@homebridge-plugins/homebridge-eufy-security 4.7.1 → 5.0.0-beta.0

package/dist/account/ownership.js

@@ -0,0 +1,290 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { chmod, mkdir, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const GUARD_RETRY_MS = 10;
+const GUARD_TIMEOUT_MS = 5_000;
+/**
+ * How long one of this module's temporary files may exist before it is certainly abandoned.
+ *
+ * A lease or guard write creates its temporary file and renames it within the same turn, so a surviving
+ * temporary file is orders of magnitude older than any write in progress.
+ */
+const ABANDONED_TEMPORARY_FILE_MS = 60_000;
+/**
+ * Removes the temporary files interrupted lease and guard writes left behind.
+ *
+ * `writeAtomically` deletes its own temporary file when a write fails, but a process killed between
+ * creating and renaming it never runs that cleanup, so the file would otherwise remain forever and
+ * every later guard scan would pay for it. Age alone decides: a temporary file belonging to a live write
+ * is milliseconds old, so anything past the staleness window belongs to a process that is gone. Deciding
+ * by the process id embedded in the name would have to trust that name and survive process-id reuse.
+ *
+ * This duplicates `reapAbandonedTemporaryFiles` in `persistence.ts` deliberately. This module has no
+ * internal imports so that a bare `node` child process can load it from source, which is how the
+ * cross-process ownership contracts prove that a live lease cannot be stolen.
+ */
+function reapAbandonedTemporaryFiles(directory) {
+    let entries;
+    try {
+        entries = readdirSync(directory);
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.endsWith('.tmp')) {
+            continue;
+        }
+        const path = join(directory, entry);
+        try {
+            if (Date.now() - statSync(path).mtimeMs > ABANDONED_TEMPORARY_FILE_MS) {
+                rmSync(path, { force: true });
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+}
+function hasCode(error, code) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === code;
+}
+function readProcessIdentity(pid) {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+        const fields = stat.slice(stat.lastIndexOf(') ') + 2).split(' ');
+        const startTime = fields[19];
+        return startTime ? `proc:${startTime}` : undefined;
+    }
+    catch {
+        try {
+            const startTime = execFileSync('/bin/ps', ['-o', 'lstart=', '-p', String(pid)], {
+                encoding: 'utf8',
+                timeout: 1_000,
+            }).trim();
+            return startTime ? `ps:${createHash('sha256').update(startTime).digest('hex')}` : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+export function isOwnerProcessAlive(record) {
+    try {
+        process.kill(record.pid, 0);
+    }
+    catch (error) {
+        return !hasCode(error, 'ESRCH');
+    }
+    const currentIdentity = readProcessIdentity(record.pid);
+    return !record.processIdentity || !currentIdentity || record.processIdentity === currentIdentity;
+}
+/** An acquired account-scoped SDK ownership lease. */
+export class AccountLease {
+    ownership;
+    accountKey;
+    token;
+    constructor(ownership, accountKey, token) {
+        this.ownership = ownership;
+        this.accountKey = accountKey;
+        this.token = token;
+    }
+    release(onReleased) {
+        return this.ownership.release(this.accountKey, this.token, onReleased);
+    }
+}
+/** Coordinates exclusive SDK ownership without relying on advisory tracker state. */
+export class AccountOwnership {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    async acquire(accountScope, kind) {
+        if (accountScope.length === 0) {
+            throw new Error('accountScope must not be empty');
+        }
+        const accountKey = createHash('sha256').update(accountScope).digest('hex');
+        const accountDirectory = join(this.root, accountKey);
+        await this.prepareDirectory(accountDirectory);
+        const releaseGuard = await this.acquireGuard(accountDirectory);
+        try {
+            const ownerPath = join(accountDirectory, 'owner.json');
+            const current = await this.readRecord(ownerPath);
+            if (current && isOwnerProcessAlive(current)) {
+                return { state: 'owner-conflict', owner: this.evidence(current) };
+            }
+            const record = {
