@hienlh/ppm 0.23.10 → 0.23.12

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## [0.23.12] - 2026-10-02
+
+### Added
+- Open System Monitor from the command palette on phones and desktops.
+- Record session runs and browser console events in a retained trace that can be read back.
+- Stream Remote Desktop over HTTP through a WebRTC relay, with Wayland screen capture.
+- Run and control an opt-in Android emulator from the browser.
+
+### Improved
+- Start a new Claude chat faster by preparing its CLI while the composer is open.
+- Open tabs, floating windows, and Settings panes without a spinner once their code is loaded.
+
+### Fixed
+- File changes no longer freeze large projects or repeatedly download the file index.
+- Large file indexes walk, compress, and search off the server event loop; content search uses ripgrep when available.
+- Linux directory watching avoids per-directory descriptors and self-inflicted inotify queue overflows.
+- Release binaries include both the extension host and file index workers.
+
+## [0.23.11] - 2026-10-01
+
+### Added
+- Settings → Design: your own instructions for every design chat, with `/` to name installed skills; a gear in the sidebar's Designs header opens it.
+- Design mode asks a few short questions before the first build when the request leaves key things open, including how many variants to make.
+- Design variants: up to five directions per design with a Variant switcher; keep or drop one by asking in the design chat.
+- Design systems per app: the first design for an app builds its design system automatically (real CSS, fonts, icons and a component map read from the app's code), with a showcase page and a reminder when it gets outdated.
+- Settings → Design → "Apps in this project" declares each app of a multi-app project (separate frontends, a mobile app).
+- "Build in new chat" replaces "Hand off to code": one click opens a new chat with the brief and a screenshot of the design attached.
+- **The System Monitor works on macOS.** On a Mac it had the Overview and the process table and little else: Services failed with `systemctl` not found, Apps said the host lists no desktop applications, Performance had a CPU and a Memory page and no drives, interfaces, GPU or fans, most CPU rows were em dashes, and memory read **99.7% used** while Activity Monitor said about 80%. Every page now has its Mac counterpart, read from the kernel over `bun:ffi` where it can be and from one shared tool read a tick where it cannot — no root, no helper binary, nothing installed.
+  - **Memory is Activity Monitor's.** Used = App Memory + Wired + Compressed from `host_statistics64`, cached files shown apart, swap from `vm.swapusage` — 27.04 GiB against 27.01 from `vm_stat` run through Activity Monitor's own formula. The old figure agreed with `top`, which counts the file cache as used.
+  - **CPU**: performance and efficiency cores, per-cluster caches, the top clock from the power manager's frequency tables, threads and open files from the kernel, and the **current clock and package power** from IOReport (no root, as `macmon` reads them), with the SMC's core temperature. The GPU page gets the same: clock against its top state, power, temperature, core count and Metal version.
+  - **One page per drive and per interface**: read/write rates, busy time, response time and the APFS partitions of each disk (within 3.6% of `iostat`); every interface System Settings lists plus VPN tunnels and VM bridges, with Wi-Fi signal, link rate and channel from CoreWLAN in 5–10 ms — never `system_profiler`, whose scan stalled the network for 3.8 s. The built-in SSD's temperature comes from its NAND sensor (37 °C, the same as its SMART figure at that moment).
+  - **Fans**: each fan's speed with the range its controller keeps it in. A Mac without fans has no Fans page, as on a Linux laptop.
+  - **Per-process GPU and disk**: GPU % from each process's GPU time in the registry, disk I/O from `proc_pid_rusage` — another user's process reads as an em dash, not 0.
+  - **Apps** are application bundles: a browser with twenty helpers is one row with its own icon, and a widget lists only once its app has a process of its own.
+  - **Services is launchd**: the system domain and both of the user's, the GUI session's and the background one's (the jobs `launchctl print` lists, less the running applications' own instances, which the Apps page shows), status, last exit, logs from the job's own files or the unified log since the job started (since boot when it is not running), CPU and memory per job, and start / stop / restart / enable / disable. PPM's own job, every `com.apple.*` job and the whole system domain refuse the actions that would hurt, with the reason shown.
+  - The sensor reads are budgeted, because each one stops the server's event loop: 4.1–4.7 ms a tick for the SMC (was 11.5–19 ms), ~4 ms for IOReport, and the SSD every ten seconds.
+  - Also fixed on the way: `nettop` now runs with `-n`, so the Processes page no longer sends 18 DNS lookups a tick; and the credential guard compares every protected folder by its real path too, so a PPM directory under a symlinked `/tmp` or `/var` no longer lets a symlink to `ppm.db` through.
+
+### Fixed
+- A new chat's first message no longer fails when choosing its account fails; the chat starts on the server's own pick.
+
 ## [0.23.10] - 2026-10-01
 
 ### Added
@@ -67,7 +108,8 @@
 - **The Overview GPU card no longer claims an integrated GPU has zero VRAM.** It printed "VRAM 0 MB / 0 MB" for a UHD 770, which is a different statement from "this device has no dedicated memory" — and the Performance page's own GPU detail already rendered that case as an em dash, so the two disagreed about the same number on the same host.
 
 - **A Mac with 8 GB of swap in use said nothing about swap at all.** `node:os` carries no swap figure, so off Linux `swapTotalMB`/`swapUsedMB` were simply absent — and the memory page renders an absent field as an em dash, i.e. as the claim that this host's swap cannot be measured. On macOS it can: `vm.swapusage` is one sysctl, and on the M1 Max this was found on it read **8039 MB of 9216 MB in use**, matching what the collector now reports to the megabyte on the same sample. Swap that is genuinely off stays a real `0` rather than becoming an em dash, because the UI hides the graph on a zero total and dashes only on `undefined`, and those are different claims. The cost was measured rather than assumed, since this runs on every tick: **1.33 ms**, against the 1.7 ms `/proc/<pid>/io` already costs per tick on Linux — and Linux pays none of it, because the `/proc/meminfo` branch returns before the reader is ever called.
-  - Not changed, and deliberately: the *used* figure itself. `os.freemem()` on darwin looks alarming — 97.9% used on that Mac — and it is right. macOS's own `top` reported `31G used … 75M unused` on the same machine at the same moment. The tempting correction is to add `vm_stat`'s inactive pages, or to follow `memory_pressure`, which called that machine "56% free"; that metric measures what could be reclaimed under duress, not free RAM, and taking it would have replaced a figure matching Activity Monitor with one contradicting it. Recorded in the source so the next reader does not re-derive the wrong conclusion.
+  - The *used* figure has since changed too — see "The System Monitor works on macOS" above. It was left alone here because it agreed with `top`'s `31G used`, but `top` counts the file cache as used and Activity Monitor does not; `memory_pressure` is still not the fix.
+
 
 - **The Details dialog told macOS users that running processes were dead.** Opening it on a Chrome renderer using 4.2% of the CPU — visible in the table behind the dialog — answered **“PID 72973 is no longer running”**. The reader was `/proc`-only and the service answered `null` for every other platform, which the route turned into a 404 carrying that sentence: correct on Linux, where a vanished `/proc/<pid>` really does mean the process exited, and simply false anywhere else. The two claims now travel separately — a host with no reader answers **501** saying so, and “no longer running” is said only when a process actually is.
   - And macOS has a reader now, because it turns out `ps` answers **ten of the eleven fields**: parent, state, nice, user, executable, start time, threads, working directory, command line and name. Two of them arrive more directly than on Linux — `lstart` is a real timestamp rather than jiffies to be added to `btime`, and `user` is already the login name, so no `/etc/passwd` lookup is needed and it works across users. Only `cgroup` has no macOS equivalent and stays an em dash, which is the honest answer rather than an invented one. Cost, measured on an M1 Max: 29.7 ms for the first `ps`, then three concurrent calls (`ps -o command=`, `ps -M`, `lsof -d cwd`) at 30–38 ms — on-demand when the dialog opens, never on the tick.

