@detergent-software/conductor 3.0.0-dev.2 → 3.0.0-dev.21

package/build/host/credential-manager.js

@@ -0,0 +1,109 @@
+// Windows generic credentials (Credential Manager). Node can't read Credential Manager and `cmdkey`
+// can't print a secret, so PowerShell calls advapi32's CredRead. The secret is only returned: never
+// logged, stored or put on a command line.
+// The machine credentials the conductor named with an ATK prefix before ATK-529. A read of the new
+// name that finds none copies the old one to it, once, with its user name, secret and persistence,
+// and leaves the old one where it is. After that the new one is found, so nothing reads the old name.
+export const RENAMED_TARGETS = {
+    'conductor-linear': 'atk-conductor-linear',
+    'conductor-pushover': 'atk-conductor-pushover',
+};
+const NOT_FOUND = 3;
+// Win32 ERROR_NOT_FOUND: CredRead's "no such credential". Any other failure is a broken read.
+const ERROR_NOT_FOUND = 1168;
+// Writes the user name, a newline, then the password. With CONDUCTOR_CRED_FROM set, a missing target
+// is copied from that credential first; a copy that fails still returns the secret, and the next read
+// tries the copy again.
+const CRED_READ = `
+$ErrorActionPreference = 'Stop'
+try {
+Add-Type -Namespace Conductor -Name Cred -MemberDefinition @'
+[DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+public static extern bool CredRead(string target, int type, int flags, out System.IntPtr cred);
+[DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+public static extern bool CredWrite(ref CREDENTIAL cred, int flags);
+[DllImport("advapi32.dll")]
+public static extern void CredFree(System.IntPtr cred);
+[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+public struct CREDENTIAL { public int Flags; public int Type; public string TargetName; public string Comment;
+  public long LastWritten; public int CredentialBlobSize; public System.IntPtr CredentialBlob; public int Persist;
+  public int AttributeCount; public System.IntPtr Attributes; public string TargetAlias; public string UserName; }
+'@
+$p = [IntPtr]::Zero
+$copy = $false
+if (-not [Conductor.Cred]::CredRead($env:CONDUCTOR_CRED_TARGET, 1, 0, [ref]$p)) {
+  $code = [Runtime.InteropServices.Marshal]::GetLastWin32Error()
+  if ($code -ne ${ERROR_NOT_FOUND}) { [Console]::Error.WriteLine("CredRead failed with Win32 error $code"); exit 4 }
+  if (-not $env:CONDUCTOR_CRED_FROM) { exit ${NOT_FOUND} }
+  if (-not [Conductor.Cred]::CredRead($env:CONDUCTOR_CRED_FROM, 1, 0, [ref]$p)) {
+    $code = [Runtime.InteropServices.Marshal]::GetLastWin32Error()
+    if ($code -eq ${ERROR_NOT_FOUND}) { exit ${NOT_FOUND} }
+    [Console]::Error.WriteLine("CredRead failed with Win32 error $code"); exit 4
+  }
+  $copy = $true
+}
+try {
+  $c = [Runtime.InteropServices.Marshal]::PtrToStructure($p, [type][Conductor.Cred+CREDENTIAL])
+  if ($copy) {
+    $n = $c
+    $n.Flags = 0; $n.TargetName = $env:CONDUCTOR_CRED_TARGET; $n.TargetAlias = $null; $n.LastWritten = 0
+    $n.AttributeCount = 0; $n.Attributes = [IntPtr]::Zero
+    if (-not [Conductor.Cred]::CredWrite([ref]$n, 0)) {
+      [Console]::Error.WriteLine("CredWrite failed with Win32 error " + [Runtime.InteropServices.Marshal]::GetLastWin32Error())
+    }
+  }
+  [Console]::Out.Write([string]$c.UserName + [char]10)
+  [Console]::Out.Write([Runtime.InteropServices.Marshal]::PtrToStringUni($c.CredentialBlob, $c.CredentialBlobSize / 2))
+} finally { [Conductor.Cred]::CredFree($p) }
+} catch { [Console]::Error.WriteLine($_.Exception.Message); exit 4 }
+`;
+export function credentialManager(run, renamed = RENAMED_TARGETS) {
+    // Whether `target` is saved, from `cmdkey /list:<target>`, which prints no secret and starts no
+    // PowerShell.
+    const listed = async (target, env) => {
+        const result = await run('cmdkey', [`/list:${target}`], { env, timeoutMs: 15_000 });
+        if (result.code !== 0)
+            return 'unknown';
+        if (/\*\s*NONE\s*\*/.test(result.stdout))
+            return 'missing';
+        return /^\s*Target:/m.test(result.stdout) ? 'saved' : 'unknown';
+    };
+    return {
+        name: 'Credential Manager',
+        read: async (target, env) => {
+            const from = renamed[target];
+            const result = await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(CRED_READ, 'utf16le').toString('base64')], {
+                // Always set, so a CONDUCTOR_CRED_FROM in the daemon's own env can never start a copy.
+                env: { ...env, CONDUCTOR_CRED_FROM: from ?? '', CONDUCTOR_CRED_TARGET: target },
+                timeoutMs: 30_000,
+            });
+            if (result.code === 0) {
+                const newline = result.stdout.indexOf('\n');
+                const secret = result.stdout.slice(newline + 1).trim();
+                if (newline >= 0 && secret)
+                    return { credential: { secret, user: result.stdout.slice(0, newline).trim() }, found: true };
+            }
+            if (result.code === NOT_FOUND)
+                return { found: false, missing: true, reason: `no credential ${target}` };
+            // Never echo stdout here: on a partial failure it could hold the secret.
+            const line = result.stderr
+                .split(/\r?\n/)
+                .map((l) => l.trim())
+                .find((l) => l && !l.startsWith('#< CLIXML') && !l.startsWith('<Objs'));
+            return {
+                found: false,
+                missing: false,
+                reason: `the credential ${target} couldn't be read (${result.error ?? line ?? `exit ${result.code}`})`,
+            };
+        },
+        saveCommand: (target, user) => `cmdkey /generic:${target} /user:${user} /pass`,
+        // A new name that isn't saved yet counts as saved while its old name is, so the read that
+        // copies it runs.
+        saved: async (target, env) => {
+            const saved = await listed(target, env);
+            const from = renamed[target];
+            return saved === 'missing' && from !== undefined ? listed(from, env) : saved;
+        },
+    };
+}
+//# sourceMappingURL=credential-manager.js.map

