pilotswarm 0.5.37 → 0.5.39

package/web/auth/config.js

@@ -60,6 +60,9 @@ export function inferAuthProviderId(env = process.env) {
     ) {
         return "entra";
     }
+    if (env.PORTAL_AUTH_PROXY_MODE || env.PORTAL_AUTH_PROXY_JWKS_URL) {
+        return "proxy";
+    }
     return "none";
 }
 

package/web/auth/index.js

@@ -1,6 +1,7 @@
 import { createNoAuthProvider } from "./providers/none.js";
 import { createEntraAuthProvider } from "./providers/entra.js";
 import { createDevAuthProvider } from "./providers/dev.js";
+import { createProxyAuthProvider } from "./providers/proxy.js";
 import { authorizePrincipal } from "./authz/engine.js";
 import { loadAuthorizationPolicy, resolveAuthProviderId, resolvePluginAuthConfigFromPluginDirs } from "./config.js";
 
@@ -11,6 +12,9 @@ const PROVIDERS = {
     // PORTAL_AUTH_PROVIDER=dev selects it, and its factory throws without
     // PORTAL_AUTH_DEV_ALLOW=true (see providers/dev.js).
     dev: createDevAuthProvider,
+    // Identity established by an identity-aware proxy in front of the portal.
+    // Has no browser half: the proxy signs the user in before the SPA loads.
+    proxy: createProxyAuthProvider,
 };
 
 const NO_AUTH_UNKNOWN_PRINCIPAL = Object.freeze({
@@ -91,7 +95,10 @@ export async function authenticateToken(token, req) {
     const policy = getAuthorizationPolicy();
 
     if (provider.enabled) {
-        if (!token) {
+        // A provider may establish identity from the request itself rather
+        // than from a bearer token — a proxy in front of the portal puts it in
+        // a header, and there is no token for the browser to send.
+        if (!token && !provider.authenticatesFromRequest) {
             return buildDeniedResult({
                 status: 401,
                 error: "Unauthorized",

package/web/auth/normalize/proxy.js

@@ -0,0 +1,48 @@
+function toStringArray(value) {
+    if (Array.isArray(value)) return value.map((entry) => String(entry).trim()).filter(Boolean);
+    if (typeof value === "string") {
+        return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+    }
+    return [];
+}
+
+function first(...values) {
+    for (const value of values) {
+        if (typeof value === "string" && value.trim()) return value.trim();
+    }
+    return null;
+}
+
+/**
+ * Normalize a principal from whatever an identity-aware proxy put in front of
+ * us — either the claims of a signed assertion it minted, or plain headers.
+ *
+ * Claim and header names differ per proxy (Cloudflare Access, Google IAP, AWS
+ * ALB, Pomerium, oauth2-proxy, Authelia, Authentik), so every source is
+ * configurable and the defaults simply match the most common spelling.
+ */
+export function normalizeProxyPrincipal(claims = {}, opts = {}) {
+    const subjectClaim = opts.subjectClaim || "sub";
+    const emailClaim = opts.emailClaim || "email";
+    const nameClaim = opts.nameClaim || "name";
+    const rolesClaim = opts.rolesClaim || "roles";
+    const groupsClaim = opts.groupsClaim || "groups";
+
+    const email = first(claims[emailClaim], claims.email, claims.preferred_username, claims.upn);
+    // Fall back to the email when the proxy supplies no stable subject: an
+    // identity with no key at all cannot own sessions, and every downstream
+    // table is keyed on (provider, subject).
+    const subject = first(claims[subjectClaim], claims.sub, email);
+    if (!subject) return null;
+
+    return {
+        provider: "proxy",
+        subject,
+        email,
+        displayName: first(claims[nameClaim], claims.name),
+        groups: toStringArray(claims[groupsClaim]),
+        roles: toStringArray(claims[rolesClaim]),
+        tenantId: null,
+        rawClaims: claims,
+    };
+}

