@hearsay-tools/squawk 0.0.0-stage → 0.17.0-pr3058.5683

package/dist/server-install/platforms/macosx-ngrok.js

@@ -0,0 +1,490 @@
+import { productName } from '../../home/display.js';
+import { shellQuote } from '../../core/shell-env.js';
+import { productIdentity } from '../../home/identity.js';
+import { commandText } from '../../home/command.js';
+import { launchdRemoteEnv } from './service-env.js';
+import { productEnvEntries } from '../../core/product-env.js';
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { CANCEL, PreflightError } from '../types.js';
+import { brewInstallTool, brewRemoveHint, depCheckStep, HOSTNAME_RE, owned, shared, StepAborted, StepCancelled, verifyCommand } from '../steps.js';
+import { REBRAND_SWITCH } from '../../home/switch.js';
+import { launchdHealthDetails, migrateLaunchd, rollbackLaunchdMigration, startLaunchdServices, stopLaunchdServices, unloadLaunchd } from './macosx-migration.js';
+import { applyMigrationReport } from '../migration-report.js';
+import { guardLaunchdWrite, ownsLaunchdPlist, readLaunchdPlist } from './macosx-launchd-files.js';
+import { refreshNpxCacheForRedeploy } from '../npx-cache.js';
+/**
+ * The `macosx-ngrok` strategy: the app runs locally on a Mac and ngrok is the
+ * public front, in place of nginx+certbot. ngrok's built-in `--basic-auth` is
+ * the identity gate (the htpasswd equivalent), and a launchd agent is the
+ * autostart (the systemd equivalent). Proves the engine seam with a genuinely
+ * different platform — same engine, different steps.
+ */
+/** Keep OS-user discovery at one injectable boundary. */
+function launchAgentsDir(ctx) {
+    return ctx.launchAgentsDir?.() ?? join(homedir(), 'Library', 'LaunchAgents');
+}
+/** Agents that `server-migrate` stops and starts: recorded in the ledger, or a launcher that proves it ours. */
+function launchdServices(ctx, rebrand) {
+    const services = [];
+    for (const [step, role] of [['autostart', 'cockpit'], ['ngrok', 'ngrok']]) {
+        const agent = agentArtifact(ctx, step, rebrand);
+        const recorded = ctx.state.steps[step]?.created?.artifacts.some((a) => a.kind === 'owned' && a.type === 'launchd');
+        if (recorded || (existsSync(agent.path) && ownsLaunchdPlist(ctx, agent, readLaunchdPlist(agent.path))))
+            services.push({ ...agent, role });
+    }
+    return services;
+}
+/** Move the agents; a dry run also names each health check under the label the agent has after its move. */
+async function migrateAgents(ctx, rebrand) {
+    const report = await migrateLaunchd(ctx, launchAgentsDir(ctx), rebrand);
+    if (!rebrand || !ctx.dryRun || report.errors.length)
+        return report;
+    try {
+        const after = { ...ctx, state: applyMigrationReport(ctx.state, report) };
+        report.details = [...report.details ?? [], ...launchdHealthDetails(launchdServices(after, rebrand), ctx.state.primaryPort)];
+    }
+    catch (error) {
+        report.errors.push({ artifact: { kind: 'owned', type: 'launchd', path: launchAgentsDir(ctx) }, message: error instanceof Error ? error.message : String(error) });
+    }
+    return report;
+}
+function labelFor(agent, rebrand) {
+    return `${rebrand ? 'tools.hearsay.squawk' : 'ai.cezar'}.${agent}`;
+}
+function agentCandidates(ctx, step, rebrand, created) {
+    const agent = step === 'ngrok' ? 'ngrok' : 'cockpit';
+    const selected = labelFor(agent, rebrand);
+    const artifact = (name) => ({ kind: 'owned', type: 'launchd', name, path: join(launchAgentsDir(ctx), `${name}.plist`) });
+    const recorded = created?.artifacts.find((a) => a.kind === 'owned' && a.type === 'launchd');
+    // A ledger is authoritative: static fallback must not claim an unrelated old agent.
+    if (recorded) {
+        const fallback = artifact(recorded.name ?? selected);
+        return [{ ...recorded, ...fallback, path: recorded.path ?? fallback.path }];
+    }
+    if (!rebrand)
+        return [artifact(selected)];
+    const legacy = artifact(labelFor(agent, false));
+    return legacyCandidateOwned(ctx, step, legacy) ? [artifact(selected), legacy] : [artifact(selected)];
+}
+/** Legacy cockpit ownership comes from its launcher; ngrok needs a pre-switch null record. */
+function legacyCandidateOwned(ctx, step, artifact) {
+    if (step === 'ngrok')
+        return ctx.state.steps[step]?.created === null;
+    try {
+        return ownsLaunchdPlist(ctx, artifact, readLaunchdPlist(artifact.path));
+    }
+    catch {
+        return false;
+    }
+}
+function agentArtifact(ctx, step, rebrand, created = ctx.state.steps[step]?.created) {
+    const candidates = agentCandidates(ctx, step, rebrand, created);
+    return candidates.find((a) => existsSync(a.path)) ?? candidates[0];
+}
+async function removeAgent(ctx, { name, path }) {
+    const uid = process.getuid ? process.getuid() : 0;
+    await ctx.runner.capture('launchctl', ['bootout', `gui/${uid}/${name}`]);
+    rmSync(path, { force: true });
+}
+/**
+ * `launchctl bootstrap` + proof the agent actually loaded. A discarded
+ * bootstrap exit code (malformed plist, spawn failure) used to record the
+ * step `done` — install reported complete with nothing running.