package/build/host/credential-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-manager.js","sourceRoot":"","sources":["../../src/host/credential-manager.ts"],"names":[],"mappings":"AAEA,oGAAoG;AACpG,oGAAoG;AACpG,2CAA2C;AAE3C,mGAAmG;AACnG,mGAAmG;AACnG,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAqC;IAC/D,kBAAkB,EAAE,sBAAsB;IAC1C,oBAAoB,EAAE,wBAAwB;CAC/C,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,qGAAqG;AACrG,sGAAsG;AACtG,wBAAwB;AACxB,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;kBAmBA,eAAe;8CACa,SAAS;;;oBAGnC,eAAe,YAAY,SAAS;;;;;;;;;;;;;;;;;;;CAmBvD,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,GAAQ,EAAE,UAA4C,eAAe;IACrG,gGAAgG;IAChG,cAAc;IACd,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAE,GAAsB,EAA4B,EAAE;QACxF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3D,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA2B,EAAE;YACnD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAC1G;gBACE,uFAAuF;gBACvF,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,mBAAmB,EAAE,IAAI,IAAI,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE;gBAC/E,SAAS,EAAE,MAAM;aAClB,CACF,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,IAAI,OAAO,IAAI,CAAC,IAAI,MAAM;oBACxB,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjG,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,MAAM,EAAE,EAAE,CAAC;YACzG,yEAAyE;YACzE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM;iBACvB,KAAK,CAAC,OAAO,CAAC;iBACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,MAAM,sBAAsB,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,GAAG;aACvG,CAAC;QACJ,CAAC;QACD,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,mBAAmB,MAAM,UAAU,IAAI,QAAQ;QAC9E,0FAA0F;QAC1F,kBAAkB;QAClB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/build/host/keychain.js

