@getmarrow/mcp 3.9.107 → 3.9.109

package/dist/win-private-state.js

@@ -0,0 +1,544 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WIN_ACL_ENCODED = exports.WIN_ACL_SCRIPT = exports.WIN_PROOF_CACHE_MS = exports.WIN_PROOF_MAX_BUFFER = exports.WIN_PROOF_TIMEOUT_MS = exports.WIN_BIRTH_TOLERANCE_MS = void 0;
+exports.realWindowsDeps = realWindowsDeps;
+exports.validWindowsPath = validWindowsPath;
+exports.parseSecurityDescriptor = parseSecurityDescriptor;
+exports.evaluateDescriptor = evaluateDescriptor;
+exports.proveWindowsPrivate = proveWindowsPrivate;
+exports.ensureWindowsPrivateState = ensureWindowsPrivateState;
+exports.verifyWindowsPrivateState = verifyWindowsPrivateState;
+// Windows private-state proof for the local loop guard (3.9.106 spec, parts A1 and A2).
+//
+// POSIX proves "private" with uid and mode bits. Node reports 0o666 for everything on Windows, so
+// the proof here uses the real Windows facts instead: a strict path grammar, no reparse point
+// anywhere in the chain, the canonical long path, and the owner plus DACL read as raw SIDs and
+// masks from the binary security descriptor that Windows PowerShell `Get-Acl` returns, parsed here
+// with a closed grammar. The ACL query runs before the state lock is taken, never while it is held.
+//
+// Fail closed: every error, timeout, parse doubt or unknown value is a refusal with a fixed reason
+// code. A reason never carries a path or a value. Nothing here reads HOME, the PATH, or any Marrow
+// key, and no secret is passed to the child process. All OS access goes through `WinDeps`.
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+/** A state file born this long before the proof began still counts as created after it (file-system clock granularity). */
+exports.WIN_BIRTH_TOLERANCE_MS = 250;
+// Sized from real cold-start data (a first PowerShell start on a slow runner); on expiry the proof still denies.
+exports.WIN_PROOF_TIMEOUT_MS = 5000;
+exports.WIN_PROOF_MAX_BUFFER = 65536;
+exports.WIN_PROOF_CACHE_MS = 2000;
+const MAX_DESCRIPTOR_BYTES = 12 * 1024;
+const MAX_DESCRIPTOR_LINE = 16 * 1024;
+const processCache = new Map();
+class WinRefusal extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+    }
+}
+function refuse(reason) { throw new WinRefusal(reason); }
+/** Production dependencies: Node's own fs, child_process and crypto. There is no env switch. */
+function realWindowsDeps() {
+    return {
+        platform: process.platform,
+        env: process.env,
+        lstatBig: (path) => (0, node_fs_1.lstatSync)(path, { bigint: true }),
+        realpathNative: (path) => node_fs_1.realpathSync.native(path),
+        spawnSync: (file, args, options) => require('node:child_process').spawnSync(file, args, options),
+        randomHex: (bytes) => (0, node_crypto_1.randomBytes)(bytes).toString('hex'),
+        now: () => Date.now(),
+        mkdir: (path) => { (0, node_fs_1.mkdirSync)(path); },
+        cache: processCache,
+    };
+}
+// ---- path grammar ------------------------------------------------------------------------
+const DEVICE_NAME = /^(?:CON|PRN|AUX|NUL|CONIN\$|CONOUT\$|(?:COM|LPT)[0-9\u00b9\u00b2\u00b3])$/i;
+/** True only for `X:\a\b` with no alias, device, stream, UNC, relative or forward-slash form. */
+function validWindowsPath(value) {
+    if (typeof value !== 'string' || value.length < 4 || value.length > 240)
+        return false;
+    if (!/^[A-Za-z]:\\/.test(value) || value.includes('/') || value.endsWith('\\'))
+        return false;
+    for (let index = 0; index < value.length; index += 1)
+        if (value.charCodeAt(index) < 0x20)
+            return false;
+    if (/[<>"|?*]/.test(value))
+        return false;
+    const rest = value.slice(3);
+    if (rest.includes(':'))
+        return false;
+    for (const part of rest.split('\\')) {
+        if (part === '' || part === '.' || part === '..' || part.endsWith('.') || part.endsWith(' '))
+            return false;
+        if (DEVICE_NAME.test(part.split('.')[0].replace(/ +$/, '')))
+            return false;
+    }
+    return true;
+}
+function componentCount(path) { return path.slice(3).split('\\').length; }
+function sameOrUnder(child, parent) {
+    const c = child.toLowerCase();
+    const p = parent.toLowerCase();
+    return c === p || c.startsWith(`${p}\\`);
+}
+/**
+ * Every prefix must be a plain folder (file at the end) and must resolve to itself. lstat alone is not
+ * enough on Windows: Node reports only some reparse points as links (a junction whose target is a
+ * volume GUID, or a volume mount point, looks like an ordinary folder). So each prefix also has to
+ * canonicalise to exactly one more component under the previous prefix's canonical path, with the
+ * same name (a different name is allowed only for an 8.3 short name, which contains `~`), on one volume.
