@detergent-software/conductor 3.0.0-dev.4 → 3.0.0-dev.41

package/build/host/keychain.js

@@ -0,0 +1,44 @@
+// macOS generic passwords in the login keychain, through `security`: the target is the item's
+// service, its user name the account. `security` answers 44 for an item that isn't there.
+const NOT_FOUND = 44;
+// The item's account from `security find-generic-password`'s attributes: `"acct"<blob>="linear"`.
+// An account saved as hex (not printable) reads as none.
+export function account(attributes) {
+    return /"acct"<blob>="((?:[^"\\]|\\.)*)"/.exec(attributes)?.[1] ?? '';
+}
+export function keychain(run, keychainFile) {
+    // A keychain file of its own, for the real-OS tests; else the user's search list.
+    const where = keychainFile === undefined ? [] : [keychainFile];
+    const find = (args, env) => run('security', ['find-generic-password', ...args, ...where], { env, timeoutMs: 30_000 });
+    // Never echo stdout in a reason: on a partial failure it could hold the secret.
+    const failed = (target, result) => {
+        const why = result.error ?? (result.stderr.trim() || `exit ${result.code}`);
+        if (/ENOENT/.test(why))
+            return { found: false, missing: true, reason: 'no `security` command to ask' };
+        return { found: false, missing: false, reason: `the keychain item ${target} couldn't be read (${why})` };
+    };
+    return {
+        name: 'the login keychain',
+        // The attributes first (no secret is printed without -w), then the secret of the item with that
+        // account, so the two come from one item even when another has the same service.
+        read: async (target, env) => {
+            const attributes = await find(['-s', target], env);
+            if (attributes.code === NOT_FOUND)
+                return { found: false, missing: true, reason: `no keychain item ${target}` };
+            if (attributes.code !== 0)
+                return failed(target, attributes);
+            const user = account(attributes.stdout);
+            const result = await find(['-s', target, ...(user ? ['-a', user] : []), '-w'], env);
+            const secret = result.stdout.replace(/\r?\n$/, '');
+            if (result.code !== 0 || !secret)
+                return failed(target, result);
+            return { credential: { secret, user }, found: true };
+        },
+        // Delete first: an item is one per service and account, so saving under another user name would
+        // leave the old item beside it. -w last with no value: security asks for the password.
+        saveCommand: (target, user) => `security delete-generic-password -s ${target}; security add-generic-password -s ${target} -a ${user} -w`,
+        // A missing item costs read one call, the same as asking first.
+        saved: async () => 'unknown',
+    };
+}
+//# sourceMappingURL=keychain.js.map

package/build/host/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/host/keychain.ts"],"names":[],"mappings":"AAEA,8FAA8F;AAC9F,0FAA0F;AAC1F,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,kGAAkG;AAClG,yDAAyD;AACzD,MAAM,UAAU,OAAO,CAAC,UAAkB;IACxC,OAAO,kCAAkC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAQ,EAAE,YAAqB;IACtD,kFAAkF;IAClF,MAAM,KAAK,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,GAAsB,EAAE,EAAE,CAC/D,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,gFAAgF;IAChF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAgC,EAAkB,EAAE;QAClF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACvG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC;IAC3G,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,gGAAgG;QAChG,iFAAiF;QACjF,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA2B,EAAE;YACnD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,MAAM,EAAE,EAAE,CAAC;YAChH,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChE,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,gGAAgG;QAChG,uFAAuF;QACvF,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAC5B,uCAAuC,MAAM,sCAAsC,MAAM,OAAO,IAAI,KAAK;QAC3G,gEAAgE;QAChE,KAAK,EAAE,KAAK,IAA8B,EAAE,CAAC,SAAS;KACvD,CAAC;AACJ,CAAC"}