package/CLAUDE.md

@@ -82,6 +82,7 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 
 - **SDK .env poisoning**: Projects with `ANTHROPIC_API_KEY` in `.env` break SDK tool execution. Provider neutralizes these vars. See `docs/lessons-learned.md`.
 - **File watching**: never `fs.watch(dir, { recursive: true })` on a project root — on Linux that is one inotify watch per subdirectory, `node_modules` included (it once cost 359k watches). Ignored dirs must be pruned at registration time via `src/services/file-watcher/watch-tree.ts`.
+- **A file change marks the flat file index stale, and must never make a request walk the project**: `buildIndex` used to walk with `readdirSync` on the main thread while every change dropped the cache and the explorer refetched `/files/index` 300 ms later. nxsys-workspace (181k entries, 22 MB of JSON) is a 6.2 s walk, so a session writing test artefacts into it kept the event loop stopped back to back until the supervisor's health check (5 s timeout, three strikes) killed the server — and every Claude session under it. Now the walk yields every 256 entries on `setTimeout(0)` (`setImmediate` costs 0.002 ms a yield against 1.09 ms, but starved HTTP to a 16 ms p50 against 1.4 ms), a stale list is rebuilt behind the one held, a request waits for that rebuild at most `REBUILD_GRACE_MS` (1 s — enough that an ordinary project answers fresh and a file just created is in the palette on its first open), and `files:index-changed` goes out only when the rebuilt paths differ. The browser does not refetch on a change either: `file:changed` and `files:index-changed` set `indexStale`, and `ensureIndex` refreshes when the palette, the compare picker or the @-picker opens. Two traps. A rebuild runs only when a request asks for one, so a change landing mid-walk is walked again only if a request saw it (`rewalk`) — rebuilding on a timer would keep a core busy for as long as a session keeps writing. And a first walk that no longer stops the server can outlast **Bun.serve's default 10 s idle timeout** (14 s on a busy scratch server), which cuts the request off with the list nearly built; the route calls `server.timeout(req, 30)` through `c.env`, the server `app.fetch(req, server)` passed.
 - **Project Claude settings**: `.claude/settings.local.json` can restrict tools even with `bypassPermissions`. Provider overrides with empty settings.
 - **Transcript images live in two places**: the base64 payload sits at `message.content[].content[]` inside a tool result, but Claude Code also writes an image-shaped record at the top-level `toolUseResult` field carrying no payload. An assertion like "no `"type":"image"` remains" must be scoped to the former, or it fails against correct code.
 - **Plugin items are named by location, not frontmatter**: Claude Code registers a plugin's skills and commands as `<plugin>:<path>` (`ak-engineer:ak-debug`) and only honours the frontmatter `name` for agents. Kits that self-namespace instead — AgentKit ships `name: ak:debug` — publish a name nothing can resolve. `slash-discovery` mirrors that rule and keeps the declared name as an alias; `src/server/ws/chat.ts` rewrites the alias to the canonical name before the message reaches the SDK.
@@ -107,6 +108,7 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 - **A button in a Monaco hover is a `command:` link in *trusted* markdown, and trust is all-or-nothing unless you narrow it**: a hover can only contain markdown, so the blame hover's actions are `[label](command:id?args)` links reaching ids registered with `monaco.editor.registerCommand`. The renderer *strips* those links unless the `IMarkdownString` is trusted — and `isTrusted: true` allows **every** command on the page's global registry. That hover embeds a commit message, so anyone who can land a commit could write `[click](command:...)` in one and have it render as a working button. Both defences are needed and both are in `blame-hover.ts`: `isTrusted: { enabledCommands: [...] }` (an array is honoured by `toAllowCommandsOption`), and escaping the message so it cannot form a link at all. `supportHtml` stays **off** — the avatar is `![](data:image/svg+xml,...)`, which renders inline at its intrinsic size, so no HTML has to be allowed for it. Escape `<` and `>` too: with `supportHtml` off the renderer does not leave an unknown tag alone, it drops the tag and keeps the text, so a message mentioning a literal `<script>alert(1)</script>` displayed as `alert(1)` — the message silently rewritten in the one view meant to show it verbatim.
 - **Hovering injected text does reach the decoration under it, and Monaco has no `diff` language**: an `after` injected-text annotation sits past the line's last column, and `ContentHoverComputer._getLineDecorations` relaxes its column check by one character *only* for `showIfCollapsed` decorations — which is what makes the blame hover work at all, and why that flag is load-bearing rather than cosmetic. `editor.action.showHover` opens the same hover from the cursor, which is the touch path (gated on `hover: none`, not on a width breakpoint; the mouse target's `injectedText` would identify the tap exactly but is not in Monaco's public typings, so the handler goes by column). Separately: Monaco's 91 basic languages include no `diff` — VS Code's comes from a bundled extension — so a fenced diff block runs the tokenizer and comes back entirely `mtk1`, the theme's default foreground. `monaco-diff-language.ts` registers one and `theme/diff-token-rules.ts` colours it; a Monarch rule whose token name has no theme rule is the same silent no-op as an unmapped semantic token, and a test pairs the two so neither can be added without the other.
 - **The service worker's precache can silently undo any download saving, and both compressions are needed**: `injectManifest` defaults to precaching *everything* in the build output, so the first visit fetched 488 files / 33.3 MB — including the 12.7 MB TypeScript worker that `monaco-builtin-typescript.ts` had just made unnecessary to ever load. A saving measured in the network tab of a warm page is not a saving; measure `precache N entries (X KiB)` in the build output too. `globPatterns` now lists only the boot shell (9 entries / 1.08 MB) with everything else on a runtime `CacheFirst`. Separately, `scripts/precompress-web.ts` writes **both** `.br` and `.gz` siblings and `static-encoding.ts` picks one: brotli alone is not enough, because browsers advertise `br` only on a **secure origin** and PPM is routinely reached over plain HTTP on a LAN. And Monaco is staged locally by `scripts/copy-monaco.ts` with `loader.config({ paths: { vs: "/assets/monaco/vs" } })` — the default is jsdelivr, which means no editor offline and a third party told which files are opened. `vite build` empties `dist/web`, so `copy-monaco` and `precompress-web` must run *after* `build:web` (running `build:web` alone leaves an installed PPM with no Monaco at all).
+- **`FileSink.write()` consumes the whole chunk and returns a number that is not how much of it went in**: the careful-looking `while (off < buf.length) { off += await sink.write(buf.subarray(off)) }` is therefore a loop that re-sends the tail. Measured against `cat`, one 4,924,800-byte frame produced eleven `write()` calls each answering **475072** while everything had already been buffered, and the child received **28,043,840 bytes — 5.7x the frame**. Downstream the damage is silent and total: ffmpeg's rawvideo input is offset for good, so the *first* picture decodes perfectly and every one after it is drawn rolled, with no error from ffmpeg, from the sink, or from the encoder wrapper. One `write()` then `await flush()` is the whole correct form (`writeFrameToSink` in `android-video.ts`). Two things generalise. A frame **counter** cannot see this — every counter in the pipeline reported the right number while 5.7x the bytes left the process — so the test has to measure the bytes a real child receives (`tests/unit/android/android-video-frame-write.test.ts`), and it needs a chunk big enough that the sink buffers in pieces or the bug does not reproduce at all. And a capture that decodes correctly proves nothing if it holds one access unit: the first frame is always right.
 - **A lazy chunk boundary is one static import away from not existing, and it is invisible**: `code-editor.tsx` reaches the language service only through `lazy(() => import("./editor-language-service"))`, which is what keeps the LSP client out of the editor's chunk and — the part that actually costs something — keeps the code that asks the host for a server unreachable until the setting is on. One `import { anything } from "@/hooks/use-lsp"` anywhere on that static path merges the chunk back in and nothing about the UI looks different, so `tests/unit/web/editor-lsp-lazy-boundary.test.ts` enumerates the offenders instead. Importing even a *constant* from the lazy module counts; `import type` does not. Related: `lspEnabled` and `mobileWordWrap` are written with `persistDevicePref` (localStorage only) rather than `persistUiPref`, because the server round-trip that makes prefs survive an origin change also means the last device to write wins everywhere — and a desktop must not start an 854 MB server process for a phone.
 - **Escaping before matching lets a pattern rewrite the text it escaped**: the git graph escaped a commit message to HTML and *then* ran the issue-link rules over the result. The default rule is `#(\d+)`, an apostrophe escapes to `&#39;`, so "Monaco's" rendered as a literal `&#39;s` with `#39` styled as an issue link — every message with an apostrophe in it, which is most of them. `commit-message-html.ts` matches the raw text and escapes only what it emits; the same order matters for the URL and bare-hash rules, which otherwise link something *inside* a URL and split it. That file also shows the way to unit-test code that lives in a webview: write it as a real typed function and inject `fn.toString()`, which Bun returns type-stripped, rather than keeping a second copy inside a template literal where every regex backslash has to be doubled. And a backtick anywhere in a comment inside those template literals — including inside a CSS comment — ends the literal and reports as a syntax error hundreds of lines away; `webview-html.test.ts` now parses the whole injected script with `new Function` so that lands as a failing test instead of a blank panel.
 - **`dateStyle`/`timeStyle` may not be combined with any other `Intl` option**: `toLocaleString(undefined, { dateStyle: "medium", timeStyle: "medium", timeZoneName: "short" })` does not ignore the third option, it *throws* `TypeError: dateStyle and timeStyle may not be used with other DateTimeFormat options`. Behind the `try/catch` that any date formatting picks up sooner or later, that is indistinguishable from a locale which simply has no timezone in its medium format — the commit details panel showed author and committer dates with no zone at all, and no test caught it because the fallback string is perfectly well-formed. A format that needs a companion option has to list every component explicitly (`year`/`month`/`day`/`hour`/`minute`/`second` + `timeZoneName`), and the test worth writing runs the options object through a real `Intl.DateTimeFormat` and asserts the *output* contains a zone.
@@ -121,8 +123,10 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 - **Screen wake lock needs a secure context**: `navigator.wakeLock` does not exist at all over plain HTTP, so reaching PPM at `http://<lan-ip>:<port>` silently disables "keep screen awake" — the very setup (a tablet on the LAN) it was built for. Only HTTPS and `localhost` qualify. The lock is also released by the browser on *every* hide, so `src/web/hooks/use-wake-lock.ts` re-acquires on `visibilitychange` and drops its handle on hide rather than waiting for the `release` event, whose ordering against `visibilitychange` is undefined.
 - **Remote desktop on macOS (avfoundation)**: address the screen by **name** (`-i "Capture screen 0"`), never by index — the device list reorders at runtime when a Continuity Camera joins (index 3 became the iPhone). `-framerate` is ignored (the screen input delivers at display refresh, 120–165 fps, with a stuck pts) → `-use_wallclock_as_timestamps 1` + `-vf fps=30`. ffmpeg-avfoundation ignores SIGTERM/SIGINT → `proc.kill("SIGKILL")` or it leaks one process per session. No Screen Recording grant = **black frames, no error**; no Accessibility grant = silent no-op input — both are pre-flighted in `remote-desktop-requirements.ts`, never inferred from failures. TCC keys the grant to the `bun` executable.
 - **Remote desktop text injection on macOS**: `CGEventKeyboardSetUnicodeString` still carries a keycode, and IMEs that hook by key (OpenKey/EVKey) re-read keycode 0 as a literal "a" (`"日本"` → `"â"`); function/unassigned keycodes produce no text at all. The carrier is Space (`TEXT_CARRIER_KEYCODE`). Text is still subject to the host's active IME (Telex rewrote "World" → "ửold") on every OS.
-- **Remote desktop on Linux is chosen per *session*, not per platform, and Wayland must win the tie**: `process.platform === "linux"` says nothing about how to capture or inject. A Wayland session almost always also runs XWayland, which sets `DISPLAY` and answers `x11grab` **successfully** — with a view of XWayland clients only, i.e. a black or half-empty screen rather than an error. So `remote-desktop-linux-session.ts` checks Wayland *before* X11, and `XDG_SESSION_TYPE` outranks both. It also has to *probe* rather than read the env: a PPM started by its systemd user unit has no `DISPLAY`/`XAUTHORITY` at all while a full desktop runs two feet away, so the fallbacks are the `X<N>` socket in `/tmp/.X11-unix`, the `wayland-N` socket in `$XDG_RUNTIME_DIR`, and for auth the `xauth_*` file Xorg was launched with (`-auth /run/user/1000/xauth_XXXXXX`) before `~/.Xauthority`. ffmpeg is then spawned with that env merged over `process.env`. Wayland *capture* is not implemented — it needs the desktop portal, and this is surfaced as an unmet `video` requirement the user can fix by picking X11 at login, never as "platform unsupported" (which would hide the entry and explain nothing).
+- **Remote desktop on Linux is chosen per *session*, not per platform, and Wayland must win the tie**: `process.platform === "linux"` says nothing about how to capture or inject. A Wayland session almost always also runs XWayland, which sets `DISPLAY` and answers `x11grab` **successfully** — with a view of XWayland clients only, i.e. a black or half-empty screen rather than an error. So `remote-desktop-linux-session.ts` checks Wayland *before* X11, and `XDG_SESSION_TYPE` outranks both. It also has to *probe* rather than read the env: a PPM started by its systemd user unit has no `DISPLAY`/`XAUTHORITY` at all while a full desktop runs two feet away, so the fallbacks are the `X<N>` socket in `/tmp/.X11-unix`, the `wayland-N` socket in `$XDG_RUNTIME_DIR`, and for auth the `xauth_*` file Xorg was launched with (`-auth /run/user/1000/xauth_XXXXXX`) before `~/.Xauthority`. ffmpeg is then spawned with that env merged over `process.env`. Wayland capture goes through a **different backend entirely** (`remote-desktop-capture-wayland.ts`) rather than another ffmpeg grabber — see the portal bullet below.
 - **Key injection on Linux goes through evdev codes, never keysyms**: `XKeysymToKeycode(XK_a)` answers "which key currently *produces* an a", which on an AZERTY host is the physical Q key — so a keysym table silently transposes the whole keyboard for anyone not on a US layout. `remote-desktop-evdev-key-map.ts` maps `KeyboardEvent.code` → evdev code, which names the physical switch just as `code` does; X11 keycode = evdev + 8 (`X11_KEYCODE_OFFSET`), verified against a live server for all 50 spot-checked keys. The same table feeds uinput, which wants the raw code. X11 also has no "type this string" call: `text()` uses the real keymap when the character is in it (all ASCII, no round trip) and otherwise borrows a keycode with no keysyms, binds it to `0x01000000|codepoint`, and needs a real ~12ms delay after the remap — the server applies it at once but the focused *client* only learns from its `MappingNotify`, so a key pressed sooner is read with the old mapping.
+- **Wayland capture is a portal session that must outlive the capture, and the three things that make it work were each measured**: a compositor shares the screen only through `org.freedesktop.portal.ScreenCast`, which is D-Bus, which Bun does not speak — so `remote-desktop-portal.ts` is `bun:ffi` against `libdbus-1.so.3` (present on any host with a session bus). Three findings turn this from impossible to routine. **`OpenPipeWireRemote` is never called**: the documented flow ends by receiving a PipeWire *file descriptor*, which no shell-out (`busctl`, `gdbus`) can hand to a separate process — and it turns out not to be needed, because the node lives in the user's own PipeWire daemon, so a bare `pipewiresrc path=<node>` reaches it through `$XDG_RUNTIME_DIR/pipewire-0` (measured: negotiated `BGRA 1920x1080` with no fd in the pipeline). **The D-Bus connection owns the session** — the node dies with it, so the handle is held for the capture's whole life and `dbus_bus_get_private` is used rather than the shared connection, which is refcounted process-wide. And **`persist_mode: 2` + a stored `restore_token`** (under `getPpmDir()`, 0600) is what stops a consent dialog appearing on the *host's* screen every session, which on a remote desktop is a prompt only someone sitting at the machine could answer; the first session still asks. ffmpeg is not the capture tool here at all: reading PipeWire needs `--enable-libpipewire`, which distributions do not do (Arch's own `ffmpeg 2:9.0.1-4.1` does not), so GStreamer does it — exactly as RustDesk does (`Depends On: gst-plugins-base gst-plugin-pipewire` + `libdbus-1.so.3` linked in; it is Rust, not magic). Four traps in the pipeline, each silent. **`videorate max-rate=30` does not cap** — measured 59 fps through it, and 133 fps at `max-rate=60`; only a capsfilter `video/x-raw,framerate=30/1` caps. That same capsfilter is also **what makes an idle desktop watchable**: a portal stream is damage-driven and a still screen pushed **14 frames in 60 seconds**, so a viewer joining a quiet host would see nothing at all — `videorate` duplicates the last frame and held **29.6 fps on a completely static screen**, which keeps keyframes flowing so a late joiner syncs within one GOP. **`vapostproc` + `video/x-raw(memory:VAMemory)` must pair with `vah264enc`** and not with `x264enc`, or every frame is downloaded back out of VA memory; the GPU path cost **14.9% of a core at 1080p30 against 52% for software conversion uncapped**. And the **portal stream dies under consumer churn** — it wants one long-lived `pipewiresrc`, so anything that reconnects per quality change must re-run the handshake rather than reattach. Measured end to end through `startCapture`: first access unit at **430 ms**, 28.8 fps, 3.2 Mbit/s, SPS parsed from GStreamer's bytes by the same `AccessUnitAssembler` ffmpeg's output feeds. `listDisplays()` still answers `[]` on Wayland and that is correct — the portal's own dialog chooses which output is shared, so PPM neither enumerates nor picks.
+
 - **Xlib's default I/O error handler calls `exit()` on the PPM server**: a logout, a GPU reset or `systemctl restart sddm` makes libX11 print `XIO: fatal IO error` and terminate the *calling process* — every project, terminal and chat session gone because someone logged out of the desktop. `remote-desktop-x11.ts` replaces all three handlers (`XSetErrorHandler`, `XSetIOErrorHandler`, and libX11 ≥ 1.7's `XSetIOErrorExitHandler`, which cancels the exit that happens even when the first one returns) and holds the `JSCallback`s in module scope — a GC'd callback leaves Xlib calling a freed trampoline, i.e. a segfault instead of the crash it was installed to prevent. A connection that took an I/O error has no safe call left on it, not even `XCloseDisplay`, so it is dropped un-closed and the next caller reopens.
 - **`xrandr` the binary and `libXrandr` the library are different packages**: this dev host has `libXrandr.so.2` and no `xrandr`, so anything that shells out to enumerate monitors reports "no displays" on a working desktop. `remote-desktop-displays.ts` reads `XRRGetMonitors` over FFI (`sizeof(XRRMonitorInfo)` = 56 on x86-64: name Atom at 0, primary at 8, x/y/w/h at 20/24/28/32) and falls back to one whole-root-window entry when the library is absent. X11 puts every monitor in one root coordinate space, so a per-monitor capture is a crop — `-video_size WxH -i :0.0+X,Y` — and `-i :0.0` alone grabs the union of all of them.
 - **A uinput injector needs two devices, not one**: libinput classifies a device from the capabilities it declares, and one device advertising both a full keyboard and absolute axes is typically read as a *touchpad* — which then applies pointer acceleration and treats absolute coordinates as relative motion, so the pointer drifts instead of landing. `remote-desktop-input-uinput.ts` creates a pointer device (absolute axes + buttons + wheel + `INPUT_PROP_DIRECT`) and a keyboard device separately, declares every key it will ever send (`UI_SET_KEYBIT`; an undeclared key is dropped by the kernel silently), and `UI_DEV_DESTROY`s both on exit or they pile up in the compositor's device list on every restart. Derive the ioctl numbers from real headers — `_IOW` encodes the struct size, so a wrong `sizeof` yields a different request number and `ioctl` fails with `EINVAL` for no visible reason. uinput carries key *codes*, so there is no `text()` at all: a phone soft keyboard that reports no key codes cannot type on a Wayland host.
@@ -165,9 +169,15 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 
 - **`Bun.spawn` throws on a missing binary rather than reporting it, and every per-OS tool is a missing binary somewhere**: it raises `Executable not found in $PATH` *synchronously*, so a `try` placed around the awaited output — the natural reading order — never sees it and the exception escapes a function typed `Promise<RunResult>`. `src/services/host-info/spawn-runner.ts` is shared by the `systemctl`, `plutil`, `powershell.exe`, `findmnt` and `xdg-user-dir` providers, i.e. by five tools that are each absent on two of the three platforms, and there the throw turned the Services page on macOS and Windows into a 500 showing the exception — past a collector that answers `supported: false` and a panel that has a branch for exactly that. A missing binary is returned as a *failed run* (`code: null`, message on stderr) because that is the shape callers already branch on; `gpu-collector-nvidia.ts` had been carrying its own `try` around the same hazard all along, which is the tell that it was known and not generalised. Two things to take from it. Reproduce a platform you do not have by removing what it lacks — `env PATH=/nonexistent bun -e '…'` took the Services collector from `THREW` to `supported: false` in one command, and no amount of reading the file would have. And the narrowed spawn type has to be preserved when the call moves into a `try`: `ReturnType<typeof Bun.spawn>` widens `stdout` back to a union with a raw fd that `new Response()` rejects, so name a helper and take `ReturnType<typeof helper>`.
 