+ */
+function chain(path, final, deps) {
+    if (!validWindowsPath(path))
+        refuse('path');
+    const parts = path.slice(3).split('\\');
+    let current = path.slice(0, 2);
+    let parentReal = current.toLowerCase();
+    const out = [];
+    for (let index = 0; index < parts.length; index += 1) {
+        current = `${current}\\${parts[index]}`;
+        let stat;
+        try {
+            stat = deps.lstatBig(current);
+        }
+        catch {
+            return refuse('chain');
+        }
+        if (stat.isSymbolicLink())
+            refuse('chain');
+        if (out.length > 0 && stat.dev !== out[0].stat.dev)
+            refuse('chain');
+        let real;
+        try {
+            real = deps.realpathNative(current);
+        }
+        catch {
+            return refuse('canonical');
+        }
+        if (!validWindowsPath(real) || real.startsWith('\\\\'))
+            return refuse('canonical');
+        const lowerReal = real.toLowerCase();
+        const name = real.slice(real.lastIndexOf('\\') + 1).toLowerCase();
+        if (!lowerReal.startsWith(`${parentReal}\\`) || componentCount(real) !== index + 1
+            || (name !== parts[index].toLowerCase() && !/~\d+(?:\.[^.]*)?$/.test(parts[index]) && !(index === 1 && parts[index].toLowerCase() === 'system32' && name === 'syswow64')))
+            return refuse('canonical');
+        parentReal = lowerReal;
+        if (final === 'file' && index === parts.length - 1 ? !stat.isFile() : !stat.isDirectory())
+            refuse('chain');
+        out.push({ path: current, stat });
+    }
+    return out;
+}
+function canonicalOf(lexical, deps) {
+    let real;
+    try {
+        real = deps.realpathNative(lexical);
+    }
+    catch {
+        return refuse('canonical');
+    }
+    if (!validWindowsPath(real) || real.startsWith('\\\\') || componentCount(real) !== componentCount(lexical))
+        return refuse('canonical');
+    return real;
+}
+// ---- the security descriptor: closed binary grammar ----------------------------------------------
+//
+// PowerShell returns `GetSecurityDescriptorBinaryForm()` as base64. Binary keeps SIDs and masks raw:
+// no SDDL alias table, no locale, no domain-relative alias (`LA`, `DU`, ...). Anything the grammar
+// does not know is a refusal.
+const CONTROL_ALLOWED = 0x0001 | 0x0002 | 0x0004 | 0x0008 | 0x0010 | 0x0020 | 0x0100 | 0x0200 | 0x0400 | 0x0800 | 0x1000 | 0x2000 | 0x4000 | 0x8000;
+const CONTROL_DACL_PRESENT = 0x0004;
+const CONTROL_SELF_RELATIVE = 0x8000;
+const ACE_ALLOWED = 0;
+const ACE_DENIED = 1;
+const ACE_FLAGS_ALLOWED = 0x1F; // object, container, no-propagate, inherit-only, inherited
+const ACE_INHERIT_ONLY = 0x08;
+// write/add-file, append/add-subdir, write-EA, delete-child, write-attributes, DELETE, WRITE_DAC,
+// WRITE_OWNER, ACCESS_SYSTEM_SECURITY, MAXIMUM_ALLOWED, GENERIC_ALL, GENERIC_WRITE
+const WRITE_CLASS = 0x2 | 0x4 | 0x10 | 0x40 | 0x100 | 0x10000 | 0x40000 | 0x80000 | 0x1000000 | 0x2000000 | 0x10000000 | 0x40000000;
+const CREATOR_OWNER = 'S-1-3-0';
+const CREATOR_GROUP = 'S-1-3-1';
+function sidAt(buffer, offset) {
+    if (offset < 0 || offset + 8 > buffer.length || buffer[offset] !== 1)
+        return null;
+    const count = buffer[offset + 1];
+    if (count < 1 || count > 15)
+        return null;
+    const length = 8 + 4 * count;
+    if (offset + length > buffer.length)
+        return null;
+    const authority = buffer.readUIntBE(offset + 2, 6);
+    const parts = [authority > 0xFFFFFFFF ? `0x${authority.toString(16)}` : String(authority)];
+    for (let index = 0; index < count; index += 1)
+        parts.push(String(buffer.readUInt32LE(offset + 8 + 4 * index)));
+    return { sid: `S-1-${parts.join('-')}`, length };
+}
+/** Self-relative SECURITY_DESCRIPTOR to its owner SID and allow/deny ACEs; null for anything outside the grammar. */
+function parseSecurityDescriptor(buffer) {
+    if (buffer.length < 20 || buffer.length > MAX_DESCRIPTOR_BYTES || buffer[0] !== 1 || buffer[1] !== 0)
+        return null;
+    const control = buffer.readUInt16LE(2);
+    if ((control & CONTROL_SELF_RELATIVE) === 0 || (control & CONTROL_DACL_PRESENT) === 0 || (control & ~CONTROL_ALLOWED) !== 0)
+        return null;
+    const ownerOffset = buffer.readUInt32LE(4);
+    const groupOffset = buffer.readUInt32LE(8);
+    const saclOffset = buffer.readUInt32LE(12);
+    const daclOffset = buffer.readUInt32LE(16);
+    // The SACL is never read (it grants nothing), but a flag and an offset that disagree are refused.