package/build/host/launchd.js

@@ -0,0 +1,118 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { ConductorError } from "../errors.js";
+import { outputOf } from "../run.js";
+export const LAUNCHD_LABEL = 'software.detergent.conductor';
+// How long launchd gives supervise to stop its daemon after a SIGTERM before it kills it: a stop
+// waits up to 20 s, and launchd's own default is 20 s.
+const EXIT_TIMEOUT_S = 60;
+const UNLOAD_POLL_MS = 250;
+// A launchd agent in ~/Library/LaunchAgents that runs `conduct supervise` as the user logs in
+// (RunAtLoad). launchd loads it into the login session's gui/<uid> domain, so loading it starts it
+// too. supervise restarts the daemon and conduct stop must stick, so no KeepAlive; and launchd
+// would kill the job's process group as supervise ends, workers included, without
+// AbandonProcessGroup. Its output goes to ~/.conductor/logs/startup.log.
+// Unloading signals supervise and returns before launchd has removed the job, so the reload waits
+// until it has: by then supervise has stopped its daemon and the lock is free.
+export function launchd({ home, run, uid }) {
+    const plist = join(home, 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`);
+    const domain = `gui/${uid}`;
+    const service = `${domain}/${LAUNCHD_LABEL}`;
+    const launchctl = (args) => run('launchctl', args, { timeoutMs: 60_000 });
+    const loaded = async () => (await launchctl(['print', service])).code === 0;
+    const bootstrap = async () => {
+        const result = await launchctl(['bootstrap', domain, plist]);
+        if (result.code !== 0)
+            throw launchctlFailed('could not load the launchd agent', result);
+    };
+    const text = () => (existsSync(plist) ? readFileSync(plist, 'utf8') : undefined);
+    return {
+        install: async (spec) => {
+            const logs = join(home, '.conductor', 'logs');
+            mkdirSync(dirname(plist), { recursive: true });
+            // launchd opens the log before supervise runs, and makes no folder for it.
+            mkdirSync(logs, { recursive: true });
+            writeFileSync(plist, launchdPlist(spec, join(logs, 'startup.log')));
+            // A loaded agent keeps the definition it was loaded with, so it goes first: that ends the
+            // daemon it started, and loading starts it again.
+            if (await loaded()) {
+                const unloaded = await launchctl(['bootout', service]);
+                const until = Date.now() + (EXIT_TIMEOUT_S + 30) * 1000;
+                while (await loaded()) {
+                    if (Date.now() > until)
+                        throw launchctlFailed('could not unload the launchd agent', unloaded);
+                    await new Promise((done) => setTimeout(done, UNLOAD_POLL_MS));
+                }
+            }
+            await bootstrap();
+            return ['launchd started it as it loaded it'];
+        },
+        name: `the launchd agent ${LAUNCHD_LABEL}`,
+        // The plist alone goes: the loaded agent stays until logout, so a daemon it started keeps
+        // running, as on Windows.
+        remove: async () => {
+            if (!existsSync(plist))
+                return false;
+            rmSync(plist);
+            return true;
+        },
+        // An agent unloaded since logon (or never loaded) starts as it loads. kickstart does nothing to
+        // a supervise still ending, and the start falls back after its wait, as with the Windows task.
+        run: async () => {
+            if (!(await loaded()))
+                return bootstrap();
+            const result = await launchctl(['kickstart', service]);
+            if (result.code !== 0)
+                throw launchctlFailed('could not start the launchd agent', result);
+        },
+        runsCli: async (cliPath) => text()?.includes(`<string>${xml(cliPath)}</string>`) ?? false,
+        supervises: async () => /<string>supervise<\/string>\s*<\/array>/.test(text() ?? ''),
+    };
+}
+// The agent's plist.
+export function launchdPlist({ cliPath, nodePath, path }, log) {
+    const string = (value) => `<string>${xml(value)}</string>`;
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        '<dict>',
+        '  <key>Label</key>',
+        `  ${string(LAUNCHD_LABEL)}`,
+        '  <key>ProgramArguments</key>',
+        '  <array>',
+        ...[nodePath, cliPath, 'supervise'].map((arg) => `    ${string(arg)}`),
+        '  </array>',
+        '  <key>EnvironmentVariables</key>',
+        '  <dict>',
+        '    <key>PATH</key>',
+        `    ${string(path)}`,
+        '  </dict>',
+        '  <key>RunAtLoad</key>',
+        '  <true/>',
+        '  <key>AbandonProcessGroup</key>',
+        '  <true/>',
+        '  <key>ExitTimeOut</key>',
+        `  <integer>${EXIT_TIMEOUT_S}</integer>`,
+        '  <key>StandardOutPath</key>',
+        `  ${string(log)}`,
+        '  <key>StandardErrorPath</key>',
+        `  ${string(log)}`,
+        '</dict>',
+        '</plist>',
+        '',
+    ].join('\n');
+}
+function launchctlFailed(what, result) {
+    if (/ENOENT/.test(result.error ?? '')) {
+        return new ConductorError(`${what}: no launchctl`, ['start `conduct supervise` from your own login items']);
+    }
+    return new ConductorError(what, [
+        outputOf(result, 1000),
+        'launchd loads an agent into a logged-in session: run it in a terminal on the Mac, not over ssh alone',
+    ]);
+}
+function xml(text) {
+    return text.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+//# sourceMappingURL=launchd.js.map

