@meru454545/nexus-modscript-composer 2.0.12

package/README.md

@@ -0,0 +1,179 @@
+# @meru2802/nexus-modscript-composer
+
+Compose multi-layer deployment scripts for NexusEPM agents. Takes individual L0 monitoring/collection scripts and produces a composed L1 collection script + L2 deployment wrapper (systemd service on Linux, Scheduled Task on Windows).
+
+## Install
+
+```bash
+npm install @meru2802/nexus-modscript-composer
+```
+
+## Usage
+
+```typescript
+import { generateFinalScript } from "@meru2802/nexus-modscript-composer";
+
+const l0Bodies = [tomcatScript, postgresqlScript]; // raw L0 script strings with metadata headers
+
+const result = await generateFinalScript(l0Bodies, {
+  platform: "windows",
+  templateUrls: {
+    l1: "https://nexus-endpoint-desktop-app.s3.ap-south-1.amazonaws.com/l1-l2-templates/l1-windows.ps1.tmpl",
+    l2: "https://nexus-endpoint-desktop-app.s3.ap-south-1.amazonaws.com/l1-l2-templates/l2-windows.ps1.tmpl",
+  },
+  orgId: "acme-corp",
+  icebergEndpoint: "https://iceberg.example.com/api/v1/collect",
+  agentId: "agent-001",
+  authToken: "bearer-token",
+  bufferTime: "5m",
+  timeout: "10m",
+});
+
+console.log(result.l1Script);  // composed L1 collection script
+console.log(result.l2Script);  // L2 deployment wrapper
+console.log(result.modules);   // ["tomcat", "postgresql"]
+```
+
+## The L0 output contract (`OUTPUT_SCHEMA_VERSION: 2`)
+
+An L0 collector writes a stream of **single-line JSON records** to stdout — nothing else. There are exactly two shapes:
+
+```
+{"log":"probing for tomcat via ps"}
+{"log":"found 2 catalina processes"}
+{"result":{"module":"tomcat","category":"app_monitoring","status":"ok","timestamp":"...","error":null,"data":{}}}
+```
+
+Any number of `{"log":...}` records, then exactly one `{"result":...}` as the last line.
+
+L1 captures each module's stream, folds it into one envelope, and sends **one POST per module**. Your records travel **byte-for-byte** — L1 never unwraps or reshapes them:
+
+```json
+{
+  "agent_id":  "agent-001",
+  "org_id":    "acme-corp",
+  "module":    "tomcat",
+  "timestamp": "2026-07-29T10:00:00Z",
+  "logs":      [ {"log":"probing for tomcat via ps"}, {"log":"found 2 catalina processes"} ],
+  "result":    { "result": { "module": "tomcat", "status": "ok", "data": {} } }
+}
+```
+
+Because nothing is unwrapped, the collector payload sits at `envelope.result.result`.
+
+If a collector errors or reaches the L1 timeout, L1 preserves every valid
+`{"log":...}` record emitted before the failure, appends a synthetic error
+result when needed, and still attempts the module POST before exiting.
+
+Collectors get two helpers, defined inside the collector function:
+
+```sh
+_nexus_log "method 3 (process): running=true score=5"   # → {"log":"..."}
+cat <<EOF | _nexus_result                               # → {"result":{...}} on one line
+{ "module": "tomcat", ... }
+EOF
+```
+
+Verify any collector against the contract with:
+
+```bash
+./scripts/verify-l0-contract.sh                       # all scripts in l0-scripts/
+./scripts/verify-l0-contract.sh l0-scripts/mine.sh    # one script
+```
+
+See `AIX-L0-AUTHORING-GUIDE.md` §4 for the full contract, including the PowerShell equivalents.
+
+## Template URLs
+
+| Platform | Layer | URL |
+|----------|-------|-----|
+| Linux | L1 | `https://nexus-endpoint-desktop-app.s3.ap-south-1.amazonaws.com/l1-l2-templates/l1-linux.sh.tmpl` |
+| Linux | L2 | `https://nexus-endpoint-desktop-app.s3.ap-south-1.amazonaws.com/l1-l2-templates/l2-linux.sh.tmpl` |
+| Windows | L1 | `https://nexus-endpoint-desktop-app.s3.ap-south-1.amazonaws.com/l1-l2-templates/l1-windows.ps1.tmpl` |
+| Windows | L2 | `https://nexus-endpoint-desktop-app.s3.ap-south-1.amazonaws.com/l1-l2-templates/l2-windows.ps1.tmpl` |
+
+## `generateFinalScript(l0ScriptBodies, options)`
+
+### Parameters
+
+**`l0ScriptBodies`** `string[]` -- Array of raw L0 script contents. Each string must include the full metadata header (`# ==== NEXUS MODSCRIPT L0 ====` ... `# ==== END METADATA ====`) followed by the function body. All L0 scripts must target the same `OS_FAMILY` as the `platform` option.