+    const saclPresent = (control & 0x0010) !== 0;
+    if ((!saclPresent && saclOffset !== 0) || (saclPresent && saclOffset !== 0 && (saclOffset < 20 || saclOffset >= buffer.length)))
+        return null;
+    // An owner is required, and a present but null DACL (offset 0) is refused: that grants everyone everything.
+    if (ownerOffset < 20 || daclOffset < 20)
+        return null;
+    const owner = sidAt(buffer, ownerOffset);
+    if (!owner)
+        return null;
+    const regions = [[ownerOffset, ownerOffset + owner.length]];
+    // The primary group grants nothing: syntax only, never evaluated.
+    if (groupOffset !== 0) {
+        const group = groupOffset < 20 ? null : sidAt(buffer, groupOffset);
+        if (!group)
+            return null;
+        regions.push([groupOffset, groupOffset + group.length]);
+    }
+    if (daclOffset + 8 > buffer.length)
+        return null;
+    const revision = buffer[daclOffset];
+    const aclSize = buffer.readUInt16LE(daclOffset + 2);
+    const count = buffer.readUInt16LE(daclOffset + 4);
+    if ((revision !== 2 && revision !== 4) || aclSize < 8 || daclOffset + aclSize > buffer.length || count > 1024)
+        return null;
+    const aclEnd = daclOffset + aclSize;
+    const aces = [];
+    let at = daclOffset + 8;
+    for (let index = 0; index < count; index += 1) {
+        if (at + 16 > aclEnd)
+            return null;
+        const type = buffer[at];
+        const flags = buffer[at + 1];
+        const size = buffer.readUInt16LE(at + 2);
+        if ((type !== ACE_ALLOWED && type !== ACE_DENIED) || (flags & ~ACE_FLAGS_ALLOWED) !== 0 || size < 16 || at + size > aclEnd)
+            return null;
+        const sid = sidAt(buffer, at + 8);
+        if (!sid || 8 + sid.length !== size)
+            return null;
+        aces.push({ type, flags, mask: buffer.readUInt32LE(at + 4), sid: sid.sid });
+        at += size;
+    }
+    if (at !== aclEnd)
+        return null;
+    regions.push([daclOffset, aclEnd]);
+    // The parts of one descriptor never overlap, and without a SACL (Get-Acl does not read one) the
+    // descriptor ends where its last part ends.
+    regions.sort((a, b) => a[0] - b[0]);
+    for (let index = 1; index < regions.length; index += 1)
+        if (regions[index][0] < regions[index - 1][1])
+            return null;
+    if (!saclPresent && regions[regions.length - 1][1] !== buffer.length)
+        return null;
+    return { owner: owner.sid, aces };
+}
+/**
+ * Judges one object's descriptor (base64) against `policy`. null: private enough. Otherwise a reason.
+ * The owner must be trusted; a deny ACE can only remove access and is skipped; every allow ACE for
+ * someone else is judged by its raw mask.
