pilotswarm 0.5.57 → 0.5.59

package/web/api/live-plane.js

@@ -0,0 +1,193 @@
+import pg from "pg";
+
+/**
+ * Generic live-plane relay: one LISTEN connection per portal process, fanned
+ * out by (sessionId, topic). Large notifications are pointers; getLive reads
+ * the retained row before delivery.
+ */
+export function createLivePlane({
+    connectionString = process.env.DATABASE_URL,
+    schema = process.env.PILOTSWARM_CMS_SCHEMA || "copilot_sessions",
+    channel = "pilotswarm_live",
+    getLive = null,
+    createClient = (options) => new pg.Client(options),
+} = {}) {
+    if (!/^[a-z_][a-z0-9_]{0,62}$/i.test(channel)) {
+        throw new Error("Invalid live-plane channel");
+    }
+    const subscribers = new Map();
+    let client = null;
+    let started = false;
+    let stopped = false;
+    let probeTimer = null;
+    let reconnectTimer = null;
+    let reconnectDelay = 1_000;
+    let connecting = false;
+    let epoch = 0;
+    const deliveredSeq = new Map();
+    const pointerReads = new Map();
+    const available = Boolean(connectionString);
+
+    const keyFor = (sessionId, topic) => `${sessionId}\u0000${topic}`;
+
+    async function deliver(payload) {
+        if (!payload?.sessionId || !payload?.topic) return;
+        if (payload.schema !== schema || stopped) return;
+        const key = keyFor(payload.sessionId, payload.topic);
+        const handlers = subscribers.get(key);
+        if (!handlers || handlers.size === 0) return;
+
+        let update = {
+            sessionId: String(payload.sessionId),
+            topic: String(payload.topic),
+            seq: payload.seq == null ? null : Number(payload.seq),
+            kind: payload.kind === "signal" ? "signal" : payload.kind === "patch" ? "patch" : "snapshot",
+            ...(payload.data && typeof payload.data === "object" ? { data: payload.data } : {}),
+            ...(payload.updatedAt ? { updatedAt: payload.updatedAt } : {}),
+        };
+        if (update.kind !== "signal" && update.data === undefined) {
+            if (typeof getLive !== "function") return;
+            if (pointerReads.has(key)) {
+                pointerReads.get(key).latest = payload;
+                return;
+            }
+            const read = { latest: payload };
+            pointerReads.set(key, read);
+            const readEpoch = epoch;
+            try {
+                let requested;
+                do {
+                    requested = read.latest;
+                    const rows = await getLive(update.sessionId, [update.topic]);
+                    if (stopped || epoch !== readEpoch || subscribers.get(key) !== handlers) return;
+                    const row = (rows || []).find((candidate) => candidate?.topic === update.topic);
+                    if (row) await deliver({ ...payload, seq: Number(row.seq), kind: "snapshot", data: row.payload || {}, updatedAt: row.updatedAt });
+                } while (requested !== read.latest);
+            } catch {
+                // Ephemeral reads are best effort; durable replay is unchanged.
+            } finally {
+                if (pointerReads.get(key) === read) pointerReads.delete(key);
+            }
+            return;
+        }
+        if (update.kind !== "signal") {
+            if (!Number.isSafeInteger(update.seq) || update.seq <= (deliveredSeq.get(key) || 0)) return;
+            deliveredSeq.set(key, update.seq);
+        }
+        for (const callback of [...handlers]) {
+            try { callback(update); } catch { /* isolate sockets */ }
+        }
+    }
+
+    async function connect() {
+        if (stopped || !available || client || connecting) return;
+        connecting = true;
+        reconnectTimer = null;
+        const next = createClient({ connectionString, keepAlive: true, connectionTimeoutMillis: 5_000, query_timeout: 5_000 });
+        // Error listeners must exist while connect/LISTEN are still pending.
+        const onGone = () => {
+            if (client === next) {
+                client = null;
+                void next.end().catch(() => {});
+            }
+            scheduleReconnect();
+        };
+        next.on("error", onGone);
+        next.on("end", onGone);
+        try {
+            await next.connect();
+            await next.query(`LISTEN ${channel}`);
+            if (stopped) {
+                await next.end();
+                return;
+            }
+        } catch {
+            try { await next.end(); } catch {}
+            scheduleReconnect();
+            return;
+        } finally {
+            connecting = false;
+        }
+        client = next;
+        const isReconnect = epoch++ > 0;
+        deliveredSeq.clear();
+        pointerReads.clear();
+        reconnectDelay = 1_000;
+        next.on("notification", (message) => {
+            let payload;
+            try { payload = JSON.parse(message.payload || ""); } catch { return; }
+            void deliver(payload);
+        });
+        if (isReconnect) {
+            for (const [key, handlers] of subscribers) {
+                const [sessionId, topic] = key.split("\u0000");
+                // Release stale previews even when an UNLOGGED table was
+                // emptied by restart, then refresh events missed by LISTEN.
+                for (const callback of handlers) {
+                    try { callback({ sessionId, topic, kind: "unavailable" }); } catch {}
+                }
+                void deliver({ schema, sessionId, topic, kind: "snapshot" });
+            }
+        }
+    }
+
+    function scheduleReconnect() {
+        if (stopped || reconnectTimer) return;
+        const delay = reconnectDelay;
+        reconnectDelay = Math.min(reconnectDelay * 2, 15_000);
+        reconnectTimer = setTimeout(() => { void connect(); }, delay);
+        reconnectTimer.unref?.();
+    }
+
+    return {
+        available,
+        async start() {
+            if (!available || stopped || started) return;
+            started = true;
+            await connect();
+            probeTimer = setInterval(() => {
+                const current = client;
+                if (current) current.query("SELECT 1").catch(() => {
+                    if (client !== current) return;
+                    client = null;
+                    void current.end().catch(() => {});
+                    scheduleReconnect();
+                });
+            }, 30_000);
+            probeTimer.unref?.();
+        },
+        subscribe(sessionId, topics, callback) {
+            const cleanSessionId = String(sessionId || "").trim();
+            const cleanTopics = [...new Set((topics || []).map((topic) => String(topic || "").trim()))];
+            if (!cleanSessionId || cleanTopics.length === 0) return () => {};
+            for (const topic of cleanTopics) {
+                const key = keyFor(cleanSessionId, topic);
+                if (!subscribers.has(key)) subscribers.set(key, new Set());
+                subscribers.get(key).add(callback);
+            }
+            return () => {
+                for (const topic of cleanTopics) {
+                    const key = keyFor(cleanSessionId, topic);
+                    const handlers = subscribers.get(key);
+                    if (!handlers) continue;
+                    handlers.delete(callback);
+                    if (handlers.size === 0) {
+                        subscribers.delete(key);
+                        deliveredSeq.delete(key);
+                        pointerReads.delete(key);
+                    }
+                }
+            };
+        },
+        async stop() {
+            stopped = true;
+            if (probeTimer) clearInterval(probeTimer);
+            if (reconnectTimer) clearTimeout(reconnectTimer);
+            subscribers.clear();
+            if (client) {
+                try { await client.end(); } catch {}
+                client = null;
+            }
+        },
+    };
+}