+ */
+async function bootstrapVerified(ctx, uid, label, path, what) {
+    const code = await ctx.runner.interactive('launchctl', ['bootstrap', `gui/${uid}`, path]);
+    const loaded = (await ctx.runner.capture('launchctl', ['print', `gui/${uid}/${label}`])).code === 0;
+    if (code !== 0 || !loaded) {
+        throw new StepAborted(`launchctl could not load ${what} (bootstrap exit ${code}) — inspect it with: launchctl print gui/${uid}/${label}`);
+    }
+}
+/** Both agents use private plists; ngrok's plist contains plaintext credentials. */
+async function installAgent(ctx, previous, name, path, xml, what) {
+    const target = { kind: 'owned', type: 'launchd', name, path };
+    const existing = guardLaunchdWrite(ctx, target, { selected: previous });
+    mkdirSync(launchAgentsDir(ctx), { recursive: true });
+    writeFileSync(path, xml, { encoding: 'utf8', mode: 0o600, flag: existing === undefined ? 'wx' : 'w' });
+    // mode only applies on create; protect re-installs over an existing 0644 plist too.
+    chmodSync(path, 0o600);
+    const uid = process.getuid ? process.getuid() : 0;
+    // Modern launchctl avoids legacy load's EIO on current macOS. Unload before re-install.
+    await ctx.runner.capture('launchctl', ['bootout', `gui/${uid}/${name}`]);
+    try {
+        await bootstrapVerified(ctx, uid, name, path, what);
+        // A different plist can share the new label; do not stop that new job again.
+        if (previous.name !== name)
+            await unloadLaunchd(ctx, previous.name);
+        if (previous.path !== path)
+            rmSync(previous.path, { force: true });
+    }
+    catch (error) {
+        if (previous.name !== name) {
+            guardLaunchdWrite(ctx, target, { selected: target, expectedXml: xml });
+            await unloadLaunchd(ctx, name);
+            rmSync(path, { force: true });
+            const oldLoaded = (await ctx.runner.capture('launchctl', ['print', `gui/${uid}/${previous.name}`])).code === 0;
+            if (!oldLoaded && existsSync(previous.path))
+                await bootstrapVerified(ctx, uid, previous.name, previous.path, 'the previous agent');
+        }
+        throw error;
+    }
+}
+/** Escape a value for inclusion in plist XML text. */
+function escapeXml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+/** launchd agent that keeps an authenticated ngrok tunnel to the local cockpit up. */
+export function launchdPlist(port, basicAuth, domain, ngrokBin = '/opt/homebrew/bin/ngrok', rebrand = REBRAND_SWITCH) {
+    const args = ['http', String(port), '--basic-auth', basicAuth];
+    if (domain)
+        args.push('--domain', domain);
+    // Escape every arg — a password/domain with `&`, `<`, `>` would otherwise
+    // produce invalid plist XML and launchctl would silently fail to load it.
+    const argXml = [ngrokBin, ...args]
+        .map((a) => `      <string>${escapeXml(a)}</string>`)
+        .join('\n');
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!-- Managed by cezar server-install — do not edit by hand. -->
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>${labelFor('ngrok', rebrand)}</string>
+    <key>ProgramArguments</key>
+    <array>
+${argXml}
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+  </dict>
+</plist>
+`;
+}
+const ngrokStep = (rebrand) => ({
+    id: 'ngrok',
+    title: 'ngrok tunnel (authtoken + domain + basic-auth)',
+    async check(ctx) {
+        if (ctx.dryRun)
+            return false;
+        return verifyCommand(ctx, 'test', ['-f', agentArtifact(ctx, 'ngrok', rebrand).path]);
+    },
+    async run(ctx) {
+        // 1) ngrok present?
+        const present = await verifyCommand(ctx, 'ngrok', ['version']);
+        if (!present) {
+            if (ctx.dryRun)
+                ctx.ui.info('DRY RUN — would run: brew install ngrok/ngrok/ngrok');
+            else
+                await ctx.runner.interactive('brew', ['install', 'ngrok/ngrok/ngrok']);
+        }
+        // 2) authtoken (a secret — never stored in server.json; it lives in ngrok's own config)
+        const token = await ctx.ui.password({
+            message: 'Paste your ngrok authtoken (dashboard.ngrok.com → Your Authtoken)',
+            validate: (v) => (v.trim() ? undefined : 'authtoken is required'),
+        });
+        if (token === CANCEL)
+            throw new StepCancelled();
+        // The token expands INSIDE the child shell: argv carries only the literal
+        // string `"$NGROK_AUTHTOKEN"`, so `ps` never sees the secret. It lands in
+        // ngrok's own config (~/Library/Application Support/ngrok/ngrok.yml, 0600
+        // by ngrok itself), never in server.json.