+ */
+function evaluateDescriptor(encoded, trusted, policy) {
+    if (typeof encoded !== 'string' || encoded.length === 0 || encoded.length > MAX_DESCRIPTOR_LINE || encoded.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded))
+        return 'descriptor';
+    const parsed = parseSecurityDescriptor(Buffer.from(encoded, 'base64'));
+    if (!parsed)
+        return 'descriptor';
+    if (!trusted.has(parsed.owner))
+        return 'owner';
+    for (const ace of parsed.aces) {
+        if (ace.type === ACE_DENIED || trusted.has(ace.sid))
+            continue;
+        if (ace.sid === CREATOR_OWNER && (ace.flags & ACE_INHERIT_ONLY) !== 0)
+            continue;
+        if (ace.sid === CREATOR_GROUP)
+            return 'acl';
+        if (policy === 'no_write_by_others' ? (ace.mask & WRITE_CLASS) !== 0 : ace.mask !== 0)
+            return 'acl';
+    }
+    return null;
+}
+// ---- the Get-Acl spawn ------------------------------------------------------------------------------
+// A source constant: no path or value is ever interpolated into it. It is passed as -EncodedCommand
+// (base64 of UTF-16LE), so there is no quoting, no standard-input session and no profile. Every ACL
+// line is written by the same expression that calls Get-Acl, so a failed Get-Acl can never leave an
+// earlier object's value to be printed for a later one. One catch turns any error into exit 3.
+// Paths come from MARROW_WINACL_P<i> environment items. The user's SID comes from the process token.
+const SCRIPT = [
+    "$ErrorActionPreference='Stop'",
+    "$ProgressPreference='SilentlyContinue'",
+    'try{',
+    "$nonce=[Environment]::GetEnvironmentVariable('MARROW_WINACL_NONCE')",
+    "[Console]::Out.WriteLine('BEGIN '+$nonce)",
+    "[Console]::Out.WriteLine('SID '+[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value)",
+    "$n=[int][Environment]::GetEnvironmentVariable('MARROW_WINACL_N')",
+    "for($i=1;$i -le $n;$i++){[Console]::Out.WriteLine('ACL '+$i+' '+[Convert]::ToBase64String((Microsoft.PowerShell.Security\\Get-Acl -LiteralPath ([Environment]::GetEnvironmentVariable('MARROW_WINACL_P'+$i))).GetSecurityDescriptorBinaryForm()))}",
+    "[Console]::Out.WriteLine('END '+$nonce)",
+    'exit 0',
+    '}catch{exit 3}',
+    '',
+].join('\n');
+exports.WIN_ACL_SCRIPT = SCRIPT;
+exports.WIN_ACL_ENCODED = Buffer.from(SCRIPT, 'utf16le').toString('base64');
+const POWERSHELL_ARGS = ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', exports.WIN_ACL_ENCODED];
+function parseOutput(stdout, nonce, count) {
+    if (typeof stdout !== 'string' || stdout.length > exports.WIN_PROOF_MAX_BUFFER)
+        return refuse('output');
+    const lines = stdout.split(/\r?\n/);
+    if (lines.length > 0 && lines[lines.length - 1] === '')
+        lines.pop();
+    if (lines.length !== count + 3)
+        return refuse('output');
+    if (lines[0] !== `BEGIN ${nonce}` || lines[lines.length - 1] !== `END ${nonce}`)
+        return refuse('output');
+    const sidLine = /^SID (S-1-\d{1,3}(?:-\d{1,10}){1,14})$/.exec(lines[1]);
+    if (!sidLine)
+        return refuse('output');
+    const descriptors = [];
+    for (let index = 1; index <= count; index += 1) {
+        const prefix = `ACL ${index} `;
+        const line = lines[index + 1];
+        if (!line.startsWith(prefix))
+            return refuse('output');
+        const descriptor = line.slice(prefix.length);
+        if (descriptor.length === 0 || descriptor.length > MAX_DESCRIPTOR_LINE)
+            return refuse('output');
+        descriptors.push(descriptor);
+    }
+    return { sid: sidLine[1], descriptors };
+}
+function systemRoot(env, canonicalHome) {
+    const root = env.SystemRoot;
+    if (typeof root !== 'string' || !/^[A-Za-z]:\\[A-Za-z0-9_.-]{1,64}$/.test(root) || !validWindowsPath(root))
+        return refuse('sysroot');
+    const windir = env.windir;
+    if (windir !== undefined && windir.toLowerCase() !== root.toLowerCase())
+        return refuse('sysroot');
+    if (sameOrUnder(root, canonicalHome))
+        return refuse('sysroot');
+    return root;
+}
+/** Folder identity: (dev, ino, birthtime) of every directory in the chains. ctime is not used: NTFS bumps it on every entry created inside. */
+function identityOf(stats) {
+    return [...stats.entries()].filter(([, stat]) => stat.isDirectory()).sort(([a], [b]) => (a < b ? -1 : 1))
+        .map(([path, stat]) => `${path}|${stat.dev}|${stat.ino}|${stat.birthtimeNs}`).join('\n');
+}
+// ---- the whole proof ----------------------------------------------------------------------------------
+function prove(request, deps) {
+    if (deps.platform !== 'win32')
+        refuse('platform');
+    if (request.objects.length === 0 || request.objects.length > 8)
+        refuse('internal');
+    const startedAt = deps.now();
+    const homeChain = chain(request.home, 'dir', deps);
+    const home = canonicalOf(request.home, deps);
+    const canonical = {};
+    const stats = new Map();
+    const fileKeys = {};
+    for (const entry of homeChain)
+        stats.set(entry.path.toLowerCase(), entry.stat);
+    const paths = [];
+    for (const object of request.objects) {
+        const lexical = `${home}\\${object.rel}`;
+        const links = chain(lexical, object.kind, deps);
+        const real = canonicalOf(lexical, deps);
+        if (!sameOrUnder(real, home) || canonical[object.rel] !== undefined)
+            refuse('canonical');
+        // A state file must not be a hard link.
