@mono-agent/agent-app 0.19.0 → 0.20.0

package/dist/launchd-maintenance-entry.js

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+import { basename, isAbsolute, resolve } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { deriveLaunchdLabel, INTERNAL_LAUNCHD_LOG_MAINTENANCE_COMMAND, INTERNAL_WEB_LOG_MAINTENANCE_COMMAND, launchdMaintenanceDispersionSeconds, launchdWebMaintenanceInfo, launchdPathsFor, MANAGED_LAUNCHD_LOG_MAINTENANCE_ENV, MANAGED_WEB_LOG_MAINTENANCE_ENV, webMaintenanceDispersionSeconds, } from "./launchd.js";
+import { MANAGED_LAUNCHD_MAINTENANCE_ENTRY_FILE } from "./launchd-maintenance-command.js";
+import { defaultLaunchdMaintenanceGateDependencies, withLaunchdMaintenanceControllerLock, } from "./launchd-maintenance-gate.js";
+import { sanitizeManagedLaunchdLogMaintenanceEnvironment } from "./managed-launchd-maintenance-environment.js";
+import { sanitizeManagedWebLogMaintenanceEnvironment } from "./managed-web-maintenance-environment.js";
+import { verifyManagedRuntimeMaintenanceEntrypoint, } from "./managed-runtime-maintenance-entry.js";
+import { parseWebLogMaintenanceArguments } from "./web-log-maintenance-command.js";
+export function defaultLaunchdMaintenanceEntryDependencies() {
+    return {
+        gate: defaultLaunchdMaintenanceGateDependencies(),
+        pathsForLabel: (label) => launchdPathsFor(label),
+        verifyEntrypoint: verifyManagedRuntimeMaintenanceEntrypoint,
+        loadHeavy: async () => await import("./cli-background-command.js"),
+        loadWebHeavy: async () => await import("./web-log-maintenance.js"),
+        inspectWebHelper: launchdWebMaintenanceInfo,
+        currentEntrypointPath: fileURLToPath(import.meta.url),
+        platform: process.platform,
+        sleep: wait,
+        stderr: (text) => void process.stderr.write(text),
+    };
+}
+/** Dedicated entry: deterministic dispersion and the per-agent lease precede heavy imports. */
+export async function runLaunchdMaintenanceEntry(argv, env = process.env, deps = defaultLaunchdMaintenanceEntryDependencies()) {
+    const command = argv[0];
+    const agentMarked = env[MANAGED_LAUNCHD_LOG_MAINTENANCE_ENV] === "1";
+    const webMarked = env[MANAGED_WEB_LOG_MAINTENANCE_ENV] === "1";
+    if (command === INTERNAL_WEB_LOG_MAINTENANCE_COMMAND) {
+        if (!webMarked || agentMarked) {
+            safeStderr(deps, "The web log maintenance command is reserved for its exact managed LaunchAgent marker.");
+            return 2;
+        }
+        let webArgs;
+        try {
+            webArgs = parseWebLogMaintenanceArguments(argv);
+        }
+        catch (error) {
+            safeStderr(deps, safeError(error));
+            return 2;
+        }
+        sanitizeManagedWebLogMaintenanceEnvironment(env);
+        if (deps.platform !== "darwin") {
+            safeStderr(deps, "Scheduled web log maintenance is only available on macOS launchd.");
+            return 1;
+        }
+        try {
+            // Mirror the agent helper's pre-import, pre-lock RunAtLoad dispersion.
+            await deps.sleep(webMaintenanceDispersionSeconds() * 1_000);
+            await deps.verifyEntrypoint({
+                currentEntrypointPath: deps.currentEntrypointPath,
+                launchProof: webArgs.expectedManagedRuntimeLaunch,
+            });
+            const helperPid = deps.gate.currentPid();
+            const helper = await (deps.inspectWebHelper ?? launchdWebMaintenanceInfo)(deps.gate.runner, deps.gate.getuid());
+            const definition = helper.definition;
+            if (!helper.loaded
+                || helper.pid !== helperPid
+                || !deps.gate.isAlive(helperPid)
+                || definition === undefined
+                || definition.nodePath !== process.execPath
+                || definition.cliPath !== deps.currentEntrypointPath
+                || definition.expectedManagedRuntimeLaunch !== webArgs.expectedManagedRuntimeLaunch
+                || definition.expectedWebPlistIdentity !== webArgs.expectedWebPlistIdentity) {
+                throw new Error("launchd does not own this exact web-maintenance helper definition and pid");
+            }
+            const heavy = await (deps.loadWebHeavy ?? (async () => await import("./web-log-maintenance.js")))();
+            return await heavy.runWebLogMaintenanceCommand(webArgs);
+        }
+        catch (error) {
+            safeStderr(deps, `Scheduled web maintenance could not establish its dispersed attested boundary: ${safeError(error)}`);
+            return 1;
+        }
+    }
+    if (command !== INTERNAL_LAUNCHD_LOG_MAINTENANCE_COMMAND) {
+        safeStderr(deps, agentMarked || webMarked
+            ? "The managed log-maintenance marker cannot authorize another command."
+            : "The launchd maintenance entry only accepts its reserved managed command.");
+        return 2;
+    }
+    if (!agentMarked || webMarked) {
