clinkx 0.3.0 → 1.0.0

package/clinkx-workflows/dist/dashboard/read-model.js

@@ -0,0 +1,440 @@
+import { constants as fsConstants } from "node:fs";
+import { open, realpath } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { ContainedFileChangedError, ContainedFilePolicyError, ContainedFileTooLargeError, readContainedRelativeFile, resolveOpenedDescriptorPath, } from "../contained-file.js";
+import { validateRunId } from "../run-id.js";
+import { logger } from "../logger.js";
+import { DEFAULT_DASHBOARD_MAX_STATE_BYTES as CONFIGURED_DEFAULT_DASHBOARD_MAX_STATE_BYTES } from "../config.js";
+import { parseDashboardRunState, } from "./contracts.js";
+import { deriveWorkflowRunGeneration } from "./generation.js";
+export const DEFAULT_DASHBOARD_MAX_STATE_BYTES = CONFIGURED_DEFAULT_DASHBOARD_MAX_STATE_BYTES;
+class DashboardGenerationRaceError extends Error {
+}
+const defaultFileSystem = { open, realpath };
+function hasErrorCode(error, code) {
+    return error?.code === code;
+}
+/** Map optional-content deletion without reclassifying the enclosing run. */
+export async function readDashboardOptionalContent(read) {
+    try {
+        return { kind: "available", value: await read() };
+    }
+    catch (error) {
+        if (hasErrorCode(error, "ENOENT")) {
+            return { kind: "unavailable", reason: "not_found" };
+        }
+        throw error;
+    }
+}
+function directoryIdentity(stats) {
+    return {
+        dev: stats.dev,
+        ino: stats.ino,
+        birthtimeNs: stats.birthtimeNs,
+    };
+}
+function directoryIdentitiesEqual(left, right) {
+    return left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.birthtimeNs === right.birthtimeNs;
+}
+function isProperDescendant(root, candidate) {
+    const pathFromRoot = relative(root, candidate);
+    return pathFromRoot !== "" &&
+        pathFromRoot !== ".." &&
+        !pathFromRoot.startsWith(`..${sep}`) &&
+        !isAbsolute(pathFromRoot);
+}
+async function inspectOpenedDirectory(handle) {
+    const stats = await handle.stat({ bigint: true });
+    if (!stats.isDirectory() ||
+        stats.nlink === 0n) {
+        throw new DashboardGenerationRaceError();
+    }
+    return directoryIdentity(stats);
+}
+async function verifyCurrentDirectoryIdentity(fileSystem, path, flags, expected) {
+    let current;
+    try {
+        // Opening the exact path with O_NOFOLLOW proves the current directory entry
+        // still names a real directory; comparing the opened identity to the
+        // transaction's live handle detects rename/recycle without a Darwin `lsof`
+        // subprocess. Directory hard links are not available to unprivileged callers,
+        // while the state-file descriptor retains its stricter initial/final
+        // authoritative path checks.
+        current = await fileSystem.open(path, flags);
+    }
+    catch {
+        throw new DashboardGenerationRaceError();
+    }
+    try {
+        const identity = await inspectOpenedDirectory(current);
+        if (!directoryIdentitiesEqual(identity, expected)) {
+            throw new DashboardGenerationRaceError();
+        }
+    }
+    finally {
+        await current.close();
+    }
+}
+function generationFor(cache, runId, identity, generate) {
+    const current = cache.generations.get(runId);
+    if (current !== undefined && directoryIdentitiesEqual(current.identity, identity)) {
+        return current.generation;
+    }
+    const generation = generate();
+    cache.generations.set(runId, { identity, generation });
+    return generation;
+}
+export function createDashboardRunReader(options = {}) {
+    const fileSystem = options.fileSystem ?? defaultFileSystem;
+    const verifyDescriptorPath = options.descriptorPathVerifier ??
+        resolveOpenedDescriptorPath;
+    const readStateFile = options.readStateFile ?? readContainedRelativeFile;
+    const generateRunGeneration = options.generateRunGeneration;
+    const maxStateBytes = options.maxStateBytes ?? DEFAULT_DASHBOARD_MAX_STATE_BYTES;
+    const rootCache = new Map();
+    const directoryFlags = fsConstants.O_RDONLY |
+        (fsConstants.O_DIRECTORY ?? 0) |
+        (fsConstants.O_NOFOLLOW ?? 0);
+    function runGeneration(cache, runId, rootIdentity, directoryIdentity) {
+        if (generateRunGeneration === undefined) {
+            return deriveWorkflowRunGeneration(runId, rootIdentity, directoryIdentity);
+        }
+        return generationFor(cache, runId, directoryIdentity, generateRunGeneration);
+    }
+    /**
+     * `runPath` is the exact canonical path `handle` was opened on — the CHILD run
+     * directory, never `canonicalRoot`. Passing it lets the darwin verifier take
+     * its fast `realpath`+`fstat`/`lstat` path instead of falling through to the
+     * `lsof` subprocess, which is both slower and hardlink-blind. Passing
+     * `canonicalRoot` here would compare two different inodes and reject every run.
