pilotswarm 0.5.39 → 0.5.41

package/web/api/canvas-plane.js

@@ -0,0 +1,116 @@
+import pg from "pg";
+
+/**
+ * The canvas-plane relay: one LISTEN connection to the CMS primary, fanned
+ * out to WebSocket subscribers by session id.
+ *
+ * Deliberately a PURE fan-out. The NOTIFY payload already carries everything
+ * a viewer needs ({slot, seq, kind} and, for small patches, the patch
+ * itself); when it does not (big patch, PUT, doc), the ping is a pointer and
+ * the BROWSER fetches the snapshot through the authorized REST path
+ * (getCanvasLive). No queries here, no state worth losing, so any number of
+ * relay processes scale with zero coordination — NOTIFY broadcasts to all.
+ *
+ * Connection discipline (the dispatcher-freeze lesson): TCP keepalive on the
+ * client, a 30 s liveness probe, and reconnect-with-backoff. Subscriptions
+ * live in process memory, so a reconnect needs no re-reads — browsers detect
+ * any missed seq and resync themselves.
+ */
+export function createCanvasPlane({
+    connectionString = process.env.DATABASE_URL,
+    schema = process.env.PILOTSWARM_CMS_SCHEMA || "copilot_sessions",
+    channel = "pilotswarm_canvas_live",
+} = {}) {
+    const subscribers = new Map(); // sessionId -> Set<cb>
+    let client = null;
+    let stopped = false;
+    let probeTimer = null;
+    let reconnectDelay = 1_000;
+
+    const available = Boolean(connectionString);
+
+    async function connect() {
+        if (stopped || !available) return;
+        const next = new pg.Client({ connectionString, keepAlive: true });
+        try {
+            await next.connect();
+            await next.query(`LISTEN ${channel}`);
+        } catch {
+            try { await next.end(); } catch { /* already dead */ }
+            scheduleReconnect();
+            return;
+        }
+        client = next;
+        reconnectDelay = 1_000;
+        next.on("notification", (msg) => {
+            let payload;
+            try {
+                payload = JSON.parse(msg.payload || "");
+            } catch {
+                return;
+            }
+            // Multi-schema deployments (and test suites) share the channel;
+            // the payload names its schema so we never cross streams.
+            if (payload?.schema && payload.schema !== schema) return;
+            const handlers = subscribers.get(payload?.sessionId);
+            if (!handlers) return;
+            const update = {
+                slot: Number(payload.slot),
+                seq: Number(payload.seq),
+                kind: payload.kind === "doc" ? "doc" : "data",
+                ...(payload.patch && typeof payload.patch === "object" ? { patch: payload.patch } : {}),
+            };
+            for (const cb of handlers) {
+                try { cb(update); } catch { /* one bad socket must not stop the fan-out */ }
+            }
+        });
+        const onGone = () => {
+            if (client === next) client = null;
+            scheduleReconnect();
+        };
+        next.on("error", onGone);
+        next.on("end", onGone);
+    }
+
+    function scheduleReconnect() {
+        if (stopped) return;
+        const delay = reconnectDelay;
+        reconnectDelay = Math.min(reconnectDelay * 2, 15_000);
+        setTimeout(() => { void connect(); }, delay);
+    }
+
+    return {
+        available,
+        async start() {
+            if (!available) return;
+            await connect();
+            // Liveness probe: a LISTEN connection can die silently behind
+            // NAT/pools. A failed probe triggers the error path → reconnect.
+            probeTimer = setInterval(() => {
+                if (client) client.query("SELECT 1").catch(() => { /* error handler reconnects */ });
+            }, 30_000);
+            if (probeTimer.unref) probeTimer.unref();
+        },
+        subscribe(sessionId, cb) {
+            const key = String(sessionId || "").trim();
+            if (!key) return () => {};
+            if (!subscribers.has(key)) subscribers.set(key, new Set());
+            subscribers.get(key).add(cb);
+            return () => {
+                const handlers = subscribers.get(key);
+                if (!handlers) return;
+                handlers.delete(cb);
+                if (handlers.size === 0) subscribers.delete(key);
+            };
+        },
+        async stop() {
+            stopped = true;
+            if (probeTimer) clearInterval(probeTimer);
+            subscribers.clear();
+            if (client) {
+                try { await client.end(); } catch { /* going down anyway */ }
+                client = null;
+            }
+        },
+    };
+}