+
+**`options`** `GenerateOptions`:
+
+| Field | Type | Required | Default | Description |
+|-------|------|----------|---------|-------------|
+| `platform` | `"linux" \| "windows"` | Yes | -- | Target OS. Must match the `OS_FAMILY` in all L0 scripts. |
+| `templateUrls` | `{ l1: string, l2: string }` | Yes | -- | URLs to fetch the L1 and L2 template files. See table above. |
+| `orgId` | `string` | No | `"test-client"` | Organization ID baked into L1 for Iceberg payloads. |
+| `icebergEndpoint` | `string` | No | `"https://iceberg.example.com/api/v1/collect"` | URL where L1 POSTs collected data. Written to the L2 env file. |
+| `agentId` | `string` | No | `"test-agent-001"` | Agent identifier included in Iceberg payloads. |
+| `authToken` | `string` | No | `"test-bearer-token"` | Bearer token for Iceberg API authentication. |
+| `bufferTime` | `string` | No | `"5m"` | Wait time after L1 completes before next run. Accepts `"30s"`, `"5m"`, `"1h"`. Linux: `OnUnitInactiveSec`. Windows: `Start-Sleep` in wrapper loop. |
+| `timeout` | `string` | No | `"10m"` | L0 collection deadline. At the deadline L1 stops unfinished collectors and posts their partial logs; L2 retains a bounded hard-kill grace period. Same format as `bufferTime`. |
+| `maxParallel` | `number` | No | `5` | Max parallel L0 modules. Linux: background jobs. Windows: runspace pool size. |
+| `previousServiceId` | `string` | No | `""` | Service ID of a previous deployment to tear down before installing the new one. |
+| `writeToDisk` | `boolean` | No | `false` | Write the composed scripts to timestamped files on disk. |
+| `outputDir` | `string` | No | `"./final-scripts"` | Directory for `writeToDisk` output. Resolved relative to `process.cwd()`. |
+
+### Return Value
+
+```typescript
+{
+  l1Script: string;    // Composed L1 collection script (all L0 modules merged)
+  l2Script: string;    // L2 deployment wrapper (installs L1 as systemd service or Scheduled Task)
+  platform: "linux" | "windows";
+  modules: string[];   // Names of L0 modules included, e.g. ["tomcat", "postgresql"]
+  l1Path?: string;     // File path if writeToDisk was true
+  l2Path?: string;     // File path if writeToDisk was true
+}
+```
+
+The function validates the composed scripts (structural checks, syntax via `bash -n`/`shellcheck`/`pwsh`, and a dry-run extraction test) before returning. It throws if validation fails.
+
+## Windows deletion verifier lifecycle
+
+Use the `deletion-verifier` lifecycle only for a Windows Nexus Endpoint removal job. It requires exactly one L0: [`l0-scripts/nexus_endpoint_deletion.ps1`](l0-scripts/nexus_endpoint_deletion.ps1). The collector is read-only and reports the remaining owned artifacts; it never deletes them.
+
+```ts
+const result = await generateFinalScript([nexusDeletionL0], {
+  platform: "windows",
+  templateUrls,
+  orgId: "org-1",
+  icebergEndpoint: "https://iceberg.example.com/v1/nexus-deletion/events",
+  agentId: "agent-1",
+  bufferTime: "30s",
+  timeout: "60s",
+  lifecycle: {
+    kind: "deletion-verifier",
+    jobId: "delete-2026-09-25-agent-1",
+    callbackToken: "one-job-scoped-token",
+    expectedWindowsUpdateAuOptions: null, // value recorded before installation; null = absent
+  },
+});
+```
+
+This produces the isolated task `\NexusDeletionVerifier\NexusDeletionVerifier-<jobId>` and only uses `C:\ProgramData\NexusDeletionVerifier\<jobId>`. It does not share the normal `NexusModScripts` root. L1 writes `completion.ack` only when all three conditions hold: the L0 result has `data.complete: true`, its `data.job_id` matches the configured job, and Iceberg returned a 2xx response for that exact envelope. L2 then unregisters the verifier task and deletes only its isolated root.
+
+The normal bulk cleanup helper is [`scripts/purge-nexus-modscripts.ps1`](scripts/purge-nexus-modscripts.ps1). It removes regular `\NexusModScripts\` deployments and deliberately never removes a deletion verifier.
