$ROOT_DIR/target/release/seele-worker"
-fi
-if [ ! -x "$SERVER_BIN" ] || [ ! -x "$WORKER_BIN" ] || [ ! -f "$SEELE_CODEX_WEB_DIST/index.html" ]; then
-  echo "Build output is missing. Run ./scripts/deploy/bootstrap.sh first." >&2
-  exit 1
-fi
-export SEELE_WORKER_BIN="$WORKER_BIN"
-
-# Prepare the local no-auth proxy entrypoint when an upstream proxy with
-# credentials is configured. Codex's models-refresh / MCP HTTP clients send a
-# bare HTTP CONNECT without proxy credentials; an authenticated upstream then
-# replies 407 and resets the stream. prepare-proxy.sh runs a local no-auth
-# listener (SEELE_PROXY) that forwards to the credentialed upstream
-# (SEELE_UPSTREAM_PROXY). It is idempotent, so a restart re-syncs it.
-# Skipped when SEELE_UPSTREAM_PROXY is unset (legacy single-proxy mode).
-if [ -n "${SEELE_UPSTREAM_PROXY:-}" ]; then
-  echo "Preparing local no-auth proxy entrypoint (SEELE_UPSTREAM_PROXY is set)..."
-  PREPARE_PROXY="$ROOT_DIR/scripts/deploy/prepare-proxy.sh"
-  if [ ! -x "$PREPARE_PROXY" ]; then
-    echo "prepare-proxy.sh not found or not executable at $PREPARE_PROXY" >&2
-    exit 1
-  fi
-  if [ -n "$ENV_FILE" ]; then
-    "$PREPARE_PROXY" --env "$ENV_FILE"
-  else
-    "$PREPARE_PROXY"
-  fi
-fi
-
-mkdir -p "$SEELE_CODEX_WORKSPACE_ROOT"
-
-echo "Starting Seele on http://$SEELE_CODEX_HOST:$SEELE_CODEX_PORT"
-echo "Cloud authorization: $SEELE_CLOUD_URL"
-echo "Workspace root: $SEELE_CODEX_WORKSPACE_ROOT"
-echo "Server runtime: $SERVER_BIN"
-echo "Worker runtime: $SEELE_WORKER_BIN"
-
-exec "$SERVER_BIN"

package/web/dist/assets/abnfDiagram-VRR7QNED-iVbCDf-k.js

@@ -1 +0,0 @@
-import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-EbU6MBl6.js";import{p as f}from"./chunk-JWPE2WC7-BwLo02Dp.js";import{_ as n,l as o}from"./mermaid.core-ejnGpyjP.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-BQScOjLb.js";import"./index-H6j_Btq9.js";var v=d().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},B={parser:R,db:a,renderer:u,styles:p};export{B as diagram};

package/web/dist/assets/arc-JMiJ4rr3.js

@@ -1 +0,0 @@
-import{G as ln,H as un,I as N,J as I,K as J,L as an,M as y,N as tn,O as j,P as _,Q as rn,R as o,S as on,T as sn,V as fn}from"./mermaid.core-ejnGpyjP.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,q,O,v,R,K,u){var D=q-l,i=O-h,n=K-v,d=u-R,a=d*D-n*i;if(!(a*a<y))return a=(n*(h-R)-d*(l-v))/a,[l+a*D,h+a*i]}function W(l,h,q,O,v,R,K){var u=l-q,D=h-O,i=(K?R:-R)/j(u*u+D*D),n=i*D,d=-i*u,a=l+n,s=h+d,f=q+n,c=O+d,L=(a+f)/2,t=(s+c)/2,m=f-a,g=c-s,A=m*m+g*g,T=v-R,P=a*c-f*s,E=(g<0?-1:1)*j(on(0,T*T*A-P*P)),G=(P*g-m*E)/A,H=(-P*m-g*E)/A,w=(P*g+m*E)/A,p=(-P*m+g*E)/A,x=G-L,e=H-t,r=w-L,M=p-t;return x*x+e*e>r*r+M*M&&(G=w,H=p),{cx:G,cy:H,x01:-n,y01:-d,x11:G*(v/T-1),y11:H*(v/T-1)}}function hn(){var l=cn,h=yn,q=J(0),O=null,v=gn,R=dn,K=mn,u=null,D=ln(i);function i(){var n,d,a=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-an,c=R.apply(this,arguments)-an,L=rn(c-f),t=c>f;if(u||(u=n=D()),s<a&&(d=s,s=a,a=d),!(s>y))u.moveTo(0,0);else if(L>tn-y)u.moveTo(s*N(f),s*I(f)),u.arc(0,0,s,f,c,!t),a>y&&(u.moveTo(a*N(c),a*I(c)),u.arc(0,0,a,c,f,t));else{var m=f,g=c,A=f,T=c,P=L,E=L,G=K.apply(this,arguments)/2,H=G>y&&(O?+O.apply(this,arguments):j(a*a+s*s)),w=_(rn(s-a)/2,+q.apply(this,arguments)),p=w,x=w,e,r;if(H>y){var M=sn(H/a*I(G)),z=sn(H/s*I(G));(P-=M*2)>y?(M*=t?1:-1,A+=M,T-=M):(P=0,A=T=(f+c)/2),(E-=z*2)>y?(z*=t?1:-1,m+=z,g-=z):(E=0,m=g=(f+c)/2)}var Q=s*N(m),V=s*I(m),B=a*N(T),C=a*I(T);if(w>y){var F=s*N(g),U=s*I(g),X=a*N(A),Y=a*I(A),S;if(L<un)if(S=pn(Q,V,X,Y,F,U,B,C)){var Z=Q-S[0],$=V-S[1],k=F-S[0],b=U-S[1],nn=1/I(fn((Z*k+$*b)/(j(Z*Z+$*$)*j(k*k+b*b)))/2),en=j(S[0]*S[0]+S[1]*S[1]);p=_(w,(a-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}E>y?x>y?(e=W(X,Y,Q,V,s,x,t),r=W(F,U,B,C,s,x,t),u.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?u.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(u.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),u.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),u.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(u.moveTo(Q,V),u.arc(0,0,s,m,g,!t)):u.moveTo(Q,V),!(a>y)||!(P>y)?u.lineTo(B,C):p>y?(e=W(B,C,F,U,a,-p,t),r=W(Q,V,X,Y,a,-p,t),u.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?u.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(u.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),u.arc(0,0,a,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),u.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):u.arc(0,0,a,T,A,t)}if(u.closePath(),n)return u=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +R.apply(this,arguments))/2-un/2;return[N(d)*n,I(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:J(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:J(+n),i):h},i.cornerRadius=function(n){return arguments.length?(q=typeof n=="function"?n:J(+n),i):q},i.padRadius=function(n){return arguments.length?(O=n==null?null:typeof n=="function"?n:J(+n),i):O},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:J(+n),i):v},i.endAngle=function(n){return arguments.length?(R=typeof n=="function"?n:J(+n),i):R},i.padAngle=function(n){return arguments.length?(K=typeof n=="function"?n:J(+n),i):K},i.context=function(n){return arguments.length?(u=n??null,i):u},i}export{hn as d};