+        if (object.kind === 'file') {
+            const last = links[links.length - 1].stat;
+            if (last.nlink !== 1n)
+                refuse('chain');
+            fileKeys[object.rel] = `${last.dev}:${last.ino}`;
+        }
+        for (const entry of links)
+            stats.set(entry.path.toLowerCase(), entry.stat);
+        canonical[object.rel] = real;
+        paths.push(real);
+    }
+    const root = systemRoot(deps.env, home);
+    const exe = `${root}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+    chain(exe, 'file', deps);
+    const realExe = canonicalOf(exe, deps);
+    if (sameOrUnder(realExe, home))
+        refuse('powershell');
+    const key = JSON.stringify([root, request.objects.map((object, index) => [object.rel, object.kind, object.policy, paths[index]])]);
+    const identity = identityOf(stats);
+    // A state file that was replaced is a different object: it is part of what a cached answer covers.
+    const signature = `${identity}\n${Object.entries(fileKeys).map(([rel, id]) => `${rel}=${id}`).join('\n')}`;
+    const cache = deps.cache;
+    const cached = cache?.get(key);
+    if (cached && cached.signature === signature && deps.now() - cached.at <= exports.WIN_PROOF_CACHE_MS && deps.now() - cached.at >= 0) {
+        return { home, canonical, identity, provedAtMs: cached.at, fileKeys };
+    }
+    cache?.delete(key);
+    let temp = `${root}\\Temp`;
+    try {
+        const candidate = `${home}\\AppData\\Local\\Temp`;
+        chain(candidate, 'dir', deps);
+        temp = canonicalOf(candidate, deps);
+    }
+    catch { /* fall back to the Windows temp folder */ }
+    const nonce = deps.randomHex(16);
+    if (!/^[0-9a-f]{32}$/.test(nonce))
+        refuse('internal');
+    const env = {
+        SystemRoot: root,
+        windir: root,
+        PSModulePath: `${root}\\System32\\WindowsPowerShell\\v1.0\\Modules`,
+        TEMP: temp,
+        TMP: temp,
+        MARROW_WINACL_NONCE: nonce,
+        MARROW_WINACL_N: String(paths.length),
+    };
+    paths.forEach((path, index) => { env[`MARROW_WINACL_P${index + 1}`] = path; });
+    let result;
+    try {
+        result = deps.spawnSync(realExe, POWERSHELL_ARGS, {
+            stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8', windowsHide: true, shell: false,
+            timeout: exports.WIN_PROOF_TIMEOUT_MS, maxBuffer: exports.WIN_PROOF_MAX_BUFFER, cwd: `${root}\\System32`, env,
+        });
+    }
+    catch {
+        return refuse('spawn');
+    }
+    if (result && result.error && result.error.code === 'ETIMEDOUT')
+        return refuse('timeout');
+    if (!result || result.error || result.signal || result.status !== 0)
+        return refuse('spawn');
+    const parsed = parseOutput(result.stdout, nonce, paths.length);
+    const trusted = new Set([parsed.sid, 'S-1-5-18', 'S-1-5-32-544']);
+    request.objects.forEach((object, index) => {
+        const verdict = evaluateDescriptor(parsed.descriptors[index], trusted, object.policy);
+        if (verdict !== null)
+            refuse(verdict);
+    });
+    cache?.set(key, { at: startedAt, signature });
+    return { home, canonical, identity, provedAtMs: startedAt, fileKeys };
+}
+/** The proof. Never throws; every failure is `{ ok: false, reason }`. */
+function proveWindowsPrivate(request, deps) {
+    try {
+        const proven = prove(request, deps);
+        return { ok: true, home: proven.home, canonical: proven.canonical, identity: proven.identity, provedAtMs: proven.provedAtMs, fileKeys: proven.fileKeys };
+    }
+    catch (error) {
+        return { ok: false, reason: error instanceof WinRefusal ? error.reason : 'internal' };
+    }
+}
+// ---- create the two directories, then prove them -------------------------------------------------------
+const STATE_DIRECTORY = 'session-loop-guard';
+const STATE_FILE = 'state.json';
+function presentNoFollow(path, deps) {
+    try {
+        deps.lstatBig(path);
+        return true;
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return false;
+        return refuse('chain');
+    }
+}
+function makeDirectory(path, deps) {
+    if (!presentNoFollow(path, deps)) {
+        try {
+            deps.mkdir(path);
+        }
+        catch (error) {
+            if (error?.code !== 'EEXIST')
+                refuse('mkdir');
+        }
+    }
+    chain(path, 'dir', deps);
+    // The parent is already canonical, so the child must resolve to exactly the path we built.