@@ -0,0 +1,44 @@
+// macOS generic passwords in the login keychain, through `security`: the target is the item's
+// service, its user name the account. `security` answers 44 for an item that isn't there.
+const NOT_FOUND = 44;
+// The item's account from `security find-generic-password`'s attributes: `"acct"<blob>="linear"`.
+// An account saved as hex (not printable) reads as none.
+export function account(attributes) {
+    return /"acct"<blob>="((?:[^"\\]|\\.)*)"/.exec(attributes)?.[1] ?? '';
+}
+export function keychain(run, keychainFile) {
+    // A keychain file of its own, for the real-OS tests; else the user's search list.
+    const where = keychainFile === undefined ? [] : [keychainFile];
+    const find = (args, env) => run('security', ['find-generic-password', ...args, ...where], { env, timeoutMs: 30_000 });
+    // Never echo stdout in a reason: on a partial failure it could hold the secret.
+    const failed = (target, result) => {
+        const why = result.error ?? (result.stderr.trim() || `exit ${result.code}`);
+        if (/ENOENT/.test(why))
+            return { found: false, missing: true, reason: 'no `security` command to ask' };
+        return { found: false, missing: false, reason: `the keychain item ${target} couldn't be read (${why})` };
+    };
+    return {
+        name: 'the login keychain',
+        // The attributes first (no secret is printed without -w), then the secret of the item with that
+        // account, so the two come from one item even when another has the same service.
+        read: async (target, env) => {
+            const attributes = await find(['-s', target], env);
+            if (attributes.code === NOT_FOUND)
+                return { found: false, missing: true, reason: `no keychain item ${target}` };
+            if (attributes.code !== 0)
+                return failed(target, attributes);
+            const user = account(attributes.stdout);
+            const result = await find(['-s', target, ...(user ? ['-a', user] : []), '-w'], env);
+            const secret = result.stdout.replace(/\r?\n$/, '');
+            if (result.code !== 0 || !secret)
+                return failed(target, result);
+            return { credential: { secret, user }, found: true };
+        },
+        // Delete first: an item is one per service and account, so saving under another user name would
+        // leave the old item beside it. -w last with no value: security asks for the password.
+        saveCommand: (target, user) => `security delete-generic-password -s ${target}; security add-generic-password -s ${target} -a ${user} -w`,
+        // A missing item costs read one call, the same as asking first.
+        saved: async () => 'unknown',
+    };
+}
+//# sourceMappingURL=keychain.js.map

package/build/host/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/host/keychain.ts"],"names":[],"mappings":"AAEA,8FAA8F;AAC9F,0FAA0F;AAC1F,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,kGAAkG;AAClG,yDAAyD;AACzD,MAAM,UAAU,OAAO,CAAC,UAAkB;IACxC,OAAO,kCAAkC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAQ,EAAE,YAAqB;IACtD,kFAAkF;IAClF,MAAM,KAAK,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,GAAsB,EAAE,EAAE,CAC/D,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,gFAAgF;IAChF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAgC,EAAkB,EAAE;QAClF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC;IAC3G,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,gGAAgG;QAChG,iFAAiF;QACjF,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA2B,EAAE;YACnD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,MAAM,EAAE,EAAE,CAAC;YAChH,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChE,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,gGAAgG;QAChG,uFAAuF;QACvF,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAC5B,uCAAuC,MAAM,sCAAsC,MAAM,OAAO,IAAI,KAAK;QAC3G,gEAAgE;QAChE,KAAK,EAAE,KAAK,IAA8B,EAAE,CAAC,SAAS;KACvD,CAAC;AACJ,CAAC"}

package/build/host/libsecret.js

@@ -0,0 +1,40 @@
+// Linux secrets in the Secret Service (GNOME Keyring, KeePassXC and others), through libsecret's
+// `secret-tool`: an item with the attributes service=conductor and target=<target>, its user name in
+// a `user` attribute. secret-tool needs a D-Bus session with a Secret Service on it; a headless box
+// without one can't read, and the env fallback (secrets.ts) stands in.
+const SERVICE = 'conductor';
+export function libsecret(run) {
+    const tool = (args, env) => run('secret-tool', args, { env, timeoutMs: 30_000 });
+    const lookup = (target, env) => tool(['lookup', 'service', SERVICE, 'target', target], env);
+    return {
+        name: 'libsecret',
+        read: async (target, env) => {
+            const result = await lookup(target, env);
+            const secret = result.stdout.replace(/\r?\n$/, '');
+            if (result.code === 0 && secret) {
+                // search prints the item's attributes, and its secret, which only the user line is read from.
+                const found = await tool(['search', 'service', SERVICE, 'target', target], env);
+                return { credential: { secret, user: userOf(`${found.stdout}\n${found.stderr}`) }, found: true };
+            }
+            if (result.error !== null && /ENOENT/.test(result.error))
+                return { found: false, missing: true, reason: 'no secret-tool (libsecret-tools) to ask' };
+            // lookup exits 1 and says nothing for an item that isn't there.
+            if (result.code === 1 && !result.stderr.trim())
+                return { found: false, missing: true, reason: `no libsecret item ${target}` };
+            // Never echo stdout here: on a partial failure it could hold the secret.
+            const why = result.error ?? (result.stderr.trim().split(/\r?\n/)[0] || `exit ${result.code}`);
+            return { found: false, missing: false, reason: `the libsecret item ${target} couldn't be read (${why})` };
+        },
+        // Clear first: store replaces only an item whose attributes are all the same, so saving under
+        // another user name would leave the old item beside it, and lookup and search could each pick
+        // another one. secret-tool store asks for the secret.
+        saveCommand: (target, user) => `secret-tool clear service ${SERVICE} target ${target}; secret-tool store --label=${target} service ${SERVICE} target ${target} user ${user}`,
+        // Asking would be a lookup, which reads the secret: read decides instead.
+        saved: async () => 'unknown',
+    };
+}
+// The `user` attribute from `secret-tool search`: `attribute.user = linear`.
+export function userOf(search) {
+    return /^attribute\.user = (.*)$/m.exec(search)?.[1]?.trim() ?? '';
+}
+//# sourceMappingURL=libsecret.js.map

