create-workframe 0.1.12 → 0.1.13

package/workframe-api/workspace_files.py

@@ -0,0 +1,344 @@
+"""WF-032 extract: workspace file tree, read/write, revision state."""
+
+from __future__ import annotations
+
+import base64
+import mimetypes
+import threading
+import time
+from pathlib import Path
+from typing import Any
+
+TREE_SKIP_NAMES = {
+    ".git",
+    ".next",
+    ".turbo",
+    ".venv",
+    ".workframe-cache",
+    "__pycache__",
+    "node_modules",
+    "dist",
+    "build",
+    "coverage",
+    "users",  # ponytail: legacy scaffold dir — hide if present
+    "content",  # ponytail: legacy nested tree — hide if present
+}
+
+PROTECTED_WORKSPACE_FILE_NAMES = {"AGENTS.md", ".hermes.md"}
+PROTECTED_PROFILE_CONFIG_FILE_NAMES = {"config.yaml", "profile.yaml"}
+
+_workspace_state_lock = threading.Lock()
+_workspace_state_cache: dict[str, Any] = {
+    "ok": True,
+    "revision": "0:0:",
+    "files": 0,
+    "updated_at": "",
+    "latest_path": "",
+    "generation": 0,
+}
+_workspace_tree_lock = threading.Lock()
+_workspace_tree_cache: dict[str, Any] = {
+    "revision": "",
+    "root": None,
+}
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def _normalized_workspace_rel(rel: str) -> str:
+    return (rel or "").replace("\\", "/").lstrip("/")
+
+
+def _workspace_root() -> Path:
+    return _srv().WORKSPACE.resolve()
+
+
+def safe_workspace_path(rel: str) -> Path | None:
+    rel = rel.replace("\\", "/").lstrip("/")
+    if not rel or ".." in rel.split("/"):
+        return None
+    root = _workspace_root()
+    path = (root / rel).resolve()
+    try:
+        path.relative_to(root)
+    except ValueError:
+        return None
+    return path
+
+
+def _workspace_rel(path: Path) -> str:
+    return path.resolve().relative_to(_workspace_root()).as_posix()
+
+
+def _is_env_like_name(name: str) -> bool:
+    lower = name.lower()
+    return (
+        lower == ".env"
+        or lower.startswith(".env.")
+        or lower.endswith(".env")
+        or lower == "environment"
+    )
+
+
+def workspace_protected_reason(rel: str) -> str | None:
+    """Return a stable reason when a workspace-relative path is protected."""
+    safe = safe_workspace_path(_normalized_workspace_rel(rel))
+    workspace = _srv().WORKSPACE.resolve()
+    if safe is None:
+        return "invalid_path"
+    try:
+        rel_path = safe.relative_to(workspace)
+    except ValueError:
+        return "invalid_path"
+
+    parts = rel_path.parts
+    if not parts:
+        return None
+
+    for part in parts:
+        if part in PROTECTED_WORKSPACE_FILE_NAMES:
+            return "protected_workspace_file"
+        if _is_env_like_name(part):
+            return "protected_env_file"
+
+    if len(parts) >= 3 and parts[0] == "profiles" and parts[2] in PROTECTED_PROFILE_CONFIG_FILE_NAMES:
+        return "protected_profile_config"
+    if len(parts) >= 2 and parts[0] == "profiles" and parts[-1] in PROTECTED_PROFILE_CONFIG_FILE_NAMES:
+        return "protected_profile_config"
+    return None
+
+
+def safe_content_path(rel: str) -> Path | None:
+    return safe_workspace_path(rel)
+
+
+def _list_folder_nodes(folder: Path) -> list[dict[str, Any]]:
+    out: list[dict[str, Any]] = []
+    try:
+        entries = sorted(folder.iterdir(), key=lambda p: (p.is_file(), p.name.lower()))
+    except OSError:
+        return out
+    for p in entries:
+        if p.name in TREE_SKIP_NAMES:
+            continue
+        rel = _workspace_rel(p)
+        if workspace_protected_reason(rel):
+            continue
+        node: dict[str, Any] = {
+            "id": rel,
+            "name": p.name,
+            "type": "folder" if p.is_dir() else "file",
+        }
+        if p.is_dir():
+            node["children"] = []
+            node["children_loaded"] = False
+        out.append(node)
+    return out
+
+
+def _files_tree_root_name() -> str:
+    """Navigator root label follows workspace branding, not WORKFRAME_PROJECT env."""
+    try:
+        conn = _srv()._workframe_db()
+        branding = _srv()._primary_workspace_branding(conn)
+        conn.close()
+        if branding:
+            name = str(branding.get("display_name") or "").strip()
+            if name:
+                return name
+    except Exception:  # noqa: BLE001
+        pass
+    return _srv().PROJECT_NAME
+
+
+def files_tree() -> dict[str, Any]:
+    workspace = _srv().WORKSPACE
+    current_revision = str(workspace_state().get("revision") or "")
+    root_name = _files_tree_root_name()
+    with _workspace_tree_lock:
+        cached_revision = str(_workspace_tree_cache.get("revision") or "")
+        cached_root = _workspace_tree_cache.get("root")
+        if cached_root and cached_revision == current_revision:
+            if str(cached_root.get("name") or "") == root_name:
+                return cached_root
+            refreshed = dict(cached_root)
+            refreshed["name"] = root_name
+            _workspace_tree_cache["root"] = refreshed
+            return refreshed
+
+    root = {
+        "id": "root",
+        "name": root_name,
+        "type": "folder",
+        "children": [],
+    }
+    if not workspace.is_dir():
+        return root
+    root["children"] = _list_folder_nodes(workspace)
+    with _workspace_tree_lock:
+        _workspace_tree_cache["revision"] = current_revision
+        _workspace_tree_cache["root"] = root
+    return root
+
+