package/web/api/router.js

@@ -136,7 +136,7 @@ export function createApiRouter({ runtime, requireAuth }) {
 
     // ── Public routes ───────────────────────────────────────────────────
     router.get("/health", (_req, res) => {
-        res.json({ ok: true, started: runtime.started, mode: runtime.mode, apiVersion: API_VERSION });
+        res.json({ ok: true, started: runtime.started, mode: runtime.mode, apiVersion: API_VERSION, authz: runtime.getAuthorizationPolicy?.() });
     });
 
     router.get("/auth/config", async (req, res) => {

package/web/api/ws.js

@@ -7,8 +7,11 @@ import { authenticateToken, extractToken } from "../auth.js";
  * One connection handler serves both `/api/v1/ws` (the product API) and the
  * legacy `/portal-ws` (which additionally answers the portal-only `theme`
  * message). Vocabulary:
- *   client -> server: subscribeSession | unsubscribeSession | subscribeLogs | unsubscribeLogs
- *   server -> client: ready | subscribedSession | sessionEvent | subscribedLogs | logEntry | error
+ *   client -> server: subscribeSession | unsubscribeSession |
+ *                     subscribeLive | unsubscribeLive |
+ *                     subscribeLogs | unsubscribeLogs
+ *   server -> client: ready | subscribedSession | sessionEvent |
+ *                     subscribedLive | live | subscribedLogs | logEntry | error
  *
  * Delivery here is an acceleration path — correctness comes from event
  * replay via GET /api/v1/management/sessions/:id/events?afterSeq=… after a
@@ -83,13 +86,48 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
 