+        if (!ctx.dryRun) {
+            const code = await ctx.runner.interactive('bash', ['-c', 'ngrok config add-authtoken "$NGROK_AUTHTOKEN"'], {
+                env: { NGROK_AUTHTOKEN: String(token) },
+            });
+            if (code !== 0)
+                throw new StepAborted('ngrok rejected the authtoken (`ngrok config add-authtoken` failed) — check the token and re-run');
+        }
+        // 3) reserved domain (optional → ephemeral URL)
+        const domainInput = await ctx.ui.text({
+            message: 'Reserved ngrok domain (leave blank for an ephemeral URL that changes on restart)',
+            placeholder: `cezar.ngrok.app`,
+            // Bare hostname only — `https://…` here used to yield `--domain https://…`
+            // in the plist and a `https://https://…` publicUrl.
+            validate: (v) => (!v.trim() || HOSTNAME_RE.test(v.trim()) ? undefined : `enter a bare hostname (no scheme), e.g. cezar.ngrok.app`),
+        });
+        if (domainInput === CANCEL)
+            throw new StepCancelled();
+        // Guard against `String(undefined)` → `"undefined"` — @clack/prompts can
+        // return undefined when the user accepts without typing over the placeholder.
+        const domain = typeof domainInput === 'string' && domainInput.trim() ? domainInput.trim() : undefined;
+        // 4) basic-auth identity
+        const user = await ctx.ui.text({
+            message: 'Basic-auth username for the tunnel',
+            placeholder: 'ops',
+            validate: (v) => (v.trim() ? undefined : 'username is required'),
+        });
+        if (user === CANCEL)
+            throw new StepCancelled();
+        const password = await ctx.ui.password({
+            message: `Basic-auth password for "${user}"`,
+            validate: (v) => (v.length >= 6 ? undefined : 'use at least 6 characters'),
+        });
+        if (password === CANCEL)
+            throw new StepCancelled();
+        if (!ctx.dryRun && String(password).length < 6) {
+            throw new StepAborted('a basic-auth password (≥6 chars) is required — run server-install without --yes to set one');
+        }
+        const basicAuth = `${String(user)}:${String(password)}`;
+        // 5) launchd agent (the plist embeds the basic-auth creds, like htpasswd on Linux)
+        const previous = agentArtifact(ctx, 'ngrok', rebrand);
+        const name = labelFor('ngrok', rebrand);
+        const path = join(launchAgentsDir(ctx), `${name}.plist`);
+        if (ctx.dryRun) {
+            ctx.ui.info(`DRY RUN — would write ${path} and launchctl bootstrap it.`);
+        }
+        else {
+            // Resolve the real ngrok binary path so the plist works on both Apple
+            // Silicon (/opt/homebrew/bin) and Intel (/usr/local/bin) Macs.
+            const ngrokBin = (await ctx.runner.capture('bash', ['-lc', 'command -v ngrok'])).stdout.trim() || '/opt/homebrew/bin/ngrok';
+            await installAgent(ctx, previous, name, path, launchdPlist(ctx.state.primaryPort, basicAuth, domain, ngrokBin, rebrand), 'the ngrok tunnel agent');
+        }
+        if (domain) {
+            ctx.state.publicUrl = `https://${domain}`;
+            ctx.state.ephemeral = false;
+        }
+        else {
+            ctx.state.ephemeral = true;
+            ctx.ui.note('No reserved domain — the tunnel URL is ephemeral and changes each restart. Find it at http://localhost:4040.', 'ngrok');
+        }
+        return {
+            artifacts: [
+                shared('ngrok-config', { name: 'authtoken', removeHint: 'ngrok config add-authtoken "" (or edit ~/Library/Application Support/ngrok/ngrok.yml)' }),
+                owned('launchd', { name, path }),
+            ],
+        };
+    },
+    async undo(ctx, created) {
+        // Prefer the recorded identity; check() can leave created:null, so keep the
+        // selected-label fallback to remove credential-bearing agents in that case.
+        if (ctx.dryRun) {
+            ctx.ui.info('DRY RUN — would launchctl bootout and remove the ngrok agent.');
+        }
+        else {
+            await removeAgent(ctx, agentArtifact(ctx, 'ngrok', rebrand, created));
+        }
+        const cfg = (created?.artifacts ?? []).find((a) => a.type === 'ngrok-config');
+        if (cfg) {
+            ctx.ui.note(`The ngrok authtoken was left in ngrok's own config — remove it yourself if you want it gone:\n${cfg.removeHint ?? ''}`, 'ngrok');
+        }
+    },
+});
+/* ── autostart: run cezar itself as a launchd agent ─────────────────── */
+/** Live launchd `ProgramArguments` joined into one string so the shared npx-cache
+ *  helper can classify the launch form the same way ubuntu-vps classifies ExecStart.