+     * `canonicalRoot` is still required for the containment re-assert below, which
+     * is the upgrade the fast path relies on.
+     */
+    async function inspectInitiallyOpenedRunDirectory(handle, canonicalRoot, runPath) {
+        const identity = await inspectOpenedDirectory(handle);
+        let descriptorPath;
+        try {
+            descriptorPath = await verifyDescriptorPath(handle.fd, runPath);
+        }
+        catch {
+            throw new DashboardGenerationRaceError();
+        }
+        if (descriptorPath === undefined ||
+            !isProperDescendant(canonicalRoot, descriptorPath)) {
+            throw new DashboardGenerationRaceError();
+        }
+        return identity;
+    }
+    async function inspectCurrentDirectoryIdentity(configuredRoot, runId) {
+        try {
+            const canonicalRoot = await fileSystem.realpath(configuredRoot);
+            const rootHandle = await fileSystem.open(canonicalRoot, directoryFlags);
+            try {
+                const rootIdentity = await inspectOpenedDirectory(rootHandle);
+                const runPath = resolve(canonicalRoot, runId);
+                const runHandle = await fileSystem.open(runPath, directoryFlags);
+                try {
+                    const runIdentity = await inspectInitiallyOpenedRunDirectory(runHandle, canonicalRoot, runPath);
+                    await verifyCurrentDirectoryIdentity(fileSystem, runPath, directoryFlags, runIdentity);
+                    await verifyCurrentDirectoryIdentity(fileSystem, canonicalRoot, directoryFlags, rootIdentity);
+                    return {
+                        kind: "present",
+                        directoryIdentity: runIdentity,
+                        rootIdentity,
+                    };
+                }
+                finally {
+                    await runHandle.close();
+                }
+            }
+            finally {
+                await rootHandle.close();
+            }
+        }
+        catch {
+            return { kind: "missing" };
+        }
+    }
+    function unavailable(runId, reason, admission) {
+        return {
+            kind: "unavailable",
+            runId,
+            reason,
+            ...(options.includeUnavailableAdmissionMetadata === true && admission !== undefined
+                ? { admission }
+                : {}),
+        };
+    }
+    async function admitUnavailableDirectory(configuredRoot, runId) {
+        try {
+            const cacheKey = resolve(configuredRoot);
+            const canonicalRoot = await fileSystem.realpath(configuredRoot);
+            const rootHandle = await fileSystem.open(canonicalRoot, directoryFlags);
+            try {
+                const rootIdentity = await inspectOpenedDirectory(rootHandle);
+                let cache = rootCache.get(cacheKey);
+                if (cache === undefined ||
+                    cache.canonicalRoot !== canonicalRoot ||
+                    !directoryIdentitiesEqual(cache.identity, rootIdentity)) {
+                    cache = {
+                        canonicalRoot,
+                        identity: rootIdentity,
+                        generations: new Map(),
+                    };
+                    rootCache.set(cacheKey, cache);
+                }
+                const runPath = resolve(canonicalRoot, runId);
+                const runHandleA = await fileSystem.open(runPath, directoryFlags);
+                try {
+                    const identityA = await inspectInitiallyOpenedRunDirectory(runHandleA, canonicalRoot, runPath);
+                    const runHandleB = await fileSystem.open(runPath, directoryFlags);
+                    try {
+                        const identityB = await inspectOpenedDirectory(runHandleB);
+                        if (!directoryIdentitiesEqual(identityA, identityB))
+                            return undefined;
+                        await verifyCurrentDirectoryIdentity(fileSystem, canonicalRoot, directoryFlags, rootIdentity);
+                        return {
+                            runGeneration: runGeneration(cache, runId, rootIdentity, identityA),
+                            sourceBytes: 0,
+                            directoryIdentity: identityA,
+                            rootIdentity,
+                        };
+                    }
+                    finally {
+                        await runHandleB.close();
+                    }
+                }
+                finally {
+                    await runHandleA.close();
+                }