+        safeStderr(deps, "The launchd log maintenance command is reserved for its managed LaunchAgent.");
+        return 2;
+    }
+    sanitizeManagedLaunchdLogMaintenanceEnvironment(env);
+    if (deps.platform !== "darwin") {
+        safeStderr(deps, "Scheduled log maintenance is only available on macOS launchd.");
+        return 1;
+    }
+    let args;
+    try {
+        args = parseManagedArguments(argv);
+    }
+    catch (error) {
+        safeStderr(deps, safeError(error));
+        return 2;
+    }
+    const configPath = resolve(args.configPath);
+    const label = deriveLaunchdLabel(configPath);
+    const target = { label, paths: deps.pathsForLabel(label) };
+    try {
+        // RunAtLoad starts every helper together. Preserve N/N recovery coverage
+        // while spreading the heavy boundary deterministically without new lock
+        // authority or stale-owner state.
+        await deps.sleep(launchdMaintenanceDispersionSeconds(label) * 1_000);
+        return await withLaunchdMaintenanceControllerLock(target, deps.gate, async (ownership) => {
+            await deps.verifyEntrypoint({
+                currentEntrypointPath: deps.currentEntrypointPath,
+                launchProof: args.expectedManagedRuntimeLaunch,
+            });
+            const heavy = await deps.loadHeavy();
+            return await heavy.runLaunchdLogMaintenanceCommandWithLifecycleLease(args, ownership);
+        });
+    }
+    catch (error) {
+        safeStderr(deps, `Scheduled recovery could not establish its dispersed attested ownership boundary: ${safeError(error)}`);
+        return 1;
+    }
+}
+function wait(milliseconds) {
+    return new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
+}
+function parseManagedArguments(argv) {
+    const required = [
+        "--config",
+        "--controller-cli",
+        "--agent-cwd",
+        "--agent-path",
+        "--expected-managed-runtime-launch",
+    ];
+    let index = 1;
+    const values = [];
+    for (const flag of required) {
+        if (argv[index++] !== flag)
+            throw new Error(`Managed launchd recovery requires ${flag}.`);
+        const value = argv[index++];
+        if (value === undefined || value.length === 0 || hasControlCharacter(value)) {
+            throw new Error(`Managed launchd recovery received an invalid ${flag} value.`);
+        }
+        values.push(value);
+    }
+    let envFile;
+    if (argv[index] === "--env-file") {
+        envFile = argv[index + 1];
+        index += 2;
+        if (envFile === undefined || !isAbsolute(envFile) || hasControlCharacter(envFile)) {
+            throw new Error("Managed launchd recovery received an invalid --env-file value.");
+        }
+    }
+    if (index !== argv.length)
+        throw new Error("Managed launchd recovery received unexpected arguments.");
+    const [configPath, controllerCliPath, agentCwd, agentPath, expectedManagedRuntimeLaunch] = values;
+    if (![configPath, controllerCliPath, agentCwd].every((path) => isAbsolute(path))) {
+        throw new Error("Managed launchd recovery requires absolute config, controller CLI, and agent cwd paths.");
+    }
+    if (!/^[0-9A-Za-z_-]+$/u.test(expectedManagedRuntimeLaunch)) {
+        throw new Error("Managed launchd recovery received a malformed runtime launch proof.");
+    }
+    return {
+        configPath,
+        controllerCliPath,
+        agentCwd,
+        agentPath,
+        expectedManagedRuntimeLaunch,
+        ...(envFile === undefined ? {} : { envFile }),
+    };
+}
+function safeStderr(deps, message) {
+    const line = `[error] ${message}\n`;
+    try {
+        const reported = deps.stderr(line);
+        if (reported !== undefined)
+            void Promise.resolve(reported).catch(() => undefined);
+    }
+    catch {
+        // Reporter failure never becomes an unhandled rejection or widens authority.
+    }
+}
+function safeError(error) {
+    return (error instanceof Error ? error.message : String(error))
+        .replace(/[\u0000-\u001f\u007f]+/gu, " ")
+        .replace(/\b(token|secret|password|api[-_]?key|authorization)\s*[=:]\s*\S+/giu, "$1=<redacted>")
+        .replace(/\bBearer\s+\S+/giu, "Bearer <redacted>")
+        .replace(/(?:\/[A-Za-z0-9._~!$&'()+,;=:@%-]+){2,}/gu, "<path>")
+        .replace(/\s+/gu, " ")
+        .trim()
+        .slice(0, 512);
+}
+function hasControlCharacter(value) {
+    return /[\u0000-\u001f\u007f]/u.test(value);
+}
+const entryName = process.argv[1] === undefined ? undefined : basename(process.argv[1]);
+if (entryName === MANAGED_LAUNCHD_MAINTENANCE_ENTRY_FILE) {
+    runLaunchdMaintenanceEntry(process.argv.slice(2))
+        .then((code) => {
+        if (code !== 0)
+            process.exitCode = code;
+    })
+        .catch((error) => {
+        process.stderr.write(`[error] Launchd maintenance failed: ${safeError(error)}\n`);
+        process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=launchd-maintenance-entry.js.map