+                version: 1,
+                token: randomUUID(),
+                kind,
+                pid: process.pid,
+                processIdentity: readProcessIdentity(process.pid),
+                acquiredAt: new Date().toISOString(),
+            };
+            await this.writeAtomically(ownerPath, record);
+            return {
+                state: 'owner',
+                recovered: current !== null,
+                lease: new AccountLease(this, accountKey, record.token),
+            };
+        }
+        finally {
+            await releaseGuard();
+        }
+    }
+    async release(accountKey, token, onReleased) {
+        const accountDirectory = join(this.root, accountKey);
+        await this.prepareDirectory(accountDirectory);
+        const releaseGuard = await this.acquireGuard(accountDirectory);
+        try {
+            const ownerPath = join(accountDirectory, 'owner.json');
+            const current = await this.readRecord(ownerPath);
+            if (!current) {
+                return { state: 'stopped' };
+            }
+            if (current.token !== token) {
+                return { state: 'owner-conflict', owner: this.evidence(current) };
+            }
+            await rm(ownerPath, { force: true });
+            onReleased?.();
+            return { state: 'stopped' };
+        }
+        finally {
+            await releaseGuard();
+        }
+    }
+    async prepareDirectory(accountDirectory) {
+        await mkdir(accountDirectory, { mode: 0o700, recursive: true });
+        await chmod(this.root, 0o700);
+        await chmod(accountDirectory, 0o700);
+        reapAbandonedTemporaryFiles(accountDirectory);
+    }
+    async acquireGuard(accountDirectory) {
+        const operationsDirectory = join(accountDirectory, 'operations');
+        await mkdir(operationsDirectory, { mode: 0o700, recursive: true });
+        await chmod(operationsDirectory, 0o700);
+        reapAbandonedTemporaryFiles(operationsDirectory);
+        const token = randomUUID();
+        const operationPath = join(operationsDirectory, `${token}.json`);
+        const operation = {
+            version: 1,
+            token,
+            pid: process.pid,
+            processIdentity: readProcessIdentity(process.pid),
+            choosing: true,
+            ticket: 0,
+        };
+        const startedAt = Date.now();
+        await this.writeAtomically(operationPath, operation);
+        const initialRecords = await this.readOperationRecords(operationsDirectory, token);
+        operation.choosing = false;
+        operation.ticket = initialRecords.reduce((maximum, record) => Math.max(maximum, record.ticket), 0) + 1;
+        await this.writeAtomically(operationPath, operation);
+        try {
+            while (true) {
+                const records = await this.readOperationRecords(operationsDirectory, token);
+                const predecessor = records.find((record) => record.choosing ||
+                    record.ticket < operation.ticket ||
+                    (record.ticket === operation.ticket && record.token < operation.token));
+                if (!predecessor) {
+                    return async () => {
+                        await rm(operationPath, { force: true });
+                    };
+                }
+                if (Date.now() - startedAt >= GUARD_TIMEOUT_MS) {
+                    throw new Error(`account ownership operation is busy in process ${predecessor.pid}`);
+                }
+                await new Promise((resolve) => setTimeout(resolve, GUARD_RETRY_MS));
+            }
+        }
+        catch (error) {
+            await rm(operationPath, { force: true });
+            throw error;
+        }
+    }
+    async readOperationRecords(directory, ownToken) {
+        const records = [];
+        for (const entry of await readdir(directory)) {
+            if (!entry.endsWith('.json') || entry === `${ownToken}.json`) {
+                continue;
+            }
+            const path = join(directory, entry);
+            const record = await this.readOperationRecord(path);
+            if (!record) {
+                continue;
+            }
+            if (!isOwnerProcessAlive(record)) {
+                await rm(path, { force: true });
+            }
+            else {
+                records.push(record);
+            }
+        }
+        return records;
+    }