package/build/host/launchd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd.js","sourceRoot":"","sources":["../../src/host/launchd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAM1C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,CAAC,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAE5D,iGAAiG;AACjG,uDAAuD;AACvD,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,8FAA8F;AAC9F,mGAAmG;AACnG,+FAA+F;AAC/F,kFAAkF;AAClF,yEAAyE;AACzE,kGAAkG;AAClG,+EAA+E;AAC/E,MAAM,UAAU,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAA2C;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,aAAa,QAAQ,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,aAAa,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,IAAuB,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,KAAK,IAAsB,EAAE,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;QAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,eAAe,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAC3F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,GAAuB,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErG,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAC9C,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,2EAA2E;YAC3E,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YACpE,0FAA0F;YAC1F,kDAAkD;YAClD,IAAI,MAAM,MAAM,EAAE,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;gBACxD,OAAO,MAAM,MAAM,EAAE,EAAE,CAAC;oBACtB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;wBAAE,MAAM,eAAe,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC;oBAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YACD,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,CAAC,oCAAoC,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,EAAE,qBAAqB,aAAa,EAAE;QAC1C,0FAA0F;QAC1F,0BAA0B;QAC1B,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,gGAAgG;QAChG,+FAA+F;QAC/F,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,IAAI,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC;gBAAE,OAAO,SAAS,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,eAAe,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK;QACzF,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,yCAAyC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,qBAAqB;AACrB,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAe,EAAE,GAAW;IAChF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,WAAW,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;IAC3E,OAAO;QACL,wCAAwC;QACxC,wGAAwG;QACxG,uBAAuB;QACvB,QAAQ;QACR,oBAAoB;QACpB,KAAK,MAAM,CAAC,aAAa,CAAC,EAAE;QAC5B,+BAA+B;QAC/B,WAAW;QACX,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,YAAY;QACZ,mCAAmC;QACnC,UAAU;QACV,qBAAqB;QACrB,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE;QACrB,WAAW;QACX,wBAAwB;QACxB,WAAW;QACX,kCAAkC;QAClC,WAAW;QACX,0BAA0B;QAC1B,cAAc,cAAc,YAAY;QACxC,8BAA8B;QAC9B,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE;QAClB,gCAAgC;QAChC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE;QAClB,SAAS;QACT,UAAU;QACV,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAiB;IACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,cAAc,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE;QAC9B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;QACtB,sGAAsG;KACvG,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC"}

package/build/host/libsecret.js

@@ -0,0 +1,40 @@
+// Linux secrets in the Secret Service (GNOME Keyring, KeePassXC and others), through libsecret's
+// `secret-tool`: an item with the attributes service=conductor and target=<target>, its user name in
+// a `user` attribute. secret-tool needs a D-Bus session with a Secret Service on it; a headless box
+// without one can't read, and the env fallback (secrets.ts) stands in.
+const SERVICE = 'conductor';
+export function libsecret(run) {
+    const tool = (args, env) => run('secret-tool', args, { env, timeoutMs: 30_000 });
+    const lookup = (target, env) => tool(['lookup', 'service', SERVICE, 'target', target], env);
+    return {
+        name: 'libsecret',
+        read: async (target, env) => {
+            const result = await lookup(target, env);
+            const secret = result.stdout.replace(/\r?\n$/, '');
+            if (result.code === 0 && secret) {
+                // search prints the item's attributes, and its secret, which only the user line is read from.
+                const found = await tool(['search', 'service', SERVICE, 'target', target], env);
+                return { credential: { secret, user: userOf(`${found.stdout}\n${found.stderr}`) }, found: true };
+            }
+            if (result.error !== null && /ENOENT/.test(result.error))
+                return { found: false, missing: true, reason: 'no secret-tool (libsecret-tools) to ask' };
+            // lookup exits 1 and says nothing for an item that isn't there.
+            if (result.code === 1 && !result.stderr.trim())
+                return { found: false, missing: true, reason: `no libsecret item ${target}` };
+            // Never echo stdout here: on a partial failure it could hold the secret.
+            const why = result.error ?? (result.stderr.trim().split(/\r?\n/)[0] || `exit ${result.code}`);
+            return { found: false, missing: false, reason: `the libsecret item ${target} couldn't be read (${why})` };
+        },
+        // Clear first: store replaces only an item whose attributes are all the same, so saving under
+        // another user name would leave the old item beside it, and lookup and search could each pick
+        // another one. secret-tool store asks for the secret.
+        saveCommand: (target, user) => `secret-tool clear service ${SERVICE} target ${target}; secret-tool store --label=${target} service ${SERVICE} target ${target} user ${user}`,
+        // Asking would be a lookup, which reads the secret: read decides instead.
+        saved: async () => 'unknown',
+    };
+}
+// The `user` attribute from `secret-tool search`: `attribute.user = linear`.
+export function userOf(search) {
+    return /^attribute\.user = (.*)$/m.exec(search)?.[1]?.trim() ?? '';
+}
+//# sourceMappingURL=libsecret.js.map