package/dist/launchd-maintenance-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd-maintenance-entry.js","sourceRoot":"","sources":["../src/launchd-maintenance-entry.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,kBAAkB,EAClB,wCAAwC,EACxC,oCAAoC,EACpC,mCAAmC,EACnC,yBAAyB,EACzB,eAAe,EACf,mCAAmC,EACnC,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAE1F,OAAO,EACL,yCAAyC,EACzC,oCAAoC,GACrC,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EAAE,+CAA+C,EAAE,MAAM,8CAA8C,CAAC;AAC/G,OAAO,EAAE,2CAA2C,EAAE,MAAM,0CAA0C,CAAC;AACvG,OAAO,EACL,yCAAyC,GAC1C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AA2BnF,MAAM,UAAU,0CAA0C;IACxD,OAAO;QACL,IAAI,EAAE,yCAAyC,EAAE;QACjD,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;QAChD,gBAAgB,EAAE,yCAAyC;QAC3D,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,6BAA6B,CAAC;QAClE,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC;QAClE,gBAAgB,EAAE,yBAAyB;QAC3C,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACrD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAuB,EACvB,MAA0C,OAAO,CAAC,GAAG,EACrD,OAA4C,0CAA0C,EAAE;IAExF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,WAAW,GAAG,GAAG,CAAC,mCAAmC,CAAC,KAAK,GAAG,CAAC;IACrE,MAAM,SAAS,GAAG,GAAG,CAAC,+BAA+B,CAAC,KAAK,GAAG,CAAC;IAC/D,IAAI,OAAO,KAAK,oCAAoC,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,EAAE,uFAAuF,CAAC,CAAC;YAC1G,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,OAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,2CAA2C,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,EAAE,mEAAmE,CAAC,CAAC;YACtF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC;YACH,uEAAuE;YACvE,MAAM,IAAI,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,KAAK,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,gBAAgB,CAAC;gBAC1B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;gBACjD,WAAW,EAAE,OAAO,CAAC,4BAA4B;aAClD,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,yBAAyB,CAAC,CACvE,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CACnB,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,MAAM;mBACb,MAAM,CAAC,GAAG,KAAK,SAAS;mBACxB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;mBAC7B,UAAU,KAAK,SAAS;mBACxB,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;mBACxC,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,qBAAqB;mBACjD,UAAU,CAAC,4BAA4B,KAAK,OAAO,CAAC,4BAA4B;mBAChF,UAAU,CAAC,wBAAwB,KAAK,OAAO,CAAC,wBAAwB,EAAE,CAAC;gBAC9E,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,OAAO,MAAM,KAAK,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,EAAE,kFAAkF,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvH,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,wCAAwC,EAAE,CAAC;QACzD,UAAU,CACR,IAAI,EACJ,WAAW,IAAI,SAAS;YACtB,CAAC,CAAC,sEAAsE;YACxE,CAAC,CAAC,0EAA0E,CAC/E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,EAAE,8EAA8E,CAAC,CAAC;QACjG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,+CAA+C,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,IAAI,EAAE,+DAA+D,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAmC,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,yEAAyE;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC;QACrE,OAAO,MAAM,oCAAoC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACvF,MAAM,IAAI,CAAC,gBAAgB,CAAC;gBAC1B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;gBACjD,WAAW,EAAE,IAAI,CAAC,4BAA4B;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,OAAO,MAAM,KAAK,CAAC,iDAAiD,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,EAAE,qFAAqF,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1H,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,YAAoB;IAChC,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB;IACpD,MAAM,QAAQ,GAAG;QACf,UAAU;QACV,kBAAkB;QAClB,aAAa;QACb,cAAc;QACd,mCAAmC;KAC3B,CAAC;IACX,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,SAAS,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,OAA2B,CAAC;IAChC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1B,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACtG,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,4BAA4B,CAAC,GAAG,MAM1F,CAAC;IACF,IAAI,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,UAAU;QACV,iBAAiB;QACjB,QAAQ;QACR,SAAS;QACT,4BAA4B;QAC5B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAyD,EAAE,OAAe;IAC5F,MAAM,IAAI,GAAG,WAAW,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC5D,OAAO,CAAC,0BAA0B,EAAE,GAAG,CAAC;SACxC,OAAO,CAAC,qEAAqE,EAAE,eAAe,CAAC;SAC/F,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SACjD,OAAO,CAAC,2CAA2C,EAAE,QAAQ,CAAC;SAC9D,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,IAAI,SAAS,KAAK,sCAAsC,EAAE,CAAC;IACzD,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC9C,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1C,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/launchd-maintenance-gate.d.ts