+
+### Iceberg controller contract
+
+The controller must create a unique job ID and callback token, deploy the verifier **before** issuing the RMM uninstall command, and accept idempotent callback events. Treat completion as valid only when the authenticated callback has:
+
+```json
+{
+  "module": "nexus_endpoint_deletion",
+  "result": {
+    "result": {
+      "data": {
+        "job_id": "the-controller-job-id",
+        "manifest_version": 1,
+        "complete": true,
+        "remaining": []
+      }
+    }
+  }
+}
+```
+
+Require the scoped token plus `X-Nexus-Deletion-Job` to match the job. Deduplicate `X-Nexus-Event-Id`; persist every non-complete scan as progress; and mark the job complete only after receiving this complete event. Record `AUOptions` before installation and pass that original value (or `null` when absent) as `expectedWindowsUpdateAuOptions`; restore it before accepting completion. For existing machines that lack this installation-time journal, require an explicit administrator-selected baseline and keep the job pending until one is supplied. Do not rely on the TacticalRMM DELETE HTTP response as proof of endpoint cleanup: it removes the management record before the agent-side uninstall has necessarily finished. Start the verifier after all ordinary modular scripts have been purged and before the first endpoint/RMM removal action, so it remains available to observe the final state.

package/dist/composer.d.ts

@@ -0,0 +1,83 @@
+import type { L0Script, ModScriptLifecycle, OsFamily } from "./types.js";
+/**
+ * Normalize all line endings to CRLF for Windows PowerShell 5.1 compatibility.
+ * Strips all bare \r first (handles \r\n→\n and stray \r→nothing),
+ * then converts every \n to \r\n.
+ * Guarantees no bare \r survives before here-string terminators ("@, '@).
+ *
+ * Also replaces non-ASCII characters (box-drawing, em/en dashes) with ASCII
+ * equivalents. PowerShell 5.1 reads files without a BOM using the system's
+ * ANSI code page (usually Windows-1252). Multi-byte UTF-8 sequences like
+ * ─ (U+2500, box-drawing) decode as â"€, where byte 0x94 is a RIGHT DOUBLE
+ * QUOTATION MARK — this can corrupt the tokenizer's string-tracking state
+ * and cause spurious "Missing closing '}'" parse errors.
+ */
+export declare function normalizeWindowsLineEndings(content: string): string;
+export interface ComposeL1Params {
+    orgId: string;
+    l0Scripts: L0Script[];
+    osFamily: OsFamily;
+    template: string;
+}
+/**
+ * Compose an L1 script from multiple L0 scripts.
+ *
+ * For Linux:  L0 functions run in parallel as background jobs (&),
+ *             each writes to a temp file, results are pushed individually.
+ * For Windows: L0 functions run in parallel using PowerShell runspace pool,
+ *             results are pushed individually.
+ */
+export declare function composeL1(params: ComposeL1Params): string;
+export interface ComposeL2Params {
+    l1Script: string;
+    serviceName?: string;
+    osFamily: OsFamily;
+    template: string;
+    bufferTime?: string;
+    bufferTimeSeconds?: number;
+    timeout?: string;
+    timeoutSeconds?: number;
+    icebergEndpoint?: string;
+    agentId?: string;
+    authToken?: string;
+    orgId?: string;
+    maxParallel?: number;
+    previousServiceId?: string;
+    lifecycle?: ModScriptLifecycle;
+}
+/**
+ * Wrap an L1 script inside an L2 deployment wrapper.
+ *
+ * For Linux: L2 creates systemd service+timer, writes L1 to disk,
+ *            creates env file, enables and starts the timer.
+ *            Parameters are baked into the script (not passed as args)
+ *            because TacticalRMM runs the L2 once to install.
+ *
+ * For Windows: L2 creates a Scheduled Task running as SYSTEM,
+ *             writes L1 + env + wrapper to disk, registers the task.
+ */
+export declare function composeL2(params: ComposeL2Params): {
+    script: string;
+    args: string[];
+    shell: "shell" | "powershell";
+    requiredRuntimeArgs: string[];
+};
+/**
+ * Parse a human-readable interval string into seconds, minutes, and systemd format.
+ * Examples: "5m" → { seconds: 300, minutes: 5, systemd: "5min" }
+ */
+export declare function parseInterval(interval: string): {
+    seconds: number;
+    minutes: number;
+    systemd: string;
+};
+/**
+ * Validate that every here-string terminator ('@ or "@) in a PowerShell script
+ * conforms to PowerShell 5.1 rules:
+ * - Must be at column 0 (no leading whitespace)
+ * - No bare \r anywhere in the script
+ *
+ * Returns an array of error messages (empty = valid).
+ */
+export declare function validateHereStringTerminators(script: string): string[];
+//# sourceMappingURL=composer.d.ts.map

package/dist/composer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../src/composer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAKzE;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASnE;AAqBD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAgFzD;AAID,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,OAAO,GAAG,YAAY,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B,CAkBA;AAwMD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAuCA;AAID;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAwBtE"}

package/dist/composer.js

@@ -0,0 +1,367 @@
+import { createLogger } from "./logger.js";
+const log = createLogger("composer");
+/**
+ * Normalize all line endings to CRLF for Windows PowerShell 5.1 compatibility.