-- **A platform's memory figure can look wrong and be right, and `memory_pressure` is the trap**: `os.freemem()` on darwin reports only truly-free pages — 124 MB on a 32 GB M1 Max — which reads as a broken collector until you check the platform's own tool. `top` said `PhysMem: 31G used (3523M wired, 11G compressor), 75M unused` on the same host at the same moment, i.e. PPM already agreed with Activity Monitor. The correction that suggests itself is `memory_pressure`, which called that machine **"56% free"** — it measures what could be reclaimed under duress, not free RAM, and adopting it would have swapped a figure matching Activity Monitor for one contradicting it. `vm_stat`'s `inactive` (8.5 GB there) is the same mistake in another form: macOS counts it as used, Linux's `MemAvailable` would not. Compare against the *platform's own* headline number before "fixing" anything. What was genuinely missing on darwin was **swap**, which `node:os` does not carry at all and `vm.swapusage` answers in one sysctl (`memory-darwin.ts`, 1.33 ms/tick, measured); it was rendering as an em dash on a Mac with 8 GB swapped.
+- **macOS has two "used memory" figures, and the one `top` prints is not Activity Monitor's**: `os.freemem()` on darwin counts only truly-free pages (66–124 MB on a 32 GB M1 Max), so `total − freemem` drew the Memory card at **99.7 %** while Activity Monitor said ~80 %. It survived because it agreed with `top` — `PhysMem: 31G used (3523M wired, 11G compressor), 75M unused` — and that agreement is the trap: `top`'s *used* counts the file cache, while Activity Monitor's **Memory Used** is App Memory + Wired + Compressed with **Cached Files** listed beside it (27.1 GB against `top`'s 31.9 on the same host at the same moment). Linux draws the same line (`MemAvailable`: cache the kernel can take back is not in use), so Activity Monitor's meaning is also the Linux one. `memory-darwin.ts` reads `host_statistics64(HOST_VM_INFO64)` over FFI (0.002 ms): used = (internal − purgeable) + wired + compressor, cached = external + purgeable, available = cached + free — **not** total − used, because 0.86 GiB of `hw.memsize` is held by the firmware in no page state and total − used would call it allocatable. Measured: 27.04 GiB against 27.01 from `vm_stat` run through Activity Monitor's formula. Two other corrections suggest themselves and both are wrong: `memory_pressure`'s "free %" (48–56 % on a machine using 27 of 32 GB) measures what could be reclaimed under duress, and `vm_stat`'s `inactive` mixes anonymous and file-backed pages, so neither is free RAM. Swap is `vm.swapusage` read as the `xsw_usage` struct — `node:os` carries no swap at all, and it rendered as an em dash on a Mac with 8 GB swapped. Compare against the platform's *headline* number, and make sure it is the right one of the platform's numbers, before fixing anything.
 
 - **A platform gap parked as `null` becomes a *lie* the moment its caller has only one sentence for `null`**: the process Details reader was `/proc`-only and answered `null` everywhere else, and the route already spelled `null` as `PID <n> is no longer running` — true on Linux, where a vanished `/proc/<pid>` really is an exited process, and false on macOS, where it reported a renderer using 4.2% of the CPU as dead. A placeholder is only safe while nothing downstream *interprets* it, so give the unsupported case its own answer (`supportsProcessDetails()` → 501) before writing the `: null`. The gap itself was smaller than it looked: `ps` answers **ten of the eleven fields** on darwin (`process-details-darwin.ts`), two of them more directly than Linux — `lstart` is a real timestamp rather than jiffies to add to `btime`, and `user` is the login name already, so it works across users with no `/etc/passwd` lookup. Only `cgroup` has no equivalent. Three traps in the parse, all silent: macOS `ps` offers **no delimiter**, so fields are taken **positionally** — `lstart` is always five tokens (a single-digit day pads with two spaces, which a `\s+` split collapses rather than dropping) and `comm` must be **last**, since a path like `/Applications/Google Chrome.app/…/Google Chrome Helper (Renderer)` holds six spaces; `-M` may **not** be combined with `-o` (it prints the chosen columns *and* thread-layout leftovers on one line, which parses as nonsense instead of failing), so the thread count is a second call against the default format; and the state letters are **BSD's, not Linux's** — uninterruptible wait is `U` where Linux writes `D`, and `Z` is not an edge case (126 zombies against 645 sleepers on a normal desktop). Same family as the `Bun.spawn`-throws bullet above: reproduce a platform you do not have by taking its tools away, and verify the result against that platform's own output.
+- **A CoreFoundation or Objective-C reference crossing `bun:ffi` must be a `u64`, never `T.ptr`**: macOS hands back short CFStrings and many object ids as **tagged pointers** — the value *is* the data, high bits set — and `CFStringCreateWithCString("CPU Stats")` answered `0xbc990da26c92796a`, above 2^53, while "Energy Model" got a heap address that crossed intact, which is why it works until it does not. `T.ptr` returns a JS double, so the reference is rounded on the way in, and handing it back (`CFRelease`, `CFStringGetCString`) dereferences a neighbouring address: the probe segfaulted at `0x10` with nothing reporting an error before it. Every ref in `core-foundation-darwin.ts` is a bigint (`T.u64` in both directions), `CFRelease(NULL)` is never called, and a string is read only after `CFGetTypeID` says it is one. CoreWLAN hit the same trap first (`wifi-darwin.ts` carries its object ids as u64 for this reason), which is the tell: any Apple API that returns an object can return a tagged one.
+- **A Mac's sensors are three APIs, none needs root, and every read stops the event loop**: the SMC (temperatures, fans), IOReport (CPU/GPU energy and state residency → power and clock) and the HID event system (the SSD's "NAND CH0 temp") are all synchronous IOKit calls over `bun:ffi`, each with its own cost. An SMC read is a **firmware round trip** — 0.24 ms idle, up to 0.46 ms under load — so reading all 41 temperature keys was 11.5–19 ms of stopped event loop every tick. `smc-darwin.ts` reads the fans every tick and round-robins the rest inside a 4 ms budget (everything on the first call and after a 10 s gap), averaging each site over every sensor's *latest* value, because the sensors of one site read low/middle/high and a mean of only this tick's subset jumps; measured 4.1–4.7 ms a tick. IOReport's `IOReportCopyAllChannels` is 188 ms for 9341 channels **once** — copying per group costs 110 ms *per group* — and the array is then pruned to 13 channels; each tick is one sample and one delta, ~4 ms, and a gap over 10 s restarts the baseline instead of averaging over it. The NAND sensor costs 1.7 ms a read (33 ms to find) and moves over minutes, so it is read every 10 s. A worker thread cannot take any of this off the main thread: a release binary bundles only `src/index.ts`. Three attribution rules keep the figures honest: the SSD temperature goes only to the one `IOEmbeddedNVMeBlockDevice` (checked against `diskutil`'s SMART: 310 K = 37 °C, PPM 37 °C); GPU clock, power and temperature only where exactly one GPU is listed, since neither source names a GPU; and the first tick has no interval, so power and clock are absent on it, not zero. `PSTR` is whole-machine power and `F0Dc` is undocumented — neither is read.
+- **Per-process GPU, disk and network on macOS come from three places, each with its own edge**: GPU time lives in the registry, not in a tool — every `AGXDeviceUserClient` child of the `IOAccelerator` names its process (`IOUserClientCreator` = "pid N, name") and carries `AppUsage[].accumulatedGPUTime` in **nanoseconds** (its `lastSubmittedTime` matched `CLOCK_UPTIME_RAW` to 0.01 s), so one `ioreg` read a tick serves the GPU page and the process column alike; a client absent from the previous read contributes nothing, or a window opened a moment ago reads as thousands of percent. Disk is `proc_pid_rusage(RUSAGE_INFO_V2)` (~3 µs a process), which answers **EPERM for another user's process** — an em dash, not 0, and the column is offered only when some pid answered. Network is `nettop`, which must run with **`-n`**: without it every sample resolves each connection's remote address (18 DNS queries a run, one run a tick while the page is open), telling the resolver what the machine talks to.
+- **launchd is not systemd, and most of the differences are silent**: `launchctl print gui/<uid>` is *a* listing of the user's jobs, not the listing: the background session's `user/<uid>` is the GUI domain's parent with jobs of its own (84 beside 450 here, none in both — an agent allowed in both sessions loads once, in the background one), and launchd answers for a label only in the domain that holds it (`Could not find service` from the other), so a job is printed and acted on in the domain it was listed from. Each listing carries its own `disabled services` section, and a disabled job is not bootstrapped — it appears **only** there. Launch Services adds an `application.<bundle id>.<n>.<n>` job for every launch of every app; those are the Apps page's rows, and leaving them out of the list does not stop a request naming one, so the guard refuses every action on them — stopping one quits its app, the terminal PPM was started from included. `(pe)`, an idle exit (memory reclaimed from an idle job — 155 of 446 jobs here), is not a failure, and neither is a job whose own `last exit reason` reads `JETSAM_REASON_MEMORY_IDLE_EXIT`; any other jetsam kill (`(jt)`, typically a job past its memory limit) is, the way systemd calls an OOM kill `failed`. Stop is `launchctl kill SIGTERM`, never `bootout`: a booted-out job leaves the list until the next login, and 13 of 24 third-party jobs here had no plist to load it back from. A KeepAlive job comes back by itself — 0.05 s after a kill for a job that had run a while, 8.2 s for one started 2 s earlier, because launchd will not relaunch within 10 s of the previous launch. A label's enable/disable override is kept **forever** and removing it needs root, so never click Enable/Disable on a throwaway job in a test. launchd sets `XPC_SERVICE_NAME` for a job's processes, and PPM inherits `XPC_SERVICE_NAME=com.hienlh.ppm` — which is how the guard recognises its own job. And there is no journal: a job's log is its own stdout/stderr files, else `log show`, whose cost is what it *prints*, not the window it is given — with a predicate naming one process, three days of a quiet daemon is 3 s, while runningboardd's 758k lines since boot are 32 s. So the reader asks for the last hour first and widens to the process's start (the boot, for a stopped job) only while the hour holds fewer lines than the box shows, inside one 10 s budget, one read at a time. A five-minute window — the first version — showed a line for 6 of 23 running jobs and 0 of 25 stopped ones, i.e. an empty box for nearly everything, failed jobs included. The pid predicate needs the process's start as its floor: pids wrap at 99,999, which this desktop reached in under three days, so a query by pid over the boot can answer with an earlier process's lines. Search by *message text* (`eventMessage CONTAINS`) is the one predicate never to use here: it decodes every message in the store, 105 s for one day.
+- **On macOS `/tmp` and `/var` are symlinks into `/private`, so a path guard comparing one spelling protects nothing there**: every fs door checks a path and its real path, and a real path never spells a root through a symlink — so a PPM directory under `/tmp` (every test's `PPM_HOME`) matched only the first check, and a symlink to `ppm.db` was served as an ordinary file. `fs-credential-path-guard.ts` compares each protected root (PPM dir, `~/.cloudflared`, backups) by its configured **and** its real spelling, resolved once per root. An exception is never spelled by its *own* real path: the uploads and codex-image exceptions are the PPM dir's spellings plus their subpath, and they lift only the PPM-dir refusal. Resolving `uploads` itself — the first version of this fix — let a link put in its place carry the exception to the link's target: the snapshot directory, or the PPM dir and `ppm.db` with it. The `fs-sqlite` route test had been failing on every Mac for exactly this reason, which read as a flaky test.
+- **Wi-Fi on macOS: `system_profiler` scans, CoreWLAN does not, and the SSID is not PPM's to read**: `system_profiler SPAirPortDataType` looks like a query and is a **scan** — 3.8 s of wall time, and ping to the router went from max 73 ms to 135 ms while it ran, a network hitch on the machine being monitored. `CWWiFiClient.sharedWiFiClient().interface()` over the Objective-C runtime answers RSSI, noise, transmit rate, channel and band in 5–10 ms without scanning (`wifi-darwin.ts`: every id a u64, each message guarded by `class_respondsToSelector`, each read in its own autorelease pool). The SSID is nil without the Location permission, which a server process cannot obtain, so that row stays an em dash.
 - **Whisper invents speech out of silence, and in Vietnamese it invents the same YouTube outro every time**: six seconds of digital silence transcribes as "Hãy subscribe cho kênh Ghiền Mì Gõ Để không bỏ lỡ những video hấp dẫn" on both `small` and `large-v3-turbo`, and pink noise as "Cảm ơn các bạn đã theo dõi và hẹn gặp lại." — so the Silero VAD model (885 KB) is downloaded beside every speech model and `--vad` is not a tuning knob: with it both come back empty, and in 0.3s rather than seconds. Four more traps in the same install. The browser's own recording is **not** a format whisper.cpp can read — Chrome records Opus in WebM, Firefox Opus in Ogg, Safari AAC in MP4, while whisper reads wav/flac/mp3/Vorbis-ogg — so the conversion is done in the browser (`recordingToWav`, an `OfflineAudioContext` at 16 kHz, which is also what makes the upload 32 KB/s), because doing it on the host would mean requiring ffmpeg there as well. The published Linux build needs **glibc 2.34** and GCC 11's libstdc++, so on an older host (Ubuntu 20.04 is 2.31) every file downloads fine and only the first sentence fails — the installer runs `whisper-cli --help` once so that surfaces as an install error naming the cause. macOS has **no** CLI in the release at all (its asset is an xcframework, a library for Swift apps), so a Mac installs Homebrew's `whisper.cpp` and PPM looks for `whisper-cli` at `/opt/homebrew/bin` and `/usr/local/bin` as well as on PATH — a launchd-started PPM has neither prefix in its PATH. And whisper.cpp defaults to **4 threads**, which is worth raising and worth capping: on a 24-thread i9-12900K a 10s clip took 12.0s at 4 threads, 8.1s at 8, 5.6s at 16 and 5.4s at 24. The VAD is not quite the end of it either: it stops every non-speech clip measured here (silence, white noise at four levels, 50 Hz hum, a 440 Hz tone, brown noise, typing, a cough, a breath, room tone — each of which *without* it comes back as that same one sentence, byte for byte), but a live install still produced it, so `whisper-hallucinations.ts` drops the invented sentence by whole segment — `-nt` prints one line per segment, which is what makes dropping one safe when real speech sits either side. The two knobs that look like the fix are not: `--suppress-nst` changes nothing at all, and `-nth 0.3` empties the invented sentence **and** a perfectly clear 10s dictation with it.
 - **MCP sign-in works in SDK mode, through methods `sdk.d.ts` does not declare**: a server the CLI reports as `needs-auth` (an HTTP server with OAuth such as Vanta, every plugin connector) used to be unusable from PPM because the CLI's `/mcp` screen does not exist without a terminal — and the model, reading the CLI's own "this session is non-interactive" hint, told users to go and open one. The `Query` object in fact carries `mcpAuthenticate(name, redirectUri?)` and `mcpSubmitOAuthCallbackUrl(name, url)` (in `sdk.mjs`, stripped from the typings), and a **prompt-less** streaming `query()` answers them — and `mcpServerStatus()` — in about a second with no model call. `src/services/mcp-oauth/` runs each sign-in in a subprocess of its own, and that process has to outlive the dialog's request: with the default `redirectScheme: "localhost"` the CLI's callback listener lives *inside* it, so closing it early strands the browser on a dead page. An https origin gets `redirectUri` pointed at PPM's public `GET /api/mcp-auth/callback` instead, which is what makes a phone over a tunnel work (Vanta accepts it); plain http falls back to the localhost listener plus a paste box. Four traps. The tokens land in the CLI's shared credential store, so a *running* chat still reports the server `needs-auth` until `reconnectMcpServer` is called in it — `chat-mcp-sign-in-sync.ts` does that, and drops an idle subprocess that still cannot see them. claude.ai connectors (`claude.ai <name>`, scope `claudeai`) answer "Server not found" to `mcp_authenticate` in SDK mode, so the UI sends them to claude.ai's connector settings rather than starting a flow that cannot succeed. The expiry timer only starts once there is a link, so `mcpAuthenticate` and the status probe's reads are wrapped in `withTimeout` — a CLI that never answers would otherwise hold its subprocess for as long as PPM runs, and every caller shares the probe. And in an e2e, Bun's `fetch` reuses a pooled socket the server has already closed after a long idle stretch, so a request silently never arrives: that read as a hung sign-in until the server log showed no `starting sign-in` line for it — `tests/e2e/mcp-sign-in-e2e.mjs` sends `Connection: close`. `tests/unit/services/mcp-oauth-flows.test.ts` greps `sdk.mjs` for the undeclared methods so an SDK upgrade that renames them fails a test rather than the button.
 