+ *  Empty string when the plist can't be read — callers then skip the cache refresh
+ *  rather than guessing. */
+function readCezarProgramArguments(path) {
+    try {
+        const xml = readFileSync(path, 'utf8');
+        const inner = xml.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/)?.[1];
+        if (inner === undefined)
+            return '';
+        return [...inner.matchAll(/<string>([\s\S]*?)<\/string>/g)]
+            .map((m) => (m[1] ?? '').replaceAll('&amp;', '&').replaceAll('&lt;', '<').replaceAll('&gt;', '>'))
+            .map(shellQuote).join(' ');
+    }
+    catch {
+        return '';
+    }
+}
+/** Resolve the argv array for the cezar launchd agent, mirroring how the CLI was launched. */
+export async function resolveCezarArgv(ctx, rebrand = REBRAND_SWITCH) {
+    const node = process.execPath;
+    const pkgRoot = resolve(fileURLToPath(new URL('../../..', import.meta.url)));
+    const entry = join(pkgRoot, 'dist', rebrand ? `${productIdentity(rebrand).command}.js` : 'index.js');
+    const cliPackage = productIdentity(rebrand).npmAlias;
+    const npxPath = join(dirname(node), 'npx');
+    if (/[/\\]_npx[/\\]/.test(pkgRoot))
+        return [npxPath, '--yes', cliPackage];
+    if (ctx.dryRun || existsSync(entry))
+        return [node, entry];
+    const out = (await ctx.runner.capture('bash', ['-lc', rebrand ? `command -v ${productIdentity(rebrand).command}` : `command -v ${cliPackage} || command -v cez`])).stdout.trim();
+    const globalBin = out.split('\n').map((s) => s.trim()).filter(Boolean).pop();
+    if (globalBin)
+        return [node, globalBin];
+    // No runnable cezar → installing a KeepAlive agent would make launchd
+    // respawn-throttle a permanently failing job across reboots. Fail the step.
+    throw new StepAborted(`could not locate a runnable ${productName('cezar', rebrand)} (${entry} missing, no global ${cliPackage}) — ` +
+        `install it (npm i -g ${cliPackage}) or build the checkout, then re-run with --reconfigure autostart`);
+}
+/** launchd agent that keeps the cezar cockpit running on the given port. */
+export function cezarLaunchdPlist(repoRoot, port, argv, rebrand = REBRAND_SWITCH) {
+    // Give the agent the operator's PATH so cezar can spawn claude/gh/codex.
+    const pathDirs = [dirname(process.execPath), ...(process.env.PATH ?? '').split(':'), '/usr/local/bin', '/usr/bin', '/bin']
+        .filter((d, i, a) => d && d !== '.' && a.indexOf(d) === i);
+    const fullArgv = [...argv, 'serve', '--no-open', '--port', String(port)];
+    const argXml = fullArgv.map((a) => `      <string>${escapeXml(a)}</string>`).join('\n');
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!-- Managed by cezar server-install — do not edit by hand. -->
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>${labelFor('cockpit', rebrand)}</string>
+    <key>ProgramArguments</key>
+    <array>
+${argXml}
+    </array>
+    <key>WorkingDirectory</key>
+    <string>${escapeXml(repoRoot)}</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+${Object.entries(productEnvEntries('REMOTE', '1', true)).reverse().map(([key, value]) => `      <key>${key}</key>\n      <string>${value}</string>`).join('\n')}
+      <key>PATH</key>
+      <string>${escapeXml(pathDirs.join(':'))}</string>
+    </dict>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+  </dict>
+</plist>
+`;
+}
+/** Idempotent env drift repair retains the selected agent's identity and command. */
+function repairAgentEnv(ctx, agent) {
+    if (!existsSync(agent.path))
+        return false;
+    const current = readLaunchdPlist(agent.path);
+    const next = launchdRemoteEnv(current);
+    if (next === current)
+        return false;
+    guardLaunchdWrite(ctx, agent, { selected: agent, expectedXml: current });
+    writeFileSync(agent.path, next, { encoding: 'utf8', mode: 0o600 });
+    chmodSync(agent.path, 0o600);
+    return true;
+}
+const autostartStep = (rebrand) => ({
+    id: 'autostart',
+    title: `Run ${productName('cezar', rebrand)} as a service (launchd — starts now + on boot)`,
+    async check(ctx) {
+        if (ctx.dryRun)
+            return false;
+        const agent = agentArtifact(ctx, 'autostart', rebrand);
+        if (!await verifyCommand(ctx, 'test', ['-f', agent.path]))
+            return false;
+        const current = readLaunchdPlist(agent.path);
+        return launchdRemoteEnv(current) === current;
+    },
+    async run(ctx) {
+        const argv = await resolveCezarArgv(ctx, rebrand);
+        const previous = agentArtifact(ctx, 'autostart', rebrand);
+        const name = labelFor('cockpit', rebrand);
+        const path = join(launchAgentsDir(ctx), `${name}.plist`);
+        if (ctx.dryRun) {
+            ctx.ui.info(`DRY RUN — would write ${path} and launchctl bootstrap it.`);
+        }
+        else {
+            await installAgent(ctx, previous, name, path, cezarLaunchdPlist(ctx.repoRoot, ctx.state.primaryPort, argv, rebrand), `the ${productName('cezar', rebrand)} cockpit agent`);
+        }
+        return { artifacts: [owned('launchd', { name, path })] };
+    },
+    async undo(ctx, created) {
+        // Recorded identity, with the same null-ledger fallback as ngrok.