+def files_list(rel: str = "") -> dict[str, Any]:
+    workspace = _srv().WORKSPACE
+    folder = workspace if not rel.strip() else safe_workspace_path(rel)
+    if folder is None or not folder.exists() or not folder.is_dir():
+        raise ValueError("folder not found")
+    reason = workspace_protected_reason(rel)
+    if reason:
+        raise PermissionError(f"protected file: {reason}")
+    folder_rel = "" if folder == workspace else _workspace_rel(folder)
+    return {
+        "ok": True,
+        "path": folder_rel,
+        "children": _list_folder_nodes(folder),
+    }
+
+
+def _scan_workspace_state() -> dict[str, Any]:
+    workspace = _srv().WORKSPACE
+    files = 0
+    latest_mtime = 0.0
+    latest_rel = ""
+    if workspace.is_dir():
+        try:
+            for path in workspace.rglob("*"):
+                if not path.is_file():
+                    continue
+                if path.name in TREE_SKIP_NAMES:
+                    continue
+                try:
+                    rel = _workspace_rel(path)
+                except ValueError:
+                    continue
+                if workspace_protected_reason(rel):
+                    continue
+                files += 1
+                try:
+                    mtime = float(path.stat().st_mtime)
+                except OSError:
+                    continue
+                if mtime >= latest_mtime:
+                    latest_mtime = mtime
+                    latest_rel = rel
+        except OSError:
+            pass
+    revision = f"{int(latest_mtime)}:{files}:{latest_rel}"
+    return {
+        "ok": True,
+        "revision": revision,
+        "files": files,
+        "updated_at": _srv()._iso_from_unix(latest_mtime),
+        "latest_path": latest_rel,
+    }
+
+
+def _refresh_workspace_state() -> dict[str, Any]:
+    state = _scan_workspace_state()
+    with _workspace_state_lock:
+        generation = int(_workspace_state_cache.get("generation") or 0)
+        _workspace_state_cache.update(state)
+        _workspace_state_cache["generation"] = generation
+        if generation:
+            _workspace_state_cache["revision"] = f"{state['revision']}:{generation}"
+        return dict(_workspace_state_cache)
+
+
+def workspace_state() -> dict[str, Any]:
+    with _workspace_state_lock:
+        return dict(_workspace_state_cache)
+
+
+def bump_workspace_state(path: Path | None = None) -> None:
+    now = time.time()
+    rel = ""
+    if path is not None:
+        try:
+            rel = _workspace_rel(path)
+        except Exception:  # noqa: BLE001
+            rel = ""
+    with _workspace_state_lock:
+        current_files = int(_workspace_state_cache.get("files") or 0)
+        generation = int(_workspace_state_cache.get("generation") or 0) + 1
+        _workspace_state_cache.update(
+            {
+                "ok": True,
+                "revision": f"{int(now)}:{current_files}:{rel}:{generation}",
+                "updated_at": _srv()._iso_from_unix(now),
+                "latest_path": rel,
+                "generation": generation,
+            }
+        )
+    with _workspace_tree_lock:
+        _workspace_tree_cache["revision"] = ""
+        _workspace_tree_cache["root"] = None
+
+
+def workspace_state_daemon() -> None:
+    while True:
+        try:
+            _refresh_workspace_state()
+        except Exception:  # noqa: BLE001
+            pass
+        time.sleep(2)
+
+
+def file_read(rel: str) -> dict[str, Any]:
+    reason = workspace_protected_reason(rel)
+    if reason:
+        raise PermissionError(f"protected file: {reason}")
+    fp = safe_workspace_path(rel)
+    if not fp or not fp.exists() or not fp.is_file():
+        raise ValueError("not found")
+    try:
+        text = fp.read_text(encoding="utf-8")
+        return {"path": _workspace_rel(fp), "content": text}
+    except UnicodeDecodeError:
+        return {"path": _workspace_rel(fp), "content": ""}
+
+
+def file_write(rel: str, content: str) -> dict[str, Any]:
+    reason = workspace_protected_reason(rel)
+    if reason:
+        raise PermissionError(f"protected file: {reason}")
+    fp = safe_workspace_path(rel)
+    if not fp:
+        raise ValueError("invalid path")
+    fp.parent.mkdir(parents=True, exist_ok=True)
+    fp.write_text(content, encoding="utf-8")
+    bump_workspace_state(fp)
+    return {"ok": True, "path": _workspace_rel(fp)}
+
+
+def file_upload_binary(rel: str, content_b64: str) -> dict[str, Any]:
+    reason = workspace_protected_reason(rel)
+    if reason:
+        raise PermissionError(f"protected file: {reason}")
+    fp = safe_workspace_path(rel)
+    if not fp:
+        raise ValueError("invalid path")
+    try:
+        raw = base64.b64decode(content_b64, validate=True)
+    except ValueError as exc:
+        raise ValueError("invalid base64") from exc
+    fp.parent.mkdir(parents=True, exist_ok=True)
+    fp.write_bytes(raw)
+    bump_workspace_state(fp)
+    return {"ok": True, "path": _workspace_rel(fp), "size": len(raw)}
+
+
+def file_raw(rel: str) -> tuple[bytes, str]:
+    reason = workspace_protected_reason(rel)
+    if reason:
+        raise PermissionError(f"protected file: {reason}")
+    fp = safe_workspace_path(rel)
+    if not fp or not fp.is_file():
+        raise ValueError("not found")
+    mime, _ = mimetypes.guess_type(str(fp))
+    return fp.read_bytes(), mime or "application/octet-stream"