         const sessionSubscriptions = new Map();
         const canvasSubscriptions = new Map();
+        const liveSubscriptions = new Map();
+        const liveSubscriptionGeneration = new Map();
         let logUnsubscribe = null;
+        let accessCheckPending = false;
+        // An open socket must not preserve a revoked grant indefinitely.
+        // One bounded check per subscribed session per interval, not per delta;
+        // session/live/canvas subscriptions share the same check.
+        const accessRevalidateTimer = !shareScope && runtime.authz?.enforce
+            ? setInterval(async () => {
+                if (accessCheckPending || ws.readyState !== ws.OPEN) return;
+                accessCheckPending = true;
+                try {
+                    const ids = new Set([...sessionSubscriptions.keys(), ...canvasSubscriptions.keys(), ...liveSubscriptions.keys()]);
+                    for (const sessionId of ids) {
+                        try {
+                            await runtime.authorizeSessionSubscribe(sessionId, auth);
+                        } catch {
+                            sessionSubscriptions.get(sessionId)?.();
+                            sessionSubscriptions.delete(sessionId);
+                            canvasSubscriptions.get(sessionId)?.();
+                            canvasSubscriptions.delete(sessionId);
+                            liveSubscriptions.get(sessionId)?.unsubscribe();
+                            liveSubscriptions.delete(sessionId);
+                            liveSubscriptionGeneration.set(sessionId, (liveSubscriptionGeneration.get(sessionId) || 0) + 1);
+                            send({ type: "error", scope: "session", sessionId, code: "ACCESS_REVOKED", error: "Session not found." });
+                        }
+                    }
+                } finally { accessCheckPending = false; }
+            }, Math.max(1, Number(process.env.PILOTSWARM_SESSION_REVALIDATE_MS) || 5_000))
+            : null;
+        accessRevalidateTimer?.unref?.();
 
         const send = (message) => {
             if (ws.readyState === ws.OPEN) {
                 ws.send(JSON.stringify(message));
             }
         };
+        const sendSubscriptionError = (scope, sessionId, error) => {
+            const denied = [403, 404].includes(error?.status) || ["FORBIDDEN", "NOT_FOUND"].includes(error?.code);
+            send({ type: "error", scope, sessionId, ...(denied ? { code: "ACCESS_REVOKED" } : {}),
+                error: denied ? "Session not found." : error?.message || String(error) });
+        };
 
         send({ type: "ready" });
 
@@ -111,6 +149,12 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
             }
 
             const type = String(message?.type || "");
+            if (!shareScope && type.startsWith("subscribe")
+                && new Set([...sessionSubscriptions.keys(), ...canvasSubscriptions.keys(), ...liveSubscriptions.keys()]).size >= 64
+                && !sessionSubscriptions.has(message.sessionId) && !canvasSubscriptions.has(message.sessionId) && !liveSubscriptions.has(message.sessionId)) {
+                send({ type: "error", scope: "session", error: "Too many subscriptions." });
+                return;
+            }
             if (shareScope) {
                 // The whole share-scope protocol: subscribe to THE canvas the
                 // token names. No session events, no logs, no other sessions.
@@ -162,7 +206,7 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
                     sessionSubscriptions.set(sessionId, unsubscribe);
                     send({ type: "subscribedSession", sessionId });
                 } catch (error) {
-                    send({ type: "error", scope: "session", sessionId, error: error?.message || String(error) });
+                    sendSubscriptionError("session", sessionId, error);
                 }
                 return;
             }
@@ -198,7 +242,7 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
                     canvasSubscriptions.set(sessionId, unsubscribe);
                     send({ type: "subscribedCanvas", sessionId });
                 } catch (error) {
-                    send({ type: "error", scope: "canvas", sessionId, error: error?.message || String(error) });
+                    sendSubscriptionError("canvas", sessionId, error);
                 }
                 return;
             }
@@ -213,6 +257,112 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
                 return;
             }
 