package/web/auth/providers/proxy.js

@@ -0,0 +1,141 @@
+import * as jose from "jose";
+import { normalizeProxyPrincipal } from "../normalize/proxy.js";
+
+const JWKS_CACHE = new Map();
+
+/**
+ * Identity established by a proxy in front of the portal.
+ *
+ * Covers Cloudflare Access, Google IAP, AWS ALB, Pomerium, oauth2-proxy,
+ * Authelia and Authentik. They differ in only two ways — which header carries
+ * the identity, and whether it is signed — so both are configuration rather
+ * than separate providers.
+ *
+ * There is no browser half. The proxy completes the sign-in before the SPA
+ * loads, so the browser makes ordinary same-origin requests and PilotSwarm
+ * reads the identity off each one. That is the whole reason this provider is
+ * ~a tenth the size of an OIDC one: no PKCE, no token cache, no refresh.
+ *
+ * Two modes, with very different threat models:
+ *
+ *   jwt     (default) The proxy mints a signed assertion, verified here
+ *           against its JWKS with issuer and audience checks. Safe no matter
+ *           how the request arrived.
+ *
+ *   header  Plain, unsigned headers. ONLY safe when the portal is
+ *           unreachable except through the proxy — otherwise anyone who can
+ *           hit the origin sets the email header and becomes whoever they
+ *           like. Opt-in via PORTAL_AUTH_PROXY_TRUST_HEADERS=true, and
+ *           refuses to start without it.
+ */
+function getProxyConfig(env = process.env, pluginAuthConfig = {}) {
+    const mode = (env.PORTAL_AUTH_PROXY_MODE || "jwt").trim().toLowerCase();
+    const displayName = String(
+        pluginAuthConfig?.providers?.proxy?.displayName || pluginAuthConfig?.displayName || "Proxy",
+    ).trim() || "Proxy";
+
+    const shared = {
+        mode,
+        displayName,
+        subjectClaim: env.PORTAL_AUTH_PROXY_SUBJECT_CLAIM,
+        emailClaim: env.PORTAL_AUTH_PROXY_EMAIL_CLAIM,
+        nameClaim: env.PORTAL_AUTH_PROXY_NAME_CLAIM,
+        rolesClaim: env.PORTAL_AUTH_PROXY_ROLES_CLAIM,
+        groupsClaim: env.PORTAL_AUTH_PROXY_GROUPS_CLAIM,
+    };
+
+    if (mode === "header") {
+        const trusted = /^(1|true|yes|on)$/i.test(String(env.PORTAL_AUTH_PROXY_TRUST_HEADERS || "").trim());
+        if (!trusted) {
+            throw new Error(
+                "PORTAL_AUTH_PROXY_MODE=header forwards identity in UNSIGNED headers, which anyone who can reach "
+                + "the origin directly can forge. Set PORTAL_AUTH_PROXY_TRUST_HEADERS=true to confirm the portal is "
+                + "reachable only through the proxy, or use the default signed-assertion mode.",
+            );
+        }
+        return {
+            ...shared,
+            subjectHeader: (env.PORTAL_AUTH_PROXY_SUBJECT_HEADER || "x-forwarded-user").toLowerCase(),
+            emailHeader: (env.PORTAL_AUTH_PROXY_EMAIL_HEADER || "x-forwarded-email").toLowerCase(),
+            nameHeader: (env.PORTAL_AUTH_PROXY_NAME_HEADER || "x-forwarded-preferred-username").toLowerCase(),
+            groupsHeader: (env.PORTAL_AUTH_PROXY_GROUPS_HEADER || "x-forwarded-groups").toLowerCase(),
+        };
+    }
+
+    // Default Cloudflare Access, the most common deployment.
+    const jwtHeader = (env.PORTAL_AUTH_PROXY_JWT_HEADER || "cf-access-jwt-assertion").toLowerCase();
+    const jwksUrl = (env.PORTAL_AUTH_PROXY_JWKS_URL || "").trim();
+    const issuer = (env.PORTAL_AUTH_PROXY_ISSUER || "").trim();
+    const audience = (env.PORTAL_AUTH_PROXY_AUDIENCE || "").trim();
+    if (!jwksUrl || !issuer || !audience) return null;
+    return { ...shared, jwtHeader, jwksUrl, issuer, audience };
+}
+
+function ensureJwks(jwksUrl) {
+    const cached = JWKS_CACHE.get(jwksUrl);
+    if (cached) return cached;
+    const jwks = jose.createRemoteJWKSet(new URL(jwksUrl));
+    JWKS_CACHE.set(jwksUrl, jwks);
+    return jwks;
+}
+
+function headerValue(req, name) {
+    const raw = req?.headers?.[name];
+    if (Array.isArray(raw)) return raw[0];
+    return typeof raw === "string" ? raw : undefined;
+}
+
+export function createProxyAuthProvider({ pluginAuthConfig, env = process.env } = {}) {
+    const config = getProxyConfig(env, pluginAuthConfig);
+
+    return {
+        id: "proxy",
+        enabled: Boolean(config),
+        displayName: config?.displayName || "Proxy",
+
+        // The identity rides on the request, not on a bearer token, so the
+        // pipeline must not reject the call for having no token.
+        authenticatesFromRequest: true,
+
+        async authenticateRequest(_token, req) {
+            if (!config || !req) return null;
+
+            if (config.mode === "header") {
+                const subject = headerValue(req, config.subjectHeader);
+                const email = headerValue(req, config.emailHeader);
+                if (!subject && !email) return null;
+                return normalizeProxyPrincipal({
+                    sub: subject,
+                    email,
+                    name: headerValue(req, config.nameHeader),
+                    groups: headerValue(req, config.groupsHeader),
+                }, config);
+            }
+
+            const assertion = headerValue(req, config.jwtHeader);
+            if (!assertion) return null;
+            try {
+                const { payload } = await jose.jwtVerify(assertion, ensureJwks(config.jwksUrl), {
+                    issuer: config.issuer,
+                    audience: config.audience,
+                });
+                return normalizeProxyPrincipal(payload, config);
+            } catch (error) {
+                console.error("[portal-auth:proxy] assertion validation failed:", error?.message || String(error));
+                return null;
+            }
+        },
+
+        async getPublicConfig() {
+            // No client-side configuration exists to hand out: the browser
+            // never talks to an identity provider, so `client` stays null and
+            // the SPA simply makes ordinary requests.
+            return {
+                enabled: Boolean(config),
+                provider: "proxy",
+                displayName: config?.displayName || "Proxy",
+                client: null,
+            };
+        },
+    };
+}