+ * Strips all bare \r first (handles \r\n→\n and stray \r→nothing),
+ * then converts every \n to \r\n.
+ * Guarantees no bare \r survives before here-string terminators ("@, '@).
+ *
+ * Also replaces non-ASCII characters (box-drawing, em/en dashes) with ASCII
+ * equivalents. PowerShell 5.1 reads files without a BOM using the system's
+ * ANSI code page (usually Windows-1252). Multi-byte UTF-8 sequences like
+ * ─ (U+2500, box-drawing) decode as â"€, where byte 0x94 is a RIGHT DOUBLE
+ * QUOTATION MARK — this can corrupt the tokenizer's string-tracking state
+ * and cause spurious "Missing closing '}'" parse errors.
+ */
+export function normalizeWindowsLineEndings(content) {
+    return content
+        .replace(/\r/g, "")
+        .replace(/[─━┄┅┈┉╌╍═]/g, "-") // box-drawing horizontals → ASCII dash
+        .replace(/[│┃┆┇┊┋╎╏║]/g, "|") // box-drawing verticals → ASCII pipe
+        .replace(/—/g, "--") // em dash -> double dash
+        .replace(/–/g, "-") // en dash -> single dash
+        .replace(/[→←↑↓↔↕]/g, "->") // arrows -> ASCII arrow
+        .replace(/\n/g, "\r\n");
+}
+/**
+ * Safe template placeholder replacement that avoids special $ patterns.
+ * String.prototype.replace treats $', $`, $&, $1 etc. as special in the
+ * replacement string. Using a function callback avoids this entirely.
+ */
+function templateReplace(template, placeholder, value) {
+    const pattern = new RegExp(placeholder.replace(/[{}]/g, (c) => `\\${c}`), "g");
+    return template.replace(pattern, () => value);
+}
+/**
+ * Compose an L1 script from multiple L0 scripts.
+ *
+ * For Linux:  L0 functions run in parallel as background jobs (&),
+ *             each writes to a temp file, results are pushed individually.
+ * For Windows: L0 functions run in parallel using PowerShell runspace pool,
+ *             results are pushed individually.
+ */
+export function composeL1(params) {
+    const { orgId, l0Scripts, osFamily } = params;
+    log.info("Composing L1 script", {
+        orgId,
+        osFamily,
+        moduleCount: l0Scripts.length,
+        modules: l0Scripts.map((l0) => l0.meta.name),
+    });
+    // Validate all L0 scripts match the target OS
+    for (const l0 of l0Scripts) {
+        if (l0.meta.osFamily !== osFamily) {
+            log.error("OS family mismatch in L0 script", {
+                scriptName: l0.meta.name,
+                scriptOs: l0.meta.osFamily,
+                targetOs: osFamily,
+            });
+            throw new Error(`L0 "${l0.meta.name}" is for ${l0.meta.osFamily}, but target OS is ${osFamily}`);
+        }
+    }
+    const template = params.template;
+    log.debug("L1 template received", { templateLength: template.length });
+    // Extract module names and versions
+    const moduleNames = l0Scripts.map((l0) => l0.meta.name);
+    const versionList = l0Scripts
+        .map((l0) => `${l0.meta.name}@${l0.meta.version}`)
+        .join(", ");
+    // Build module names array string for the target language.
+    // Linux (bash `arr=(...)`) and AIX (ksh `set -A arr ...`) both want
+    // space-separated quoted names; Windows (PowerShell `@(...)`) wants commas.
+    const moduleNamesArray = osFamily === "windows"
+        ? moduleNames.map((n) => `"${n}"`).join(", ")
+        : moduleNames.map((n) => `"${n}"`).join(" ");
+    // Concatenate all L0 function bodies
+    const l0Bodies = l0Scripts
+        .map((l0) => `# ── L0: ${l0.meta.name} v${l0.meta.version} (${l0.meta.category}) ──\n${l0.functionBody}`)
+        .join("\n\n");
+    log.trace("L0 bodies concatenated", { totalLength: l0Bodies.length });
+    // Replace template placeholders — use templateReplace for values that may
+    // contain $ characters (L0 bodies, module arrays) to avoid JS replace() $-patterns
+    let composed = template;
+    composed = templateReplace(composed, "{{ORG_ID}}", orgId);
+    composed = templateReplace(composed, "{{GENERATED_AT}}", new Date().toISOString());
+    composed = templateReplace(composed, "{{MODULE_LIST}}", moduleNames.join(", "));
+    composed = templateReplace(composed, "{{L0_VERSION_LIST}}", versionList);
+    composed = templateReplace(composed, "{{L0_FUNCTION_BODIES}}", l0Bodies);
+    composed = templateReplace(composed, "{{MODULE_NAMES_ARRAY}}", moduleNamesArray);
+    // Normalize line endings: Windows PowerShell 5.1 fails on mixed \r\n and \n,
+    // and bare \r before here-string terminators ("@, '@) breaks parsing.