package/build/host/libsecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"libsecret.js","sourceRoot":"","sources":["../../src/host/libsecret.ts"],"names":[],"mappings":"AAEA,iGAAiG;AACjG,qGAAqG;AACrG,oGAAoG;AACpG,uEAAuE;AACvE,MAAM,OAAO,GAAG,WAAW,CAAC;AAE5B,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,GAAsB,EAAE,EAAE,CAC/D,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAsB,EAAE,EAAE,CACxD,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAE9D,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA2B,EAAE;YACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBAChC,8FAA8F;gBAC9F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChF,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACnG,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;YAC5F,gEAAgE;YAChE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,MAAM,EAAE,EAAE,CAAC;YAChF,yEAAyE;YACzE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC;QAC5G,CAAC;QACD,8FAA8F;QAC9F,8FAA8F;QAC9F,sDAAsD;QACtD,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAC5B,6BAA6B,OAAO,WAAW,MAAM,+BAA+B,MAAM,YAAY,OAAO,WAAW,MAAM,SAAS,IAAI,EAAE;QAC/I,0EAA0E;QAC1E,KAAK,EAAE,KAAK,IAA8B,EAAE,CAAC,SAAS;KACvD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,MAAM,CAAC,MAAc;IACnC,OAAO,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrE,CAAC"}

package/build/host/macos-terminal.js

@@ -0,0 +1,63 @@
+import { outputOf } from "../run.js";
+import { shLine, shQuote, viaSh } from "./shell.js";
+// A string as AppleScript reads it, in double quotes.
+export function appleString(text) {
+    return `"${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+// Terminal.app: a new window per tab (Terminal has no named windows to add a tab to), titled.
+export function appleTerminal(run) {
+    return macTerminal(run, 'Terminal', (tab) => [
+        'tell application "Terminal"',
+        'activate',
+        `set t to do script ${appleString(macLine(tab))}`,
+        `set custom title of t to ${appleString(cleanTitle(tab.title))}`,
+        'end tell',
+    ]);
+}
+// iTerm: a tab in its front window, or a new window when none is open, named after the tab. An
+// iTerm that wasn't running opens a window of its own as it starts: the tab takes that window's
+// session instead of adding one beside it.
+export function iterm(run) {
+    return macTerminal(run, 'iTerm', (tab) => [
+        'set wasRunning to application "iTerm" is running',
+        'tell application "iTerm"',
+        'activate',
+        'if (count of windows) is 0 then',
+        'set w to (create window with default profile)',
+        'else',
+        'set w to current window',
+        'if wasRunning then tell w to create tab with default profile',
+        'end if',
+        'tell current session of w',
+        `set name to ${appleString(cleanTitle(tab.title))}`,
+        `write text ${appleString(macLine(tab))}`,
+        'end tell',
+        'end tell',
+    ]);
+}
+// What a macOS tab types into its shell: the folder and the command through sh, then `exit`, so the
+// shell ends with the command as a Windows Terminal or tmux tab does (Terminal closes the window
+// then if its profile says to). The shell is the user's login shell, in its own environment, so
+// `env` goes on the line.
+export function macLine(tab) {
+    return `${viaSh(`cd ${shQuote(tab.cwd)} && ${shLine(tab)}`)}; exit`;
+}
+function cleanTitle(title) {
+    return title.replace(/\s+/g, ' ').trim().slice(0, 80);
+}
+// Runs the AppleScript, one `-e` per line: osascript takes it as arguments, never through a shell.
+function macTerminal(run, name, script) {
+    return {
+        attachHint: () => null,
+        name,
+        open: async (tab) => {
+            const result = await run('osascript', script(tab).flatMap((line) => ['-e', line]), { timeoutMs: 60_000 });
+            if (result.code === 0)
+                return null;
+            return result.error !== null && /ENOENT/.test(result.error)
+                ? 'no osascript to open it with'
+                : outputOf(result, 500);
+        },
+    };
+}
+//# sourceMappingURL=macos-terminal.js.map

package/build/host/macos-terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos-terminal.js","sourceRoot":"","sources":["../../src/host/macos-terminal.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEpD,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACjE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,GAAQ;IACpC,OAAO,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3C,6BAA6B;QAC7B,UAAU;QACV,sBAAsB,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;QACjD,4BAA4B,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;QAChE,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,gGAAgG;AAChG,2CAA2C;AAC3C,MAAM,UAAU,KAAK,CAAC,GAAQ;IAC5B,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QACxC,kDAAkD;QAClD,0BAA0B;QAC1B,UAAU;QACV,iCAAiC;QACjC,+CAA+C;QAC/C,MAAM;QACN,yBAAyB;QACzB,8DAA8D;QAC9D,QAAQ;QACR,2BAA2B;QAC3B,eAAe,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;QACnD,cAAc,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;QACzC,UAAU;QACV,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,gGAAgG;AAChG,0BAA0B;AAC1B,MAAM,UAAU,OAAO,CAAC,GAAyD;IAC/E,OAAO,GAAG,KAAK,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,GAAQ,EAAE,IAAY,EAAE,MAAqC;IAChF,OAAO;QACL,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,IAAI;QACJ,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAC3C,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/build/host/platform.js