package/workframe-api/workspace_messaging.py

@@ -0,0 +1,206 @@
+"""WF-032 extract: workspace messaging settings and gateway env sync."""
+
+from __future__ import annotations
+
+import json
+import re
+import sqlite3
+from typing import Any
+
+# Hermes gateway reads these from the primary profile .env; vault is source of truth.
+_MESSAGING_GATEWAY_ENV: dict[str, dict[str, str]] = {
+    "discord": {
+        "token": "DISCORD_BOT_TOKEN",
+        "home_channel": "DISCORD_HOME_CHANNEL",
+        "allowed_users": "DISCORD_ALLOWED_USERS",
+    },
+    "telegram": {
+        "token": "TELEGRAM_BOT_TOKEN",
+        "home_channel": "TELEGRAM_HOME_CHANNEL",
+        "allowed_users": "TELEGRAM_ALLOWED_USERS",
+    },
+}
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def _parse_messaging_settings_patch(body: dict[str, Any], settings: dict[str, Any]) -> dict[str, Any]:
+    """Merge admin messaging channel/allowlist config into workspace settings."""
+    raw = body.get("messaging")
+    if not isinstance(raw, dict):
+        return settings
+    messaging = settings.get("messaging") if isinstance(settings.get("messaging"), dict) else {}
+    merged = dict(messaging)
+    for provider in ("discord", "telegram"):
+        block = raw.get(provider)
+        if not isinstance(block, dict):
+            continue
+        current = merged.get(provider) if isinstance(merged.get(provider), dict) else {}
+        row = dict(current)
+        if "home_channel" in block:
+            row["home_channel"] = str(block.get("home_channel") or "").strip()
+        if "allowed_users" in block:
+            row["allowed_users"] = str(block.get("allowed_users") or "").strip()
+        merged[provider] = row
+    settings["messaging"] = merged
+    return settings
+
+
+def _workspace_member_platform_ids(workspace_id: str) -> dict[str, set[str]]:
+    """Collect linked Discord/Telegram user IDs for workspace members."""
+    workspace_id = str(workspace_id or "").strip()
+    out: dict[str, set[str]] = {"discord": set(), "telegram": set(), "slack": set()}
+    if not workspace_id:
+        return out
+    conn = _srv()._workframe_db()
+    try:
+        rows = conn.execute(
+            """
+            SELECT u.platform_ids
+            FROM users u
+            JOIN workspace_memberships wm ON wm.user_id = u.id
+            WHERE wm.workspace_id = ?
+              AND wm.deleted_at IS NULL
+              AND u.deleted_at IS NULL
+              AND wm.status = 'active'
+            """,
+            (workspace_id,),
+        ).fetchall()
+    finally:
+        conn.close()
+    for row in rows:
+        raw = row[0] if row else "{}"
+        try:
+            parsed = json.loads(str(raw or "{}"))
+        except (TypeError, json.JSONDecodeError):
+            parsed = {}
+        if not isinstance(parsed, dict):
+            continue
+        for platform in out:
+            val = str(parsed.get(platform) or "").strip()
+            if val:
+                out[platform].add(val)
+    return out
+
+
+def _merged_messaging_allowed_users(workspace_id: str, provider: str, seed: str) -> str:
+    """Admin seed allowlist + member-linked platform IDs for gateway env."""
+    provider = str(provider or "").strip().lower()
+    ids: list[str] = []
+    seen: set[str] = set()
+    for part in re.split(r"[\s,;]+", str(seed or "").strip()):
+        token = part.strip()
+        if token and token not in seen:
+            seen.add(token)
+            ids.append(token)
+    for member_id in sorted(_workspace_member_platform_ids(workspace_id).get(provider, set())):
+        if member_id not in seen:
+            seen.add(member_id)
+            ids.append(member_id)
+    return ",".join(ids)
+
+
+def _workspace_messaging_integrations_payload(workspace_id: str, settings: dict[str, Any]) -> dict[str, Any]:
+    messaging = settings.get("messaging") if isinstance(settings.get("messaging"), dict) else {}
+    payload: dict[str, Any] = {}
+    for provider, env_map in _MESSAGING_GATEWAY_ENV.items():
+        block = messaging.get(provider) if isinstance(messaging.get(provider), dict) else {}
+        resolved = _srv()._resolve_credential("", workspace_id, provider)