@@ -188,6 +198,12 @@ Related: `configService.save()`/`set()` throw when `load()` has not run, because
 - **A streaming rollout parser cannot use whole-file look-ahead**: it commits to legacy vs `item_completed` format from the *first* `session_meta`'s `cli_version` (`item_completed` shipped in codex cli 0.154.0) and never revisits that choice mid-file — there is no later point at which re-reading the whole file to check is acceptable for a live tail. A `compacted` or `thread_rolled_back` record rewrites the file's *content*, not its format, so `codex-rollout-tail-parser.ts` resets its de-dupe state on those but keeps the format decision from the header.
 - **`resolveSessionDir` falls back to scanning every Claude project on disk**: given a session id whose encoded project path does not resolve, it walks every `~/.claude/projects/*` looking for a matching `<sessionId>.jsonl` — useful for a session started outside PPM, unsafe if trusted before the caller is known to own that session. `src/services/agent-transcript/session-ownership.ts` is the gate every Agent-session transcript read goes through first instead; the `/ws/global` hub never accepts a client-supplied path for this reason.
 
+- **WebCodecs is secure-context only, so Remote Desktop and the Android viewer cannot show a picture on a plain-HTTP LAN address** — which is how a phone or tablet normally reaches PPM. Measured in one browser at one moment: `VideoDecoder` is `undefined` on `http://192.168.98.96:3210` and present on `http://127.0.0.1:3210`, while `RTCPeerConnection` exists on both. Nothing warns; the viewer just reports "this browser has no WebCodecs" about a browser that is fine, which is why `missingDecoderReason()` branches on `window.isSecureContext` instead. The way out is WebRTC, and in Bun that means a **downloaded binary**: there is no WebRTC stack in the runtime, GStreamer's `webrtcbin` **segfaults PyGObject** on GStreamer 1.28.7 + Python 3.14 (`gst_webrtc_session_description_copy` → `gst_sdp_message_copy` → `g_strdup` on a malformed emails array — it dies just *reading* the offer, and rebuilding the description from SDP text does not help) *and* would put GStreamer + PyGObject on every Windows and macOS host, and `@roamhq/wrtc` only accepts raw i420, i.e. it would discard the hardware H.264 encode and re-encode in software. `mediamtx-*.ts` is the answer: MediaMTX repackages the H.264 ffmpeg already produced (verified — 1920x1080 Main@4.0 in, `video/H264` at the same size out) for 0.6% of a core and 55 MB RSS. Four traps in wiring it. Its **shipped `mediamtx.yml` must never be used**: it listens on every interface with RTMP/HLS/SRT/MoQ/API/metrics/pprof on, and MoQ writes `auto.crt`/`auto.key` beside itself on first start — PPM generates its own config and every switch is spelled out, because MediaMTX *rejects unknown keys* (`json: unknown field`), so a renamed key fails loudly instead of silently leaving a listener open. The **ICE/UDP port cannot be loopback** — WebRTC media is peer-to-peer, so confining it breaks every remote viewer while the page still connects; what protects it is the per-session ICE ufrag/password, which is why a test asserts the port is *not* loopback. `filesrc` **cannot read a FIFO** (it probes for seekability and closes it, so ffmpeg takes EPIPE) — open the FIFO yourself and hand over `fdsrc fd=N`. And the relay answers **404 until the publisher's first packet**, which a quality change re-creates by respawning ffmpeg, so the browser's WHEP handshake must retry rather than fail. Peer-to-peer also means a viewer on the **Cloudflare tunnel** has no route for the media at all: the handshake is proxied over HTTPS and succeeds, then nothing arrives, and Chromium takes **15 s** (measured, no candidate reachable) to call the connection `failed`. So `use-webrtc-canvas-video.ts` gives ICE `CONNECT_DEADLINE_MS` and the connection hook reconnects asking for the WebSocket stream, remembered for the tab in `sessionStorage` — but only where WebCodecs exists: behind the tunnel's HTTPS it does in any browser that ships it, on a plain-HTTP LAN origin it never does, and there the WebRTC error stands. Last: `startCapture` keeps `stdout: "pipe"` in both modes even though nothing reads it when publishing — making it conditional widens Bun's spawn type so `proc.stdout` is possibly-undefined everywhere below, the same family as the `ReturnType<typeof Bun.spawn>` trap above.
+- **`Bun.spawn({ stdin: other.stdout })` is not a pipe between two children**: Bun reads every byte into PPM and writes it back out with a pump of its own (measured: piping 200 MB raised the Bun process's own `rchar` and `wchar` by 200 MB each). Two failures follow, both silent until the reader dies. Under a burst, that pump rejects with `EPIPE`s nothing can catch — 2–3 per remux death with keyframe-sized writes, and `handleFatalError` in `src/server/index.ts` exits the server at 3 in a minute. And a reader that stalls before dying leaves the writer running for good, because Bun is still reading it: gst-launch kept encoding with no `onExit` and the viewer sat on a frozen picture. `remote-desktop-capture-wayland.ts` therefore pumps gst into the remux itself (one awaited `write()` + `flush()` per chunk, the same shape as the `FileSink` entry above) and watches **both** processes, the first to die taking the other down. `wayland-capture-supervision.test.ts` drives it with shell stand-ins; under `bun test` an unhandled rejection is a failed test, which is what makes the burst case assertable at all.
+
+- **`PRAGMA auto_vacuum` takes the write lock even when it changes nothing, so `busy_timeout` must be set first**: the session trace set it after `auto_vacuum`/`journal_mode` (copied from `query-audit-db.ts`, which still has that order), and a second process opening the file while another was mid-write got `SQLITE_BUSY` at once — measured: a lock held for 300 ms failed the open outright against a 2 s timeout. Only the full unit suite's server-plus-CLI race caught it. `journal_mode = WAL` on a file already in WAL does *not* wait on a writer, which is why `db.service.ts`'s order is harmless. Put `busy_timeout` first in any opener two processes share.
+- **The Claude SDK interleaves a data-less `system/thinking_tokens` between every two thinking deltas**, so anything folding *consecutive* deltas folds nothing: the trace's coalescer turned one real turn into 92 rows, 84 of them single deltas and ticks. The provider forwards every SDK system message it does not special-case as a bare `{type, subtype}` (`claude-agent-sdk.ts`), and that shape is how to recognise a signal — `trace-coalescer.ts` counts one arriving inside a block on the block (`signals`) instead of closing it. A mock or scripted provider that never sends these hides the bug entirely, which is why the replay test's script now does.
+
 ## UI Rules
 