+    if (osFamily === "windows") {
+        composed = normalizeWindowsLineEndings(composed);
+        const terminatorErrors = validateHereStringTerminators(composed);
+        if (terminatorErrors.length > 0) {
+            throw new Error(`L1 here-string terminator corruption after normalization: ${terminatorErrors.join("; ")}`);
+        }
+    }
+    log.info("L1 composition complete", {
+        outputLength: composed.length,
+        versionList,
+    });
+    return composed;
+}
+/**
+ * Wrap an L1 script inside an L2 deployment wrapper.
+ *
+ * For Linux: L2 creates systemd service+timer, writes L1 to disk,
+ *            creates env file, enables and starts the timer.
+ *            Parameters are baked into the script (not passed as args)
+ *            because TacticalRMM runs the L2 once to install.
+ *
+ * For Windows: L2 creates a Scheduled Task running as SYSTEM,
+ *             writes L1 + env + wrapper to disk, registers the task.
+ */
+export function composeL2(params) {
+    const { osFamily } = params;
+    log.info("Composing L2 deployment wrapper", {
+        osFamily,
+        serviceName: params.serviceName,
+        bufferTime: params.bufferTime,
+        timeout: params.timeout,
+        orgId: params.orgId,
+    });
+    if (osFamily === "linux") {
+        return composeL2Linux(params);
+    }
+    else if (osFamily === "aix") {
+        return composeL2Aix(params);
+    }
+    else {
+        return composeL2Windows(params);
+    }
+}
+function composeL2Linux(params) {
+    const template = params.template;
+    log.debug("Composing L2 Linux (systemd service+timer)", {
+        serviceName: params.serviceName,
+        bufferTime: params.bufferTime,
+        timeout: params.timeout,
+        l1Length: params.l1Script.length,
+    });
+    // Replace all placeholders — must use templateReplace because L1
+    // contains L0 bodies with $ patterns that JS replace() misinterprets.
+    // Missing params get empty string (script validates at runtime).
+    let script = templateReplace(template, "{{L1_SCRIPT_BODY}}", params.l1Script);
+    script = templateReplace(script, "{{SERVICE_NAME}}", params.serviceName ?? "");
+    script = templateReplace(script, "{{PREVIOUS_SERVICE_ID}}", params.previousServiceId ?? "");
+    script = templateReplace(script, "{{BUFFER_TIME}}", params.bufferTime ?? "");
+    script = templateReplace(script, "{{ICEBERG_ENDPOINT}}", params.icebergEndpoint ?? "");
+    script = templateReplace(script, "{{AGENT_ID}}", params.agentId ?? "");
+    script = templateReplace(script, "{{AUTH_TOKEN}}", params.authToken ?? "");
+    script = templateReplace(script, "{{ORG_ID}}", params.orgId ?? "");
+    script = templateReplace(script, "{{MAX_PARALLEL}}", String(params.maxParallel ?? 5));
+    script = templateReplace(script, "{{TIMEOUT}}", params.timeout ?? "");
+    const args = [params.serviceName ?? "", params.previousServiceId ?? ""];
+    // Track which params were NOT provided at composition time
+    const requiredRuntimeArgs = [];
+    if (!params.serviceName)
+        requiredRuntimeArgs.push("--service-name");
+    if (!params.bufferTime)
+        requiredRuntimeArgs.push("--buffer-time");
+    if (!params.icebergEndpoint)
+        requiredRuntimeArgs.push("--iceberg-endpoint");
+    if (!params.agentId)
+        requiredRuntimeArgs.push("--agent-id");
+    if (!params.authToken)
+        requiredRuntimeArgs.push("--auth-token");
+    if (!params.orgId)
+        requiredRuntimeArgs.push("--org-id");
+    if (!params.timeout)
+        requiredRuntimeArgs.push("--timeout");
+    log.debug("L2 Linux composed", {
+        outputLength: script.length,
+        argCount: args.length,
+        requiredRuntimeArgs,
+    });
+    return { script, args, shell: "shell", requiredRuntimeArgs };
+}
+function composeL2Aix(params) {
+    const template = params.template;
+    log.debug("Composing L2 AIX (SRC subsystem + ksh wrapper daemon)", {
+        serviceName: params.serviceName,
+        bufferTimeSeconds: params.bufferTimeSeconds,
+        timeoutSeconds: params.timeoutSeconds,
+        l1Length: params.l1Script.length,
+    });
+    // Replace all placeholders — must use templateReplace because L1
+    // contains L0 bodies with $ patterns that JS replace() misinterprets.