+        has_token = bool(resolved and _srv()._credential_secret(resolved, ""))
+        payload[provider] = {
+            "bot_token_configured": has_token,
+            "home_channel": str(block.get("home_channel") or ""),
+            "allowed_users": str(block.get("allowed_users") or ""),
+        }
+    return payload
+
+
+def _set_primary_messaging_platforms(enabled: dict[str, bool]) -> tuple[bool, str]:
+    primary = _srv()._primary_profile()
+    if not primary:
+        return False, "no_primary_profile"
+    flags = {name: bool(enabled.get(name)) for name in ("discord", "telegram")}
+    cfg_path = _srv()._profile_gateway_config_path(primary)
+    if cfg_path is None:
+        return False, "no_primary_profile"
+    try:
+        import yaml
+
+        cfg: dict[str, Any] = {}
+        if cfg_path.is_file():
+            loaded = yaml.safe_load(cfg_path.read_text(encoding="utf-8"))
+            cfg = loaded if isinstance(loaded, dict) else {}
+        plats = cfg.setdefault("platforms", {})
+        if not isinstance(plats, dict):
+            plats = {}
+            cfg["platforms"] = plats
+        for name, on in flags.items():
+            row = plats.get(name) if isinstance(plats.get(name), dict) else {}
+            row["enabled"] = bool(on)
+            plats[name] = row
+        cfg_path.write_text(yaml.safe_dump(cfg, sort_keys=False), encoding="utf-8")
+        return True, "ok"
+    except (OSError, ImportError) as exc:
+        return False, str(exc)
+
+
+def _sync_workspace_messaging_gateway(workspace_id: str) -> dict[str, Any]:
+    """Vault → primary profile .env overlay + platform toggles + gateway restart."""
+    workspace_id = str(workspace_id or "").strip()
+    if not workspace_id:
+        return {"ok": False, "error": "workspace_id_required"}
+    primary = _srv()._primary_profile()
+    if not primary:
+        return {"ok": False, "error": "no_primary_profile"}
+    try:
+        conn = _srv()._workframe_db()
+        row = conn.execute(
+            "SELECT settings_json FROM workspaces WHERE id = ? AND deleted_at IS NULL",
+            (workspace_id,),
+        ).fetchone()
+        conn.close()
+    except sqlite3.Error as exc:
+        return {"ok": False, "error": f"db_error: {exc}"}
+    settings = _srv()._parse_workspace_settings(row) if row else {}
+    messaging = settings.get("messaging") if isinstance(settings.get("messaging"), dict) else {}
+    env_path = _srv()._profile_dir(primary) / ".env"
+    enabled: dict[str, bool] = {}
+    for provider, env_map in _MESSAGING_GATEWAY_ENV.items():
+        token_var = env_map["token"]
+        resolved = _srv()._resolve_credential("", workspace_id, provider)
+        secret = _srv()._credential_secret(resolved, "") if resolved else ""
+        block = messaging.get(provider) if isinstance(messaging.get(provider), dict) else {}
+        if secret:
+            _srv()._upsert_env_secret(env_path, token_var, secret)
+            enabled[provider] = True
+            home = str(block.get("home_channel") or "").strip()
+            if home:
+                _srv()._upsert_env_secret(env_path, env_map["home_channel"], home)
+            else:
+                _srv()._remove_env_secret(env_path, env_map["home_channel"])
+            allowed = _merged_messaging_allowed_users(
+                workspace_id,
+                provider,
+                str(block.get("allowed_users") or ""),
+            )
+            if allowed:
+                _srv()._upsert_env_secret(env_path, env_map["allowed_users"], allowed)
+            else:
+                _srv()._remove_env_secret(env_path, env_map["allowed_users"])
+        else:
+            enabled[provider] = False
+            for key in env_map.values():
+                _srv()._remove_env_secret(env_path, key)
+    ok, out = _set_primary_messaging_platforms(enabled)
+    if not ok:
+        return {"ok": False, "error": f"messaging_platform_config_failed: {out}"}
+    try:
+        restart = _srv()._restart_stack_gateway()
+    except (ValueError, OSError, RuntimeError) as exc:
+        _srv()._log_handler_error("_sync_workspace_messaging_gateway restart", exc)
+        return {"ok": False, "error": str(exc)}
+    return {"ok": True, "gateway": restart}