 When creating or modifying any UI component, you MUST read and follow `docs/design-guidelines.md`, especially the **Mobile-First UI Rules** section. Key rules:
@@ -224,13 +240,17 @@ Before planning or implementing a new feature, read `docs/project-roadmap.md` to
 - `src/services/host-info/` — Per-OS drives/known-folders/pinned-folders providers (`/api/system/host`)
 - `src/services/system-metrics/` — Task Manager backend (`/api/system/resources*`): per-OS collectors, one long-lived PowerShell child on Windows (never spawn per tick — 32 MiB commit leak each), light/full SSE tiers with leases, guarded kill. UI in `src/web/components/system/` (floating window on desktop, tab on mobile)
   - Mission Center's pages are ported on top of it. Per-device collectors (`disk-devices-linux.ts`, `net-devices-linux.ts`, `gpu-devices-linux.ts`, `cpu-details-linux.ts`, `memory-linux.ts`, `fans-linux.ts`) feed the Performance page's device sidebar; the static labels beside them (DIMM vendors, disk models and serials, link speeds, driver/API versions) come from `hardware-inventory.ts` + `udev-db.ts` and are sent once, not per tick. Per-process GPU is DRM fdinfo (`gpu-fdinfo-linux.ts`). Signals are `signal-request-handler.ts` → `signal-executor.ts` behind the same parse → re-query → identity → guard sequence as the kill path, and `process-details-linux.ts` is the Details dialog.
+  - macOS has a collector beside each Linux one, reading the kernel over `bun:ffi` where it can and one shared tool read a tick where it cannot (`darwin-tool-reads.ts` memoises each `ioreg`/`netstat`/`ifconfig` read for 1 s, so two collectors needing one spawn share it): `memory-darwin.ts` (Activity Monitor's figures from `host_statistics64`), `cpu-details-darwin.ts` (perf levels, the `pmgr` DVFS tables), `disk-devices-darwin.ts` + `disk-inventory-darwin.ts` (one `ioreg IOBlockStorageDevice` for every drive; partitions from `mount` + one `diskutil list -plist`), `net-devices-darwin.ts` + `wifi-darwin.ts` (CoreWLAN, never `system_profiler`), `gpu-darwin.ts` (one `ioreg IOAccelerator` for the GPU page and the per-process column), `process-io-darwin.ts` (`proc_pid_rusage`), `process-details-darwin.ts` (`ps`), and the sensors — `smc-darwin.ts`, `ioreport-darwin.ts`, `hid-temperature-darwin.ts`, taken once a tick by `sensors-darwin.ts` on top of `core-foundation-darwin.ts`. `device-collector-darwin.ts` assembles them into the tick.
   - `src/services/system-services/` is the Services page (`/api/system/services*`, routes in `src/server/routes/system-services.ts`): **two** `systemctl` spawns per scope — `list-units` plus one bulk `show` — never one per unit, with `journalctl -o json` behind the per-unit log. There is no D-Bus in Bun, which is why this shells out at all. Pass each unit as its own argv element after `--`: `-.mount` begins with a dash.
+  - The routes take a `ServiceBackend` (`service-backend.ts`): systemd on Linux, launchd on macOS — `launchd-collector.ts` (`launchctl print` of `system`, `gui/<uid>` and `user/<uid>`, each job printed and acted on in the one that holds it), `launchd-parse.ts`, `launchd-guard.ts` (PPM's own job by `XPC_SERVICE_NAME` and its ancestor pids, macOS's `com.apple.*` jobs, apps' per-launch `application.*` jobs, the root-only system domain), `launchd-logs.ts` (the job's own files, else `log show` from the job's start — the boot for a stopped one — newest hour first) and `launchd-job-index.ts` (the listing's pid → job map the tick walks by ppid, so per-job CPU/RAM costs no spawn).
   - An application is not a process: `app-rows.ts` folds processes into apps by the systemd app cgroup they live in (`app-<desktop-id>[-<pid>].scope`, `app-<id>@<hash>.service`), and `/api/system/app-icon/:id` serves that app's own desktop-entry icon. That route is the one place the `?token=` query fallback in `middleware/auth.ts` was widened to — an `<img>` cannot send an `Authorization` header — and it is only safe because it takes an **app id, never a path**. Keep it that way.
+  - On macOS an app is an **application bundle**, not a cgroup: `apps-darwin.ts` walks each process's executable path (`process-path-darwin.ts`: the kernel's `proc_pidpath` unless it names a different file than `ps` printed) up to its bundle, reads `Info.plist` in-process (XML or binary, `plist-binary.ts`), and `app-icons-darwin.ts` turns the bundle's icon into a 64 px PNG with `sips`. The icon route still takes an app id, never a path.
   - A pid names its Services row through `serviceKeyFromCgroup` in `system-services/app-cgroup-linux.ts`, which answers `"<scope>:<unit>"`. Three traps, all silent: the **innermost** unit wins (a user service nests under `user@1000.service`, so the outer one would put every desktop process on one row); living under `/user.slice/` does **not** make a unit a user one (`session-2.scope` and `user@1000.service` are both system units); and the scope is part of the key because `dbus-broker.service` exists in **both** scopes on an ordinary desktop. The Services page then sums the tick's own process rows in the browser (`services/service-resources.ts`) rather than recomputing rates in the services route, which has no counter state and would give one process two different figures on two pages of one window. A fourth trap lives on that side: a unit with no rows is only an em dash if it OUGHT to have processes, and neither `ActiveState` nor `SubState` answers that alone — systemd calls a mount `active (mounted)`, a finished oneshot `active (exited)` and a **listening socket `running`**, so going by the first dashed 97 of this host's 222 rows and going by the second still dashed 14. `resourcesFor` requires `SubState === "running"` **and** a `.service`/`.scope` unit, because a socket's processes live in the service it activates and its own `MainPID` is empty.
   - **`os.cpus()` cannot express a core that is blocked on I/O**, and the failure is a *confident wrong number* rather than a gap: libuv's Linux `uv_cpu_info` reads the `iowait`, `softirq` and `steal` columns of `/proc/stat` into a throwaway, so a core parked in iowait reports a tiny total delta with no idle in it and `(total-idle)/total` comes out **100%** — one bar of the Overview per-core strip drew solid red, every tick, for a thread that was 3% busy behind a 191 MB/s write. `cpu-memory-collector.ts` samples `/proc/stat` itself (`parseProcStatCores`) and keeps `os.cpus()` as the off-Linux fallback; iowait is folded into not-busy the way `top` and Mission Center both have it, and softirq is counted as kernel time rather than dropped from the total. Do **not** also add `guest`/`guest_nice`: the kernel already counts them inside `user`/`nice`, so summing them deflates every percentage on a host running VMs. The whole-machine `total` hid this — one core's 6-jiffy window barely moves a sum over 24 — so verify per-core figures against `/proc/stat` directly, never against the total.
   - The contract everywhere here is **`undefined` = cannot measure**, and the UI renders that as an em dash. Never substitute `0`: "this GPU has no dedicated memory" and "this GPU has 0 MB of memory" are different claims, and `tests/unit/web/overview-gpu-card-vram.test.tsx` pins the difference.
 - `src/services/db-backup/` — verified `VACUUM INTO` snapshots of `ppm.db` (hourly + at start + before every migration), GFS retention, `ppm backup` / `ppm restore`
-- `src/services/remote-desktop/` — Remote Desktop: one ffmpeg per WS session (`remote-desktop-capture.ts` + per-platform `remote-desktop-capture-input.ts` + `remote-desktop-encoder-args.ts`) → Annex-B H.264 access units → WebCodecs; input via `remote-desktop-input.ts` facade over `remote-desktop-input-{win32,darwin,linux,uinput}.ts` (bun:ffi, no helper binary); host checklist in `remote-desktop-requirements.ts` (ffmpeg install command, macOS TCC pre-flight, Linux session/XTEST/uinput rows); display list in `remote-desktop-displays.ts` (`CGGetActiveDisplayList` order = avfoundation `Capture screen N`, names/bounds via one JXA call; X11 monitors via `XRRGetMonitors`). Linux specifics: `remote-desktop-linux-session.ts` decides X11 vs Wayland and resolves `DISPLAY`/`XAUTHORITY`, `remote-desktop-x11.ts` is the shared Xlib connection, `remote-desktop-evdev-key-map.ts` is the one key table both Linux backends use. Clipboard sync is `remote-desktop-clipboard.ts` (host side, one helper process per read/write) and `src/web/components/remote-desktop/remote-desktop-clipboard-client.ts` (which key combos mean copy/paste, plus the insecure-origin copy fallback). The in-session controls are `remote-desktop-toolbar.tsx` (desktop, RustDesk's grouped menus) and `remote-desktop-mobile-toolbar.tsx` + `remote-desktop-mobile-settings.tsx` (thumb zone), with the scale maths in `remote-desktop-view-style.ts`. Host audio is `remote-desktop-audio.ts` (a second ffmpeg, Opus in Ogg) demuxed by `remote-desktop-ogg-opus.ts` and played by `use-opus-audio-player.ts`; privacy mode is `remote-desktop-privacy.ts` (X grabs + DPMS); host resolution is `remote-desktop-resolution.ts` (XRandR FFI) with the menu collapse and the fit-local decision in `remote-desktop-resolution-list.ts`; the custom image-quality maths ported from RustDesk's `video_qos.rs` are `src/shared/remote-desktop-custom-quality.ts` behind `remote-desktop-custom-quality-dialog.tsx`; screenshot/recording are `remote-desktop-recording.ts` + `use-remote-desktop-recorder.ts` (client-side `MediaRecorder` over the canvas). Codec choice comes from `workingEncoders()` in `media-transcode/ffmpeg-capabilities.ts`, which probes *every* candidate rather than short-circuiting. Routes `src/server/routes/remote-desktop.ts`, WS `src/server/ws/remote-desktop.ts`, UI `src/web/components/remote-desktop/`, e2e `tests/e2e/remote-desktop-e2e.mjs`
+- `src/services/session-trace/` — the session trace ("every run is traceable"): its own `session-trace.db` (outside `db-backup` — a log, not state), one trace per run keyed by the PPM session id with `trace_aliases` for ids a provider migrated to. `ChatService` records every input it handles (`user_message`, `context_added`, `approval_resolved`, `turn_aborted`) and every provider event, text/thinking deltas coalesced per block (`trace-coalescer.ts`), through a batching writer that never throws into a chat (`trace-writer.ts`). Browser half: `src/web/lib/trace-client.ts` (every console level; errors carry the 50 lines before them) posting to `POST /api/trace` keyed by device id, plus the inline watchdog beacon in `index.html`. Read a session with `GET /api/trace/sessions/:id`; retention in `session-trace-cleanup.ts`. Design and as-built notes: `docs/architecture/plugins-and-tracing.md`
+- `src/services/remote-desktop/` — Remote Desktop: one ffmpeg per WS session (`remote-desktop-capture.ts` + per-platform `remote-desktop-capture-input.ts` + `remote-desktop-encoder-args.ts`) → Annex-B H.264 access units → WebCodecs; input via `remote-desktop-input.ts` facade over `remote-desktop-input-{win32,darwin,linux,uinput}.ts` (bun:ffi, no helper binary); host checklist in `remote-desktop-requirements.ts` (ffmpeg install command, macOS TCC pre-flight, Linux session/XTEST/uinput rows); display list in `remote-desktop-displays.ts` (`CGGetActiveDisplayList` order = avfoundation `Capture screen N`, names/bounds via one JXA call; X11 monitors via `XRRGetMonitors`). Linux specifics: `remote-desktop-linux-session.ts` decides X11 vs Wayland and resolves `DISPLAY`/`XAUTHORITY` (a Wayland session then takes a separate capture backend: `remote-desktop-portal.ts` holds the `org.freedesktop.portal.ScreenCast` session over libdbus FFI and `remote-desktop-capture-wayland.ts` runs `gst-launch-1.0` against the PipeWire node it hands back, producing the same Annex-B stdout ffmpeg does),  `remote-desktop-x11.ts` is the shared Xlib connection, `remote-desktop-evdev-key-map.ts` is the one key table both Linux backends use. Clipboard sync is `remote-desktop-clipboard.ts` (host side, one helper process per read/write) and `src/web/components/remote-desktop/remote-desktop-clipboard-client.ts` (which key combos mean copy/paste, plus the insecure-origin copy fallback). The in-session controls are `remote-desktop-toolbar.tsx` (desktop, RustDesk's grouped menus) and `remote-desktop-mobile-toolbar.tsx` + `remote-desktop-mobile-settings.tsx` (thumb zone), with the scale maths in `remote-desktop-view-style.ts`. Host audio is `remote-desktop-audio.ts` (a second ffmpeg, Opus in Ogg) demuxed by `remote-desktop-ogg-opus.ts` and played by `use-opus-audio-player.ts`; privacy mode is `remote-desktop-privacy.ts` (X grabs + DPMS); host resolution is `remote-desktop-resolution.ts` (XRandR FFI) with the menu collapse and the fit-local decision in `remote-desktop-resolution-list.ts`; the custom image-quality maths ported from RustDesk's `video_qos.rs` are `src/shared/remote-desktop-custom-quality.ts` behind `remote-desktop-custom-quality-dialog.tsx`; screenshot/recording are `remote-desktop-recording.ts` + `use-remote-desktop-recorder.ts` (client-side `MediaRecorder` over the canvas). The WebRTC transport is an optional downloaded relay: `mediamtx-catalog.ts` (pinned version + SHA-256 per platform), `mediamtx-install.service.ts`, `mediamtx-paths.ts`, `mediamtx-config.ts` (the generated config — the one place the relay's exposure is decided) and `mediamtx-process.ts` (one relay per session, free ports, waits until it is really listening); `buildCaptureArgs`'s last argument swaps `pipe:1` for an RTSP push, `remote-desktop-whep-registry.ts` + `POST /api/remote-desktop/whep/:ticket` are the authenticated, **ticket-addressed** handshake proxy, and `use-webrtc-canvas-video.ts` paints the track into the same canvas the WebCodecs path draws to. Settings pane `settings/remote-desktop-settings-section.tsx`. Codec choice comes from `workingEncoders()` in `media-transcode/ffmpeg-capabilities.ts`, which probes *every* candidate rather than short-circuiting. Routes `src/server/routes/remote-desktop.ts`, WS `src/server/ws/remote-desktop.ts`, UI `src/web/components/remote-desktop/`, e2e `tests/e2e/remote-desktop-e2e.mjs`
 - `src/services/git-hunks/` — hunk/line-level stage, unstage and discard (`/api/projects/:name/git/{hunks,stage-hunks,unstage-hunks,discard-hunks}`). `unified-diff.ts` holds the patch surgery (recomputed `@@` counts, unselected deletions demoted to context); the UI is `src/web/components/git/hunk-stage-dialog.tsx`
 - `src/services/git-repos/` — which repository a project's git surfaces run in, when the project folder is a container of checkouts rather than a repository itself. `git-repo-discovery.ts` walks the folder (`GET /git/repos`), the `?repo=` middleware in `src/server/routes/git.ts` scopes every git route to one of them, and the browser side is `src/web/lib/git-repo-scope.ts` (pure decisions and both directions of path rebasing), `src/web/stores/git-repo-store.ts` (the device-local choice), `src/web/hooks/use-git-repo.ts` (what every panel calls) and `src/web/components/git/git-repo-picker.tsx`. Extension panels are opened on the repository, so `packages/ext-git-graph/src/project-scope.ts` maps that path back to the containing project
 - `src/web/lib/icons.ts` + `src/web/lib/icons.generated.tsx` + `src/web/lib/fluent-icon.tsx` — the product icons (Fluent System Icons 20px Regular, MIT, microsoft/fluentui-system-icons) for the app's own chrome. Every UI icon is imported from `@/lib/icons`; regenerate with `bun scripts/gen-product-icons.ts` after editing its `MAP`