+            }
+            finally {
+                await rootHandle.close();
+            }
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async function readAttempt(configuredRoot, runId, attempt) {
+        const cacheKey = resolve(configuredRoot);
+        let canonicalRoot;
+        try {
+            canonicalRoot = await fileSystem.realpath(configuredRoot);
+        }
+        catch (error) {
+            if (hasErrorCode(error, "ENOENT")) {
+                rootCache.delete(cacheKey);
+                return { kind: "missing", runId };
+            }
+            logger.debug({ err: error, runId }, "dashboard runs root could not be canonicalized");
+            return { kind: "unavailable", runId, reason: "state_unreadable" };
+        }
+        let rootHandle;
+        try {
+            rootHandle = await fileSystem.open(canonicalRoot, directoryFlags);
+        }
+        catch (error) {
+            if (hasErrorCode(error, "ENOENT")) {
+                rootCache.delete(cacheKey);
+                return { kind: "missing", runId };
+            }
+            logger.debug({ err: error, runId }, "dashboard runs root could not be opened");
+            return { kind: "unavailable", runId, reason: "path_rejected" };
+        }
+        try {
+            const rootIdentity = await inspectOpenedDirectory(rootHandle);
+            let cache = rootCache.get(cacheKey);
+            if (cache === undefined ||
+                cache.canonicalRoot !== canonicalRoot ||
+                !directoryIdentitiesEqual(cache.identity, rootIdentity)) {
+                cache = {
+                    canonicalRoot,
+                    identity: rootIdentity,
+                    generations: new Map(),
+                };
+                rootCache.set(cacheKey, cache);
+            }
+            const runPath = resolve(canonicalRoot, runId);
+            let runHandle;
+            try {
+                runHandle = await fileSystem.open(runPath, directoryFlags);
+            }
+            catch (error) {
+                if (hasErrorCode(error, "ENOENT")) {
+                    cache.generations.delete(runId);
+                    return { kind: "missing", runId };
+                }
+                logger.debug({ err: error, runId }, "dashboard run directory could not be opened");
+                return { kind: "unavailable", runId, reason: "path_rejected" };
+            }
+            try {
+                const identityA = await inspectInitiallyOpenedRunDirectory(runHandle, canonicalRoot, runPath);
+                const hookContext = { attempt, canonicalRunsRoot: canonicalRoot, runId };
+                await options.hooks?.afterDirectoryAdmission?.(hookContext);
+                const verifyCurrentDirectory = async () => {
+                    let currentRunHandle;
+                    try {
+                        currentRunHandle = await fileSystem.open(runPath, directoryFlags);
+                    }
+                    catch {
+                        throw new DashboardGenerationRaceError();
+                    }
+                    try {
+                        const identityB = await inspectOpenedDirectory(currentRunHandle);
+                        if (!directoryIdentitiesEqual(identityA, identityB)) {
+                            throw new DashboardGenerationRaceError();
+                        }
+                    }
+                    finally {
+                        await currentRunHandle.close();
+                    }
+                };
+                const verifyStateBeforeClose = async (stateHandle) => {
+                    await options.hooks?.beforeCommitVerification?.(hookContext);
+                    await verifyCurrentDirectory();
+                    const currentStatePath = await stateHandle.resolveRealPath();
+                    if (stateHandle.fingerprint.nlink === 0n ||
+                        currentStatePath !== resolve(runPath, "state.json")) {
+                        throw new DashboardGenerationRaceError();
+                    }
+                };
+                const verifyRootStillCurrent = async () => {
+                    await verifyCurrentDirectoryIdentity(fileSystem, canonicalRoot, directoryFlags, rootIdentity);
+                };
+                const unavailableAdmission = (sourceBytes, stateFingerprint) => ({
+                    runGeneration: runGeneration(cache, runId, rootIdentity, identityA),
+                    sourceBytes,
+                    ...(stateFingerprint === undefined ? {} : { stateFingerprint }),