package/workframe-api/zk_auth.py

@@ -165,8 +165,9 @@ def _zk_db() -> sqlite3.Connection:
     os.makedirs(os.path.dirname(db_path), exist_ok=True)
     conn = sqlite3.connect(db_path, timeout=10.0)
     conn.row_factory = sqlite3.Row
-    conn.execute("PRAGMA journal_mode=WAL")
-    conn.execute("PRAGMA busy_timeout=5000")
+    # ponytail: DELETE only — WAL sidecars fail on Docker Desktop Windows bind mounts.
+    conn.execute("PRAGMA journal_mode=DELETE")
+    conn.execute("PRAGMA busy_timeout=30000")
     _zk_init_db(conn)
     return conn
 

package/workframe-supervisor/server.py

@@ -272,10 +272,19 @@ def load_routes() -> dict[str, Any]:
                 if p.is_dir():
                     raw_routes.append({"profile": p.name})
     routes = []
+    seen: set[str] = set()
     for row in raw_routes:
         slug = str(row.get("profile") or "").strip()
-        if slug and profile_exists(slug):
+        if slug and profile_exists(slug) and slug not in seen:
             routes.append({"profile": slug})
+            seen.add(slug)
+    if default_profile and default_profile not in seen and profile_exists(default_profile):
+        routes.insert(0, {"profile": default_profile})
+        seen.add(default_profile)
+    native = safe_profile_slug(NATIVE_PROFILE) if NATIVE_PROFILE else ""
+    if native and native not in seen and profile_exists(native):
+        routes.insert(0, {"profile": native})
+        seen.add(native)
     return {"default_profile": default_profile, "routes": routes}
 
 