+    const real = canonicalOf(path, deps);
+    if (real.toLowerCase() !== path.toLowerCase())
+        refuse('canonical');
+    return real;
+}
+/**
+ * `~/.marrow` and `~/.marrow/session-loop-guard` are created when absent (they inherit the profile
+ * DACL), checked for reparse points and canonicalised after each creation, and then proven private
+ * together with `state.json` when it exists. `home` is the caller's `os.homedir()`; HOME is never read.
+ * This spawns PowerShell: call it BEFORE taking the state lock, never while holding it.
+ */
+function ensureWindowsPrivateState(home, deps) {
+    try {
+        if (deps.platform !== 'win32')
+            refuse('platform');
+        if (!validWindowsPath(home))
+            refuse('path');
+        const startedAt = deps.now();
+        chain(home, 'dir', deps);
+        const canonicalHome = canonicalOf(home, deps);
+        const marrow = makeDirectory(`${canonicalHome}\\.marrow`, deps);
+        const directory = makeDirectory(`${marrow}\\${STATE_DIRECTORY}`, deps);
+        const target = `${directory}\\${STATE_FILE}`;
+        const stateProven = presentNoFollow(target, deps);
+        const objects = [
+            { rel: '.marrow', kind: 'dir', policy: 'no_write_by_others' },
+            { rel: `.marrow\\${STATE_DIRECTORY}`, kind: 'dir', policy: 'no_access_by_others' },
+        ];
+        if (stateProven)
+            objects.push({ rel: `.marrow\\${STATE_DIRECTORY}\\${STATE_FILE}`, kind: 'file', policy: 'no_access_by_others' });
+        const proof = proveWindowsPrivate({ home: canonicalHome, objects }, deps);
+        if (!proof.ok)
+            return proof;
+        const stateKey = stateProven ? proof.fileKeys[`.marrow\\${STATE_DIRECTORY}\\${STATE_FILE}`] ?? null : null;
+        // Born after this moment means created inside the proven folder, which gave it the proven DACL.
+        const provedAtMs = Math.min(startedAt, proof.provedAtMs);
+        return { ok: true, marrow: proof.canonical['.marrow'], directory: proof.canonical[`.marrow\\${STATE_DIRECTORY}`], target, stateProven, identity: proof.identity, provedAtMs, stateKey };
+    }
+    catch (error) {
+        return { ok: false, reason: error instanceof WinRefusal ? error.reason : 'internal' };
+    }
+}
+/**
+ * Called while the state lock is held: the cheap structural half only (path grammar, no reparse
+ * point, canonical path, hard-link count) plus the folder identity of the earlier proof. It never
+ * spawns anything. A state file that appeared or was replaced after the proof is accepted if it is a
+ * plain single-link file in an unchanged, already proven folder: only a trusted principal can create
+ * entries there. A changed folder identity is a refusal, with no retry.