+                    directoryIdentity: identityA,
+                    rootIdentity,
+                });
+                let stateRead;
+                try {
+                    stateRead = await readStateFile(canonicalRoot, `${runId}/state.json`, {
+                        wantBytes: true,
+                        requireRegular: true,
+                        maxBytes: maxStateBytes,
+                        descriptorPathVerifier: verifyDescriptorPath,
+                        requireExactRequestedPath: true,
+                        beforeClose: verifyStateBeforeClose,
+                    });
+                }
+                catch (error) {
+                    if (error instanceof DashboardGenerationRaceError)
+                        throw error;
+                    if (error instanceof ContainedFileChangedError) {
+                        throw new DashboardGenerationRaceError();
+                    }
+                    if (hasErrorCode(error, "ENOENT")) {
+                        return { kind: "missing", runId };
+                    }
+                    if (error instanceof ContainedFileTooLargeError) {
+                        if (error.size !== undefined && error.fingerprint !== undefined) {
+                            await verifyRootStillCurrent();
+                            return unavailable(runId, "too_large_for_dashboard", unavailableAdmission(error.size, error.fingerprint));
+                        }
+                        await verifyCurrentDirectory();
+                        await verifyRootStillCurrent();
+                        return unavailable(runId, "state_unreadable", unavailableAdmission(0));
+                    }
+                    if (error instanceof ContainedFilePolicyError) {
+                        await verifyCurrentDirectory();
+                        await verifyRootStillCurrent();
+                        return unavailable(runId, "path_rejected", unavailableAdmission(0));
+                    }
+                    logger.debug({ err: error, runId }, "dashboard state could not be read");
+                    await verifyCurrentDirectory();
+                    await verifyRootStillCurrent();
+                    return unavailable(runId, "state_unreadable", unavailableAdmission(0));
+                }
+                await verifyRootStillCurrent();
+                let rawState;
+                try {
+                    rawState = JSON.parse(stateRead.bytes.toString("utf-8"));
+                }
+                catch {
+                    return unavailable(runId, "state_invalid", unavailableAdmission(stateRead.size, stateRead.fingerprint));
+                }
+                const decoded = parseDashboardRunState(rawState, runId);
+                if (!decoded.ok) {
+                    return unavailable(runId, decoded.reason, unavailableAdmission(stateRead.size, stateRead.fingerprint));
+                }
+                return {
+                    kind: "admitted",
+                    runId,
+                    runGeneration: runGeneration(cache, runId, rootIdentity, identityA),
+                    state: decoded.state,
+                    sourceBytes: stateRead.size,
+                    stateFingerprint: stateRead.fingerprint,
+                    directoryIdentity: identityA,
+                    rootIdentity,
+                };
+            }
+            finally {
+                await runHandle.close();
+            }
+        }
+        finally {
+            await rootHandle.close();
+        }
+    }
+    return {
+        async read(runsRoot, runId) {
+            try {
+                validateRunId(runId);
+            }
+            catch {
+                return { kind: "unavailable", runId, reason: "path_rejected" };
+            }
+            for (const attempt of [1, 2]) {
+                try {
+                    return await readAttempt(runsRoot, runId, attempt);
+                }
+                catch (error) {
+                    if (!(error instanceof DashboardGenerationRaceError)) {
+                        logger.warn({ err: error, runId }, "dashboard run admission failed unexpectedly");
+                        return { kind: "unavailable", runId, reason: "state_unreadable" };
+                    }
+                    if (attempt === 2) {
+                        return unavailable(runId, "run_generation_race", options.includeUnavailableAdmissionMetadata === true
+                            ? await admitUnavailableDirectory(runsRoot, runId)
+                            : undefined);