package/workframe-supervisor/test_supervisor_negative.py

@@ -0,0 +1,75 @@
+"""WF-011 supervisor negative tests — docker boundary, profile/path misuse, auth.
+
+Run: python services/workframe-supervisor/test_supervisor_negative.py
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server as supervisor
+from profile_secret_policy import exec_blocked_for_profile, is_secret_read_attempt
+
+
+def test_secret_read_blocked() -> None:
+    cmd = ["sh", "-lc", "cat /opt/data/profiles/u-alice-dev/.env"]
+    assert is_secret_read_attempt(cmd)
+    assert exec_blocked_for_profile(cmd, "u-alice-dev")
+
+
+def test_foreign_profile_secrets_blocked() -> None:
+    cmd = ["cat", "/opt/data/profiles/u-bob-dev/.env"]
+    assert exec_blocked_for_profile(cmd, "u-alice-dev")
+
+
+def test_invalid_profile_slug_rejected() -> None:
+    for bad in ("", "../etc", "UPPER", "a" * 70):
+        try:
+            supervisor.safe_profile_slug(bad)
+            raise AssertionError(f"expected ValueError for {bad!r}")
+        except ValueError:
+            pass
+
+
+def test_supervisor_auth_required() -> None:
+    supervisor.SUPERVISOR_TOKEN = "neg-test-token"
+
+    class _Handler:
+        headers: dict[str, str] = {}
+
+    assert not supervisor._auth_ok(_Handler())  # type: ignore[arg-type]
+    _Handler.headers = {"Authorization": "Bearer neg-test-token"}
+    assert supervisor._auth_ok(_Handler())  # type: ignore[arg-type]
+
+
+def test_raw_container_exec_disabled_by_default() -> None:
+    os.environ.pop("WORKFRAME_SUPERVISOR_ALLOW_RAW_EXEC", None)
+    assert os.environ.get("WORKFRAME_SUPERVISOR_ALLOW_RAW_EXEC", "0") != "1"
+
+
+def test_api_compose_public_has_no_docker_sock() -> None:
+  repo = Path(__file__).resolve().parents[2]
+  public = (repo / "infra" / "compose" / "workframe" / "docker-compose.public.yml").read_text(
+      encoding="utf-8"
+  )
+  api_block = public.split("workframe-api:")[1].split("workframe-supervisor:")[0]
+  assert "/var/run/docker.sock" not in api_block
+  assert "WORKFRAME_SUPERVISOR_ALLOW_RAW_EXEC=0" in public
+
+
+def main() -> None:
+    test_secret_read_blocked()
+    test_foreign_profile_secrets_blocked()
+    test_invalid_profile_slug_rejected()
+    test_supervisor_auth_required()
+    test_raw_container_exec_disabled_by_default()
+    test_api_compose_public_has_no_docker_sock()
+    print("supervisor negative tests ok")
+
+
+if __name__ == "__main__":
+    main()