package/assets/skills/ppm/SKILL.md

@@ -71,4 +71,4 @@ This skill covers the `ppm` CLI, its HTTP API, and its config DB. It does **not*
 - Third-party extensions (inspect via `ppm ext list`).
 - The Claude Agent SDK internals (separate skill).
 
-<!-- Generated for PPM v0.23.10 at build time. Re-run `ppm export skill --install` to refresh. -->
+<!-- Generated for PPM v0.23.12 at build time. Re-run `ppm export skill --install` to refresh. -->

package/assets/skills/ppm/references/cli-reference.md

@@ -781,7 +781,7 @@ Show recent runs for a schedule
 Manage and inspect discovered skills & commands
 
 **Options:**
-- `--project <path>` — Project path (default: `"C:\\Users\\PC\\ppm-release-clone"`)
+- `--project <path>` — Project path (default: `"C:\\Users\\PC\\ppm-release-0.23.12"`)
 
 **Usage:** `ppm skills [options] [command]`
 
@@ -791,7 +791,7 @@ List all discovered skills and commands
 
 **Options:**
 - `--json` — JSON output
-- `--project <path>` — Project path (default: `"C:\\Users\\PC\\ppm-release-clone"`)
+- `--project <path>` — Project path (default: `"C:\\Users\\PC\\ppm-release-0.23.12"`)
 
 ### `ppm skills search`
 
@@ -799,7 +799,7 @@ Fuzzy search skills and commands
 
 **Options:**
 - `--json` — JSON output
-- `--project <path>` — Project path (default: `"C:\\Users\\PC\\ppm-release-clone"`)
+- `--project <path>` — Project path (default: `"C:\\Users\\PC\\ppm-release-0.23.12"`)
 
 **Usage:** `ppm skills search [options] <query>`
 
@@ -809,7 +809,7 @@ Show detailed info for a specific skill
 
 **Options:**
 - `--json` — JSON output
-- `--project <path>` — Project path (default: `"C:\\Users\\PC\\ppm-release-clone"`)
+- `--project <path>` — Project path (default: `"C:\\Users\\PC\\ppm-release-0.23.12"`)
 
 **Usage:** `ppm skills info [options] <name>`
 

package/assets/skills/ppm/references/http-api.md

@@ -42,6 +42,33 @@ _Base URL: `http://localhost:8080` (default; override via `ppm config set port <
 - `POST   /api/ai-resources/duplicate`
 - `DELETE /api/ai-resources`
 
+## /api/android
+
+- `GET    /api/android/android`
+- `GET    /api/android/auth`
+- `GET    /api/android/capabilities`
+- `GET    /api/android/auth`
+- `GET    /api/android/devices`
+- `POST   /api/android/avds/:avdId/start`
+- `GET    /api/android/operations/:id`
+- `POST   /api/android/devices/:deviceId/stop`
+- `GET    /api/android/devices/:deviceId/log`
+- `POST   /api/android/devices/:deviceId/sessions`
+- `GET    /api/android/devices/:deviceId/screenshot`
+- `GET    /api/android/devices/:deviceId/clipboard`
+- `POST   /api/android/devices/:deviceId/clipboard`
+- `POST   /api/android/operations/:id/cancel`
+- `POST   /api/android/devices/:deviceId/apk`
+- `POST   /api/android/devices/:deviceId/apk/project`
+- `GET    /api/android/projects`
+- `GET    /api/android/projects/:project/apks`
+- `GET    /api/android/projects`
+- `GET    /api/android/system-images`
+- `GET    /api/android/device-profiles`
+- `POST   /api/android/avds`
+- `POST   /api/android/avds/:avdId/wipe`
+- `DELETE /api/android/avds/:avdId`
+
 ## /api/chat
 
 - `GET    /api/chat/sessions/running`
@@ -229,6 +256,10 @@ _Base URL: `http://localhost:8080` (default; override via `ppm config set port <
 - `GET    /api/remote-desktop/auth`
 - `POST   /api/remote-desktop/requirements/:id/:action`
 - `POST   /api/remote-desktop/session`
+- `POST   /api/remote-desktop/whep/:ticket`
+- `GET    /api/remote-desktop/relay`
+- `POST   /api/remote-desktop/relay/install`
+- `POST   /api/remote-desktop/relay/uninstall`
 
 ## /api/schedules
 
@@ -287,6 +318,12 @@ _Base URL: `http://localhost:8080` (default; override via `ppm config set port <
 - `PATCH  /api/settings/files`
 - `GET    /api/settings/clawbot/tasks`
 
+## /api/settings/design
+
+- `GET    /api/settings/design/projects`
+- `GET    /api/settings/design`
+- `PUT    /api/settings/design`
+
 ## /api/settings/mcp
 
 - `GET    /api/settings/mcp`
@@ -335,6 +372,11 @@ _Base URL: `http://localhost:8080` (default; override via `ppm config set port <
 - `GET    /api/teams/:name/members/:member/transcript`
 - `DELETE /api/teams/:name`
 
+## /api/trace
+
+- `POST   /api/trace`
+- `GET    /api/trace/sessions/:sessionId`
+
 ## /api/tunnel
 
 - `GET    /api/tunnel`
@@ -388,4 +430,4 @@ _Base URL: `http://localhost:8080` (default; override via `ppm config set port <
 - `ws://<host>/ws/terminal` — PTY terminal multiplexer
 - `ws://<host>/ws/extensions` — extension host channel
 
-<!-- Generated from src/server/routes/ for PPM v0.23.10 -->
+<!-- Generated from src/server/routes/ for PPM v0.23.12 -->

package/bun.lock

@@ -8,6 +8,8 @@
         "@anthropic-ai/claude-agent-sdk": "0.3.280",
         "@codemirror/lang-sql": "^6.10.0",
         "@glideapps/glide-data-grid": "^6.0.3",
+        "@grpc/grpc-js": "1.14.0",
+        "@grpc/proto-loader": "0.7.15",
         "@inquirer/prompts": "^8.3.0",
         "@monaco-editor/react": "^4.7.0",
         "@radix-ui/react-switch": "^1.2.6",
@@ -424,6 +426,10 @@
 
     "@glideapps/glide-data-grid": ["@glideapps/glide-data-grid@6.0.3", "", { "dependencies": { "@linaria/react": "^4.5.3", "canvas-hypertxt": "^1.0.3", "react-number-format": "^5.0.0" }, "peerDependencies": { "lodash": "^4.17.19", "marked": "^4.0.10", "react": "^16.12.0 || 17.x || 18.x", "react-dom": "^16.12.0 || 17.x || 18.x", "react-responsive-carousel": "^3.2.7" } }, "sha512-YXKggiNOaEemf0jP0jORq2EQKz+zXms+6mGzZc+q0mLMjmgzzoGLOQC1uYcynXSj1R61bd27JcPFsoH+Gj37Vg=="],
 
+    "@grpc/grpc-js": ["@grpc/grpc-js@1.14.0", "", { "dependencies": { "@grpc/proto-loader": "^0.8.0", "@js-sdsl/ordered-map": "^4.4.2" } }, "sha512-N8Jx6PaYzcTRNzirReJCtADVoq4z7+1KQ4E70jTg/koQiMoUSN1kbNjPOqpPbhMFhfU1/l7ixspPl8dNY+FoUg=="],
+
+    "@grpc/proto-loader": ["@grpc/proto-loader@0.7.15", "", { "dependencies": { "lodash.camelcase": "^4.3.0", "long": "^5.0.0", "protobufjs": "^7.2.5", "yargs": "^17.7.2" }, "bin": { "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js" } }, "sha512-tMXdRCfYVixjuFK+Hk0Q1s38gV9zDiDJfWL3h1rv4Qc39oILCu1TRTDt7+fGUI8K4G1Fj125Hx/ru3azECWTyQ=="],
+
     "@hono/node-server": ["@hono/node-server@1.19.14", "", { "peerDependencies": { "hono": "^4" } }, "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw=="],
 
     "@iconify-json/fluent": ["@iconify-json/fluent@1.2.57", "", { "dependencies": { "@iconify/types": "*" } }, "sha512-ecYjdYhwiQ+UNz94cOnYY8RCRbZ8+N54jzocxmfgRZgblM2IvG8RRGeI9Z52jxG8KhZcLftxyhvvk/rrqKSZLw=="],
@@ -480,6 +486,8 @@
 
     "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
 
+    "@js-sdsl/ordered-map": ["@js-sdsl/ordered-map@4.4.2", "", {}, "sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw=="],
+
     "@kwsites/file-exists": ["@kwsites/file-exists@1.1.1", "", { "dependencies": { "debug": "^4.1.1" } }, "sha512-m9/5YGR18lIwxSFDwfE3oA7bWuq9kdau6ugN4H2rJeyhFQZcG9AgSHkQtSD15a8WvTgfz9aikZMrKPHvbpqFiw=="],
 
     "@kwsites/promise-deferred": ["@kwsites/promise-deferred@1.1.1", "", {}, "sha512-GaHYm+c0O9MjZRu0ongGBRbinu8gVAMd2UZjji6jVmqKtZluZnptXGWhz1E8j8D2HJ3f/yMxKAUC0b+57wncIw=="],
@@ -524,6 +532,24 @@
 
     "@profoundlogic/hogan": ["@profoundlogic/hogan@3.0.4", "", { "dependencies": { "nopt": "1.0.10" }, "bin": { "hulk": "bin/hulk" } }, "sha512-pmNVGuooS30Mm7YbZd5T7E5zYVO6D5Ct91sn4T39mUvMUc3sCGridcnhAufL1/Bz2QzAtzEn0agNrdk3+5yWzw=="],
 