+                    }
+                }
+            }
+            return { kind: "unavailable", runId, reason: "run_generation_race" };
+        },
+        async inspectDirectoryIdentity(runsRoot, runId) {
+            try {
+                validateRunId(runId);
+            }
+            catch {
+                return { kind: "missing" };
+            }
+            return await inspectCurrentDirectoryIdentity(runsRoot, runId);
+        },
+        async inspectGeneration(runsRoot, runId) {
+            try {
+                validateRunId(runId);
+            }
+            catch {
+                return { kind: "missing" };
+            }
+            const admission = await admitUnavailableDirectory(runsRoot, runId);
+            return admission === undefined
+                ? { kind: "missing" }
+                : { kind: "present", runGeneration: admission.runGeneration };
+        },
+        forget(runsRoot, runId) {
+            rootCache.get(resolve(runsRoot))?.generations.delete(runId);
+        },
+    };
+}
+const defaultDashboardRunReader = createDashboardRunReader();
+export async function readDashboardRun(runsRoot, runId) {
+    return await defaultDashboardRunReader.read(runsRoot, runId);
+}
+//# sourceMappingURL=read-model.js.map

package/clinkx-workflows/dist/dashboard/read-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-model.js","sourceRoot":"","sources":["../../src/dashboard/read-model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAoB,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAmB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,GAG5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iCAAiC,IAAI,4CAA4C,EAAE,MAAM,cAAc,CAAC;AACjH,OAAO,EACL,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,CAAC,MAAM,iCAAiC,GAAG,4CAA4C,CAAC;AAgH9F,MAAM,4BAA6B,SAAQ,KAAK;CAAG;AAEnD,MAAM,iBAAiB,GAAiC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAE3E,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,OAAQ,KAA+B,EAAE,IAAI,KAAK,IAAI,CAAC;AACzD,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAgC,EAChC,KAAiC;IAEjC,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAC3B,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACtB,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,SAAiB;IACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,OAAO,YAAY,KAAK,EAAE;QACxB,YAAY,KAAK,IAAI;QACrB,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACpC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IACE,CAAC,KAAK,CAAC,WAAW,EAAE;QACpB,KAAK,CAAC,KAAK,KAAK,EAAE,EAClB,CAAC;QACD,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,UAAwC,EACxC,IAAY,EACZ,KAAa,EACb,QAAoC;IAEpC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,4EAA4E;QAC5E,qEAAqE;QACrE,2EAA2E;QAC3E,8EAA8E;QAC9E,qEAAqE;QACrE,6BAA6B;QAC7B,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAqB,EACrB,KAAa,EACb,QAAoC,EACpC,QAAsB;IAEtB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClF,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,EAAE,CAAC;IAC9B,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAC3D,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB;QACzD,2BAA2B,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,yBAAyB,CAAC;IACzE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,iCAAiC,CAAC;IACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ;QACzC,CAAC,WAAW,CAAC,WAAW,IAAI,CAAC,CAAC;QAC9B,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IAEhC,SAAS,aAAa,CACpB,KAAqB,EACrB,KAAa,EACb,YAAwC,EACxC,iBAA6C;QAE7C,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,2BAA2B,CAChC,KAAK,EACL,YAAY,EACZ,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAClB,KAAK,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,kCAAkC,CAC/C,MAAkB,EAClB,aAAqB,EACrB,OAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,cAAkC,CAAC;QACvC,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC3C,CAAC;QACD,IACE,cAAc,KAAK,SAAS;YAC5B,CAAC,kBAAkB,CAAC,aAAa,EAAE,cAAc,CAAC,EAClD,CAAC;YACD,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,+BAA+B,CAC5C,cAAsB,EACtB,KAAa;QASb,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;gBAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,MAAM,kCAAkC,CAC1D,SAAS,EACT,aAAa,EACb,OAAO,CACR,CAAC;oBACF,MAAM,8BAA8B,CAClC,UAAU,EACV,OAAO,EACP,cAAc,EACd,WAAW,CACZ,CAAC;oBACF,MAAM,8BAA8B,CAClC,UAAU,EACV,aAAa,EACb,cAAc,EACd,YAAY,CACb,CAAC;oBACF,OAAO;wBACL,IAAI,EAAE,SAAS;wBACf,iBAAiB,EAAE,WAAW;wBAC9B,YAAY;qBACb,CAAC;gBACJ,CAAC;wBAAS,CAAC;oBACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,SAAS,WAAW,CAClB,KAAa,EACb,MAAqC,EACrC,SAAyC;QAEzC,