+    async writeAtomically(path, record) {
+        const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporaryPath, JSON.stringify(record), { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+            await rename(temporaryPath, path);
+        }
+        catch (error) {
+            await rm(temporaryPath, { force: true }).catch(() => undefined);
+            throw error;
+        }
+    }
+    async readRecord(path) {
+        try {
+            const value = JSON.parse(await readFile(path, 'utf8'));
+            if (value.version !== 1 ||
+                typeof value.token !== 'string' ||
+                (value.kind !== 'runtime' && value.kind !== 'temporary-authentication') ||
+                typeof value.pid !== 'number' ||
+                !Number.isSafeInteger(value.pid) ||
+                value.pid <= 0 ||
+                !this.isValidProcessIdentity(value.processIdentity) ||
+                typeof value.acquiredAt !== 'string') {
+                throw new Error('account ownership lease is malformed');
+            }
+            return value;
+        }
+        catch (error) {
+            if (hasCode(error, 'ENOENT')) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async readOperationRecord(path) {
+        try {
+            const value = JSON.parse(await readFile(path, 'utf8'));
+            if (value.version !== 1 ||
+                typeof value.token !== 'string' ||
+                typeof value.choosing !== 'boolean' ||
+                !Number.isSafeInteger(value.ticket) ||
+                value.ticket < 0 ||
+                typeof value.pid !== 'number' ||
+                !Number.isSafeInteger(value.pid) ||
+                value.pid <= 0 ||
+                !this.isValidProcessIdentity(value.processIdentity)) {
+                throw new Error('account ownership operation record is malformed');
+            }
+            return value;
+        }
+        catch (error) {
+            if (hasCode(error, 'ENOENT')) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    evidence(record) {
+        return { acquiredAt: record.acquiredAt, kind: record.kind, pid: record.pid };
+    }
+    isValidProcessIdentity(value) {
+        return value === undefined || (typeof value === 'string' && /^(?:proc:\d+|ps:[0-9a-f]{64})$/.test(value));
+    }
+}
+//# sourceMappingURL=ownership.js.map

package/dist/account/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../src/account/ownership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA+BjC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,SAAS,2BAA2B,CAAC,SAAiB;IACpD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,2BAA2B,EAAE,CAAC;gBACtE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC/F,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;gBAC9E,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiD;IACnF,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,KAAK,eAAe,CAAC;AACnG,CAAC;AAED,sDAAsD;AACtD,MAAM,OAAO,YAAY;IACN,SAAS,CAAmB;IAC5B,UAAU,CAAS;IACnB,KAAK,CAAS;IAE/B,YAAY,SAA2B,EAAE,UAAkB,EAAE,KAAa;QACxE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,UAAuB;QAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAS;IAE9B,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,IAAsB;QACxD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,UAAU,EAAE;gBACnB,IAAI;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,eAAe,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;gBACjD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;YACF,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO;gBACL,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,OAAO,KAAK,IAAI;gBAC3B,KAAK,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC;aACxD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,YAAY,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,KAAa,EAAE,UAAuB;QACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,CAAC;YAED,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,UAAU,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,MAAM,YAAY,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,gBAAwB;QACrD,MAAM,KAAK,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACrC,2BAA2B,CAAC,gBAAgB,CAAC,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,gBAAwB;QACjD,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACxC,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;QACjE,MAAM,SAAS,GAAoB;YACjC,OAAO,EAAE,CAAC;YACV,