package/build/host/libsecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"libsecret.js","sourceRoot":"","sources":["../../src/host/libsecret.ts"],"names":[],"mappings":"AAEA,iGAAiG;AACjG,qGAAqG;AACrG,oGAAoG;AACpG,uEAAuE;AACvE,MAAM,OAAO,GAAG,WAAW,CAAC;AAE5B,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,GAAsB,EAAE,EAAE,CAC/D,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAsB,EAAE,EAAE,CACxD,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAE9D,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA2B,EAAE;YACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBAChC,8FAA8F;gBAC9F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChF,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACnG,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;YAC5F,gEAAgE;YAChE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,MAAM,EAAE,EAAE,CAAC;YAChF,yEAAyE;YACzE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC;QAC5G,CAAC;QACD,8FAA8F;QAC9F,8FAA8F;QAC9F,sDAAsD;QACtD,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAC5B,6BAA6B,OAAO,WAAW,MAAM,+BAA+B,MAAM,YAAY,OAAO,WAAW,MAAM,SAAS,IAAI,EAAE;QAC/I,0EAA0E;QAC1E,KAAK,EAAE,KAAK,IAA8B,EAAE,CAAC,SAAS;KACvD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,MAAM,CAAC,MAAc;IACnC,OAAO,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrE,CAAC"}

package/build/host/macos-terminal.js

@@ -0,0 +1,63 @@
+import { outputOf } from "../run.js";
+import { shLine, shQuote, viaSh } from "./shell.js";
+// A string as AppleScript reads it, in double quotes.
+export function appleString(text) {
+    return `"${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+// Terminal.app: a new window per tab (Terminal has no named windows to add a tab to), titled.
+export function appleTerminal(run) {
+    return macTerminal(run, 'Terminal', (tab) => [
+        'tell application "Terminal"',
+        'activate',
+        `set t to do script ${appleString(macLine(tab))}`,
+        `set custom title of t to ${appleString(cleanTitle(tab.title))}`,
+        'end tell',
+    ]);
+}
+// iTerm: a tab in its front window, or a new window when none is open, named after the tab. An
+// iTerm that wasn't running opens a window of its own as it starts: the tab takes that window's
+// session instead of adding one beside it.
+export function iterm(run) {
+    return macTerminal(run, 'iTerm', (tab) => [
+        'set wasRunning to application "iTerm" is running',
+        'tell application "iTerm"',
+        'activate',
+        'if (count of windows) is 0 then',
+        'set w to (create window with default profile)',
+        'else',
+        'set w to current window',
+        'if wasRunning then tell w to create tab with default profile',
+        'end if',
+        'tell current session of w',
+        `set name to ${appleString(cleanTitle(tab.title))}`,
+        `write text ${appleString(macLine(tab))}`,
+        'end tell',
+        'end tell',
+    ]);
+}
+// What a macOS tab types into its shell: the folder and the command through sh, then `exit`, so the
+// shell ends with the command as a Windows Terminal or tmux tab does (Terminal closes the window
+// then if its profile says to). The shell is the user's login shell, in its own environment, so
+// `env` goes on the line.
+export function macLine(tab) {
+    return `${viaSh(`cd ${shQuote(tab.cwd)} && ${shLine(tab)}`)}; exit`;
+}
+function cleanTitle(title) {
+    return title.replace(/\s+/g, ' ').trim().slice(0, 80);
+}
+// Runs the AppleScript, one `-e` per line: osascript takes it as arguments, never through a shell.
+function macTerminal(run, name, script) {
+    return {
+        attachHint: () => null,
+        name,
+        open: async (tab) => {
+            const result = await run('osascript', script(tab).flatMap((line) => ['-e', line]), { timeoutMs: 60_000 });
+            if (result.code === 0)
+                return null;
+            return result.error !== null && /ENOENT/.test(result.error)
+                ? 'no osascript to open it with'
+                : outputOf(result, 500);
+        },
+    };
+}
+//# sourceMappingURL=macos-terminal.js.map