+        if (ctx.dryRun) {
+            ctx.ui.info(`DRY RUN — would launchctl bootout and remove the ${productName('cezar', rebrand)} agent.`);
+        }
+        else {
+            await removeAgent(ctx, agentArtifact(ctx, 'autostart', rebrand, created));
+        }
+    },
+});
+const identityStep = {
+    id: 'identity',
+    title: 'Identity check (ngrok basic-auth active)',
+    async check() {
+        return false;
+    },
+    async run(ctx) {
+        if (ctx.dryRun) {
+            ctx.ui.info('DRY RUN — would confirm the ngrok tunnel is up and basic-auth is enforced.');
+            return { artifacts: [] };
+        }
+        // ngrok needs a moment after launchctl bootstrap to bind to :4040.
+        // Retry a few times with a short delay before giving up.
+        let up = false;
+        for (let attempt = 0; attempt < 5 && !up; attempt++) {
+            if (attempt > 0)
+                await new Promise((r) => setTimeout(r, 1500));
+            up = await verifyCommand(ctx, 'curl', ['-s', 'http://localhost:4040/api/tunnels'], (r) => r.stdout.includes('public_url'));
+        }
+        if (up)
+            ctx.ui.success('ngrok tunnel is up (basic-auth enforced at the ngrok edge).');
+        else
+            ctx.ui.warn('Could not reach the ngrok local API (localhost:4040) — check the tunnel started.');
+        return { artifacts: [] };
+    },
+    async undo() {
+        // nothing created
+    },
+};
+/** Explicit selection lets tests cover the release without mocking its switch. */
+export function createMacosxNgrok({ rebrand = REBRAND_SWITCH } = {}) {
+    return {
+        id: 'macosx-ngrok',
+        label: 'macOS + ngrok',
+        async preflight(ctx) {
+            if (ctx.dryRun) {
+                ctx.ui.info('DRY RUN — skipping OS preflight.');
+                return;
+            }
+            if (!(await ctx.runner.capture('uname', ['-s'])).stdout.includes('Darwin')) {
+                throw new PreflightError('macosx-ngrok requires macOS. On a Linux VPS use --platform ubuntu-vps.');
+            }
+        },
+        steps() {
+            return [
+                depCheckStep({ installTool: brewInstallTool, removeHint: brewRemoveHint }),
+                autostartStep(rebrand),
+                ngrokStep(rebrand),
+                identityStep,
+            ];
+        },
+        async redeploy(ctx) {
+            // hearsay-tools/cezarion#32: an npx-launched agent re-execs its cached build on kickstart, so a
+            // deploy that doesn't invalidate the npx cache never actually updates.
+            // Clear the cezarion cache first (read the live ProgramArguments to know the
+            // launch form); a checkout / global agent is left alone.
+            refreshNpxCacheForRedeploy(ctx, readCezarProgramArguments(agentArtifact(ctx, 'autostart', rebrand).path), {
+                reconfigureHint: commandText(`  cez server-install --platform macosx-ngrok --reconfigure autostart`, undefined, rebrand),
+            });
+            // Restart both the cezar cockpit and the ngrok tunnel, then re-verify.
+            if (ctx.dryRun) {
+                ctx.ui.info(`DRY RUN — would restart the ${productName('cezar', rebrand)} and ngrok launchd agents and re-verify.`);
+                return;
+            }
+            const cockpit = agentArtifact(ctx, 'autostart', rebrand);
+            const ngrok = agentArtifact(ctx, 'ngrok', rebrand);
+            const uid = process.getuid ? process.getuid() : 0;
+            const repaired = repairAgentEnv(ctx, cockpit);
+            if (repaired) {
+                await ctx.runner.capture('launchctl', ['bootout', `gui/${uid}/${cockpit.name}`]);
+            }
+            // A previous deploy can have repaired the file before bootstrap failed.