package/workframe-ui/public/assets/{arc-B0OFRGmJ.js → arc-aUUffclm.js}

@@ -1 +1 @@
-import{n as e,t}from"./path-BWPyau1x.js";import{a as n,c as r,d as i,f as a,i as o,l as s,m as c,n as l,o as u,p as d,r as f,u as p}from"./dist-Cz2turIT.js";function m(e){return e.innerRadius}function h(e){return e.outerRadius}function g(e){return e.startAngle}function _(e){return e.endAngle}function v(e){return e&&e.padAngle}function y(e,t,n,r,i,a,o,s){var c=n-e,l=r-t,u=o-i,d=s-a,f=d*c-u*l;if(!(f*f<1e-12))return f=(u*(t-a)-d*(e-i))/f,[e+f*c,t+f*l]}function b(e,t,n,r,i,a,o){var c=e-n,l=t-r,u=(o?a:-a)/d(c*c+l*l),f=u*l,p=-u*c,m=e+f,h=t+p,g=n+f,_=r+p,v=(m+g)/2,y=(h+_)/2,b=g-m,x=_-h,S=b*b+x*x,C=i-a,w=m*_-g*h,T=(x<0?-1:1)*d(s(0,C*C*S-w*w)),E=(w*x-b*T)/S,D=(-w*b-x*T)/S,O=(w*x+b*T)/S,k=(-w*b+x*T)/S,A=E-v,j=D-y,M=O-v,N=k-y;return A*A+j*j>M*M+N*N&&(E=O,D=k),{cx:E,cy:D,x01:-f,y01:-p,x11:E*(i/C-1),y11:D*(i/C-1)}}function x(){var s=m,x=h,S=e(0),C=null,w=g,T=_,E=v,D=null,O=t(k);function k(){var e,t,m=+s.apply(this,arguments),h=+x.apply(this,arguments),g=w.apply(this,arguments)-r,_=T.apply(this,arguments)-r,v=l(_-g),k=_>g;if(D||=e=O(),h<m&&(t=h,h=m,m=t),!(h>1e-12))D.moveTo(0,0);else if(v>c-1e-12)D.moveTo(h*u(g),h*a(g)),D.arc(0,0,h,g,_,!k),m>1e-12&&(D.moveTo(m*u(_),m*a(_)),D.arc(0,0,m,_,g,k));else{var A=g,j=_,M=g,N=_,P=v,F=v,I=E.apply(this,arguments)/2,L=I>1e-12&&(C?+C.apply(this,arguments):d(m*m+h*h)),R=p(l(h-m)/2,+S.apply(this,arguments)),z=R,B=R,V,H;if(L>1e-12){var U=o(L/m*a(I)),W=o(L/h*a(I));(P-=U*2)>1e-12?(U*=k?1:-1,M+=U,N-=U):(P=0,M=N=(g+_)/2),(F-=W*2)>1e-12?(W*=k?1:-1,A+=W,j-=W):(F=0,A=j=(g+_)/2)}var G=h*u(A),K=h*a(A),q=m*u(N),J=m*a(N);if(R>1e-12){var Y=h*u(j),X=h*a(j),Z=m*u(M),Q=m*a(M),$;if(v<i)if($=y(G,K,Z,Q,Y,X,q,J)){var ee=G-$[0],te=K-$[1],ne=Y-$[0],re=X-$[1],ie=1/a(f((ee*ne+te*re)/(d(ee*ee+te*te)*d(ne*ne+re*re)))/2),ae=d($[0]*$[0]+$[1]*$[1]);z=p(R,(m-ae)/(ie-1)),B=p(R,(h-ae)/(ie+1))}else z=B=0}F>1e-12?B>1e-12?(V=b(Z,Q,G,K,h,B,k),H=b(Y,X,q,J,h,B,k),D.moveTo(V.cx+V.x01,V.cy+V.y01),B<R?D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,h,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),!k),D.arc(H.cx,H.cy,B,n(H.y11,H.x11),n(H.y01,H.x01),!k))):(D.moveTo(G,K),D.arc(0,0,h,A,j,!k)):D.moveTo(G,K),!(m>1e-12)||!(P>1e-12)?D.lineTo(q,J):z>1e-12?(V=b(q,J,Y,X,m,-z,k),H=b(G,K,Z,Q,m,-z,k),D.lineTo(V.cx+V.x01,V.cy+V.y01),z<R?D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,m,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),k),D.arc(H.cx,H.cy,z,n(H.y11,H.x11),n(H.y01,H.x01),!k))):D.arc(0,0,m,N,M,k)}if(D.closePath(),e)return D=null,e+``||null}return k.centroid=function(){var e=(+s.apply(this,arguments)+ +x.apply(this,arguments))/2,t=(+w.apply(this,arguments)+ +T.apply(this,arguments))/2-i/2;return[u(t)*e,a(t)*e]},k.innerRadius=function(t){return arguments.length?(s=typeof t==`function`?t:e(+t),k):s},k.outerRadius=function(t){return arguments.length?(x=typeof t==`function`?t:e(+t),k):x},k.cornerRadius=function(t){return arguments.length?(S=typeof t==`function`?t:e(+t),k):S},k.padRadius=function(t){return arguments.length?(C=t==null?null:typeof t==`function`?t:e(+t),k):C},k.startAngle=function(t){return arguments.length?(w=typeof t==`function`?t:e(+t),k):w},k.endAngle=function(t){return arguments.length?(T=typeof t==`function`?t:e(+t),k):T},k.padAngle=function(t){return arguments.length?(E=typeof t==`function`?t:e(+t),k):E},k.context=function(e){return arguments.length?(D=e??null,k):D},k}export{x as t};