+            if (type === "subscribeLive") {
+                const sessionId = String(message?.sessionId || "").trim();
+                const topics = [...new Set(Array.isArray(message?.topics)
+                    ? message.topics.map((topic) => String(topic || "").trim())
+                    : [])];
+                if (!sessionId || topics.length === 0 || topics.length > 16
+                    || topics.some((topic) => !/^[a-z][a-z0-9_.:-]{0,63}$/.test(topic))) {
+                    send({ type: "error", scope: "live", sessionId, error: "invalid live subscription" });
+                    return;
+                }
+                const generation = (liveSubscriptionGeneration.get(sessionId) || 0) + 1;
+                liveSubscriptionGeneration.set(sessionId, generation);
+                const previous = liveSubscriptions.get(sessionId);
+                if (previous) {
+                    previous.unsubscribe();
+                    liveSubscriptions.delete(sessionId);
+                }
+                const plane = runtime.livePlane;
+                if (!plane?.available) {
+                    send({ type: "error", scope: "live", sessionId, error: "live plane unavailable" });
+                    return;
+                }
+                try {
+                    await runtime.start();
+                    if (typeof runtime.authorizeSessionSubscribe === "function") {
+                        await runtime.authorizeSessionSubscribe(sessionId, auth);
+                    }
+                    if (liveSubscriptionGeneration.get(sessionId) !== generation) return;
+
+                    // Subscribe before reading the burst so no notification is
+                    // lost in between. Buffer until the snapshot is sent to
+                    // preserve burst-before-live ordering for the browser.
+                    let bursting = true;
+                    const queued = [];
+                    const unsubscribe = plane.subscribe(sessionId, topics, (update) => {
+                        if (liveSubscriptionGeneration.get(sessionId) !== generation) return;
+                        // Bound both the initial read queue and a slow socket.
+                        // Reconnect performs an authoritative snapshot burst.
+                        if (queued.length >= 128 || ws.bufferedAmount > 1_048_576) {
+                            ws.close(1013, "Live consumer is too slow; reconnect for a snapshot");
+                            return;
+                        }
+                        if (bursting) queued.push(update);
+                        else send({ type: "live", ...update });
+                    });
+                    liveSubscriptions.set(sessionId, { generation, unsubscribe });
+                    const rows = typeof runtime.getLive === "function"
+                        ? await runtime.getLive(sessionId, topics)
+                        : [];
+                    if (liveSubscriptionGeneration.get(sessionId) !== generation) {
+                        unsubscribe();
+                        const current = liveSubscriptions.get(sessionId);
+                        if (current?.generation === generation) liveSubscriptions.delete(sessionId);
+                        return;
+                    }
+                    const burstSeq = new Map();
+                    for (const row of rows || []) {
+                        const seq = Number(row.seq) || 0;
+                        burstSeq.set(row.topic, seq);
+                        send({
+                            type: "live",
+                            sessionId,
+                            topic: row.topic,
+                            seq,
+                            kind: "snapshot",
+                            data: row.payload || {},
+                            updatedAt: row.updatedAt,
+                        });
+                    }
+                    bursting = false;
+                    for (const update of queued) {
+                        const seen = burstSeq.get(update.topic) || 0;
+                        if (update.seq != null && Number(update.seq) <= seen) continue;
+                        if (update.seq != null) burstSeq.set(update.topic, Number(update.seq));
+                        send({ type: "live", ...update });
+                    }
+                    queued.length = 0;
+                    send({ type: "subscribedLive", sessionId, topics });
+                } catch (error) {
+                    const current = liveSubscriptions.get(sessionId);
+                    if (current?.generation === generation) {
+                        current.unsubscribe();
+                        liveSubscriptions.delete(sessionId);
+                    }
+                    if (liveSubscriptionGeneration.get(sessionId) !== generation) return;
+                    sendSubscriptionError("live", sessionId, error);
+                }
+                return;
+            }
+
+            if (type === "unsubscribeLive") {
+                const sessionId = String(message?.sessionId || "").trim();
+                liveSubscriptionGeneration.set(sessionId, (liveSubscriptionGeneration.get(sessionId) || 0) + 1);
+                const subscription = liveSubscriptions.get(sessionId);
+                if (subscription) {
+                    subscription.unsubscribe();
+                    liveSubscriptions.delete(sessionId);
+                }
+                return;
+            }
+
+            if (type === "publishLive") {
+                send({ type: "error", scope: "live", error: "live publishing is server-only" });
+                return;
+            }
+
             if (type === "subscribeLogs") {
                 if (logUnsubscribe) return;
                 try {
@@ -245,6 +395,7 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
         });
 