package/build/host/macos-terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos-terminal.js","sourceRoot":"","sources":["../../src/host/macos-terminal.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEpD,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACjE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,GAAQ;IACpC,OAAO,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3C,6BAA6B;QAC7B,UAAU;QACV,sBAAsB,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;QACjD,4BAA4B,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;QAChE,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,gGAAgG;AAChG,2CAA2C;AAC3C,MAAM,UAAU,KAAK,CAAC,GAAQ;IAC5B,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QACxC,kDAAkD;QAClD,0BAA0B;QAC1B,UAAU;QACV,iCAAiC;QACjC,+CAA+C;QAC/C,MAAM;QACN,yBAAyB;QACzB,8DAA8D;QAC9D,QAAQ;QACR,2BAA2B;QAC3B,eAAe,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;QACnD,cAAc,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;QACzC,UAAU;QACV,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,gGAAgG;AAChG,0BAA0B;AAC1B,MAAM,UAAU,OAAO,CAAC,GAAyD;IAC/E,OAAO,GAAG,KAAK,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,GAAQ,EAAE,IAAY,EAAE,MAAqC;IAChF,OAAO;QACL,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,IAAI;QACJ,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAC3C,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/build/host/platform.js

@@ -0,0 +1,4 @@
+export function hostPlatform(platform = process.platform) {
+    return platform === 'win32' || platform === 'darwin' ? platform : 'linux';
+}
+//# sourceMappingURL=platform.js.map

package/build/host/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/host/platform.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,YAAY,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACvE,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5E,CAAC"}

package/build/host/secrets.js

@@ -0,0 +1,46 @@
+import { run as runCommand } from "../run.js";
+import { credentialManager } from "./credential-manager.js";
+import { keychain } from "./keychain.js";
+import { libsecret } from "./libsecret.js";
+import { hostPlatform } from "./platform.js";
+// The env var that stands in for the credential `target` where the store has none, or can't be
+// read (a headless Linux box with no keyring): CONDUCTOR_SECRET_ and the target in upper snake
+// case, with its user name, when one is needed, in the same name plus _USER.
+export function secretEnvName(target) {
+    return `CONDUCTOR_SECRET_${target
+        .toUpperCase()
+        .replace(/[^A-Z0-9]+/g, '_')
+        .replace(/^_+|_+$/g, '')}`;
+}
+// This platform's store, with the env fallback.
+export function secretStore({ platform = hostPlatform(), run = runCommand, } = {}) {
+    const stores = {
+        darwin: () => keychain(run),
+        linux: () => libsecret(run),
+        win32: () => credentialManager(run),
+    };
+    return withEnvFallback(stores[platform]());
+}
+// The store, else secretEnvName(target) from the environment.
+export function withEnvFallback(store) {
+    const fromEnv = (target, env) => {
+        const name = secretEnvName(target);
+        const secret = env[name]?.trim();
+        return secret ? { secret, user: env[`${name}_USER`]?.trim() ?? '' } : null;
+    };
+    return {
+        name: store.name,
+        read: async (target, env) => {
+            const got = await store.read(target, env);
+            if (got.found)
+                return got;
+            const credential = fromEnv(target, env);
+            return credential
+                ? { credential, found: true }
+                : { ...got, reason: `${got.reason}, and no ${secretEnvName(target)}` };
+        },
+        saveCommand: (target, user) => store.saveCommand(target, user),
+        saved: async (target, env) => (fromEnv(target, env) ? 'saved' : store.saved(target, env)),
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/build/host/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/host/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,IAAI,UAAU,EAAmC,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAqB,YAAY,EAAE,MAAM,eAAe,CAAC;AA8BhE,+FAA+F;AAC/F,+FAA+F;AAC/F,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,oBAAoB,MAAM;SAC9B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,WAAW,CAAC,EAC1B,QAAQ,GAAG,YAAY,EAAE,EACzB,GAAG,GAAG,UAAU,MAC0B,EAAE;IAC5C,MAAM,MAAM,GAA4C;QACtD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3B,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;QAC3B,KAAK,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC;KACpC,CAAC;IACF,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,GAAsB,EAAqB,EAAE;QAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,GAAG,CAAC;YAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO,UAAU;gBACf,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC7B,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,YAAY,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;QAC9D,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC1F,CAAC;AACJ,CAAC"}