@@ -0,0 +1,28 @@
+import type { LaunchctlRunner } from "./launchd.js";
+import type { BackgroundLifecycleTarget, BackgroundLockAcquireOptions } from "./launchd-lifecycle-lock.js";
+declare const OWNED_MAINTENANCE_LIFECYCLE: unique symbol;
+export interface LaunchdMaintenanceLifecycleLease {
+    readonly label: string;
+    readonly pid: number;
+    readonly [OWNED_MAINTENANCE_LIFECYCLE]: true;
+}
+export interface LaunchdMaintenanceGateDependencies {
+    readonly runner: LaunchctlRunner;
+    readonly getuid: () => number;
+    readonly currentPid: () => number;
+    readonly isAlive: (pid: number) => boolean;
+    readonly acquireLifecycleLock: (target: BackgroundLifecycleTarget, options?: BackgroundLockAcquireOptions) => Promise<(() => Promise<void>) | undefined>;
+    readonly stderr: (text: string) => void | Promise<void>;
+}
+export declare function defaultLaunchdMaintenanceGateDependencies(): LaunchdMaintenanceGateDependencies;
+/**
+ * Authenticate the exact launchd-owned helper, then own its per-agent lifecycle
+ * lock nonblocking before invoking any caller-supplied inspection or import.
+ * The account-wide log lock is deliberately acquired later, only around the
+ * shared-chain mutation that actually needs it.
+ */
+export declare function withLaunchdMaintenanceControllerLock(target: BackgroundLifecycleTarget, deps: LaunchdMaintenanceGateDependencies, operation: (ownership: LaunchdMaintenanceLifecycleLease) => Promise<number>): Promise<number>;
+/** Reject heavy reconciliation calls that did not cross this authenticated gate. */
+export declare function assertLaunchdMaintenanceLifecycleLease(ownership: LaunchdMaintenanceLifecycleLease, target: BackgroundLifecycleTarget): void;
+export {};
+//# sourceMappingURL=launchd-maintenance-gate.d.ts.map

package/dist/launchd-maintenance-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd-maintenance-gate.d.ts","sourceRoot":"","sources":["../src/launchd-maintenance-gate.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAIpD,OAAO,KAAK,EACV,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,6BAA6B,CAAC;AAIrC,QAAA,MAAM,2BAA2B,eAAgD,CAAC;AAElF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,MAAM,EAAE,yBAAyB,EACjC,OAAO,CAAC,EAAE,4BAA4B,KACnC,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,wBAAgB,yCAAyC,IAAI,kCAAkC,CAS9F;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,MAAM,EAAE,yBAAyB,EACjC,IAAI,EAAE,kCAAkC,EACxC,SAAS,EAAE,CAAC,SAAS,EAAE,gCAAgC,KAAK,OAAO,CAAC,MAAM,CAAC,GAC1E,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,oFAAoF;AACpF,wBAAgB,sCAAsC,CACpD,SAAS,EAAE,gCAAgC,EAC3C,MAAM,EAAE,yBAAyB,GAChC,IAAI,CAMN"}