+    // The SRC wrapper daemon uses integer-seconds timing (sleep N / watchdog),
+    // like the Windows wrapper. The human-readable forms are kept for the
+    // JSON service_id output only.
+    let script = templateReplace(template, "{{L1_SCRIPT_BODY}}", params.l1Script);
+    script = templateReplace(script, "{{SERVICE_NAME}}", params.serviceName ?? "");
+    script = templateReplace(script, "{{PREVIOUS_SERVICE_ID}}", params.previousServiceId ?? "");
+    script = templateReplace(script, "{{BUFFER_TIME}}", params.bufferTime ?? "");
+    script = templateReplace(script, "{{BUFFER_TIME_SECONDS}}", String(params.bufferTimeSeconds ?? 0));
+    script = templateReplace(script, "{{TIMEOUT}}", params.timeout ?? "");
+    script = templateReplace(script, "{{TIMEOUT_SECONDS}}", String(params.timeoutSeconds ?? 0));
+    script = templateReplace(script, "{{ICEBERG_ENDPOINT}}", params.icebergEndpoint ?? "");
+    script = templateReplace(script, "{{AGENT_ID}}", params.agentId ?? "");
+    script = templateReplace(script, "{{AUTH_TOKEN}}", params.authToken ?? "");
+    script = templateReplace(script, "{{ORG_ID}}", params.orgId ?? "");
+    script = templateReplace(script, "{{MAX_PARALLEL}}", String(params.maxParallel ?? 5));
+    const args = [params.serviceName ?? "", params.previousServiceId ?? ""];
+    // Track which params were NOT provided at composition time
+    const requiredRuntimeArgs = [];
+    if (!params.serviceName)
+        requiredRuntimeArgs.push("--service-name");
+    if (!params.bufferTimeSeconds)
+        requiredRuntimeArgs.push("--buffer-time");
+    if (!params.icebergEndpoint)
+        requiredRuntimeArgs.push("--iceberg-endpoint");
+    if (!params.agentId)
+        requiredRuntimeArgs.push("--agent-id");
+    if (!params.authToken)
+        requiredRuntimeArgs.push("--auth-token");
+    if (!params.orgId)
+        requiredRuntimeArgs.push("--org-id");
+    if (!params.timeoutSeconds)
+        requiredRuntimeArgs.push("--timeout");
+    log.debug("L2 AIX composed", {
+        outputLength: script.length,
+        argCount: args.length,
+        requiredRuntimeArgs,
+    });
+    return { script, args, shell: "shell", requiredRuntimeArgs };
+}
+function composeL2Windows(params) {
+    const template = params.template;
+    const lifecycle = params.lifecycle ?? { kind: "continuous" };
+    const effectiveAuthToken = lifecycle.kind === "deletion-verifier"
+        ? lifecycle.callbackToken
+        : (params.authToken ?? "");
+    log.debug("Composing L2 Windows (Scheduled Task)", {
+        serviceName: params.serviceName,
+        bufferTimeSeconds: params.bufferTimeSeconds,
+        timeoutSeconds: params.timeoutSeconds,
+        l1Length: params.l1Script.length,
+    });
+    // Replace all placeholders — must use templateReplace because L1
+    // contains L0 bodies with $ patterns that JS replace() misinterprets.
+    // Missing int params get 0 (sentinel), strings get empty.
+    let script = templateReplace(template, "{{L1_SCRIPT_BODY}}", params.l1Script);
+    script = templateReplace(script, "{{SERVICE_NAME}}", params.serviceName ?? "");
+    script = templateReplace(script, "{{PREVIOUS_SERVICE_ID}}", params.previousServiceId ?? "");
+    script = templateReplace(script, "{{BUFFER_TIME_SECONDS}}", String(params.bufferTimeSeconds ?? 0));
+    script = templateReplace(script, "{{TIMEOUT_SECONDS}}", String(params.timeoutSeconds ?? 0));
+    script = templateReplace(script, "{{ICEBERG_ENDPOINT}}", params.icebergEndpoint ?? "");
+    script = templateReplace(script, "{{AGENT_ID}}", params.agentId ?? "");
+    script = templateReplace(script, "{{AUTH_TOKEN}}", effectiveAuthToken);
+    script = templateReplace(script, "{{ORG_ID}}", params.orgId ?? "");
+    script = templateReplace(script, "{{MAX_PARALLEL}}", String(params.maxParallel ?? 5));
+    script = templateReplace(script, "{{LIFECYCLE_KIND}}", lifecycle.kind);
+    script = templateReplace(script, "{{DELETION_JOB_ID}}", lifecycle.kind === "deletion-verifier" ? lifecycle.jobId : "");
+    script = templateReplace(script, "{{EXPECTED_WINDOWS_UPDATE_AU_OPTIONS}}", lifecycle.kind === "deletion-verifier"
+        ? (lifecycle.expectedWindowsUpdateAuOptions === null
+            ? "absent"
+            : String(lifecycle.expectedWindowsUpdateAuOptions))
+        : "");
+    const moduleListMatch = params.l1Script.match(/^# MODULES:\s*(.+)$/m);
+    const moduleCount = moduleListMatch?.[1]
+        ?.split(",")
+        .map((name) => name.trim())
+        .filter(Boolean).length ?? 1;
+    script = templateReplace(script, "{{MODULE_COUNT}}", String(Math.max(1, moduleCount)));
+    // Template has LF, injected L1 has CRLF → mixed endings.