@@ -0,0 +1,4 @@
+export function hostPlatform(platform = process.platform) {
+    return platform === 'win32' || platform === 'darwin' ? platform : 'linux';
+}
+//# sourceMappingURL=platform.js.map

package/build/host/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/host/platform.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,YAAY,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACvE,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5E,CAAC"}

package/build/host/secrets.js

@@ -0,0 +1,46 @@
+import { run as runCommand } from "../run.js";
+import { credentialManager } from "./credential-manager.js";
+import { keychain } from "./keychain.js";
+import { libsecret } from "./libsecret.js";
+import { hostPlatform } from "./platform.js";
+// The env var that stands in for the credential `target` where the store has none, or can't be
+// read (a headless Linux box with no keyring): CONDUCTOR_SECRET_ and the target in upper snake
+// case, with its user name, when one is needed, in the same name plus _USER.
+export function secretEnvName(target) {
+    return `CONDUCTOR_SECRET_${target
+        .toUpperCase()
+        .replace(/[^A-Z0-9]+/g, '_')
+        .replace(/^_+|_+$/g, '')}`;
+}
+// This platform's store, with the env fallback.
+export function secretStore({ platform = hostPlatform(), run = runCommand, } = {}) {
+    const stores = {
+        darwin: () => keychain(run),
+        linux: () => libsecret(run),
+        win32: () => credentialManager(run),
+    };
+    return withEnvFallback(stores[platform]());
+}
+// The store, else secretEnvName(target) from the environment.
+export function withEnvFallback(store) {
+    const fromEnv = (target, env) => {
+        const name = secretEnvName(target);
+        const secret = env[name]?.trim();
+        return secret ? { secret, user: env[`${name}_USER`]?.trim() ?? '' } : null;
+    };
+    return {
+        name: store.name,
+        read: async (target, env) => {
+            const got = await store.read(target, env);
+            if (got.found)
+                return got;
+            const credential = fromEnv(target, env);
+            return credential
+                ? { credential, found: true }
+                : { ...got, reason: `${got.reason}, and no ${secretEnvName(target)}` };
+        },
+        saveCommand: (target, user) => store.saveCommand(target, user),
+        saved: async (target, env) => (fromEnv(target, env) ? 'saved' : store.saved(target, env)),
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/build/host/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/host/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,IAAI,UAAU,EAAmC,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAqB,YAAY,EAAE,MAAM,eAAe,CAAC;AA8BhE,+FAA+F;AAC/F,+FAA+F;AAC/F,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,oBAAoB,MAAM;SAC9B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,WAAW,CAAC,EAC1B,QAAQ,GAAG,YAAY,EAAE,EACzB,GAAG,GAAG,UAAU,MAC0B,EAAE;IAC5C,MAAM,MAAM,GAA4C;QACtD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3B,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;QAC3B,KAAK,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC;KACpC,CAAC;IACF,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,GAAsB,EAAqB,EAAE;QAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,GAAG,CAAC,KAAK;gBAAE,OAAO,GAAG,CAAC;YAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO,UAAU;gBACf,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC7B,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,YAAY,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;QAC9D,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC1F,CAAC;AACJ,CAAC"}

package/build/host/shell.js

@@ -0,0 +1,26 @@
+import { win32 } from 'node:path';
+// What a held tab says when its command fails, such as "claude attach failed, press Enter to close
+// this tab". win32's basename splits on both / and \, so a Windows path reads the same on any host.
+export function failedText(command) {
+    const [program = '', verb] = command;
+    const name = win32.basename(program).replace(/\.(exe|cmd)$/i, '');
+    return `${verb === undefined ? name : `${name} ${verb}`} failed, press Enter to close this tab`;
+}
+// The tab's command as one sh line: its env first, and with `hold`, a failure that waits for Enter
+// before the tab closes.
+export function shLine(tab) {
+    const env = Object.entries(tab.env).map(([name, value]) => `${name}=${shQuote(value)}`);
+    const line = [...(env.length > 0 ? ['env', ...env] : []), ...tab.command.map(shQuote)].join(' ');
+    return tab.hold ? `${line} || { echo ${shQuote(failedText(tab.command))}; read _; }` : line;
+}
+// A word as sh reads it: bare when it can't be taken for anything else, else in single quotes.
+export function shQuote(word) {
+    return /^[\w%+,./:=@-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+// A line run through sh, as one word for the shell that runs it. tmux's default-shell and a macOS
+// login shell are the user's, which may not be sh (fish has no `{ …; }`); `sh -c '…'` reads the same
+// in each.
+export function viaSh(line) {
+    return `sh -c ${shQuote(line)}`;
+}
+//# sourceMappingURL=shell.js.map