package/dist/launchd-maintenance-gate.js

@@ -0,0 +1,80 @@
+import process from "node:process";
+import { deriveLaunchdMaintenanceLabel, launchdServiceInfo, makeLaunchctlRunner, } from "./launchd.js";
+import { acquireFilesystemLifecycleLock, } from "./launchd-lifecycle-lock.js";
+import { maintenanceErrorMessage } from "./background-lifecycle-utils.js";
+import * as ui from "./ui.js";
+const OWNED_MAINTENANCE_LIFECYCLE = Symbol("owned-launchd-maintenance-lifecycle");
+export function defaultLaunchdMaintenanceGateDependencies() {
+    return {
+        runner: makeLaunchctlRunner(),
+        getuid: () => process.getuid?.() ?? 0,
+        currentPid: () => process.pid,
+        isAlive: processIsAlive,
+        acquireLifecycleLock: acquireFilesystemLifecycleLock,
+        stderr: (text) => void process.stderr.write(text),
+    };
+}
+/**
+ * Authenticate the exact launchd-owned helper, then own its per-agent lifecycle
+ * lock nonblocking before invoking any caller-supplied inspection or import.
+ * The account-wide log lock is deliberately acquired later, only around the
+ * shared-chain mutation that actually needs it.
+ */
+export async function withLaunchdMaintenanceControllerLock(target, deps, operation) {
+    const helperLabel = deriveLaunchdMaintenanceLabel(target.label);
+    const helperPid = deps.currentPid();
+    const helperService = await launchdServiceInfo(deps.runner, helperLabel, deps.getuid());
+    if (!helperService.loaded || helperService.pid !== helperPid || !deps.isAlive(helperPid)) {
+        reportFailure(target, deps, "authenticate the launchd-owned recovery controller", new Error(`launchd does not own this helper pid ${helperPid}`));
+        return 1;
+    }
+    const releasePerAgent = await deps.acquireLifecycleLock(target, {
+        purpose: "lifecycle",
+        waitTimeoutMs: 0,
+    });
+    if (releasePerAgent === undefined)
+        return 0;
+    try {
+        return await operation({
+            label: target.label,
+            pid: helperPid,
+            [OWNED_MAINTENANCE_LIFECYCLE]: true,
+        });
+    }
+    finally {
+        await releasePerAgent().catch((error) => {
+            safeStderr(deps, ui.errorLine(`Could not release lifecycle lock for ${target.label}: ${maintenanceErrorMessage(error)}`));
+        });
+    }
+}
+/** Reject heavy reconciliation calls that did not cross this authenticated gate. */
+export function assertLaunchdMaintenanceLifecycleLease(ownership, target) {
+    if (ownership?.[OWNED_MAINTENANCE_LIFECYCLE] !== true
+        || ownership.label !== target.label
+        || ownership.pid !== process.pid) {
+        throw new Error("Launchd maintenance requires the authenticated per-agent lifecycle capability.");
+    }
+}
+function reportFailure(target, deps, action, error) {
+    safeStderr(deps, ui.errorLine(`Scheduled log maintenance could not ${action} for ${target.label}: ${maintenanceErrorMessage(error)}`));
+}
+function safeStderr(deps, text) {
+    try {
+        const reported = deps.stderr(text);
+        if (reported !== undefined)
+            void Promise.resolve(reported).catch(() => undefined);
+    }
+    catch {
+        // A reporter cannot change lock ownership, helper lifecycle, or rejection.
+    }
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error?.code === "EPERM";
+    }
+}
+//# sourceMappingURL=launchd-maintenance-gate.js.map