         ws.on("close", () => {
+            if (accessRevalidateTimer) clearInterval(accessRevalidateTimer);
             if (shareRevalidateTimer) clearInterval(shareRevalidateTimer);
             for (const unsubscribe of sessionSubscriptions.values()) {
                 try {
@@ -258,6 +409,11 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
                 } catch {}
             }
             canvasSubscriptions.clear();
+            for (const subscription of liveSubscriptions.values()) {
+                try { subscription.unsubscribe(); } catch {}
+            }
+            liveSubscriptions.clear();
+            liveSubscriptionGeneration.clear();
             if (logUnsubscribe) {
                 try {
                     logUnsubscribe();

package/web/authz.js

@@ -4,7 +4,9 @@ import {
     normalizeVisibility,
     relationFor,
     SESSION_VISIBILITY_VALUES,
+    validateAdminScope,
 } from "pilotswarm-sdk/api";
+import { loadAuthorizationPolicy, resolveAuthProviderId } from "./auth/config.js";
 
 // The session-tree predicate now lives in the SDK so the WORKER evaluates the
 // same rules for agent tools (Agent Manager proposal §4). Re-exported here so
@@ -35,6 +37,10 @@ export function loadAuthzConfig(env = process.env) {
     const rawDefault = String(env.SESSIONS_DEFAULT_VISIBILITY || "").trim().toLowerCase();
     const visibilityValues = new Set(SESSION_VISIBILITY_VALUES);
     return {
+        adminScope: validateAdminScope(env, {
+            authenticationEnabled: resolveAuthProviderId({ env }) !== "none"
+                && !loadAuthorizationPolicy({ env }).allowUnauthenticated,
+        }),
         enforce: parseBooleanEnv(env.AUTHZ_ENFORCE_OWNERSHIP, false),
         defaultVisibility: visibilityValues.has(rawDefault) ? rawDefault : "private",
         // "read" (default): system sessions are metadata/content-visible to
@@ -66,4 +72,3 @@ export function notFoundError() {
 function ownerLabel(snapshot) {
     return snapshot?.owner?.displayName || snapshot?.owner?.email || snapshot?.owner?.subject || "another user";
 }
-

package/web/dist/assets/{abnfDiagram-VRR7QNED-CJOR2hPi.js → abnfDiagram-VRR7QNED-D9Rv2VpV.js}

@@ -1 +1 @@
-import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-_Uc0ksg3.js";import{p as f}from"./chunk-JWPE2WC7-CT3Q7T2A.js";import{_ as n,l as o}from"./mermaid.core-C9u4FOCX.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-C_8v2wIz.js";import"./pilotswarm--kvfB_6q.js";var v=d().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},B={parser:R,db:a,renderer:u,styles:p};export{B as diagram};
+import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-D-Y6KQ7t.js";import{p as f}from"./chunk-JWPE2WC7-CQN0qE7F.js";import{_ as n,l as o}from"./mermaid.core-C78wdk8Y.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-CgRQfdW1.js";import"./pilotswarm-UV6T1_QI.js";var v=d().RailroadAbnf.parser.LangiumParser,i=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return i(e.element);case"AbnfOptionalGroup":return{type:"optional",element:i(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:i(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},B={parser:R,db:a,renderer:u,styles:p};export{B as diagram};

package/web/dist/assets/{arc-Yh3kc_KB.js → arc-BATiucnq.js}

@@ -1 +1 @@
-import{Y as ln,$ as an,a0 as F,a1 as q,a2 as j,a3 as un,a4 as y,a5 as tn,a6 as J,a7 as _,a8 as rn,a9 as o,aa as on,ab as sn,ac as fn}from"./mermaid.core-C9u4FOCX.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(on(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-un,c=A.apply(this,arguments)-un,B=rn(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(rn(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<an)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(fn((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-an/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};
+import{Y as ln,$ as an,a0 as F,a1 as q,a2 as j,a3 as un,a4 as y,a5 as tn,a6 as J,a7 as _,a8 as rn,a9 as o,aa as on,ab as sn,ac as fn}from"./mermaid.core-C78wdk8Y.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(on(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-un,c=A.apply(this,arguments)-un,B=rn(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(rn(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<an)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(fn((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-an/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};