package/build/host/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/host/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAIlC,mGAAmG;AACnG,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,wCAAwC,CAAC;AAClG,CAAC;AAED,mGAAmG;AACnG,yBAAyB;AACzB,MAAM,UAAU,MAAM,CAAC,GAAiD;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,cAAc,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9F,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACnF,CAAC;AAED,kGAAkG;AAClG,qGAAqG;AACrG,WAAW;AACX,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,OAAO,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAClC,CAAC"}

package/build/host/startup.js

@@ -0,0 +1,26 @@
+import { homedir, userInfo } from 'node:os';
+import { run as runCommand } from "../run.js";
+import { launchd } from "./launchd.js";
+import { hostPlatform } from "./platform.js";
+import {} from "./secrets.js";
+import { systemd } from "./systemd.js";
+import { taskScheduler } from "./task-scheduler.js";
+// This platform's startup.
+export function startup({ env = process.env, home = homedir(), platform = hostPlatform(), run = runCommand, uid = process.getuid?.() ?? 0, user = userName(), } = {}) {
+    const startups = {
+        darwin: () => launchd({ home, run, uid }),
+        linux: () => systemd({ env, home, run, user }),
+        win32: () => taskScheduler(run),
+    };
+    return startups[platform]();
+}
+// userInfo throws for a uid with no passwd entry, such as a container's.
+function userName() {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return process.env.USER ?? '';
+    }
+}
+//# sourceMappingURL=startup.js.map

package/build/host/startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.js","sourceRoot":"","sources":["../../src/host/startup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAqB,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAY,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAuCpD,2BAA2B;AAC3B,MAAM,UAAU,OAAO,CAAC,EACtB,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,IAAI,GAAG,OAAO,EAAE,EAChB,QAAQ,GAAG,YAAY,EAAE,EACzB,GAAG,GAAG,UAAU,EAChB,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,EAC7B,IAAI,GAAG,QAAQ,EAAE,MACF,EAAE;IACjB,MAAM,QAAQ,GAAwC;QACpD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACzC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC9C,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;KAChC,CAAC;IACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,yEAAyE;AACzE,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,CAAC;AACH,CAAC"}