package/web/api/ws.js

@@ -21,10 +21,48 @@ function isSafeThemeId(value) {
 
 export function createConnectionHandler(runtime, { allowThemeMessages = false } = {}) {
     return async function handleConnection(ws, req) {
-        const auth = await authenticateToken(extractToken(req), req);
-        if (!auth.ok) {
-            ws.close(auth.status === 403 ? 4403 : 4401, auth.error || (auth.status === 403 ? "Forbidden" : "Unauthorized"));
-            return;
+        // Canvas share tokens FIRST: presenting `?canvasShare=<token>` makes
+        // this a token-bearer connection, full stop — it never falls back to
+        // portal auth (on no-auth deployments anonymous auth SUCCEEDS, and a
+        // fallback would silently upgrade a link bearer to a full-auth
+        // connection — or, just as bad, break the share protocol by routing
+        // it through the authed branch). A token connection may do exactly
+        // one thing: subscribe to its canvas's plane pings, slot-filtered.
+        // An invalid token closes 4401, indistinguishable from missing auth.
+        const shareToken = new URL(req.url || "/", "http://localhost").searchParams.get("canvasShare");
+        let shareScope = null;
+        let shareRevalidateTimer = null;
+        let auth = null;
+        if (shareToken) {
+            if (typeof runtime.resolveCanvasShareToken === "function") {
+                shareScope = await runtime.resolveCanvasShareToken(shareToken).catch(() => null);
+            }
+            if (!shareScope) {
+                ws.close(4401, "Unauthorized");
+                return;
+            }
+            // Revocation has a bounded latency for OPEN sockets: the owner's
+            // reset/remove replaces the hash row, and this re-validation
+            // notices within the interval and closes the connection. Without
+            // it, an already-connected bearer would keep receiving pings for
+            // the connection's whole lifetime after the link died.
+            const revalidateMs = Math.max(1, Number(process.env.PILOTSWARM_SHARE_REVALIDATE_MS) || 60_000);
+            shareRevalidateTimer = setInterval(() => {
+                runtime.resolveCanvasShareToken(shareToken)
+                    .then((scope) => {
+                        if (!scope || scope.sessionId !== shareScope.sessionId || scope.slot !== shareScope.slot) {
+                            ws.close(4403, "Link no longer valid");
+                        }
+                    })
+                    .catch(() => { /* transient — next tick retries */ });
+            }, revalidateMs);
+            if (shareRevalidateTimer.unref) shareRevalidateTimer.unref();
+        } else {
+            auth = await authenticateToken(extractToken(req), req);
+            if (!auth.ok) {
+                ws.close(auth.status === 403 ? 4403 : 4401, auth.error || (auth.status === 403 ? "Forbidden" : "Unauthorized"));
+                return;
+            }
         }
         // Same sign-in role capture as the HTTP `requireAuth` path. This is
         // the OTHER authenticated entry point, and it must not be forgotten:
@@ -32,9 +70,10 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
         // otherwise never re-confirm its role, and the worker — which expires
         // stale observations — would quietly drop that user's agent sessions
         // to non-admin while the portal still showed them as admin.
-        runtime.noteSignInRole?.(auth);
+        if (!shareScope && auth) runtime.noteSignInRole?.(auth);
 
         const sessionSubscriptions = new Map();
+        const canvasSubscriptions = new Map();
         let logUnsubscribe = null;
 
         const send = (message) => {
@@ -54,6 +93,39 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
             }
 