+ */
+function verifyWindowsPrivateState(home, proof, deps) {
+    try {
+        if (deps.platform !== 'win32' || !validWindowsPath(home))
+            return false;
+        const stats = new Map();
+        const note = (entries) => { for (const entry of entries)
+            stats.set(entry.path.toLowerCase(), entry.stat); };
+        chain(home, 'dir', deps);
+        const canonicalHome = canonicalOf(home, deps);
+        note(chain(canonicalHome, 'dir', deps));
+        for (const [expected, kind] of [[proof.marrow, 'dir'], [proof.directory, 'dir']]) {
+            note(chain(expected, kind, deps));
+            if (canonicalOf(expected, deps).toLowerCase() !== expected.toLowerCase() || !sameOrUnder(expected, canonicalHome))
+                return false;
+        }
+        if (presentNoFollow(proof.target, deps)) {
+            const entries = chain(proof.target, 'file', deps);
+            const file = entries[entries.length - 1].stat;
+            if (file.nlink !== 1n || canonicalOf(proof.target, deps).toLowerCase() !== proof.target.toLowerCase())
+                return false;
+            // The file the proof covered is fine. Any other state file (new, or renamed over by a writer) is accepted
+            // only if it was BORN after the proof began: a file created inside the proven folder inherited its
+            // DACL, while one moved in from elsewhere keeps its old DACL and an older birth time.
+            const covered = proof.stateKey !== null && proof.stateKey === `${file.dev}:${file.ino}`;
+            if (!covered && file.birthtimeNs < BigInt(Math.max(0, proof.provedAtMs - exports.WIN_BIRTH_TOLERANCE_MS)) * 1000000n)
+                return false;
+        }
+        return identityOf(stats) === proof.identity;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=win-private-state.js.map

package/dist/win-private-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"win-private-state.js","sourceRoot":"","sources":["../src/win-private-state.ts"],"names":[],"mappings":";;;AAwDA,0CAYC;AAOD,4CAYC;AAwFD,0DAiDC;AAOD,gDAYC;AAiJD,kDAOC;AAoCD,8DAyBC;AASD,8DA0BC;AA3eD,wFAAwF;AACxF,EAAE;AACF,kGAAkG;AAClG,8FAA8F;AAC9F,+FAA+F;AAC/F,mGAAmG;AACnG,oGAAoG;AACpG,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,2FAA2F;AAC3F,6CAA0C;AAC1C,qCAA+E;AAe/E,2HAA2H;AAC9G,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAc1C,iHAAiH;AACpG,QAAA,oBAAoB,GAAG,IAAI,CAAC;AAC5B,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC7B,QAAA,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;AAE3D,MAAM,UAAW,SAAQ,KAAK;IACP;IAArB,YAAqB,MAAiB;QAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAAnC,WAAM,GAAN,MAAM,CAAW;IAAmB,CAAC;CAC3D;AACD,SAAS,MAAM,CAAC,MAAiB,IAAW,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAE3E,gGAAgG;AAChG,SAAgB,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAS,EAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAY,CAAC,MAAM,CAAC,IAAI,CAAC;QACnD,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAE,OAAO,CAAC,oBAAoB,CAAyC,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAA8B;QACtK,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAA,mBAAS,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,KAAK,EAAE,YAAY;KACpB,CAAC;AACJ,CAAC;AAED,6FAA6F;AAE7F,MAAM,WAAW,GAAG,4EAA4E,CAAC;AAEjG,iGAAiG;AACjG,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACtF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IACvG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3G,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,IAAY,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1F,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc;IAChD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAMD;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,IAAY,EAAE,KAAqB,EAAE,IAAa;IAC/D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,IAAI,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,GAAG,GAAG,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACxE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAClF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,UAAU,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC;eAC7E,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QACxM,UAAU,GAAG,SAAS,CAAC;QACvB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3G,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAa;IACjD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;IAClF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IACvI,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qGAAqG;AACrG,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,8BAA8B;AAE9B,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AACpJ,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,iBAAiB,GAAG,IAAI,CAAC,CAAC,2DAA2D;AAC3F,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,kGAAkG;AAClG,mFAAmF;AACnF,MAAM,WAAW,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AACpI,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,aAAa,GAAG,SAAS,CAAC;AAKhC,SAAS,KAAK,CAAC,MAAc,EAAE,MAAc;IAC3C,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7B,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAa,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACrG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/G,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,qHAAqH;AACrH,SAAgB,uBAAuB,CAAC,MAAc;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,oBAAoB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClH,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzI,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3C,kGAAkG;IAClG,MAAM,WAAW,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,WAAW,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,UAAU,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7I,4GAA4G;IAC5G,IAAI,WAAW,GAAG,EAAE,IAAI,UAAU,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAA4B,CAAC,CAAC,WAAW,EAAE,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,kEAAkE;IAClE,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3H,MAAM,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IACpC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,EAAE,GAAG,UAAU,GAAG,CAAC,CAAC;IACxB