package/build/host/systemd.js

@@ -0,0 +1,91 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { ConductorError } from "../errors.js";
+import { outputOf } from "../run.js";
+export const SYSTEMD_UNIT = 'conductor.service';
+// A systemd user unit that runs `conduct supervise` when the user's service manager starts: at
+// login, or at boot with lingering on. supervise restarts the daemon and conduct stop must stick,
+// so no Restart=; and KillMode=process, or the unit ending (a stop, an upgrade) would kill its whole
+// cgroup, the workers and tmux the daemon started included. Its output goes to the journal
+// (journalctl --user -u conductor).
+export function systemd({ env, home, run, user, }) {
+    // systemd reads user units from $XDG_CONFIG_HOME/systemd/user, ~/.config without it.
+    const unit = join(env.XDG_CONFIG_HOME || join(home, '.config'), 'systemd', 'user', SYSTEMD_UNIT);
+    const systemctl = async (what, args) => {
+        const result = await run('systemctl', ['--user', ...args], { timeoutMs: 60_000 });
+        if (result.code !== 0)
+            throw systemctlFailed(what, result);
+    };
+    const text = () => (existsSync(unit) ? readFileSync(unit, 'utf8') : undefined);
+    return {
+        install: async (spec) => {
+            mkdirSync(dirname(unit), { recursive: true });
+            writeFileSync(unit, systemdUnit(spec));
+            await systemctl('could not load the systemd unit', ['daemon-reload']);
+            await systemctl('could not enable the systemd unit', ['enable', SYSTEMD_UNIT]);
+            // A running one keeps the command it started with until it restarts.
+            await systemctl('could not start the systemd unit', ['restart', SYSTEMD_UNIT]);
+            const linger = await run('loginctl', ['show-user', user, '--property=Linger', '--value'], { timeoutMs: 30_000 });
+            return [
+                'systemd started it now',
+                ...(linger.stdout.trim() === 'yes'
+                    ? []
+                    : [
+                        `it starts at your login; to start it at boot on a machine nobody logs in to, run \`loginctl enable-linger ${user || '$USER'}\``,
+                    ]),
+            ];
+        },
+        name: `the systemd user unit ${SYSTEMD_UNIT}`,
+        // Disabled and gone, but not stopped: a daemon it started keeps running, as on Windows.
+        remove: async () => {
+            if (!existsSync(unit))
+                return false;
+            await systemctl('could not disable the systemd unit', ['disable', SYSTEMD_UNIT]);
+            rmSync(unit);
+            await run('systemctl', ['--user', 'daemon-reload'], { timeoutMs: 60_000 });
+            return true;
+        },
+        run: () => systemctl('could not start the systemd unit', ['start', SYSTEMD_UNIT]),
+        runsCli: async (cliPath) => execStart(text())?.includes(` ${unitWord(cliPath)} `) ?? false,
+        supervises: async () => / supervise$/.test(execStart(text()) ?? ''),
+    };
+}
+// The unit file.
+export function systemdUnit({ cliPath, nodePath, path }) {
+    return [
+        '[Unit]',
+        'Description=The conductor daemon (conduct supervise)',
+        '',
+        '[Service]',
+        `ExecStart=${[nodePath, cliPath].map((word) => unitWord(word)).join(' ')} supervise`,
+        `Environment=${unitWord(`PATH=${path}`, false)}`,
+        'KillMode=process',
+        '',
+        '[Install]',
+        'WantedBy=default.target',
+        '',
+    ].join('\n');
+}
+function execStart(unit) {
+    return /^ExecStart=(.*)$/m.exec(unit ?? '')?.[1];
+}
+function systemctlFailed(what, result) {
+    if (/ENOENT/.test(result.error ?? '')) {
+        return new ConductorError(`${what}: no systemctl`, ['start `conduct supervise` from your own login items']);
+    }
+    return new ConductorError(what, [
+        outputOf(result, 1000),
+        "systemctl --user needs your login session's service manager: run it in a session you logged in to, not after su",
+    ]);
+}
+// A word in quotes, as ExecStart= and Environment= read it: `%` starts a specifier, and in
+// ExecStart= `$` an environment variable.
+function unitWord(text, command = true) {
+    const escaped = text
+        .replaceAll('\\', '\\\\')
+        .replaceAll('"', '\\"')
+        .replaceAll('%', '%%')
+        .replaceAll('$', () => (command ? '$$' : '$'));
+    return `"${escaped}"`;
+}
+//# sourceMappingURL=systemd.js.map

package/build/host/systemd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd.js","sourceRoot":"","sources":["../../src/host/systemd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAM1C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEhD,+FAA+F;AAC/F,kGAAkG;AAClG,qGAAqG;AACrG,2FAA2F;AAC3F,oCAAoC;AACpC,MAAM,UAAU,OAAO,CAAC,EACtB,GAAG,EACH,IAAI,EACJ,GAAG,EACH,IAAI,GAML;IACC,qFAAqF;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAE,IAAuB,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,GAAuB,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEnG,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACtB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,MAAM,SAAS,CAAC,iCAAiC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;YACtE,MAAM,SAAS,CAAC,mCAAmC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;YAC/E,qEAAqE;YACrE,MAAM,SAAS,CAAC,kCAAkC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YACjH,OAAO;gBACL,wBAAwB;gBACxB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK;oBAChC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,6GAA6G,IAAI,IAAI,OAAO,IAAI;qBACjI,CAAC;aACP,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,yBAAyB,YAAY,EAAE;QAC7C,wFAAwF;QACxF,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,MAAM,SAAS,CAAC,oCAAoC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,kCAAkC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK;QAC1F,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,WAAW,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAe;IAClE,OAAO;QACL,QAAQ;QACR,sDAAsD;QACtD,EAAE;QACF,WAAW;QACX,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY;QACpF,eAAe,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,CAAC,EAAE;QAChD,kBAAkB;QAClB,EAAE;QACF,WAAW;QACX,yBAAyB;QACzB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAiB;IACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,cAAc,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE;QAC9B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;QACtB,iHAAiH;KAClH,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,0CAA0C;AAC1C,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAO,GAAG,IAAI;IAC5C,MAAM,OAAO,GAAG,IAAI;SACjB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;SACtB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC;SACrB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,OAAO,GAAG,CAAC;AACxB,CAAC"}