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK;YACL,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,mCAAmC,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS;gBACjF,CAAC,CAAC,EAAE,SAAS,EAAE;gBACf,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,yBAAyB,CACtC,cAAsB,EACtB,KAAa;QAEb,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;YACzC,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;gBAC9D,IAAI,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACpC,IACE,KAAK,KAAK,SAAS;oBACnB,KAAK,CAAC,aAAa,KAAK,aAAa;oBACrC,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,EACvD,CAAC;oBACD,KAAK,GAAG;wBACN,aAAa;wBACb,QAAQ,EAAE,YAAY;wBACtB,WAAW,EAAE,IAAI,GAAG,EAAE;qBACvB,CAAC;oBACF,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;gBAED,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,UAAU,EACV,aAAa,EACb,OAAO,CACR,CAAC;oBACF,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;oBAClE,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;wBAC3D,IACE,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC;4BAC/C,OAAO,SAAS,CAAC;wBACnB,MAAM,8BAA8B,CAClC,UAAU,EACV,aAAa,EACb,cAAc,EACd,YAAY,CACb,CAAC;wBACF,OAAO;4BACL,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC;4BACnE,WAAW,EAAE,CAAC;4BACd,iBAAiB,EAAE,SAAS;4BAC5B,YAAY;yBACb,CAAC;oBACJ,CAAC;4BAAS,CAAC;wBACT,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;oBAC3B,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,cAAsB,EACtB,KAAa,EACb,OAAc;QAEd,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,gDAAgD,CAAC,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,yCAAyC,CAAC,CAAC;YAC/E,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpC,IACE,KAAK,KAAK,SAAS;gBACnB,KAAK,CAAC,aAAa,KAAK,aAAa;gBACrC,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,EACvD,CAAC;gBACD,KAAK,GAAG;oBACN,aAAa;oBACb,QAAQ,EAAE,YAAY;oBACtB,WAAW,EAAE,IAAI,GAAG,EAAE;iBACvB,CAAC;gBACF,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAClC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBACpC,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,6CAA6C,CAAC,CAAC;gBACnF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACjE,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CACxD,SAAS,EACT,aAAa,EACb,OAAO,CACR,CAAC;gBACF,MAAM,WAAW,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;gBACzE,MAAM,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE,CAAC,WAAW,CAAC,CAAC;gBAE5D,MAAM,sBAAsB,GAAG,KAAK,IAAmB,EAAE;oBACvD,IAAI,gBAA4B,CAAC;oBACjC,IAAI,CAAC;wBACH,gBAAgB,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;oBACpE,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,IAAI,4BAA4B,EAAE,CAAC;oBAC3C,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;wBACjE,IAAI,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;4BACpD,MAAM,IAAI,4BAA4B,EAAE,CAAC;wBAC3C,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,MAAM,gBAAgB,CAAC,KAAK,EAAE,CAAC;oBACjC,CAAC;gBACH,CAAC,CAAC;gBAEF,MAAM,sBAAsB,GAAG,KAAK,EAClC,WAA4H,EAC7G,EAAE;oBACjB,MAAM,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,CAAC,WAAW,CAAC,CAAC;oBAC7D,MAAM,sBAAsB,EAAE,CAAC;oBAC/B,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,eAAe,EAAE,CAAC;oBAC7D,IACE,WAAW,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE;wBACpC,gBAAgB,KAAK,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,EACnD,CAAC;wBACD,MAAM,IAAI,4BAA4B,EAAE,CAAC;oBAC3C,CAAC;gBACH,CAAC,CAAC;gBAEF,MAAM,sBAAsB,GAAG,KAAK,IAAmB,EAAE;oBACvD,MAAM,8BAA8B,CAClC,UAAU,EACV,aAAa,EACb,cAAc,EACd,YAAY,CACb,CAAC;gBACJ,CAAC,CAAC;gBAEF,MAAM,oBAAoB,GAAG,CAC3B,WAAmB,EACnB,gBAA2C,EACZ,EAAE,CAAC,CAAC;oBACnC,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC;oBACnE,WAAW;oBACX,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;oBAC/D,iBAAiB,EAAE,SAAS;oBAC5B,YAAY;iBACb,CAAC,CAAC;gBAEH,IAAI,SAAS,CAAC;gBACd,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,aAAa,EAAE;wBACpE,SAAS,EAAE,IAAI;wBACf,cAAc,EAAE,IAAI;wBACpB,QAAQ,EAAE,aAAa;wBACvB,sBAAsB,EAAE,oBAAoB;wBAC5C,yBAAyB,EAAE,IAAI;wBAC/B,WAAW,EAAE,sBAAsB;qBACpC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,4BAA4B;wBAAE,MAAM,KAAK,CAAC;oBAC/D,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;wBAC/C,MAAM,IAAI,4BAA4B,EAAE,CAAC;oBAC3C,CAAC;oBACD,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;wBAClC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;oBACpC,CAAC;oBACD,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;wBAChD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;4BAChE,MAAM,sBAAsB,EAAE,CAAC;4BAC/B,OAAO,WAAW,CAChB,KAAK,EACL,yBAAyB,EACzB,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CACpD,CAAC;wBACJ,CAAC;wBACD,MAAM,sBAAsB,EAAE,CAAC;wBAC/B,MAAM,sBAAsB,EAAE