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;QACxI,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,EAAE,IAAI,IAAI,CAAC;IACb,CAAC;IACD,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACnC,gGAAgG;IAChG,4CAA4C;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACnH,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAAgB,EAAE,OAA4B,EAAE,MAAiB;IAClG,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IAC5L,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,IAAI,GAAG,CAAC,GAAG,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC;YAAE,SAAS;QAChF,IAAI,GAAG,CAAC,GAAG,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACtG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AAExG,oGAAoG;AACpG,oGAAoG;AACpG,oGAAoG;AACpG,+FAA+F;AAC/F,qGAAqG;AACrG,MAAM,MAAM,GAAG;IACb,+BAA+B;IAC/B,wCAAwC;IACxC,MAAM;IACN,qEAAqE;IACrE,2CAA2C;IAC3C,uGAAuG;IACvG,kEAAkE;IAClE,oPAAoP;IACpP,yCAAyC;IACzC,QAAQ;IACR,gBAAgB;IAChB,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACA,QAAA,cAAc,GAAG,MAAM,CAAC;AACxB,QAAA,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjF,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAe,CAAC,CAAC;AAEzG,SAAS,WAAW,CAAC,MAAe,EAAE,KAAa,EAAE,KAAa;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,4BAAoB;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,KAAK,GAAG,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,mBAAmB;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,GAAmB,EAAE,aAAqB;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACrI,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAClG,IAAI,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+IAA+I;AAC/I,SAAS,UAAU,CAAC,KAA+B;IACjD,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACtG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7F,CAAC;AAED,0GAA0G;AAE1G,SAAS,KAAK,CAAC,OAAwD,EAAE,IAAa;IACpF,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,IAAI,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACzF,wCAAwC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1C,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,qDAAqD,CAAC;IACzE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAErD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnI,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,mGAAmG;IACnG,MAAM,SAAS,GAAG,GAAG,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,0BAAkB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5H,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC;IACxE,CAAC;IACD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnB,IAAI,IAAI,GAAG,GAAG,IAAI,QAAQ,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,IAAI,wBAAwB,CAAC;QAClD,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,GAAG,GAA2B;QAClC,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,GAAG,IAAI,8CAA8C;QACnE,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,IAAI;QACT,mBAAmB,EAAE,KAAK;QAC1B,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;KACtC,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE;YAChD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK;YACpF,OAAO,EAAE,4BAAoB,EAAE,SAAS,EAAE,4BAAoB,EAAE,GAAG,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG;SAC9F,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACnC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,IAAK,MAAM,CAAC,KAA+B,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACrH,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,SAAgB,mBAAmB,CAAC,OAAwD,EAAE,IAAa;IACzG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3J,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACxF,CAAC;AACH,CAAC;AAED,2GAA2G;AAE3G,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAC7C,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,SAAS,eAAe,CAAC,IAAY,EAAE,IAAa;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA2C,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAa;IAChD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACvC,IAAK,KAA2C,EAAE,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACzB,2FAA2F;IAC3F,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,yBAAyB,CAAC,IAAa,EAAE,IAAa;IACpE,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,aAAa,WAAW,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,MAAM,KAAK,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,GAAG,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAgB;YAC3B,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAC7D,EAAE,GAAG,EAAE,YAAY,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE;SACnF,CAAC;QACF,IAAI,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,eAAe,KAAK,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClI,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,eAAe,KAAK,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3G,gGAAgG;QAChG,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC1L,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACxF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,IAAa,EAAE,KAAkB,EAAE,IAAa;IACxF,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,OAAqB,EAAQ,EAAE,GAAG,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAU,EAAE,CAAC;YAC1F,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAClC,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC;gBAAE,OAAO,KAAK,CAAC;QAClI,CAAC;QACD,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9C,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;gBAAE,OAAO,KAAK,CAAC;YACpH,0GAA0G;YAC1G,mGAAmG;YACnG,sFAAsF;YACtF,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACxF,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,GAAG,8BAAsB,CAAC,CAAC,GAAG,QAAU;gBAAE,OAAO,KAAK,CAAC;QAC/H,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/mcp",
-  "version": "3.9.107",
+  "version": "3.9.109",
   "mcpName": "ai.getmarrow/marrow",
   "description": "Marrow AI MCP server: a named yes before your AI agent acts, and proof the next agent can reuse.",
   "bin": {

package/server.json

@@ -24,12 +24,12 @@
       ]
     }
   ],
-  "version": "3.9.107",
+  "version": "3.9.109",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@getmarrow/mcp",
-      "version": "3.9.107",
+      "version": "3.9.109",
       "transport": {
         "type": "stdio"
       },