             const type = String(message?.type || "");
+            if (shareScope) {
+                // The whole share-scope protocol: subscribe to THE canvas the
+                // token names. No session events, no logs, no other sessions.
+                if (type === "subscribeCanvas") {
+                    // The bearer does not know (and is never told) the
+                    // session id — the token IS the address. An absent or
+                    // matching id subscribes the token's canvas; anything
+                    // else is refused.
+                    const requested = String(message?.sessionId || "").trim();
+                    const sessionId = requested || shareScope.sessionId;
+                    if (sessionId !== shareScope.sessionId || canvasSubscriptions.has(sessionId)) return;
+                    const plane = runtime.canvasPlane;
+                    if (!plane?.available) {
+                        send({ type: "error", scope: "canvas", sessionId, error: "canvas plane unavailable" });
+                        return;
+                    }
+                    const unsubscribe = plane.subscribe(sessionId, (update) => {
+                        if (Number(update?.slot) !== shareScope.slot) return;
+                        send({ type: "canvasLive", sessionId, ...update });
+                    });
+                    canvasSubscriptions.set(sessionId, unsubscribe);
+                    send({ type: "subscribedCanvas", sessionId });
+                } else if (type === "unsubscribeCanvas") {
+                    const unsubscribe = canvasSubscriptions.get(shareScope.sessionId);
+                    if (unsubscribe) {
+                        unsubscribe();
+                        canvasSubscriptions.delete(shareScope.sessionId);
+                    }
+                } else {
+                    send({ type: "error", scope: "share", error: "share connections may only subscribe to their canvas" });
+                }
+                return;
+            }
             if (type === "subscribeSession") {
                 const sessionId = String(message?.sessionId || "").trim();
                 if (!sessionId || sessionSubscriptions.has(sessionId)) return;
@@ -85,6 +157,42 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
                 return;
             }
 
+            if (type === "subscribeCanvas") {
+                const sessionId = String(message?.sessionId || "").trim();
+                if (!sessionId || canvasSubscriptions.has(sessionId)) return;
+                const plane = runtime.canvasPlane;
+                if (!plane?.available) {
+                    send({ type: "error", scope: "canvas", sessionId, error: "canvas plane unavailable" });
+                    return;
+                }
+                try {
+                    await runtime.start();
+                    // A canvas subscription is a session content read — the
+                    // exact predicate live events use.
+                    if (typeof runtime.authorizeSessionSubscribe === "function") {
+                        await runtime.authorizeSessionSubscribe(sessionId, auth);
+                    }
+                    const unsubscribe = plane.subscribe(sessionId, (update) => {
+                        send({ type: "canvasLive", sessionId, ...update });
+                    });
+                    canvasSubscriptions.set(sessionId, unsubscribe);
+                    send({ type: "subscribedCanvas", sessionId });
+                } catch (error) {
+                    send({ type: "error", scope: "canvas", sessionId, error: error?.message || String(error) });
+                }
+                return;
+            }
+
+            if (type === "unsubscribeCanvas") {
+                const sessionId = String(message?.sessionId || "").trim();
+                const unsubscribe = canvasSubscriptions.get(sessionId);
+                if (unsubscribe) {
+                    unsubscribe();
+                    canvasSubscriptions.delete(sessionId);
+                }
+                return;
+            }
+
             if (type === "subscribeLogs") {
                 if (logUnsubscribe) return;
                 try {
@@ -117,12 +225,19 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
         });
 
         ws.on("close", () => {
+            if (shareRevalidateTimer) clearInterval(shareRevalidateTimer);
             for (const unsubscribe of sessionSubscriptions.values()) {
                 try {
                     unsubscribe();
                 } catch {}
             }
             sessionSubscriptions.clear();
+            for (const unsubscribe of canvasSubscriptions.values()) {
+                try {
+                    unsubscribe();
+                } catch {}
+            }
+            canvasSubscriptions.clear();
             if (logUnsubscribe) {
                 try {
                     logUnsubscribe();