,CAAC;wBAC/B,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzE,CAAC;oBACD,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;wBAC9C,MAAM,sBAAsB,EAAE,CAAC;wBAC/B,MAAM,sBAAsB,EAAE,CAAC;wBAC/B,OAAO,WAAW,CAAC,KAAK,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;oBACtE,CAAC;oBACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,mCAAmC,CAAC,CAAC;oBACzE,MAAM,sBAAsB,EAAE,CAAC;oBAC/B,MAAM,sBAAsB,EAAE,CAAC;oBAC/B,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzE,CAAC;gBAED,MAAM,sBAAsB,EAAE,CAAC;gBAE/B,IAAI,QAAiB,CAAC;gBACtB,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,WAAW,CAChB,KAAK,EACL,eAAe,EACf,oBAAoB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAC5D,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACxD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO,WAAW,CAChB,KAAK,EACL,OAAO,CAAC,MAAM,EACd,oBAAoB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAC5D,CAAC;gBACJ,CAAC;gBAED,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,KAAK;oBACL,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC;oBACnE,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,SAAS,CAAC,IAAI;oBAC3B,gBAAgB,EAAE,SAAS,CAAC,WAAW;oBACvC,iBAAiB,EAAE,SAAS;oBAC5B,YAAY;iBACb,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK;YACxB,IAAI,CAAC;gBACH,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACjE,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAU,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,OAAO,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC,EAAE,CAAC;wBACrD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,6CAA6C,CAAC,CAAC;wBAClF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;oBACpE,CAAC;oBACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;wBAClB,OAAO,WAAW,CAChB,KAAK,EACL,qBAAqB,EACrB,OAAO,CAAC,mCAAmC,KAAK,IAAI;4BAClD,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC;4BAClD,CAAC,CAAC,SAAS,CACd,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,KAAK;YAC5C,IAAI,CAAC;gBACH,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YACD,OAAO,MAAM,+BAA+B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK;YACrC,IAAI,CAAC;gBACH,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,SAAS,KAAK,SAAS;gBAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;gBACrB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,KAAK;YACpB,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,wBAAwB,EAAE,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,KAAa;IAEb,OAAO,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC"}

package/clinkx-workflows/dist/dashboard/request-admission.d.ts

@@ -0,0 +1,31 @@
+export interface DashboardRequestTarget {
+    readonly path: string;
+    readonly query: URLSearchParams;
+    readonly segments: readonly string[];
+}
+export type DashboardAuthRoute = Readonly<{
+    name: "status";
+    method: "GET";
+}> | Readonly<{
+    name: "register-options";
+    method: "POST";
+}> | Readonly<{
+    name: "register-verify";
+    method: "POST";
+}> | Readonly<{
+    name: "login-options";
+    method: "POST";
+}> | Readonly<{
+    name: "login-verify";
+    method: "POST";
+}> | Readonly<{
+    name: "logout";
+    method: "POST";
+}>;
+/**
+ * Admit an origin-form request target without WHATWG URL path normalization.
+ * Query parsing is deliberately separate from the single-decode path pass.
+ */
+export declare function admitDashboardRequestTarget(requestTarget: string): DashboardRequestTarget | undefined;
+export declare function isKnownDashboardApiRoute(segments: readonly string[]): boolean;
+export declare function dashboardAuthRoute(segments: readonly string[]): DashboardAuthRoute | undefined;

package/clinkx-workflows/dist/dashboard/request-admission.js

@@ -0,0 +1,126 @@
+import { isProgressReportStatusOverrideSegments, } from "./progress-report-status-overlay.js";
+const DASHBOARD_AUTH_ROUTES = new Map([
+    ["status", Object.freeze({ name: "status", method: "GET" })],
+    ["register/options", Object.freeze({ name: "register-options", method: "POST" })],
+    ["register/verify", Object.freeze({ name: "register-verify", method: "POST" })],
+    ["login/options", Object.freeze({ name: "login-options", method: "POST" })],
+    ["login/verify", Object.freeze({ name: "login-verify", method: "POST" })],
+    ["logout", Object.freeze({ name: "logout", method: "POST" })],
+]);
+const ENCODED_SEPARATOR_OR_NUL = /%(?:2f|5c|00)/i;
+const ENCODED_OCTET = /%[0-9a-f]{2}/i;
+/**
+ * Admit an origin-form request target without WHATWG URL path normalization.
+ * Query parsing is deliberately separate from the single-decode path pass.