+            if (repaired || (existsSync(cockpit.path) && (await ctx.runner.capture('launchctl', ['print', `gui/${uid}/${cockpit.name}`])).code !== 0)) {
+                await bootstrapVerified(ctx, uid, cockpit.name, cockpit.path, `the ${productName('cezar', rebrand)} cockpit agent`);
+            }
+            ctx.ui.info(`Redeploying — restarting the ${productName('cezar', rebrand)} cockpit.`);
+            const cezarCode = await ctx.runner.interactive('launchctl', ['kickstart', '-k', `gui/${uid}/${cockpit.name}`]);
+            if (cezarCode !== 0)
+                ctx.ui.warn(`launchctl kickstart returned non-zero — check \`launchctl print gui/${uid}/${cockpit.name}\`.`);
+            ctx.ui.info('Redeploying — restarting the ngrok tunnel.');
+            const code = await ctx.runner.interactive('launchctl', ['kickstart', '-k', `gui/${uid}/${ngrok.name}`]);
+            if (code !== 0)
+                ctx.ui.warn(`launchctl kickstart returned non-zero — check \`launchctl print gui/${uid}/${ngrok.name}\`.`);
+            await identityStep.run(ctx);
+        },
+        migrate: (ctx) => migrateAgents(ctx, rebrand),
+        rollbackMigration: (ctx, report) => rollbackLaunchdMigration(ctx, report, rebrand),
+        stopService: (ctx) => stopLaunchdServices(ctx, launchdServices(ctx, rebrand)),
+        startService: (ctx) => startLaunchdServices(ctx, launchdServices(ctx, rebrand), ctx.state.primaryPort),
+    };
+}
+export const macosxNgrok = createMacosxNgrok();
+//# sourceMappingURL=macosx-ngrok.js.map

package/dist/server-install/platforms/macosx-ngrok.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macosx-ngrok.js","sourceRoot":"","sources":["../../../src/server-install/platforms/macosx-ngrok.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAmI,MAAM,aAAa,CAAC;AACtL,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACnJ,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,aAAa,EAAuB,MAAM,uBAAuB,CAAC;AACtL,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE7D;;;;;;GAMG;AAEH,yDAAyD;AACzD,SAAS,eAAe,CAAC,GAAmB;IAC1C,OAAO,GAAG,CAAC,eAAe,EAAE,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,gHAAgH;AAChH,SAAS,eAAe,CAAC,GAAmB,EAAE,OAAgB;IAC5D,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAU,EAAE,CAAC;QACnF,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACnH,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,aAAa,CAAC,GAAmB,EAAE,OAAgB;IAChE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,oBAAoB,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpK,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAA0B,EAAE,OAAgB;IAC5D,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC;AACrE,CAAC;AAID,SAAS,eAAe,CAAC,GAAmB,EAAE,IAAY,EAAE,OAAgB,EAAE,OAAgC;IAC5G,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9I,MAAM,QAAQ,GAAG,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC5F,oFAAoF;IACpF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;QACrD,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,OAAO,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,8FAA8F;AAC9F,SAAS,oBAAoB,CAAC,GAAmB,EAAE,IAAY,EAAE,QAAqB;IACpF,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB,EAAE,IAAY,EAAE,OAAgB,EAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO;IAClH,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAe;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAmB,EAAE,GAAW,EAAE,KAAa,EAAE,IAAY,EAAE,IAAY;IAC1G,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IACpG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CACnB,4BAA4B,IAAI,oBAAoB,IAAI,4CAA4C,GAAG,IAAI,KAAK,EAAE,CACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,YAAY,CAAC,GAAmB,EAAE,QAAqB,EAAE,IAAY,EAAE,IAAY,EAAE,GAAW,EAAE,IAAY;IAC3H,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACvG,oFAAoF;IACpF,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,wFAAwF;IACxF,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,6EAA6E;QAC7E,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;YAC/G,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB,EAAE,MAAe,EAAE,QAAQ,GAAG,yBAAyB,EAAE,OAAO,GAAG,cAAc;IAC3I,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;SACpD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;;;;;cAMK,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;;;EAGtC,MAAM;;;;;;;;CAQP,CAAC;AACF,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAe,EAAE,CAAC,CAAC;IACpD,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,gDAAgD;IACvD,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,oBAAoB;QACpB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;;gBAC9E,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,wFAAwF;QACxF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;YAClC,OAAO,EAAE,mEAAmE;YAC5E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC;SAClE,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,MAAM;YAAE,MAAM,IAAI,aAAa,EAAE,CAAC;QAChD,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,0CAA0C;QAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,+CAA+C,CAAC,EAAE;gBACzG,GAAG,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,WAAW,CAAC,iGAAiG,CAAC,CAAC;QAC3I,CAAC;QAED,gDAAgD;QAChD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;YACpC,OAAO,EAAE,kFAAkF;YAC3F,WAAW,EAAE,iBAAiB;YAC9B,2EAA2E;YAC3E,oDAAoD;YACpD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yDAAyD,CAAC;SACnI,CAAC,CAAC;QACH,IAAI,WAAW,KAAK,MAAM;YAAE,MAAM,IAAI,aAAa,EAAE,CAAC;QACtD,yEAAyE;QACzE,8EAA8E;QAC9E,MAAM,MAAM,GAAG,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtG,yBAAyB;QACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;YAC7B,OAAO,EAAE,oCAAoC;YAC7C,WAAW,EAAE,KAAK;YAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,aAAa,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;YACrC,OAAO,EAAE,4BAA4B,IAAI,GAAG;YAC5C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC;SAC3E,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,MAAM;YAAE,MAAM,IAAI,aAAa,EAAE,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,WAAW,CAAC,4FAA4F,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAExD,mFAAmF;QACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,yBAAyB,IAAI,8BAA8B,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC;YAE5H,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;QACrJ,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,WAAW,MAAM,EAAE,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YAC3B,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,8GAA8G,EAAE,OAAO,CAAC,CAAC;QACvI,CAAC;QAED,OAAO;YACL,SAAS,EAAE;gBACT,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,uFAAuF,EAAE,CAAC;gBAClJ,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aACjC;SACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO;QACrB,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QAC9E,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,EAAE,CAAC,IAAI,CACT,iGAAiG,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,EACvH,OAAO,CACR,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,2EAA2E;AAG3E;;;4BAG4B;AAC5B,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,2DAA2D,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