package/build/host/task-scheduler.js

@@ -0,0 +1,78 @@
+import { ConductorError } from "../errors.js";
+import { outputOf } from "../run.js";
+export const TASK_NAME = 'Conductor';
+// The task's <Arguments> quote the cli.js path (install); XML escapes it, and Windows paths compare
+// without case.
+export function taskRunsCli(xml, cliPath) {
+    const args = taskArguments(xml);
+    return args !== undefined && args.toLowerCase().includes(`"${cliPath.toLowerCase()}"`);
+}
+// A per-user Task Scheduler task that runs `conduct supervise` at logon, which keeps `conduct serve`
+// running (supervise.ts). No elevation is needed for a task that runs as the current user.
+// conhost --headless keeps a console window (or a Windows Terminal tab) from opening, and the zero
+// time limit stops Task Scheduler from ending the daemon after its default 72 hours. A second start
+// while one runs exits on the pid lock, and its supervisor with it. Installing doesn't start it.
+export function taskScheduler(run) {
+    const schtasks = (args) => run('schtasks', args, { timeoutMs: 60_000 });
+    const taskXml = async () => {
+        const result = await schtasks(['/Query', '/TN', TASK_NAME, '/XML']);
+        return result.code === 0 ? result.stdout : undefined;
+    };
+    const installed = async () => (await schtasks(['/Query', '/TN', TASK_NAME])).code === 0;
+    return {
+        install: async ({ cliPath, nodePath }) => {
+            const script = [
+                "$ErrorActionPreference = 'Stop'",
+                '$user = "$env:USERDOMAIN\\$env:USERNAME"',
+                '$action = New-ScheduledTaskAction -Execute "$env:SystemRoot\\System32\\conhost.exe" -Argument $env:CONDUCTOR_TASK_ARGS',
+                '$trigger = New-ScheduledTaskTrigger -AtLogOn -User $user',
+                '$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit ([TimeSpan]::Zero)',
+                '$principal = New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Limited',
+                `Register-ScheduledTask -TaskName '${TASK_NAME}' -Description 'Starts the conductor daemon (conduct supervise) at logon.' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force | Out-Null`,
+            ].join('\n');
+            const result = await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+                env: { ...process.env, CONDUCTOR_TASK_ARGS: `--headless "${nodePath}" "${cliPath}" supervise` },
+                timeoutMs: 60_000,
+            });
+            if (result.code !== 0)
+                throw new ConductorError('could not register the logon task', [outputOf(result, 1000)]);
+            return [];
+        },
+        name: `the "${TASK_NAME}" logon task`,
+        remove: async () => {
+            if (!(await installed()))
+                return false;
+            const result = await schtasks(['/Delete', '/TN', TASK_NAME, '/F']);
+            if (result.code !== 0)
+                throw new ConductorError('could not remove the logon task', [outputOf(result, 1000)]);
+            return true;
+        },
+        run: async () => {
+            const result = await schtasks(['/Run', '/TN', TASK_NAME]);
+            if (result.code !== 0)
+                throw new ConductorError(`could not run the "${TASK_NAME}" logon task`, [outputOf(result, 1000)]);
+        },
+        runsCli: async (cliPath) => {
+            const xml = await taskXml();
+            return xml !== undefined && taskRunsCli(xml, cliPath);
+        },
+        supervises: async () => {
+            const xml = await taskXml();
+            return xml !== undefined && taskSupervises(xml);
+        },
+    };
+}
+export function taskSupervises(xml) {
+    return /\ssupervise\s*$/.test(taskArguments(xml) ?? '');
+}
+// The task action's <Arguments>, XML unescaped.
+function taskArguments(xml) {
+    return /<Arguments>([^<]*)<\/Arguments>/
+        .exec(xml)?.[1]
+        ?.replaceAll('&quot;', '"')
+        .replaceAll('&apos;', "'")
+        .replaceAll('&lt;', '<')
+        .replaceAll('&gt;', '>')
+        .replaceAll('&amp;', '&');
+}
+//# sourceMappingURL=task-scheduler.js.map

package/build/host/task-scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-scheduler.js","sourceRoot":"","sources":["../../src/host/task-scheduler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAErC,oGAAoG;AACpG,gBAAgB;AAChB,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe;IACtD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACzF,CAAC;AAED,qGAAqG;AACrG,2FAA2F;AAC3F,mGAAmG;AACnG,oGAAoG;AACpG,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,GAAQ;IACpC,MAAM,QAAQ,GAAG,CAAC,IAAuB,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,KAAK,IAAiC,EAAE;QACtD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,IAAsB,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IAE1G,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG;gBACb,iCAAiC;gBACjC,0CAA0C;gBAC1C,wHAAwH;gBACxH,0DAA0D;gBAC1D,uLAAuL;gBACvL,gGAAgG;gBAChG,qCAAqC,SAAS,0KAA0K;aACzN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;gBAChG,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,eAAe,QAAQ,MAAM,OAAO,aAAa,EAAE;gBAC/F,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/G,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,EAAE,QAAQ,SAAS,cAAc;QACrC,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,iCAAiC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7G,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBACnB,MAAM,IAAI,cAAc,CAAC,sBAAsB,SAAS,cAAc,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,OAAO,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,OAAO,GAAG,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,iCAAiC;SACrC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACf,EAAE,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC1B,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;SACvB,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;SACvB,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC"}