+    "@protobufjs/aspromise": ["@protobufjs/aspromise@1.1.2", "", {}, "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ=="],
+
+    "@protobufjs/base64": ["@protobufjs/base64@1.1.2", "", {}, "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg=="],
+
+    "@protobufjs/codegen": ["@protobufjs/codegen@2.0.5", "", {}, "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g=="],
+
+    "@protobufjs/eventemitter": ["@protobufjs/eventemitter@1.1.1", "", {}, "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg=="],
+
+    "@protobufjs/fetch": ["@protobufjs/fetch@1.1.1", "", { "dependencies": { "@protobufjs/aspromise": "^1.1.1" } }, "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw=="],
+
+    "@protobufjs/float": ["@protobufjs/float@1.0.2", "", {}, "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ=="],
+
+    "@protobufjs/path": ["@protobufjs/path@1.1.2", "", {}, "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA=="],
+
+    "@protobufjs/pool": ["@protobufjs/pool@1.1.0", "", {}, "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw=="],
+
+    "@protobufjs/utf8": ["@protobufjs/utf8@1.1.2", "", {}, "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug=="],
+
     "@radix-ui/number": ["@radix-ui/number@1.1.1", "", {}, "sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g=="],
 
     "@radix-ui/primitive": ["@radix-ui/primitive@1.1.3", "", {}, "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg=="],
@@ -1530,10 +1556,14 @@
 
     "lodash-es": ["lodash-es@4.17.23", "", {}, "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg=="],
 
+    "lodash.camelcase": ["lodash.camelcase@4.3.0", "", {}, "sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA=="],
+
     "lodash.debounce": ["lodash.debounce@4.0.8", "", {}, "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow=="],
 
     "lodash.sortby": ["lodash.sortby@4.7.0", "", {}, "sha512-HDWXG8isMntAyRF5vZ7xKuEvOhT4AhlRt/3czTSjvGUxjYCBVRQY48ViDHyfYz9VIoBkW4TMGQNapx+l3RUwdA=="],
 
+    "long": ["long@5.3.2", "", {}, "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="],
+
     "longest-streak": ["longest-streak@3.1.0", "", {}, "sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g=="],
 
     "loose-envify": ["loose-envify@1.4.0", "", { "dependencies": { "js-tokens": "^3.0.0 || ^4.0.0" }, "bin": { "loose-envify": "cli.js" } }, "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q=="],
@@ -1768,6 +1798,8 @@
 
     "property-information": ["property-information@7.1.0", "", {}, "sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ=="],
 
+    "protobufjs": ["protobufjs@7.6.6", "", { "dependencies": { "@protobufjs/aspromise": "^1.1.2", "@protobufjs/base64": "^1.1.2", "@protobufjs/codegen": "^2.0.5", "@protobufjs/eventemitter": "^1.1.1", "@protobufjs/fetch": "^1.1.1", "@protobufjs/float": "^1.0.2", "@protobufjs/path": "^1.1.2", "@protobufjs/pool": "^1.1.0", "@protobufjs/utf8": "^1.1.1", "@types/node": ">=13.7.0", "long": "^5.3.2" } }, "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg=="],
+
     "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="],
 
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
@@ -2212,6 +2244,8 @@
 
     "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],
 
+    "@grpc/grpc-js/@grpc/proto-loader": ["@grpc/proto-loader@0.8.1", "", { "dependencies": { "lodash.camelcase": "^4.3.0", "long": "^5.0.0", "protobufjs": "^7.5.5", "yargs": "^17.7.2" }, "bin": { "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js" } }, "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg=="],
+
     "@rollup/plugin-node-resolve/@rollup/pluginutils": ["@rollup/pluginutils@5.3.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-walker": "^2.0.2", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q=="],
 
     "@rollup/plugin-replace/magic-string": ["magic-string@0.25.9", "", { "dependencies": { "sourcemap-codec": "^1.4.8" } }, "sha512-RmF0AsMzgt25qzqqLc1+MbHmhdx0ojF2Fvs4XnOqz2ZOBXzzkEwc/dJQZCYHAn7v1jbVOjAZfK8msRn4BxO4VQ=="],

package/dist/web/assets/_basePickBy-BEVUuplK.js

@@ -0,0 +1 @@
+import{A as e,B as t,C as n,E as r,H as i,M as a,U as o,V as s,k as c,p as l,w as u,z as d}from"./isArrayLikeObject-DoNOpNUH.js";import{A as f,C as p,D as m,M as h,N as g,S as _,T as v,f as y,h as b,u as x,w as S}from"./_baseUniq-qb_BgEfK.js";var C=/\s/;function w(e){for(var t=e.length;t--&&C.test(e.charAt(t)););return t}var ee=/^\s+/;function T(e){return e&&e.slice(0,w(e)+1).replace(ee,``)}var E=NaN,D=/^[-+]0x[0-9a-f]+$/i,O=/^0b[01]+$/i,k=/^0o[0-7]+$/i,A=parseInt;function j(e){if(typeof e==`number`)return e;if(g(e))return E;if(t(e)){var n=typeof e.valueOf==`function`?e.valueOf():e;e=t(n)?n+``:n}if(typeof e!=`string`)return e===0?e:+e;e=T(e);var r=O.test(e);return r||k.test(e)?A(e.slice(2),r?2:8):D.test(e)?E:+e}var M=1/0,N=17976931348623157e292;function P(e){return e?(e=j(e),e===M||e===-M?(e<0?-1:1)*N:e===e?e:0):e===0?e:0}function F(e){var t=P(e),n=t%1;return t===t?n?t-n:t:0}function I(e){return e!=null&&e.length?_(e,1):[]}var L=Object.prototype,R=L.hasOwnProperty,z=r(function(t,r){t=Object(t);var i=-1,a=r.length,o=a>2?r[2]:void 0;for(o&&n(r[0],r[1],o)&&(a=1);++i<a;)for(var s=r[i],c=l(s),u=-1,d=c.length;++u<d;){var f=c[u],p=t[f];(p===void 0||e(p,L[f])&&!R.call(t,f))&&(t[f]=s[f])}return t});function B(e){var t=e==null?0:e.length;return t?e[t-1]:void 0}function V(e){return function(t,n,r){var i=Object(t);if(!u(t)){var a=y(n,3);t=m(t),n=function(e){return a(i[e],e,i)}}var o=e(t,n,r);return o>-1?i[a?t[o]:o]:void 0}}var H=Math.max;function U(e,t,n){var r=e==null?0:e.length;if(!r)return-1;var i=n==null?0:F(n);return i<0&&(i=H(r+i,0)),f(e,y(t,3),i)}var W=V(U);function G(e,t){var n=-1,r=u(e)?Array(e.length):[];return x(e,function(e,i,a){r[++n]=t(e,i,a)}),r}function K(e,t){return(s(e)?h:G)(e,y(t,3))}var q=Object.prototype.hasOwnProperty;function J(e,t){return e!=null&&q.call(e,t)}function Y(e,t){return e!=null&&b(e,t,J)}var X=`[object String]`;function Z(e){return typeof e==`string`||!s(e)&&i(e)&&o(e)==X}function Q(e,t){return e<t}function $(e,t,n){for(var r=-1,i=e.length;++r<i;){var a=e[r],o=t(a);if(o!=null&&(s===void 0?o===o&&!g(o):n(o,s)))var s=o,c=a}return c}function te(e){return e&&e.length?$(e,d,Q):void 0}function ne(e,n,r,i){if(!t(e))return e;n=v(n,e);for(var o=-1,s=n.length,l=s-1,u=e;u!=null&&++o<s;){var d=S(n[o]),f=r;if(d===`__proto__`||d===`constructor`||d===`prototype`)return e;if(o!=l){var p=u[d];f=i?i(p,d,u):void 0,f===void 0&&(f=t(p)?p:a(n[o+1])?[]:{})}c(u,d,f),u=u[d]}return e}function re(e,t,n){for(var r=-1,i=t.length,a={};++r<i;){var o=t[r],s=p(e,o);n(s,o)&&ne(a,v(o,e),s)}return a}export{Z as a,G as c,z as d,I as f,Q as i,W as l,P as m,te as n,Y as o,F as p,$ as r,K as s,re as t,B as u};