;aACjG,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAmB,EAAE,OAAO,GAAG,cAAc;IAClF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAE3C,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE1D,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,cAAc,UAAU,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACjL,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAExC,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,IAAI,WAAW,CACnB,+BAA+B,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,uBAAuB,UAAU,MAAM;QAC3G,wBAAwB,UAAU,mEAAmE,CACxG,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,IAAY,EAAE,IAAc,EAAE,OAAO,GAAG,cAAc;IACxG,yEAAyE;IACzE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC;SACvH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO;;;;;;cAMK,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;;;EAGxC,MAAM;;;cAGM,SAAS,CAAC,QAAQ,CAAC;;;EAG/B,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,GAAG,yBAAyB,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;gBAE/I,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;;;;;CAQ5C,CAAC;AACF,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,GAAmB,EAAE,KAAkB;IAC7D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnC,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAC,CAAC,CAAC;IACvE,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAC,CAAC,CAAC;IACjE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAe,EAAE,CAAC,CAAC;IACxD,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,gDAAgD;IAC3F,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,yBAAyB,IAAI,8BAA8B,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC7K,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO;QACrB,kEAAkE;QAClE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,oDAAoD,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1G,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAgB;IAChC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,0CAA0C;IACjD,KAAK,CAAC,KAAK;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAC1F,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;QACD,mEAAmE;QACnE,yDAAyD;QACzD,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/D,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,mCAAmC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,EAAE;YAAE,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC;;YACjF,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QACrG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,IAAI;QACR,kBAAkB;IACpB,CAAC;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,EAAE,OAAO,GAAG,cAAc,EAAE,GAAG,EAAE;IACjE,OAAO;QACL,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,eAAe;QACtB,KAAK,CAAC,SAAS,CAAC,GAAmB;YACjC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,cAAc,CAAC,wEAAwE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QACD,KAAK;YACH,OAAO;gBACL,YAAY,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;gBAC1E,aAAa,CAAC,OAAO,CAAC;gBACtB,SAAS,CAAC,OAAO,CAAC;gBAClB,YAAY;aACb,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,GAAmB;YAChC,gGAAgG;YAChG,uEAAuE;YACvE,6EAA6E;YAC7E,yDAAyD;YACzD,0BAA0B,CAAC,GAAG,EAAE,yBAAyB,CAAC,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE;gBACxG,eAAe,EAAE,WAAW,CAAC,sEAAsE,EAAE,SAAS,EAAE,OAAO,CAAC;aACzH,CAAC,CAAC;YACH,uEAAuE;YACvE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,+BAA+B,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,0CAA0C,CAAC,CAAC;gBACpH,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACnF,CAAC;YACD,wEAAwE;YACxE,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1I,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACtH,CAAC;YACD,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,gCAAgC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACtF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/G,IAAI,SAAS,KAAK,CAAC;gBAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,uEAAuE,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;YAClI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACxG,IAAI,IAAI,KAAK,CAAC;gBAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,uEAAuE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;YAC3H,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;QAC7C,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC;QAClF,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7E,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;KACvG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC"}

package/dist/server-install/platforms/service-env.d.ts

@@ -0,0 +1,4 @@
+/** Repair only installer-owned REMOTE entries; preserve launch commands and operator settings.
+ * The new reader is already live with the release switch off. Both names must pin hosted mode. */
+export declare function systemdRemoteEnv(unit: string): string;
+export declare function launchdRemoteEnv(xml: string): string;

package/dist/server-install/platforms/service-env.js

@@ -0,0 +1,17 @@
+/** Repair only installer-owned REMOTE entries; preserve launch commands and operator settings.
+ * The new reader is already live with the release switch off. Both names must pin hosted mode. */
+export function systemdRemoteEnv(unit) {
+    if (!/^Environment=CEZ_REMOTE=1$/m.test(unit))
+        return unit;
+    return unit.replace(/^Environment=HSQ_REMOTE=.*\n/gm, '')
+        .replace(/^Environment=CEZ_REMOTE=1$/gm, 'Environment=CEZ_REMOTE=1\nEnvironment=HSQ_REMOTE=1');
+}
+export function launchdRemoteEnv(xml) {
+    return xml.replace(/(<key>EnvironmentVariables<\/key>\s*<dict>)([\s\S]*?)(<\/dict>)/, (match, open, env, close) => {
+        if (!/<key>CEZ_REMOTE<\/key>\s*<string>1<\/string>/.test(env))
+            return match;
+        const kept = env.replace(/\s*<key>HSQ_REMOTE<\/key>\s*<string>[^<]*<\/string>/g, '');
+        return open + kept.replace(/(<key>CEZ_REMOTE<\/key>\s*<string>1<\/string>)/, '$1\n      <key>HSQ_REMOTE</key>\n      <string>1</string>') + close;
+    });
+}
+//# sourceMappingURL=service-env.js.map

package/dist/server-install/platforms/service-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-env.js","sourceRoot":"","sources":["../../../src/server-install/platforms/service-env.ts"],"names":[],"mappings":"AAAA;kGACkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC;SACtD,OAAO,CAAC,8BAA8B,EAAE,oDAAoD,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,iEAAiE,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE;QACxI,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,sDAAsD,EAAE,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gDAAgD,EAAE,2DAA2D,CAAC,GAAG,KAAK,CAAC;IACpJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server-install/platforms/ubuntu-vps-files.d.ts

@@ -0,0 +1,18 @@
+import type { InstallContext } from '../types.ts';
+/**
+ * A sudoStep that writes a root-owned file. The command carries the content as
+ * base64 (so quoting/newlines survive a copy-paste), which is unreadable — so we
+ * always show the DECODED file content in a note first, so the operator can see
+ * exactly what will land on disk and knows the base64 is not doing anything
+ * hidden.