package/web/dist/assets/{abnfDiagram-VRR7QNED-DlvPH-8O.js → abnfDiagram-VRR7QNED-Hsly1fgf.js}

@@ -1 +1 @@
-import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-DqNFBrfw.js";import{p as f}from"./chunk-JWPE2WC7-Dk_dBFKd.js";import{_ as n,l as o}from"./mermaid.core-C_neEtab.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-DRnAsyZU.js";import"./pilotswarm-BNKGG936.js";var v=d().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},B={parser:R,db:a,renderer:u,styles:p};export{B as diagram};
+import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-BN5MKe94.js";import{p as f}from"./chunk-JWPE2WC7-BccmZmrr.js";import{_ as n,l as o}from"./mermaid.core-bonzwapf.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-Z8eMzFMv.js";import"./pilotswarm-BT6tOknQ.js";var v=d().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},B={parser:R,db:a,renderer:u,styles:p};export{B as diagram};

package/web/dist/assets/{arc-r1liz5e5.js → arc-DiQLL9vM.js}

@@ -1 +1 @@
-import{Y as ln,$ as an,a0 as F,a1 as q,a2 as j,a3 as un,a4 as y,a5 as tn,a6 as J,a7 as _,a8 as rn,a9 as o,aa as on,ab as sn,ac as fn}from"./mermaid.core-C_neEtab.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(on(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-un,c=A.apply(this,arguments)-un,B=rn(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(rn(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<an)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(fn((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-an/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};
+import{Y as ln,$ as an,a0 as F,a1 as q,a2 as j,a3 as un,a4 as y,a5 as tn,a6 as J,a7 as _,a8 as rn,a9 as o,aa as on,ab as sn,ac as fn}from"./mermaid.core-bonzwapf.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(on(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-un,c=A.apply(this,arguments)-un,B=rn(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(rn(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<an)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(fn((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-an/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};