package/dist/web/assets/_baseUniq-qb_BgEfK.js

@@ -0,0 +1 @@
+import{A as e,B as t,F as n,H as r,M as i,O as a,T as o,U as s,V as c,W as l,_ as u,a as d,b as f,c as p,d as m,g as h,h as g,i as _,k as v,l as y,n as ee,o as b,p as x,r as te,s as ne,u as re,v as ie,w as S,y as C,z as w}from"./isArrayLikeObject-DoNOpNUH.js";import{i as ae,n as T,r as E}from"./isEmpty-BjAN1oSC.js";var oe=`[object Symbol]`;function D(e){return typeof e==`symbol`||r(e)&&s(e)==oe}function O(e,t){for(var n=-1,r=e==null?0:e.length,i=Array(r);++n<r;)i[n]=t(e[n],n,e);return i}var se=1/0,ce=l?l.prototype:void 0,le=ce?ce.toString:void 0;function ue(e){if(typeof e==`string`)return e;if(c(e))return O(e,ue)+``;if(D(e))return le?le.call(e):``;var t=e+``;return t==`0`&&1/e==-se?`-0`:t}function de(){}function fe(e,t){for(var n=-1,r=e==null?0:e.length;++n<r&&t(e[n],n,e)!==!1;);return e}function pe(e,t,n,r){for(var i=e.length,a=n+(r?1:-1);r?a--:++a<i;)if(t(e[a],a,e))return a;return-1}function me(e){return e!==e}function he(e,t,n){for(var r=n-1,i=e.length;++r<i;)if(e[r]===t)return r;return-1}function ge(e,t,n){return t===t?he(e,t,n):pe(e,me,n)}function _e(e,t){return!!(e!=null&&e.length)&&ge(e,t,0)>-1}function k(e){return S(e)?g(e):ae(e)}var ve=/\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/,ye=/^\w*$/;function A(e,t){if(c(e))return!1;var n=typeof e;return n==`number`||n==`symbol`||n==`boolean`||e==null||D(e)?!0:ye.test(e)||!ve.test(e)||t!=null&&e in Object(t)}var be=500;function xe(e){var t=re(e,function(e){return n.size===be&&n.clear(),e}),n=t.cache;return t}var Se=/[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g,Ce=/\\(\\)?/g,we=xe(function(e){var t=[];return e.charCodeAt(0)===46&&t.push(``),e.replace(Se,function(e,n,r,i){t.push(r?i.replace(Ce,`$1`):n||e)}),t});function j(e){return e==null?``:ue(e)}function M(e,t){return c(e)?e:A(e,t)?[e]:we(j(e))}var Te=1/0;function N(e){if(typeof e==`string`||D(e))return e;var t=e+``;return t==`0`&&1/e==-Te?`-0`:t}function P(e,t){t=M(t,e);for(var n=0,r=t.length;e!=null&&n<r;)e=e[N(t[n++])];return n&&n==r?e:void 0}function Ee(e,t,n){var r=e==null?void 0:P(e,t);return r===void 0?n:r}function F(e,t){for(var n=-1,r=t.length,i=e.length;++n<r;)e[i+n]=t[n];return e}var I=l?l.isConcatSpreadable:void 0;function De(e){return c(e)||f(e)||!!(I&&e&&e[I])}function L(e,t,n,r,i){var a=-1,o=e.length;for(n||=De,i||=[];++a<o;){var s=e[a];t>0&&n(s)?t>1?L(s,t-1,n,r,i):F(i,s):r||(i[i.length]=s)}return i}function Oe(e,t,n,r){var i=-1,a=e==null?0:e.length;for(r&&a&&(n=e[++i]);++i<a;)n=t(n,e[i],i,e);return n}function ke(e,t){return e&&a(t,k(t),e)}function Ae(e,t){return e&&a(t,x(t),e)}function R(e,t){for(var n=-1,r=e==null?0:e.length,i=0,a=[];++n<r;){var o=e[n];t(o,n,e)&&(a[i++]=o)}return a}function z(){return[]}var je=Object.prototype.propertyIsEnumerable,B=Object.getOwnPropertySymbols,V=B?function(e){return e==null?[]:(e=Object(e),R(B(e),function(t){return je.call(e,t)}))}:z;function Me(e,t){return a(e,V(e),t)}var Ne=Object.getOwnPropertySymbols?function(e){for(var t=[];e;)F(t,V(e)),e=y(e);return t}:z;function Pe(e,t){return a(e,Ne(e),t)}function Fe(e,t,n){var r=t(e);return c(e)?r:F(r,n(e))}function H(e){return Fe(e,k,V)}function Ie(e){return Fe(e,x,Ne)}var Le=Object.prototype.hasOwnProperty;function Re(e){var t=e.length,n=new e.constructor(t);return t&&typeof e[0]==`string`&&Le.call(e,`index`)&&(n.index=e.index,n.input=e.input),n}function ze(e,t){var n=t?d(e.buffer):e.buffer;return new e.constructor(n,e.byteOffset,e.byteLength)}var Be=/\w*$/;function Ve(e){var t=new e.constructor(e.source,Be.exec(e));return t.lastIndex=e.lastIndex,t}var He=l?l.prototype:void 0,Ue=He?He.valueOf:void 0;function We(e){return Ue?Object(Ue.call(e)):{}}var Ge=`[object Boolean]`,Ke=`[object Date]`,qe=`[object Map]`,Je=`[object Number]`,Ye=`[object RegExp]`,Xe=`[object Set]`,Ze=`[object String]`,Qe=`[object Symbol]`,$e=`[object ArrayBuffer]`,et=`[object DataView]`,tt=`[object Float32Array]`,nt=`[object Float64Array]`,rt=`[object Int8Array]`,it=`[object Int16Array]`,at=`[object Int32Array]`,ot=`[object Uint8Array]`,st=`[object Uint8ClampedArray]`,ct=`[object Uint16Array]`,lt=`[object Uint32Array]`;function ut(e,t,n){var r=e.constructor;switch(t){case $e:return d(e);case Ge:case Ke:return new r(+e);case et:return ze(e,n);case tt:case nt:case rt:case it:case at:case ot:case st:case ct:case lt:return _(e,n);case qe:return new r;case Je:case Ze:return new r(e);case Ye:return Ve(e);case Xe:return new r;case Qe:return We(e)}}var dt=`[object Map]`;function ft(e){return r(e)&&T(e)==dt}var pt=u&&u.isMap,mt=pt?ie(pt):ft,ht=`[object Set]`;function gt(e){return r(e)&&T(e)==ht}var _t=u&&u.isSet,vt=_t?ie(_t):gt,yt=1,bt=2,xt=4,St=`[object Arguments]`,Ct=`[object Array]`,wt=`[object Boolean]`,Tt=`[object Date]`,Et=`[object Error]`,Dt=`[object Function]`,Ot=`[object GeneratorFunction]`,kt=`[object Map]`,At=`[object Number]`,jt=`[object Object]`,Mt=`[object RegExp]`,Nt=`[object Set]`,Pt=`[object String]`,Ft=`[object Symbol]`,It=`[object WeakMap]`,Lt=`[object ArrayBuffer]`,Rt=`[object DataView]`,zt=`[object Float32Array]`,Bt=`[object Float64Array]`,Vt=`[object Int8Array]`,Ht=`[object Int16Array]`,Ut=`[object Int32Array]`,Wt=`[object Uint8Array]`,Gt=`[object Uint8ClampedArray]`,Kt=`[object Uint16Array]`,qt=`[object Uint32Array]`,U={};U[St]=U[Ct]=U[Lt]=U[Rt]=U[wt]=U[Tt]=U[zt]=U[Bt]=U[Vt]=U[Ht]=U[Ut]=U[kt]=U[At]=U[jt]=U[Mt]=U[Nt]=U[Pt]=U[Ft]=U[Wt]=U[Gt]=U[Kt]=U[qt]=!0,U[Et]=U[Dt]=U[It]=!1;function W(e,r,i,a,o,s){var l,u=r&yt,d=r&bt,f=r&xt;if(i&&(l=o?i(e,a,o,s):i(e)),l!==void 0)return l;if(!t(e))return e;var m=c(e);if(m){if(l=Re(e),!u)return n(e,l)}else{var h=T(e),g=h==Dt||h==Ot;if(C(e))return ne(e,u);if(h==jt||h==St||g&&!o){if(l=d||g?{}:te(e),!u)return d?Pe(e,Ae(l,e)):Me(e,ke(l,e))}else{if(!U[h])return o?e:{};l=ut(e,h,u)}}s||=new p;var _=s.get(e);if(_)return _;s.set(e,l),vt(e)?e.forEach(function(t){l.add(W(t,r,i,t,e,s))}):mt(e)&&e.forEach(function(t,n){l.set(n,W(t,r,i,n,e,s))});var y=m?void 0:(f?d?Ie:H:d?x:k)(e);return fe(y||e,function(t,n){y&&(n=t,t=e[n]),v(l,n,W(t,r,i,n,e,s))}),l}var Jt=`__lodash_hash_undefined__`;function Yt(e){return this.__data__.set(e,Jt),this}function Xt(e){return this.__data__.has(e)}function G(e){var t=-1,n=e==null?0:e.length;for(this.__data__=new m;++t<n;)this.add(e[t])}G.prototype.add=G.prototype.push=Yt,G.prototype.has=Xt;function Zt(e,t){for(var n=-1,r=e==null?0:e.length;++n<r;)if(t(e[n],n,e))return!0;return!1}function K(e,t){return e.has(t)}var Qt=1,$t=2;function en(e,t,n,r,i,a){var o=n&Qt,s=e.length,c=t.length;if(s!=c&&!(o&&c>s))return!1;var l=a.get(e),u=a.get(t);if(l&&u)return l==t&&u==e;var d=-1,f=!0,p=n&$t?new G:void 0;for(a.set(e,t),a.set(t,e);++d<s;){var m=e[d],h=t[d];if(r)var g=o?r(h,m,d,t,e,a):r(m,h,d,e,t,a);if(g!==void 0){if(g)continue;f=!1;break}if(p){if(!Zt(t,function(e,t){if(!K(p,t)&&(m===e||i(m,e,n,r,a)))return p.push(t)})){f=!1;break}}else if(!(m===h||i(m,h,n,r,a))){f=!1;break}}return a.delete(e),a.delete(t),f}function tn(e){var t=-1,n=Array(e.size);return e.forEach(function(e,r){n[++t]=[r,e]}),n}function q(e){var t=-1,n=Array(e.size);return e.forEach(function(e){n[++t]=e}),n}var nn=1,rn=2,an=`[object Boolean]`,on=`[object Date]`,sn=`[object Error]`,cn=`[object Map]`,ln=`[object Number]`,un=`[object RegExp]`,dn=`[object Set]`,fn=`[object String]`,pn=`[object Symbol]`,mn=`[object ArrayBuffer]`,hn=`[object DataView]`,gn=l?l.prototype:void 0,J=gn?gn.valueOf:void 0;function _n(t,n,r,i,a,o,s){switch(r){case hn:if(t.byteLength!=n.byteLength||t.byteOffset!=n.byteOffset)return!1;t=t.buffer,n=n.buffer;case mn:return!(t.byteLength!=n.byteLength||!o(new b(t),new b(n)));case an:case on:case ln:return e(+t,+n);case sn:return t.name==n.name&&t.message==n.message;case un:case fn:return t==n+``;case cn:var c=tn;case dn:var l=i&nn;if(c||=q,t.size!=n.size&&!l)return!1;var u=s.get(t);if(u)return u==n;i|=rn,s.set(t,n);var d=en(c(t),c(n),i,a,o,s);return s.delete(t),d;case pn:if(J)return J.call(t)==J.call(n)}return!1}var vn=1,yn=Object.prototype.hasOwnProperty;function bn(e,t,n,r,i,a){var o=n&vn,s=H(e),c=s.length;if(c!=H(t).length&&!o)return!1;for(var l=c;l--;){var u=s[l];if(!(o?u in t:yn.call(t,u)))return!1}var d=a.get(e),f=a.get(t);if(d&&f)return d==t&&f==e;var p=!0;a.set(e,t),a.set(t,e);for(var m=o;++l<c;){u=s[l];var h=e[u],g=t[u];if(r)var _=o?r(g,h,u,t,e,a):r(h,g,u,e,t,a);if(!(_===void 0?h===g||i(h,g,n,r,a):_)){p=!1;break}m||=u==`constructor`}if(p&&!m){var v=e.constructor,y=t.constructor;v!=y&&`constructor`in e&&`constructor`in t&&!(typeof v==`function`&&v instanceof v&&typeof y==`function`&&y instanceof y)&&(p=!1)}return a.delete(e),a.delete(t),p}var xn=1,Sn=`[object Arguments]`,Cn=`[object Array]`,Y=`[object Object]`,wn=Object.prototype.hasOwnProperty;function Tn(e,t,n,r,i,a){var o=c(e),s=c(t),l=o?Cn:T(e),u=s?Cn:T(t);l=l==Sn?Y:l,u=u==Sn?Y:u;var d=l==Y,f=u==Y,m=l==u;if(m&&C(e)){if(!C(t))return!1;o=!0,d=!1}if(m&&!d)return a||=new p,o||h(e)?en(e,t,n,r,i,a):_n(e,t,l,n,r,i,a);if(!(n&xn)){var g=d&&wn.call(e,`__wrapped__`),_=f&&wn.call(t,`__wrapped__`);if(g||_){var v=g?e.value():e,y=_?t.value():t;return a||=new p,i(v,y,n,r,a)}}return m?(a||=new p,bn(e,t,n,r,i,a)):!1}function X(e,t,n,i,a){return e===t?!0:e==null||t==null||!r(e)&&!r(t)?e!==e&&t!==t:Tn(e,t,n,i,X,a)}var En=1,Dn=2;function On(e,t,n,r){var i=n.length,a=i,o=!r;if(e==null)return!a;for(e=Object(e);i--;){var s=n[i];if(o&&s[2]?s[1]!==e[s[0]]:!(s[0]in e))return!1}for(;++i<a;){s=n[i];var c=s[0],l=e[c],u=s[1];if(o&&s[2]){if(l===void 0&&!(c in e))return!1}else{var d=new p;if(r)var f=r(l,u,c,e,t,d);if(!(f===void 0?X(u,l,En|Dn,r,d):f))return!1}}return!0}function kn(e){return e===e&&!t(e)}function An(e){for(var t=k(e),n=t.length;n--;){var r=t[n],i=e[r];t[n]=[r,i,kn(i)]}return t}function Z(e,t){return function(n){return n==null?!1:n[e]===t&&(t!==void 0||e in Object(n))}}function jn(e){var t=An(e);return t.length==1&&t[0][2]?Z(t[0][0],t[0][1]):function(n){return n===e||On(n,e,t)}}function Mn(e,t){return e!=null&&t in Object(e)}function Nn(e,t,n){t=M(t,e);for(var r=-1,a=t.length,s=!1;++r<a;){var l=N(t[r]);if(!(s=e!=null&&n(e,l)))break;e=e[l]}return s||++r!=a?s:(a=e==null?0:e.length,!!a&&o(a)&&i(l,a)&&(c(e)||f(e)))}function Pn(e,t){return e!=null&&Nn(e,t,Mn)}var Fn=1,In=2;function Ln(e,t){return A(e)&&kn(t)?Z(N(e),t):function(n){var r=Ee(n,e);return r===void 0&&r===t?Pn(n,e):X(t,r,Fn|In)}}function Rn(e){return function(t){return t?.[e]}}function zn(e){return function(t){return P(t,e)}}function Bn(e){return A(e)?Rn(N(e)):zn(e)}function Q(e){return typeof e==`function`?e:e==null?w:typeof e==`object`?c(e)?Ln(e[0],e[1]):jn(e):Bn(e)}function Vn(e,t){return e&&ee(e,t,k)}function Hn(e,t){return function(n,r){if(n==null)return n;if(!S(n))return e(n,r);for(var i=n.length,a=t?i:-1,o=Object(n);(t?a--:++a<i)&&r(o[a],a,o)!==!1;);return n}}var $=Hn(Vn);function Un(e,t,n){for(var r=-1,i=e==null?0:e.length;++r<i;)if(n(t,e[r]))return!0;return!1}function Wn(e){return typeof e==`function`?e:w}function Gn(e,t){return(c(e)?fe:$)(e,Wn(t))}function Kn(e,t){var n=[];return $(e,function(e,r,i){t(e,r,i)&&n.push(e)}),n}function qn(e,t){return(c(e)?R:Kn)(e,Q(t,3))}function Jn(e,t){return O(t,function(t){return e[t]})}function Yn(e){return e==null?[]:Jn(e,k(e))}function Xn(e){return e===void 0}function Zn(e,t,n,r,i){return i(e,function(e,i,a){n=r?(r=!1,e):t(n,e,i,a)}),n}function Qn(e,t,n){var r=c(e)?Oe:Zn,i=arguments.length<3;return r(e,Q(t,4),n,i,$)}var $n=E&&1/q(new E([,-0]))[1]==1/0?function(e){return new E(e)}:de,er=200;function tr(e,t,n){var r=-1,i=_e,a=e.length,o=!0,s=[],c=s;if(n)o=!1,i=Un;else if(a>=er){var l=t?null:$n(e);if(l)return q(l);o=!1,i=K,c=new G}else c=t?[]:s;outer:for(;++r<a;){var u=e[r],d=t?t(u):u;if(u=n||u!==0?u:0,o&&d===d){for(var f=c.length;f--;)if(c[f]===d)continue outer;t&&c.push(d),s.push(u)}else i(c,d,n)||(c!==s&&c.push(d),s.push(u))}return s}export{pe as A,P as C,k as D,j as E,O as M,D as N,_e as O,L as S,M as T,Zt as _,qn as a,Ie as b,Wn as c,Vn as d,Q as f,K as g,Nn as h,Yn as i,de as j,ge as k,Un as l,Pn as m,Qn as n,Kn as o,Rn as p,Xn as r,Gn as s,tr as t,$ as u,G as v,N as w,R as x,W as y};