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,eAAe,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;YACjD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,CAAC;SACV,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAErD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACnF,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;QAC3B,SAAS,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAErD,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,QAAQ;oBACf,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;oBAChC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CACzE,CAAC;gBACF,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,KAAK,IAAI,EAAE;wBAChB,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3C,CAAC,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,gBAAgB,EAAE,CAAC;oBAC/C,MAAM,IAAI,KAAK,CAAC,kDAAkD,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,QAAgB;QACpE,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,GAAG,QAAQ,OAAO,EAAE,CAAC;gBAC7D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,MAAqC;QAC/E,MAAM,aAAa,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtG,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;YAC/E,IACE,KAAK,CAAC,OAAO,KAAK,CAAC;gBACnB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC;gBACvE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;gBAChC,KAAK,CAAC,GAAG,IAAI,CAAC;gBACd,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,eAAe,CAAC;gBACnD,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EACpC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,KAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,IAAY;QAC5C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA6B,CAAC;YACnF,IACE,KAAK,CAAC,OAAO,KAAK,CAAC;gBACnB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAC/B,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;gBACnC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;gBACnC,KAAK,CAAC,MAAO,GAAG,CAAC;gBACjB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;gBAChC,KAAK,CAAC,GAAG,IAAI,CAAC;gBACd,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,eAAe,CAAC,EACnD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,KAAwB,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,MAAmB;QAClC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC/E,CAAC;IAEO,sBAAsB,CAAC,KAAc;QAC3C,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5G,CAAC;CACF"}

package/dist/account/persistence.js

@@ -0,0 +1,274 @@
+import { randomUUID } from 'node:crypto';
+import { chmodSync, closeSync, mkdirSync, openSync, readdirSync, readSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { chmod, mkdir, readdir, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { parseConfig, serializeConfig } from '../configuration.js';
+import { parseCompleteDeviceSnapshot } from '../device/snapshot.js';
+const DEFAULT_MAX_RECORD_BYTES = 1024 * 1024;
+const MAX_RECORD_BYTES = 16 * 1024 * 1024;
+/**
+ * How long a temporary file may exist before it is certainly abandoned.
+ *
+ * One atomic write creates its temporary file and renames it within the same turn, so a surviving
+ * temporary file is orders of magnitude older than any write in progress.
+ */
+const ABANDONED_TEMPORARY_FILE_MS = 60_000;
+/** The suffix every atomic write in this package gives its temporary file. */
+const TEMPORARY_SUFFIX = '.tmp';
+/**
+ * Removes the temporary files interrupted atomic writes left behind, returning how many were removed.
+ *
+ * An atomic write deletes its own temporary file when the write fails, but a process killed between
+ * creating and renaming it never runs that cleanup, so the file would otherwise remain forever and
+ * every later directory scan would pay for it. Age alone decides: a temporary file belonging to a live
+ * write is milliseconds old, so anything past the staleness window belongs to a process that is gone.
+ * Deciding by embedded process id instead would have to trust a name and survive process-id reuse.
+ */
+export function reapAbandonedTemporaryFiles(directory, now = Date.now, olderThanMs = ABANDONED_TEMPORARY_FILE_MS) {
+    let entries;
+    try {
+        entries = readdirSync(directory);
+    }
+    catch {
+        return 0;
+    }
+    let removed = 0;
+    for (const entry of entries) {
+        if (!entry.endsWith(TEMPORARY_SUFFIX)) {
+            continue;
+        }
+        const path = join(directory, entry);
+        try {
+            if (now() - statSync(path).mtimeMs <= olderThanMs) {