package/dist/launchd-maintenance-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd-maintenance-gate.js","sourceRoot":"","sources":["../src/launchd-maintenance-gate.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,MAAM,2BAA2B,GAAG,MAAM,CAAC,qCAAqC,CAAC,CAAC;AAoBlF,MAAM,UAAU,yCAAyC;IACvD,OAAO;QACL,MAAM,EAAE,mBAAmB,EAAE;QAC7B,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC;QACrC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG;QAC7B,OAAO,EAAE,cAAc;QACvB,oBAAoB,EAAE,8BAA8B;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,MAAiC,EACjC,IAAwC,EACxC,SAA2E;IAE3E,MAAM,WAAW,GAAG,6BAA6B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACpC,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,aAAa,CACX,MAAM,EACN,IAAI,EACJ,oDAAoD,EACpD,IAAI,KAAK,CAAC,wCAAwC,SAAS,EAAE,CAAC,CAC/D,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE;QAC9D,OAAO,EAAE,WAAW;QACpB,aAAa,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,EAAE,SAAS;YACd,CAAC,2BAA2B,CAAC,EAAE,IAAI;SACpC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/C,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAC3B,wCAAwC,MAAM,CAAC,KAAK,KAAK,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sCAAsC,CACpD,SAA2C,EAC3C,MAAiC;IAEjC,IAAI,SAAS,EAAE,CAAC,2BAA2B,CAAC,KAAK,IAAI;WAChD,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;WAChC,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,MAAiC,EACjC,IAAwD,EACxD,MAAc,EACd,KAAc;IAEd,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAC3B,uCAAuC,MAAM,QAAQ,MAAM,CAAC,KAAK,KAAK,uBAAuB,CAAC,KAAK,CAAC,EAAE,CACvG,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,IAAwD,EACxD,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA2C,EAAE,IAAI,KAAK,OAAO,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/launchd-private-files.d.ts

@@ -0,0 +1,3 @@
+/** Secure one account-owned launchd state directory without following links. */
+export declare function ensureOwnerPrivateLaunchdDirectory(path: string): Promise<void>;
+//# sourceMappingURL=launchd-private-files.d.ts.map

package/dist/launchd-private-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd-private-files.d.ts","sourceRoot":"","sources":["../src/launchd-private-files.ts"],"names":[],"mappings":"AAKA,gFAAgF;AAChF,wBAAsB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCpF"}

package/dist/launchd-private-files.js

@@ -0,0 +1,58 @@
+import { constants as fsConstants } from "node:fs";
+import { lstat, mkdir, open } from "node:fs/promises";
+import { dirname } from "node:path";
+import process from "node:process";
+/** Secure one account-owned launchd state directory without following links. */
+export async function ensureOwnerPrivateLaunchdDirectory(path) {
+    const parent = dirname(path);
+    const parentDetails = await lstat(parent);
+    assertOwnerDirectory(parentDetails, parent, "LaunchAgent parent");
+    try {
+        await mkdir(path, { mode: 0o700 });
+    }
+    catch (error) {
+        if (!isErrno(error, "EEXIST"))
+            throw error;
+    }
+    const parentAfter = await lstat(parent);
+    assertOwnerDirectory(parentAfter, parent, "LaunchAgent parent");
+    if (!sameFilesystemIdentity(parentDetails, parentAfter)) {
+        throw new Error(`LaunchAgent parent ${parent} changed while ${path} was created.`);
+    }
+    const handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+    try {
+        const before = await handle.stat();
+        assertOwnerDirectory(before, path, "LaunchAgent directory");
+        await handle.chmod(0o700);
+        const secured = await handle.stat();
+        if (!sameFilesystemIdentity(before, secured)) {
+            throw new Error(`LaunchAgent directory ${path} changed while it was secured.`);
+        }
+        assertOwnerDirectory(secured, path, "LaunchAgent directory");
+        if ((secured.mode & 0o077) !== 0) {
+            throw new Error(`LaunchAgent directory ${path} must be owner-only.`);
+        }
+        const current = await lstat(path);
+        if (!sameFilesystemIdentity(secured, current)) {
+            throw new Error(`LaunchAgent directory ${path} changed while it was secured.`);
+        }
+    }
+    finally {
+        await handle.close();
+    }
+}
+function assertOwnerDirectory(details, path, description) {
+    if (!details.isDirectory() || details.isSymbolicLink()) {
+        throw new Error(`${description} ${path} must be a real directory.`);
+    }
+    if (typeof process.getuid === "function" && details.uid !== process.getuid()) {
+        throw new Error(`${description} ${path} is not owned by the current user.`);
+    }
+}
+function sameFilesystemIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function isErrno(error, code) {
+    return error?.code === code;
+}
+//# sourceMappingURL=launchd-private-files.js.map