+ */
+export function admitDashboardRequestTarget(requestTarget) {
+    if (!requestTarget.startsWith("/"))
+        return undefined;
+    const queryStart = requestTarget.indexOf("?");
+    const rawPath = queryStart === -1
+        ? requestTarget
+        : requestTarget.slice(0, queryStart);
+    const rawQuery = queryStart === -1
+        ? ""
+        : requestTarget.slice(queryStart + 1);
+    if (rawPath.includes("#"))
+        return undefined;
+    const decodedSegments = [];
+    for (const rawSegment of rawPath.slice(1).split("/")) {
+        if (rawSegment.includes("\\") ||
+            rawSegment.includes("\0") ||
+            ENCODED_SEPARATOR_OR_NUL.test(rawSegment)) {
+            return undefined;
+        }
+        let decoded;
+        try {
+            decoded = decodeURIComponent(rawSegment);
+        }
+        catch {
+            return undefined;
+        }
+        if (decoded === "." ||
+            decoded === ".." ||
+            decoded.includes("/") ||
+            decoded.includes("\\") ||
+            decoded.includes("\0") ||
+            ENCODED_OCTET.test(decoded)) {
+            return undefined;
+        }
+        decodedSegments.push(decoded);
+    }
+    return Object.freeze({
+        path: `/${decodedSegments.join("/")}`,
+        query: new URLSearchParams(rawQuery),
+        segments: Object.freeze(decodedSegments),
+    });
+}
+export function isKnownDashboardApiRoute(segments) {
+    if (segments[0] !== "api")
+        return false;
+    if (dashboardAuthRoute(segments) != null)
+        return true;
+    if (segments.length === 2 &&
+        ["activities", "adapters", "artifacts", "connection", "context-runs", "env", "progress-reports", "runs", "workflows"].includes(segments[1] ?? "")) {
+        return true;
+    }
+    if (segments[1] === "context-runs" && (segments[2]?.length ?? 0) > 0) {
+        if (segments.length >= 4 &&
+            segments[3] === "session-logs") {
+            return segments.length === 4 ||
+                (segments.length === 5 && (segments[4]?.length ?? 0) > 0);
+        }
+        if (segments.length === 5 &&
+            segments[3] === "artifacts" &&
+            (segments[4]?.length ?? 0) > 0) {
+            return true;
+        }
+        return segments.length === 3;
+    }
+    if (segments[1] === "activities" && (segments[2]?.length ?? 0) > 0) {
+        if (segments.length === 3)
+            return true;
+        if (segments[3] === "session-logs") {
+            return segments.length === 4 ||
+                (segments.length === 5 && (segments[4]?.length ?? 0) > 0);
+        }
+        return segments.length === 4 && segments[3] === "result";
+    }
+    if (segments[1] === "progress-reports" && (segments[2]?.length ?? 0) > 0) {
+        return (segments.length === 4 && segments[3] === "data") ||
+            isProgressReportStatusOverrideSegments(segments);
+    }
+    if (segments[1] !== "runs" || (segments[2]?.length ?? 0) === 0)
+        return false;
+    if (segments.length === 3)
+        return true;
+    if (segments.length === 4 && segments[3] === "result")
+        return true;
+    if (segments.length >= 8 &&
+        segments[3] === "stages" &&
+        (segments[4]?.length ?? 0) > 0 &&
+        segments[5] === "calls" &&
+        (segments[6]?.length ?? 0) > 0 &&
+        segments[7] === "session-logs") {
+        return segments.length === 8 ||
+            (segments.length === 9 && (segments[8]?.length ?? 0) > 0);
+    }
+    if (segments.length >= 5 &&
+        segments[3] === "context-preflight" &&
+        segments[4] === "session-logs") {
+        return segments.length === 5 ||
+            (segments.length === 6 && (segments[5]?.length ?? 0) > 0);
+    }
+    return segments.length === 8 &&
+        segments[3] === "stages" &&
+        (segments[4]?.length ?? 0) > 0 &&
+        segments[5] === "calls" &&
+        (segments[6]?.length ?? 0) > 0 &&
+        ["artifact", "error", "output", "prompt"].includes(segments[7] ?? "");
+}
+export function dashboardAuthRoute(segments) {
+    if (segments[0] !== "api" || segments[1] !== "auth")
+        return undefined;
+    return DASHBOARD_AUTH_ROUTES.get(segments.slice(2).join("/"));
+}
+//# sourceMappingURL=request-admission.js.map

package/clinkx-workflows/dist/dashboard/request-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-admission.js","sourceRoot":"","sources":["../../src/dashboard/request-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,GACvC,MAAM,qCAAqC,CAAC;AAgB7C,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAA6B;IAChE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AAClD,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,aAAqB;IAErB,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IACE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzB,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzB,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,EACzC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IACE,OAAO,KAAK,GAAG;YACf,OAAO,KAAK,IAAI;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC3B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,KAAK,EAAE,IAAI,eAAe,CAAC,QAAQ,CAAC;QACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAA2B;IAE3B,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtD,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EACjJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,IACE,QAAQ,CAAC,MAAM,IAAI,CAAC;YACpB,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,EAC9B,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAC1B,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW;YAC3B,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAC9B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAC1B,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,kBAAkB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;YACtD,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,IACE,QAAQ,CAAC,MAAM,IAAI,CAAC;QACpB,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;QACxB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9B,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO;QACvB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9B,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,EAC9B,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IACE,QAAQ,CAAC,MAAM,IAAI,CAAC;QACpB,QAAQ,CAAC,CAAC,CAAC,KAAK,mBAAmB;QACnC,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,EAC9B,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;QACxB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9B,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO;QACvB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9B,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA2B;IAE3B,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC"}