+                continue;
+            }
+            rmSync(path, { force: true });
+            removed += 1;
+        }
+        catch {
+            continue;
+        }
+    }
+    return removed;
+}
+function writeJsonAtomically(path, value, label, maxBytes, beforePublish) {
+    const serialized = JSON.stringify(value);
+    const bytes = Buffer.byteLength(serialized);
+    if (bytes > maxBytes) {
+        throw new Error(`${label} record exceeds ${maxBytes} bytes`);
+    }
+    const directory = dirname(path);
+    mkdirSync(directory, { mode: 0o700, recursive: true });
+    chmodSync(directory, 0o700);
+    const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporaryPath, serialized, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+        beforePublish?.();
+        renameSync(temporaryPath, path);
+    }
+    catch (error) {
+        try {
+            rmSync(temporaryPath, { force: true });
+        }
+        catch { }
+        throw error;
+    }
+}
+function readJsonBounded(path, maxBytes) {
+    let descriptor;
+    try {
+        descriptor = openSync(path, 'r');
+        const buffer = Buffer.allocUnsafe(maxBytes + 1);
+        const bytesRead = readSync(descriptor, buffer, 0, buffer.length, 0);
+        if (bytesRead > maxBytes) {
+            return null;
+        }
+        return JSON.parse(buffer.toString('utf8', 0, bytesRead));
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (descriptor !== undefined) {
+            closeSync(descriptor);
+        }
+    }
+}
+export class AtomicJsonStore {
+    path;
+    label;
+    maxBytes;
+    boundary;
+    hooks;
+    parse;
+    serialize;
+    constructor(path, label, maxBytes, boundary, hooks, parse = (value) => value, serialize = (value) => value) {
+        this.path = path;
+        this.label = label;
+        this.maxBytes = maxBytes;
+        this.boundary = boundary;
+        this.hooks = hooks;
+        this.parse = parse;
+        this.serialize = serialize;
+    }
+    load() {
+        const value = readJsonBounded(this.path, this.maxBytes);
+        if (value === null) {
+            return null;
+        }
+        try {
+            return this.parse(value);
+        }
+        catch {
+            return null;
+        }
+    }
+    save(value) {
+        this.hooks?.before(this.boundary);
+        writeJsonAtomically(this.path, this.serialize(value), this.label, this.maxBytes);
+    }
+    clear() {
+        rmSync(this.path, { force: true });
+    }
+}
+/** Isolated session and push stores for one pending authentication result. */
+export class StagedAccountStores {
+    account;
+    persistence;
+    generation;
+    directory;
+    configuration;
+    push;
+    session;
+    snapshot;
+    settled = false;
+    constructor(account, persistence, generation, directory, maxRecordBytes, hooks) {
+        this.account = account;
+        this.persistence = persistence;
+        this.generation = generation;
+        this.directory = directory;
+        this.session = new AtomicJsonStore(join(directory, 'session.json'), 'session', maxRecordBytes, 'session-record', hooks);
+        this.push = new AtomicJsonStore(join(directory, 'push.json'), 'push', maxRecordBytes, 'push-record', hooks);
+        this.configuration = new AtomicJsonStore(join(directory, 'configuration.json'), 'configuration', maxRecordBytes, 'configuration-record', hooks, parseConfig, serializeConfig);
+        this.snapshot = new AtomicJsonStore(join(directory, 'device-snapshot.json'), 'device snapshot', maxRecordBytes, 'device-snapshot-record', hooks, parseCompleteDeviceSnapshot);
+    }
+    async commit(signal) {
+        if (this.settled) {
+            throw new Error('staged account stores are already settled');
+        }
+        await this.persistence.commit(this, signal);
+        this.settled = true;
+    }
+    async discard() {
+        if (!this.settled) {
+            await rm(this.directory, { force: true, recursive: true });
+            this.settled = true;
+        }
+    }
+}
+/**
+ * Owns bounded active and staging stores used by SDK owners before any runtime connection exists.
+ *
+ * `onAccountReplacement` is awaited, because it removes data bound to the account being replaced: reporting a
+ * replacement complete while that removal is still in flight would leave the previous account's images on disk
+ * for a restart to interrupt.