package/build/host/shell.js

@@ -0,0 +1,26 @@
+import { win32 } from 'node:path';
+// What a held tab says when its command fails, such as "claude attach failed, press Enter to close
+// this tab". win32's basename splits on both / and \, so a Windows path reads the same on any host.
+export function failedText(command) {
+    const [program = '', verb] = command;
+    const name = win32.basename(program).replace(/\.(exe|cmd)$/i, '');
+    return `${verb === undefined ? name : `${name} ${verb}`} failed, press Enter to close this tab`;
+}
+// The tab's command as one sh line: its env first, and with `hold`, a failure that waits for Enter
+// before the tab closes.
+export function shLine(tab) {
+    const env = Object.entries(tab.env).map(([name, value]) => `${name}=${shQuote(value)}`);
+    const line = [...(env.length > 0 ? ['env', ...env] : []), ...tab.command.map(shQuote)].join(' ');
+    return tab.hold ? `${line} || { echo ${shQuote(failedText(tab.command))}; read _; }` : line;
+}
+// A word as sh reads it: bare when it can't be taken for anything else, else in single quotes.
+export function shQuote(word) {
+    return /^[\w%+,./:=@-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+// A line run through sh, as one word for the shell that runs it. tmux's default-shell and a macOS
+// login shell are the user's, which may not be sh (fish has no `{ …; }`); `sh -c '…'` reads the same
+// in each.
+export function viaSh(line) {
+    return `sh -c ${shQuote(line)}`;
+}
+//# sourceMappingURL=shell.js.map

package/build/host/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/host/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAIlC,mGAAmG;AACnG,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,wCAAwC,CAAC;AAClG,CAAC;AAED,mGAAmG;AACnG,yBAAyB;AACzB,MAAM,UAAU,MAAM,CAAC,GAAiD;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,cAAc,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9F,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACnF,CAAC;AAED,kGAAkG;AAClG,qGAAqG;AACrG,WAAW;AACX,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,OAAO,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAClC,CAAC"}

package/build/host/terminal.js

@@ -0,0 +1,46 @@
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { run as runCommand } from "../run.js";
+import { appleTerminal, iterm } from "./macos-terminal.js";
+import { hostPlatform } from "./platform.js";
+import { tmux } from "./tmux.js";
+import { windowsTerminal } from "./windows-terminal.js";
+// config.json's workers.terminal: auto is Windows Terminal on Windows, iTerm on macOS where it is
+// installed and Terminal where it isn't, and tmux elsewhere.
+export const TERMINALS = ['auto', 'windows-terminal', 'terminal', 'iterm', 'tmux'];
+const ITERM_APPS = ['/Applications/iTerm.app', join(homedir(), 'Applications', 'iTerm.app')];
+// This platform's terminal, or the one config.json names.
+export function terminal({ choice = 'auto', installed = existsSync, platform = hostPlatform(), run = runCommand, } = {}) {
+    const picked = choice !== 'auto'
+        ? choice
+        : platform === 'win32'
+            ? 'windows-terminal'
+            : platform === 'darwin'
+                ? ITERM_APPS.some((app) => installed(app))
+                    ? 'iterm'
+                    : 'terminal'
+                : 'tmux';
+    const terminals = {
+        iterm: () => iterm(run),
+        terminal: () => appleTerminal(run),
+        tmux: () => tmux(run),
+        'windows-terminal': () => windowsTerminal(run),
+    };
+    return terminals[picked]();
+}
+export function workerTabs(where, onLaunch) {
+    return {
+        hint: (window) => where.attachHint(window),
+        onLaunch,
+        open: (tab) => where.open({
+            command: ['claude', 'attach', tab.handle],
+            cwd: tab.cwd,
+            env: {},
+            hold: true,
+            title: tab.title,
+            window: tab.window,
+        }),
+    };
+}
+//# sourceMappingURL=terminal.js.map

package/build/host/terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.js","sourceRoot":"","sources":["../../src/host/terminal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAqB,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,kGAAkG;AAClG,6DAA6D;AAC7D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AA4C5F,MAAM,UAAU,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AAE7F,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CAAC,EACvB,MAAM,GAAG,MAAM,EACf,SAAS,GAAG,UAAU,EACtB,QAAQ,GAAG,YAAY,EAAE,EACzB,GAAG,GAAG,UAAU,MAOd,EAAE;IACJ,MAAM,MAAM,GACV,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBACrB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACxC,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,UAAU;gBACd,CAAC,CAAC,MAAM,CAAC;IACjB,MAAM,SAAS,GAA0C;QACvD,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;QACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;QAClC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QACrB,kBAAkB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC;KAC/C,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAe,EAAE,QAAiB;IAC3D,OAAO;QACL,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1C,QAAQ;QACR,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CACZ,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;YACzC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;KACL,CAAC;AACJ,CAAC"}