+    // Normalize entire L2 to CRLF for PowerShell 5.1 here-string compatibility.
+    script = normalizeWindowsLineEndings(script);
+    const terminatorErrors = validateHereStringTerminators(script);
+    if (terminatorErrors.length > 0) {
+        throw new Error(`L2 here-string terminator corruption after normalization: ${terminatorErrors.join("; ")}`);
+    }
+    const args = [`-ServiceName`, params.serviceName ?? ""];
+    if (params.previousServiceId) {
+        args.push(`-PreviousServiceId`, params.previousServiceId);
+    }
+    // Track which params were NOT provided at composition time
+    const requiredRuntimeArgs = [];
+    if (!params.serviceName)
+        requiredRuntimeArgs.push("-ServiceName");
+    if (!params.bufferTimeSeconds)
+        requiredRuntimeArgs.push("-BufferTimeSeconds");
+    if (!params.timeoutSeconds)
+        requiredRuntimeArgs.push("-TimeoutSeconds");
+    if (!params.icebergEndpoint)
+        requiredRuntimeArgs.push("-IcebergEndpoint");
+    if (!params.agentId)
+        requiredRuntimeArgs.push("-AgentId");
+    if (!effectiveAuthToken)
+        requiredRuntimeArgs.push("-AuthToken");
+    if (!params.orgId)
+        requiredRuntimeArgs.push("-OrgId");
+    if (lifecycle.kind === "deletion-verifier" && !lifecycle.jobId) {
+        requiredRuntimeArgs.push("deletion lifecycle jobId");
+    }
+    log.debug("L2 Windows composed", {
+        outputLength: script.length,
+        argCount: args.length,
+        requiredRuntimeArgs,
+    });
+    return { script, args, shell: "powershell", requiredRuntimeArgs };
+}
+//  INTERVAL PARSING
+/**
+ * Parse a human-readable interval string into seconds, minutes, and systemd format.
+ * Examples: "5m" → { seconds: 300, minutes: 5, systemd: "5min" }
+ */
+export function parseInterval(interval) {
+    log.debug("Parsing interval", { interval });
+    const match = interval.match(/^(\d+)\s*(s|sec|seconds?|m|min|minutes?|h|hr|hours?)$/i);
+    if (!match) {
+        log.error("Invalid interval format", { interval });
+        throw new Error(`Invalid interval: "${interval}". Use format like "5m", "1h", "30s".`);
+    }
+    const value = parseInt(match[1], 10);
+    const unit = match[2].toLowerCase();
+    let result;
+    if (unit.startsWith("s")) {
+        result = {
+            seconds: value,
+            minutes: Math.max(1, Math.ceil(value / 60)),
+            systemd: `${value}s`,
+        };
+    }
+    else if (unit.startsWith("h")) {
+        result = { seconds: value * 3600, minutes: value * 60, systemd: `${value}h` };
+    }
+    else {
+        // minutes
+        result = { seconds: value * 60, minutes: value, systemd: `${value}min` };
+    }
+    log.debug("Interval parsed", {
+        input: interval,
+        seconds: result.seconds,
+        minutes: result.minutes,
+        systemd: result.systemd,
+    });
+    return result;
+}
+//  HERE-STRING TERMINATOR VALIDATION
+/**
+ * Validate that every here-string terminator ('@ or "@) in a PowerShell script
+ * conforms to PowerShell 5.1 rules:
+ * - Must be at column 0 (no leading whitespace)
+ * - No bare \r anywhere in the script
+ *
+ * Returns an array of error messages (empty = valid).