+ */
+export class AccountSessionPersistence {
+    root;
+    maxRecordBytes;
+    hooks;
+    onAccountReplacement;
+    constructor(root, maxRecordBytes = DEFAULT_MAX_RECORD_BYTES, hooks, onAccountReplacement) {
+        this.root = root;
+        this.maxRecordBytes = maxRecordBytes;
+        this.hooks = hooks;
+        this.onAccountReplacement = onAccountReplacement;
+        if (!Number.isSafeInteger(maxRecordBytes) || maxRecordBytes <= 0 || maxRecordBytes > MAX_RECORD_BYTES) {
+            throw new Error(`maxRecordBytes must be between 1 and ${MAX_RECORD_BYTES}`);
+        }
+    }
+    async active() {
+        await this.prepareRoot();
+        const active = await this.readActiveGeneration();
+        if (!active) {
+            return null;
+        }
+        const directory = join(this.root, 'generations', active.generation);
+        return this.stores(active.account, active.generation, directory);
+    }
+    async stage(account) {
+        if (account.length === 0 || Buffer.byteLength(account) > this.maxRecordBytes / 2) {
+            throw new Error('account identifier is empty or too large');
+        }
+        await this.prepareRoot();
+        const stagingRoot = join(this.root, 'staging');
+        await rm(stagingRoot, { force: true, recursive: true });
+        await mkdir(stagingRoot, { mode: 0o700, recursive: true });
+        await chmod(stagingRoot, 0o700);
+        const generation = randomUUID();
+        const directory = join(stagingRoot, generation);
+        await mkdir(directory, { mode: 0o700 });
+        return new StagedAccountStores(account, this, generation, directory, this.maxRecordBytes, this.hooks);
+    }
+    async commit(staging, signal) {
+        signal?.throwIfAborted();
+        const previous = await this.readActiveGeneration();
+        const generationsRoot = join(this.root, 'generations');
+        await mkdir(generationsRoot, { mode: 0o700, recursive: true });
+        await chmod(generationsRoot, 0o700);
+        const obsoleteGenerations = await readdir(generationsRoot);
+        const generation = staging.generation;
+        const destination = join(generationsRoot, generation);
+        this.hooks?.before('generation-publication');
+        await rename(staging.directory, destination);
+        if (signal?.aborted) {
+            await rm(destination, { force: true, recursive: true });
+            signal.throwIfAborted();
+        }
+        try {
+            this.hooks?.before('active-generation-record');
+            await this.writeActiveGeneration({ version: 1, account: staging.account, generation });
+        }
+        catch (error) {
+            await rm(destination, { force: true, recursive: true });
+            throw error;
+        }
+        if (previous && previous.account !== staging.account) {
+            try {
+                await this.onAccountReplacement?.();
+            }
+            catch { }
+        }
+        void Promise.allSettled(obsoleteGenerations.map((candidate) => rm(join(generationsRoot, candidate), { force: true, recursive: true })));
+    }
+    stores(account, generation, directory) {
+        return {
+            account,
+            generation,
+            session: new AtomicJsonStore(join(directory, 'session.json'), 'session', this.maxRecordBytes, 'session-record'),
+            push: new AtomicJsonStore(join(directory, 'push.json'), 'push', this.maxRecordBytes, 'push-record'),
+            configuration: new AtomicJsonStore(join(directory, 'configuration.json'), 'configuration', this.maxRecordBytes, 'configuration-record', undefined, parseConfig, serializeConfig),
+            snapshot: new AtomicJsonStore(join(directory, 'device-snapshot.json'), 'device snapshot', this.maxRecordBytes, 'device-snapshot-record', undefined, parseCompleteDeviceSnapshot),
+        };
+    }
+    async prepareRoot() {
+        await mkdir(this.root, { mode: 0o700, recursive: true });
+        await chmod(this.root, 0o700);
+        reapAbandonedTemporaryFiles(this.root);
+    }
+    async readActiveGeneration() {
+        const value = readJsonBounded(join(this.root, 'active.json'), this.maxRecordBytes);
+        if (value === null ||
+            value.version !== 1 ||
+            typeof value.account !== 'string' ||
+            typeof value.generation !== 'string' ||
+            !/^[0-9a-f-]{36}$/.test(value.generation)) {
+            return null;
+        }
+        return value;
+    }
+    async writeActiveGeneration(record) {
+        writeJsonAtomically(join(this.root, 'active.json'), record, 'active account', this.maxRecordBytes, () => this.hooks?.before('active-generation-publication'));