package/build/host/tmux.js

@@ -0,0 +1,39 @@
+import { outputOf } from "../run.js";
+import { shLine, viaSh } from "./shell.js";
+// tmux: a detached session per window, made by its first tab, and a tmux window per tab. It runs
+// where there is no desktop (a server over ssh), so a person reaches it with `tmux attach`. tmux
+// starts a tab in the tmux server's environment, so `env` goes on the command line, and runs it in
+// its default-shell, so the line goes through sh.
+export function tmux(run) {
+    return {
+        attachHint: (window) => `tmux attach -t ${tmuxSession(window)}`,
+        name: 'tmux',
+        open: async (tab) => {
+            const session = tmuxSession(tab.window);
+            // `=` matches the name exactly, not as a prefix.
+            const has = await run('tmux', ['has-session', '-t', `=${session}`], { timeoutMs: 30_000 });
+            if (has.error !== null && /ENOENT/.test(has.error))
+                return 'no tmux to open it in';
+            // tmux expands formats in -n and -c, and `#(…)` in one runs a command: `##` is a plain `#`.
+            const literal = (text) => text.replace(/#/g, '##');
+            const title = literal(tab.title.replace(/\s+/g, ' ').trim().slice(0, 80));
+            const open = (where) => run('tmux', [...where, '-n', title, '-c', literal(tab.cwd), viaSh(shLine(tab))], { timeoutMs: 30_000 });
+            const inSession = ['new-window', '-t', `=${session}:`];
+            let result = await open(has.code === 0 ? inSession : ['new-session', '-d', '-s', session]);
+            // Another tab made the session since has-session asked.
+            if (has.code !== 0 && /duplicate session/.test(result.stderr))
+                result = await open(inSession);
+            return result.code === 0 ? null : outputOf(result, 500);
+        },
+    };
+}
+// The tmux session a window's tabs open in: its name in lower case, with a dash for anything tmux
+// reads in a target (`.` and `:`) and anything a person would have to quote. "Conductor · atk"
+// becomes conductor-atk.
+export function tmuxSession(window) {
+    return (window
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, '-')
+        .replace(/^-+|-+$/g, '') || 'conductor');
+}
+//# sourceMappingURL=tmux.js.map

package/build/host/tmux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmux.js","sourceRoot":"","sources":["../../src/host/tmux.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE3C,iGAAiG;AACjG,iGAAiG;AACjG,mGAAmG;AACnG,kDAAkD;AAClD,MAAM,UAAU,IAAI,CAAC,GAAQ;IAC3B,OAAO;QACL,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,WAAW,CAAC,MAAM,CAAC,EAAE;QAC/D,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,iDAAiD;YACjD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3F,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,uBAAuB,CAAC;YACnF,4FAA4F;YAC5F,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,IAAI,GAAG,CAAC,KAAwB,EAAE,EAAE,CACxC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1G,MAAM,SAAS,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,OAAO,GAAG,CAAC,CAAC;YACvD,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3F,wDAAwD;YACxD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9F,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,+FAA+F;AAC/F,yBAAyB;AACzB,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,CACL,MAAM;SACH,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,WAAW,CAC1C,CAAC;AACJ,CAAC"}

package/build/host/windows-terminal.js

@@ -0,0 +1,46 @@
+import { outputOf } from "../run.js";
+import { failedText } from "./shell.js";
+// Windows Terminal (wt.exe). Not hidden: when the named window doesn't exist yet, Windows Terminal
+// creates it with the spawn's SW_HIDE, and the tab runs where nobody sees it (ATK-469, ATK-336).
+export function windowsTerminal(run) {
+    return {
+        attachHint: () => null,
+        name: 'Windows Terminal',
+        open: async (tab) => {
+            const args = windowsTerminalArgs(tab);
+            if (typeof args === 'string')
+                return args;
+            const result = await run('wt.exe', args, { cwd: tab.cwd, timeoutMs: 60_000, windowsHide: false });
+            if (result.code === 0)
+                return null;
+            return result.error !== null && /ENOENT/.test(result.error)
+                ? 'no Windows Terminal (wt.exe) to open it in'
+                : outputOf(result, 500);
+        },
+    };
+}
+// wt.exe's arguments for a tab in the named window. wt.exe splits its own arguments on `;`, so the
+// window and title lose it, a folder with one is left out (the tab starts in its profile's, as
+// tabs did before ATK-529), and a command with one can't open (a string says why). A held command
+// runs in pwsh and chains its prompt with `||`. The tab gets wt.exe's environment, which is the
+// caller's even in a window already open, so `env` needs no setting.
+export function windowsTerminalArgs(tab) {
+    const split = tab.command.find((part) => part.includes(';'));
+    if (split !== undefined)
+        return `a Windows Terminal tab can't take ";": ${split}`;
+    const clean = (text) => text.replace(/;/g, ',').replace(/\s+/g, ' ').trim();
+    const command = tab.hold
+        ? ['pwsh', '-Command', `${psLine(tab.command)} || Read-Host ${psQuote(failedText(tab.command))}`]
+        : tab.command;
+    const folder = tab.cwd.includes(';') ? [] : ['-d', tab.cwd];
+    return ['-w', clean(tab.window), 'new-tab', '--title', clean(tab.title).slice(0, 80), ...folder, ...command];
+}
+// A command as pwsh runs it: words bare where they can be, and a quoted program called with `&`.
+function psLine(command) {
+    const words = command.map((word) => (/^[\w.:/\\-]+$/.test(word) ? word : psQuote(word)));
+    return words[0]?.startsWith("'") ? `& ${words.join(' ')}` : words.join(' ');
+}
+function psQuote(text) {
+    return `'${text.replace(/'/g, "''")}'`;
+}
+//# sourceMappingURL=windows-terminal.js.map