package/dist/launchd-private-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchd-private-files.js","sourceRoot":"","sources":["../src/launchd-private-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAc,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,IAAY;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;IAC7C,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAChE,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,kBAAkB,IAAI,eAAe,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC,UAAU,CACxE,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,gCAAgC,CAAC,CAAC;QACjF,CAAC;QACD,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,sBAAsB,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,gCAAgC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAc,EAAE,IAAY,EAAE,WAAmB;IAC7E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,oCAAoC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAW,EAAE,KAAY;IACvD,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAQ,KAA2C,EAAE,IAAI,KAAK,IAAI,CAAC;AACrE,CAAC"}

package/dist/launchd.d.ts

@@ -1,3 +1,4 @@
+export { MANAGED_WEB_LOG_MAINTENANCE_ENV } from "./managed-web-maintenance-environment.js";
 /**
  * Thin, side-effect-light helpers around macOS launchd. The `launchctl` runner
  * is injectable so orchestration can be unit tested without touching the real
@@ -39,7 +40,7 @@ export interface PlistInput {
 export interface MaintenancePlistInput {
     readonly label: string;
     readonly nodePath: string;
-    /** Immutable CLI closure that executes the recovery controller itself. */
+    /** Attested lightweight executable in the immutable managed closure. */
     readonly cliPath: string;
     readonly configPath: string;
     readonly cwd: string;
@@ -47,10 +48,25 @@ export interface MaintenancePlistInput {
     readonly controllerCliPath: string;
     readonly agentCwd: string;
     readonly agentPath: string;
+    /** Path-free proof covering the managed marker, main CLI, and helper entry. */
+    readonly expectedManagedRuntimeLaunch: string;
     readonly envFile?: string;
     /** Deliberately allowlisted, non-secret maintenance environment. */
     readonly environment: Readonly<Record<string, string>>;
-    readonly intervalSeconds: number;
+    /** Minute in each hour derived from the canonical main LaunchAgent label. */
+    readonly calendarMinute: number;
+}
+export interface WebMaintenancePlistInput {
+    readonly label: typeof WEB_MAINTENANCE_LAUNCHD_LABEL;
+    readonly nodePath: string;
+    /** The same attested lightweight entry used by agent maintenance. */
+    readonly cliPath: string;
+    readonly cwd: string;
+    readonly expectedManagedRuntimeLaunch: string;
+    /** Fresh dev:ino:size:sha256 identity of the paired main web plist. */
+    readonly expectedWebPlistIdentity: string;
+    readonly environment: Readonly<Record<string, string>>;
+    readonly calendarMinute: number;
 }
 export interface WebPlistInput {
     readonly label: string;
@@ -86,8 +102,23 @@ export interface LaunchdManagedWorkerInfo extends LaunchdServiceInfo {
     /** Present only when launchctl exposes the exact current producer shape. */
     readonly definition?: LaunchdManagedWorkerDefinition;
 }
+export interface LaunchdWebMaintenanceDefinition {
+    readonly plistPath: string;
+    readonly nodePath: string;
+    readonly cliPath: string;
+    readonly cwd: string;
+    readonly expectedManagedRuntimeLaunch: string;
+    readonly expectedWebPlistIdentity: string;
+}
+export interface LaunchdWebMaintenanceInfo extends LaunchdServiceInfo {
+    /** Present only when launchctl exposes the exact cached helper definition. */
+    readonly definition?: LaunchdWebMaintenanceDefinition;
+}
 export declare const INTERNAL_LAUNCHD_LOG_MAINTENANCE_COMMAND = "__launchd-log-maintenance";
 export declare const MANAGED_LAUNCHD_LOG_MAINTENANCE_ENV = "MONO_AGENT_MANAGED_LOG_MAINTENANCE";
+export declare const WEB_LAUNCHD_LABEL = "com.mono-agent-web";
+export declare const WEB_MAINTENANCE_LAUNCHD_LABEL = "com.mono-agent-web-maintenance";
+export declare const INTERNAL_WEB_LOG_MAINTENANCE_COMMAND = "__web-log-maintenance";
 /**
  * A stable, launchd-legal label derived from the resolved config path. The
  * folder name keeps it human-readable; an 8-char hash of the absolute config
@@ -102,7 +133,18 @@ export declare function launchdPathsFor(label: string, home?: string): LaunchdPa
  * not mistake a scheduled one-shot helper for an extra agent.