+    }
+}
+//# sourceMappingURL=persistence.js.map

package/dist/account/persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../../src/account/persistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAI1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAA+B,MAAM,uBAAuB,CAAC;AAEjG,MAAM,wBAAwB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7C,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAE3C,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,GAAG,GAAiB,IAAI,CAAC,GAAG,EAC5B,WAAW,GAAW,2BAA2B;IAEjD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AA8BD,SAAS,mBAAmB,CAC1B,IAAY,EACZ,KAAc,EACd,KAAa,EACb,QAAgB,EAChB,aAA0B;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,QAAQ,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,aAAa,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IACnE,IAAI,CAAC;QACH,aAAa,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,aAAa,EAAE,EAAE,CAAC;QAClB,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAY,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,eAAe;IAEP,IAAI;IACJ,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,KAAK;IACL,SAAS;IAP5B,YACmB,IAAY,EACZ,KAAa,EACb,QAAgB,EAChB,QAAoC,EACpC,KAA+B,EAC/B,KAAK,GAA0B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAU,EACpD,SAAS,GAA0B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;oBANnD,IAAI;qBACJ,KAAK;wBACL,QAAQ;wBACR,QAAQ;qBACR,KAAK;qBACL,KAAK;yBACL,SAAS;IACzB,CAAC;IAEJ,IAAI;QACF,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAQ;QACX,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnF,CAAC;IAED,KAAK;QACH,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,mBAAmB;IAQnB,OAAO;IACC,WAAW;IACnB,UAAU;IACV,SAAS;IAVX,aAAa,CAA8B;IAC3C,IAAI,CAAW;IACf,OAAO,CAAe;IACtB,QAAQ,CAA0C;IACnD,OAAO,GAAG,KAAK,CAAC;IAExB,YACW,OAAe,EACP,WAAsC,EAC9C,UAAkB,EAClB,SAAiB,EAC1B,cAAsB,EACtB,KAA+B;uBALtB,OAAO;2BACC,WAAW;0BACnB,UAAU;yBACV,SAAS;QAIlB,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAChC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/B,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,KAAK,CACN,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAC7B,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAC5B,MAAM,EACN,cAAc,EACd,aAAa,EACb,KAAK,CACN,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,eAAe,CACtC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,EACrC,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,KAAK,EACL,WAAW,EACX,eAAe,CAChB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CACjC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,EACvC,iBAAiB,EACjB,cAAc,EACd,wBAAwB,EACxB,KAAK,EACL,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IAEjB,IAAI;IACJ,cAAc;IACd,KAAK;IACL,oBAAoB;IAJvC,YACmB,IAAY,EACZ,cAAc,GAAG,wBAAwB,EACzC,KAA+B,EAC/B,oBAAiD;oBAHjD,IAAI;8BACJ,cAAc;qBACd,KAAK;oCACL,oBAAoB;QAErC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,CAAC,IAAI,cAAc,GAAG,gBAAgB,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,wCAAwC,gBAAgB,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe;QACzB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA4B,EAAE,MAAoB;QAC7D,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAE7C,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QAED,KAAK,OAAO,CAAC,UAAU,CACrB,mBAAmB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAC/G,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,OAAe,EAAE,UAAkB,EAAE,SAAiB;QACnE,OAAO;YACL,OAAO;YACP,UAAU;YACV,OAAO,EAAE,IAAI,eAAe,CAC1B,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/B,SAAS,EACT,IAAI,CAAC,cAAc,EACnB,gBAAgB,CACjB;YACD,IAAI,EAAE,IAAI,eAAe,CACvB,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAC5B,MAAM,EACN,IAAI,CAAC,cAAc,EACnB,aAAa,CACd;YACD,aAAa,EAAE,IAAI,eAAe,CAChC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,EACrC,eAAe,EACf,IAAI,CAAC,cAAc,EACnB,sBAAsB,EACtB,SAAS,EACT,WAAW,EACX,eAAe,CAChB;YACD,QAAQ,EAAE,IAAI,eAAe,CAC3B,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,EACvC,iBAAiB,EACjB,IAAI,CAAC,cAAc,EACnB,wBAAwB,EACxB,SAAS,EACT,2BAA2B,CAC5B;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,MAAM,KAAK,GAAG,eAAe,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAC9B,IAAI,CAAC,cAAc,CACe,CAAC;QACrC,IACE,KAAK,KAAK,IAAI;YACd,KAAK,CAAC,OAAO,KAAK,CAAC;YACnB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;YACpC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAA+B,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,MAA8B;QAChE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CACtG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,+BAA+B,CAAC,CACpD,CAAC;IACJ,CAAC;CACF"}