package/build/host/windows-terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-terminal.js","sourceRoot":"","sources":["../../src/host/windows-terminal.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,mGAAmG;AACnG,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO;QACL,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAClG,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,+FAA+F;AAC/F,kGAAkG;AAClG,gGAAgG;AAChG,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,GAAe;IACjD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,0CAA0C,KAAK,EAAE,CAAC;IAClF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI;QACtB,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAChB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;AAC/G,CAAC;AAED,iGAAiG;AACjG,SAAS,MAAM,CAAC,OAA0B;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACzC,CAAC"}

package/build/in-process.js

@@ -1,22 +1,23 @@
 import { loadConfig } from "./config.js";
 import { providerCredentials } from "./credentials.js";
-import { adoOrganization, PROFILE_FILE, readProfile, trackerKey } from "./profile.js";
+import { profileHere } from "./profile-layers.js";
+import { adoOrganization, profileProblem, trackerKey } from "./profile.js";
 import { gitToplevel } from "./wait.js";
 // What a tracker verb run in-process (no daemon) needs: the project of the checkout it runs in, and
 // the machine's accounts. `conduct note` and `conduct brief` share it.
 // The profile of the checkout around `cwd`, when `key` (an item key, checked already) is one of its
 // items; else why not, after `why` (why it runs here), for the verb's refusal. `purpose` ends the
 // sentence: "post it from", "read it from".
-export async function checkoutProject(cwd, key, why, purpose) {
+export async function checkoutProject(paths, cwd, key, why, purpose) {
     const checkout = await gitToplevel(cwd);
     if (checkout === null)
         return { refusal: `${why}, and this isn't a project checkout to ${purpose}` };
     let profile;
     try {
-        profile = readProfile(checkout).profile;
+        profile = profileHere(checkout, paths);
     }
-    catch {
-        return { refusal: `${why}, and ${checkout} has no readable ${PROFILE_FILE}` };
+    catch (error) {
+        return { refusal: `${why}, and ${checkout} has no readable profile: ${profileProblem(error)}` };
     }
     if (key.split('-')[0] !== trackerKey(profile).toUpperCase())
         return { refusal: `${why}, and ${key} isn't an item of ${profile.name}, this checkout's project` };

package/build/in-process.js.map

@@ -1 +1 @@
-{"version":3,"file":"in-process.js","sourceRoot":"","sources":["../src/in-process.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAgB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,oGAAoG;AACpG,uEAAuE;AAEvE,oGAAoG;AACpG,kGAAkG;AAClG,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,GAAW,EACX,GAAW,EACX,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,0CAA0C,OAAO,EAAE,EAAE,CAAC;IACrG,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,QAAQ,oBAAoB,YAAY,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;QACzD,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,GAAG,qBAAqB,OAAO,CAAC,IAAI,2BAA2B,EAAE,CAAC;IACrG,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,8FAA8F;AAC9F,kGAAkG;AAClG,4BAA4B;AAC5B,MAAM,UAAU,gBAAgB,CAAC,KAAqB,EAAE,KAAmC;IACzF,OAAO,mBAAmB,CAAC;QACzB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,KAAkC;IACnE,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;QACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"in-process.js","sourceRoot":"","sources":["../src/in-process.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAgB,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,oGAAoG;AACpG,uEAAuE;AAEvE,oGAAoG;AACpG,kGAAkG;AAClG,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAuC,EACvC,GAAW,EACX,GAAW,EACX,GAAW,EACX,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,0CAA0C,OAAO,EAAE,EAAE,CAAC;IACrG,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,QAAQ,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;QACzD,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,GAAG,qBAAqB,OAAO,CAAC,IAAI,2BAA2B,EAAE,CAAC;IACrG,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,8FAA8F;AAC9F,kGAAkG;AAClG,4BAA4B;AAC5B,MAAM,UAAU,gBAAgB,CAAC,KAAqB,EAAE,KAAmC;IACzF,OAAO,mBAAmB,CAAC;QACzB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,KAAkC;IACnE,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;QACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC"}