package/web/config.js

@@ -18,3 +18,63 @@ export function getPortalAssetFile(assetName) {
     if (!key) return null;
     return getPortalBundle().assetFiles?.[key] || null;
 }
+
+/**
+ * PORTAL_LINK_ORIGINS: named entry points for link generation.
+ *
+ * Format: comma-separated `Label=Origin` pairs, e.g.
+ *   PORTAL_LINK_ORIGINS="Corporate=https://corp.example.com,Private/VPN=https://vpn.example.com"
+ *
+ * When two or more are configured, every link-producing surface (session
+ * copy-link, artifact links, the canvas share dialog) offers one labeled
+ * variant per origin — a sender on one network path can hand a recipient
+ * on another a link that actually works. This is the platform version of
+ * waldemort's dual-session-links deploy patch; deployments plug in with
+ * this one env var and delete the patch.
+ *
+ * Validation is FAIL-LOUD at startup: a malformed value should stop the
+ * portal visibly, not silently produce broken links. Rules: 2..6 entries
+ * to activate (0 or absent = feature off; exactly 1 is refused as almost
+ * certainly a mistake), labels nonempty/unique/<=40 chars, origins bare
+ * (no path/query/hash), https required except localhost, all distinct.
+ */
+export function parsePortalLinkOrigins(raw = process.env.PORTAL_LINK_ORIGINS) {
+    const value = String(raw || "").trim();
+    if (!value) return [];
+    const entries = value.split(",").map((part) => part.trim()).filter(Boolean);
+    if (entries.length === 1) {
+        throw new Error("PORTAL_LINK_ORIGINS with a single entry is refused — one origin means the feature is off; unset the variable or configure at least two.");
+    }
+    if (entries.length > 6) {
+        throw new Error("PORTAL_LINK_ORIGINS supports at most 6 entries.");
+    }
+    const seenLabels = new Set();
+    const seenOrigins = new Set();
+    return entries.map((entry) => {
+        const eq = entry.indexOf("=");
+        if (eq <= 0) throw new Error(`PORTAL_LINK_ORIGINS entry "${entry}" must be Label=Origin.`);
+        const label = entry.slice(0, eq).trim();
+        const originRaw = entry.slice(eq + 1).trim();
+        if (!label || label.length > 40) throw new Error(`PORTAL_LINK_ORIGINS label "${label}" must be 1-40 characters.`);
+        let url;
+        try {
+            url = new URL(originRaw);
+        } catch {
+            throw new Error(`PORTAL_LINK_ORIGINS origin "${originRaw}" is not a valid URL.`);
+        }
+        const isLocal = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+        if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocal)) {
+            throw new Error(`PORTAL_LINK_ORIGINS origin "${originRaw}" must be https (http only for localhost).`);
+        }
+        if (url.pathname !== "/" || url.search || url.hash || url.username || url.password) {
+            throw new Error(`PORTAL_LINK_ORIGINS origin "${originRaw}" must be a bare origin — no path, query, hash, or credentials.`);
+        }
+        const origin = url.origin;
+        const labelKey = label.toLowerCase();
+        if (seenLabels.has(labelKey)) throw new Error(`PORTAL_LINK_ORIGINS label "${label}" is duplicated.`);
+        if (seenOrigins.has(origin)) throw new Error(`PORTAL_LINK_ORIGINS origin "${origin}" is duplicated.`);
+        seenLabels.add(labelKey);
+        seenOrigins.add(origin);
+        return { label, origin };
+    });
+}

package/web/dist/assets/{abnfDiagram-VRR7QNED-Hsly1fgf.js → abnfDiagram-VRR7QNED-kpxu_PEa.js}

@@ -1 +1 @@
-import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-BN5MKe94.js";import{p as f}from"./chunk-JWPE2WC7-BccmZmrr.js";import{_ as n,l as o}from"./mermaid.core-bonzwapf.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-Z8eMzFMv.js";import"./pilotswarm-BT6tOknQ.js";var v=d().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},B={parser:R,db:a,renderer:u,styles:p};export{B as diagram};
+import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-5Dm2u-0k.js";import{p as f}from"./chunk-JWPE2WC7-BPIstyWL.js";import{_ as n,l as o}from"./mermaid.core-CPN1IVjz.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-CbeHaUWZ.js";import"./pilotswarm-CF1nmpMy.js";var v=d().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},B={parser:R,db:a,renderer:u,styles:p};export{B as diagram};

package/web/dist/assets/{arc-DiQLL9vM.js → arc-BnVQmtB5.js}

@@ -1 +1 @@
-import{Y as ln,$ as an,a0 as F,a1 as q,a2 as j,a3 as un,a4 as y,a5 as tn,a6 as J,a7 as _,a8 as rn,a9 as o,aa as on,ab as sn,ac as fn}from"./mermaid.core-bonzwapf.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(on(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-un,c=A.apply(this,arguments)-un,B=rn(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(rn(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<an)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(fn((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-an/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};
+import{Y as ln,$ as an,a0 as F,a1 as q,a2 as j,a3 as un,a4 as y,a5 as tn,a6 as J,a7 as _,a8 as rn,a9 as o,aa as on,ab as sn,ac as fn}from"./mermaid.core-CPN1IVjz.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(on(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-un,c=A.apply(this,arguments)-un,B=rn(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(rn(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<an)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(fn((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-an/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};