+ */
+export declare function writeFileStep(ctx: InstallContext, opts: {
+    description: string;
+    path: string;
+    content: string;
+    /** Extra shell appended after the write (` && …`). */
+    extra?: string;
+    verify: (c: InstallContext) => Promise<boolean>;
+}): Promise<void>;
+/** Redeploy repairs legacy env pins without replacing ExecStart, PATH or operator entries. */
+export declare function repairUnitEnv(ctx: InstallContext, scope: 'user' | 'system', path: string): Promise<void>;

package/dist/server-install/platforms/ubuntu-vps-files.js

@@ -0,0 +1,43 @@
+import { writeFileSync } from 'node:fs';
+import { shquote, sudoStep } from '../steps.js';
+import { systemdRemoteEnv } from './service-env.js';
+/** Build a privileged command that writes file content atomically (base64 → no quoting hell). */
+function writeRootFileCmd(path, content, extra = '') {
+    const b64 = Buffer.from(content, 'utf8').toString('base64');
+    const dir = path.slice(0, path.lastIndexOf('/')) || '/';
+    return `install -d -m 0755 ${shquote(dir)} && printf %s ${shquote(b64)} | base64 --decode > ${shquote(path)}${extra ? ` && ${extra}` : ''}`;
+}
+/**
+ * A sudoStep that writes a root-owned file. The command carries the content as
+ * base64 (so quoting/newlines survive a copy-paste), which is unreadable — so we
+ * always show the DECODED file content in a note first, so the operator can see
+ * exactly what will land on disk and knows the base64 is not doing anything
+ * hidden.
+ */
+export function writeFileStep(ctx, opts) {
+    return sudoStep(ctx, {
+        description: opts.description,
+        note: `This writes ${opts.path} with exactly this content:\n\n${opts.content}`,
+        command: writeRootFileCmd(opts.path, opts.content, opts.extra),
+        verify: opts.verify,
+    });
+}
+/** Redeploy repairs legacy env pins without replacing ExecStart, PATH or operator entries. */
+export async function repairUnitEnv(ctx, scope, path) {
+    const current = await ctx.runner.capture('cat', [path]);
+    if (current.code !== 0)
+        return; // The existing restart path diagnoses an absent service.
+    const next = systemdRemoteEnv(current.stdout);
+    if (next === current.stdout || ctx.dryRun)
+        return;
+    if (scope === 'user')
+        writeFileSync(path, next, 'utf8');
+    else
+        await sudoStep(ctx, {
+            description: 'Add the preferred hosted-mode environment pin to the existing service.',
+            // Keep operator env values out of the displayed privileged command.
+            command: `sed -i ${shquote('/^Environment=HSQ_REMOTE=/d; /^Environment=CEZ_REMOTE=1$/a Environment=HSQ_REMOTE=1')} ${shquote(path)}`,
+            verify: async (c) => (await c.runner.capture('cat', [path])).stdout === next,
+        });
+}
+//# sourceMappingURL=ubuntu-vps-files.js.map

package/dist/server-install/platforms/ubuntu-vps-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ubuntu-vps-files.js","sourceRoot":"","sources":["../../../src/server-install/platforms/ubuntu-vps-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,iGAAiG;AACjG,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,KAAK,GAAG,EAAE;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;IACxD,OAAO,sBAAsB,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC9I,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAmB,EACnB,IAOC;IAED,OAAO,QAAQ,CAAC,GAAG,EAAE;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,eAAe,IAAI,CAAC,IAAI,kCAAkC,IAAI,CAAC,OAAO,EAAE;QAC9E,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;QAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAmB,EAAE,KAAwB,EAAE,IAAY;IAC7F,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,yDAAyD;IACzF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IAClD,IAAI,KAAK,KAAK,MAAM;QAAE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;;QACnD,MAAM,QAAQ,CAAC,GAAG,EAAE;YACvB,WAAW,EAAE,wEAAwE;YACrF,oEAAoE;YACpE,OAAO,EAAE,UAAU,OAAO,CAAC,qFAAqF,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE;YACpI,MAAM,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI;SAC3E,CAAC,CAAC;AACL,CAAC"}