+ */
+export function validateHereStringTerminators(script) {
+    const errors = [];
+    const lines = script.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Detect MISPLACED terminators: leading whitespace before '@ or "@
+        if (/^\s+['"]@\s*$/.test(line)) {
+            errors.push(`Line ${i + 1}: here-string terminator has leading whitespace — ` +
+                `PowerShell 5.1 will not recognize it`);
+        }
+    }
+    // Check for bare \r (not followed by \n) — corrupts here-string parsing
+    const bareCR = script.match(/\r(?!\n)/g);
+    if (bareCR) {
+        errors.push(`${bareCR.length} bare \\r character(s) found — will corrupt here-string parsing`);
+    }
+    return errors;
+}
+//# sourceMappingURL=composer.js.map

package/dist/composer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer.js","sourceRoot":"","sources":["../src/composer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AAErC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,OAAO,OAAO;SACX,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAE,uCAAuC;SACrE,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAE,qCAAqC;SACnE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAa,yBAAyB;SACzD,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAc,yBAAyB;SACzD,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAI,wBAAwB;SACtD,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,QAAgB,EAChB,WAAmB,EACnB,KAAa;IAEb,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAC7C,GAAG,CACJ,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAE9C,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;QAC9B,KAAK;QACL,QAAQ;QACR,WAAW,EAAE,SAAS,CAAC,MAAM;QAC7B,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC;IAEH,8CAA8C;IAC9C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBAC3C,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI;gBACxB,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC,IAAI,CAAC,QAAQ,sBAAsB,QAAQ,EAAE,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvE,oCAAoC;IACpC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,SAAS;SAC1B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;SACjD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,2DAA2D;IAC3D,oEAAoE;IACpE,4EAA4E;IAC5E,MAAM,gBAAgB,GACpB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEjD,qCAAqC;IACrC,MAAM,QAAQ,GAAG,SAAS;SACvB,GAAG,CACF,CAAC,EAAE,EAAE,EAAE,CACL,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,SAAS,EAAE,CAAC,YAAY,EAAE,CAC9F;SACA,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtE,0EAA0E;IAC1E,mFAAmF;IACnF,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1D,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACnF,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,iBAAiB,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,qBAAqB,EAAE,WAAW,CAAC,CAAC;IACzE,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,CAAC,CAAC;IACzE,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IAEjF,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAEjD,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,6DAA6D,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAClC,YAAY,EAAE,QAAQ,CAAC,MAAM;QAC7B,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAuBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,MAAuB;IAM/C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAE5B,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE;QAC1C,QAAQ;QACR,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;IAEH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAuB;IAM7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAEjC,GAAG,CAAC,KAAK,CAAC,4CAA4C,EAAE;QACtD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,iEAAiE;IACjE,sEAAsE;IACtE,iEAAiE;IACjE,IAAI,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACvF,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEtE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAExE,2DAA2D;IAC3D,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,mBAAmB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE3D,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAC7B,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,mBAAmB;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,MAAuB;IAM3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAEjC,GAAG,CAAC,KAAK,CAAC,uDAAuD,EAAE;QACjE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,iEAAiE;IACjE,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,+BAA+B;IAC/B,IAAI,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACvF,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtF,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAExE,2DAA2D;IAC3D,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,iBAAiB;QAAE,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,mBAAmB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAElE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE;QAC3B,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,mBAAmB;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAuB;IAM/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC;IACtE,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,KAAK,mBAAmB;QAC/D,CAAC,CAAC,SAAS,CAAC,aAAa;QACzB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAE7B,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;QACjD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,iEAAiE;IACjE,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACvF,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACvE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,GAAG,eAAe,CACtB,MAAM,EACN,qBAAqB,EACrB,SAAS,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAC9D,CAAC;IACF,MAAM,GAAG,eAAe,CACtB,MAAM,EACN,wCAAwC,EACxC,SAAS,CAAC,IAAI,KAAK,mBAAmB;QACpC,CAAC,CAAC,CAAC,SAAS,CAAC,8BAA8B,KAAK,IAAI;YAClD,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC;QACtC,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IAC/B,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAEvF,yDAAyD;IACzD,4EAA4E;IAC5E,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,6DAA6D,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5D,CAAC;IAED,2DAA2D;IAC3D,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,iBAAiB;QAAE,mBAAmB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,mBAAmB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,kBAAkB;QAAE,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAC/D,mBAAmB,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvD,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE;QAC/B,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,mBAAmB;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AACpE,CAAC;AAED,oBAAoB;AAEpB;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAK5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAC1B,wDAAwD,CACzD,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,sBAAsB,QAAQ,uCAAuC,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;IAErC,IAAI,MAA6D,CAAC;IAElE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG;YACP,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YAC3C,OAAO,EAAE,GAAG,KAAK,GAAG;SACrB,CAAC;IACJ,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,GAAG,EAAE,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,UAAU;QACV,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC;IAC3E,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE;QAC3B,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qCAAqC;AAErC;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,mEAAmE;QACnE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,GAAG,CAAC,oDAAoD;gBAC/D,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,CAAC,MAAM,iEAAiE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}