+import{n as e,t}from"./path-BWPyau1x.js";import{a as n,c as r,d as i,f as a,i as o,l as s,m as c,n as l,o as u,p as d,r as f,u as p}from"./dist-mQWmB3z6.js";function m(e){return e.innerRadius}function h(e){return e.outerRadius}function g(e){return e.startAngle}function _(e){return e.endAngle}function v(e){return e&&e.padAngle}function y(e,t,n,r,i,a,o,s){var c=n-e,l=r-t,u=o-i,d=s-a,f=d*c-u*l;if(!(f*f<1e-12))return f=(u*(t-a)-d*(e-i))/f,[e+f*c,t+f*l]}function b(e,t,n,r,i,a,o){var c=e-n,l=t-r,u=(o?a:-a)/d(c*c+l*l),f=u*l,p=-u*c,m=e+f,h=t+p,g=n+f,_=r+p,v=(m+g)/2,y=(h+_)/2,b=g-m,x=_-h,S=b*b+x*x,C=i-a,w=m*_-g*h,T=(x<0?-1:1)*d(s(0,C*C*S-w*w)),E=(w*x-b*T)/S,D=(-w*b-x*T)/S,O=(w*x+b*T)/S,k=(-w*b+x*T)/S,A=E-v,j=D-y,M=O-v,N=k-y;return A*A+j*j>M*M+N*N&&(E=O,D=k),{cx:E,cy:D,x01:-f,y01:-p,x11:E*(i/C-1),y11:D*(i/C-1)}}function x(){var s=m,x=h,S=e(0),C=null,w=g,T=_,E=v,D=null,O=t(k);function k(){var e,t,m=+s.apply(this,arguments),h=+x.apply(this,arguments),g=w.apply(this,arguments)-r,_=T.apply(this,arguments)-r,v=l(_-g),k=_>g;if(D||=e=O(),h<m&&(t=h,h=m,m=t),!(h>1e-12))D.moveTo(0,0);else if(v>c-1e-12)D.moveTo(h*u(g),h*a(g)),D.arc(0,0,h,g,_,!k),m>1e-12&&(D.moveTo(m*u(_),m*a(_)),D.arc(0,0,m,_,g,k));else{var A=g,j=_,M=g,N=_,P=v,F=v,I=E.apply(this,arguments)/2,L=I>1e-12&&(C?+C.apply(this,arguments):d(m*m+h*h)),R=p(l(h-m)/2,+S.apply(this,arguments)),z=R,B=R,V,H;if(L>1e-12){var U=o(L/m*a(I)),W=o(L/h*a(I));(P-=U*2)>1e-12?(U*=k?1:-1,M+=U,N-=U):(P=0,M=N=(g+_)/2),(F-=W*2)>1e-12?(W*=k?1:-1,A+=W,j-=W):(F=0,A=j=(g+_)/2)}var G=h*u(A),K=h*a(A),q=m*u(N),J=m*a(N);if(R>1e-12){var Y=h*u(j),X=h*a(j),Z=m*u(M),Q=m*a(M),$;if(v<i)if($=y(G,K,Z,Q,Y,X,q,J)){var ee=G-$[0],te=K-$[1],ne=Y-$[0],re=X-$[1],ie=1/a(f((ee*ne+te*re)/(d(ee*ee+te*te)*d(ne*ne+re*re)))/2),ae=d($[0]*$[0]+$[1]*$[1]);z=p(R,(m-ae)/(ie-1)),B=p(R,(h-ae)/(ie+1))}else z=B=0}F>1e-12?B>1e-12?(V=b(Z,Q,G,K,h,B,k),H=b(Y,X,q,J,h,B,k),D.moveTo(V.cx+V.x01,V.cy+V.y01),B<R?D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,h,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),!k),D.arc(H.cx,H.cy,B,n(H.y11,H.x11),n(H.y01,H.x01),!k))):(D.moveTo(G,K),D.arc(0,0,h,A,j,!k)):D.moveTo(G,K),!(m>1e-12)||!(P>1e-12)?D.lineTo(q,J):z>1e-12?(V=b(q,J,Y,X,m,-z,k),H=b(G,K,Z,Q,m,-z,k),D.lineTo(V.cx+V.x01,V.cy+V.y01),z<R?D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,m,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),k),D.arc(H.cx,H.cy,z,n(H.y11,H.x11),n(H.y01,H.x01),!k))):D.arc(0,0,m,N,M,k)}if(D.closePath(),e)return D=null,e+``||null}return k.centroid=function(){var e=(+s.apply(this,arguments)+ +x.apply(this,arguments))/2,t=(+w.apply(this,arguments)+ +T.apply(this,arguments))/2-i/2;return[u(t)*e,a(t)*e]},k.innerRadius=function(t){return arguments.length?(s=typeof t==`function`?t:e(+t),k):s},k.outerRadius=function(t){return arguments.length?(x=typeof t==`function`?t:e(+t),k):x},k.cornerRadius=function(t){return arguments.length?(S=typeof t==`function`?t:e(+t),k):S},k.padRadius=function(t){return arguments.length?(C=t==null?null:typeof t==`function`?t:e(+t),k):C},k.startAngle=function(t){return arguments.length?(w=typeof t==`function`?t:e(+t),k):w},k.endAngle=function(t){return arguments.length?(T=typeof t==`function`?t:e(+t),k):T},k.padAngle=function(t){return arguments.length?(E=typeof t==`function`?t:e(+t),k):E},k.context=function(e){return arguments.length?(D=e??null,k):D},k}export{x as t};

package/workframe-ui/public/assets/architecture-7EHR7CIX-BSUP4S8J.js

@@ -0,0 +1 @@
+import"./chunk-NNHCCRGN-DlpIbxXb.js";import{x as e}from"./mermaid-parser.core-DvrtArpk.js";export{e as createArchitectureServices};