  */
 export declare function deriveLaunchdMaintenanceLabel(mainLabel: string): string;
+/** Deterministically stagger recurring helpers by the canonical main label. */
+export declare function launchdMaintenanceCalendarMinute(canonicalMainLabel: string): number;
+export declare const LAUNCHD_MAINTENANCE_DISPERSION_SECONDS = 120;
+/** Spread login helpers before PID authentication, locking, or heavy import. */
+export declare function launchdMaintenanceDispersionSeconds(canonicalMainLabel: string): number;
+/** Web has a fixed label and therefore a distinct exact-label schedule validator. */
+export declare function webMaintenanceCalendarMinute(label?: string): number;
+/** Mirror agent RunAtLoad dispersion without admitting the web label to agent grammar. */
+export declare function webMaintenanceDispersionSeconds(label?: string): number;
 export declare function launchdMaintenancePathsFor(mainLabel: string, home?: string): LaunchdMaintenancePaths;
+/** Canonical lightweight helper next to the attested managed-runtime CLI. */
+export declare function launchdMaintenanceEntrypointPathForCli(cliPath: string): string;
 export declare function escapeXml(value: string): string;
 /**
  * The plist runs the blocking worker through `/usr/bin/env -i`. Clearing the
@@ -113,14 +155,20 @@ export declare function escapeXml(value: string): string;
 export declare function buildPlistXml(input: PlistInput): string;
 /** Scheduled one-shot recovery controller. It owns no logs and never KeepAlives. */
 export declare function buildLaunchdMaintenancePlistXml(input: MaintenancePlistInput): string;
+/** Scheduled one-shot web log controller. It never owns a KeepAlive or log stream. */
+export declare function buildWebMaintenancePlistXml(input: WebMaintenancePlistInput): string;
 /** Always-on web-console LaunchAgent. It runs the public blocking `web run` worker. */
 export declare function buildWebPlistXml(input: WebPlistInput): string;
 /** Exact argv persisted by the managed LaunchAgent producer. */
 export declare function buildLaunchdProgramArguments(input: PlistInput): readonly string[];
 /** Exact argv persisted by the private scheduled maintenance LaunchAgent. */
 export declare function buildLaunchdMaintenanceProgramArguments(input: MaintenancePlistInput): readonly string[];
+/** Exact argv persisted by the private scheduled web-maintenance LaunchAgent. */
+export declare function buildWebMaintenanceProgramArguments(input: WebMaintenancePlistInput): readonly string[];
 /** Exact argv persisted for the always-on web console. */
 export declare function buildWebLaunchdProgramArguments(input: WebPlistInput): readonly string[];
+export declare function buildEnvironmentArguments(environment: Readonly<Record<string, string>>): string[];
+export declare function assertWebPlistIdentity(value: string): void;
 /**
  * PATH for the background worker: the launching shell's PATH (so the user's
  * toolchain is reachable) plus Homebrew/usr-local in case launchd started from
@@ -141,12 +189,18 @@ export declare function launchdServiceInfo(runner: LaunchctlRunner, label: strin
  * distinguish during upgrades.
  */
 export declare function launchdManagedWorkerInfo(runner: LaunchctlRunner, label: string, uid: number): Promise<LaunchdManagedWorkerInfo>;
+/** Read the cached definition, not merely the mutable helper plist on disk. */
+export declare function launchdWebMaintenanceInfo(runner: LaunchctlRunner, uid: number): Promise<LaunchdWebMaintenanceInfo>;
+/** Parse only the exact cached web-helper definition emitted by this producer. */
+export declare function parseLaunchdWebMaintenanceDefinition(output: string): LaunchdWebMaintenanceDefinition | undefined;
 /** Parse only the exact managed-worker launchctl-print shape emitted here. */
 export declare function parseLaunchdManagedWorkerDefinition(output: string): LaunchdManagedWorkerDefinition | undefined;
 /** Parse only launchd's top-level `pid = N` field; never infer a pid from noise. */
 export declare function parseLaunchdServicePid(output: string): number | undefined;
 /** Bootstrap (load + RunAtLoad-launch) the plist. Caller tolerates "already bootstrapped". */
 export declare function bootstrap(runner: LaunchctlRunner, plistPath: string, uid: number): Promise<LaunchctlResult>;
+/** Ask launchd to start a loaded one-shot service without replacing a running instance. */
+export declare function kickstart(runner: LaunchctlRunner, label: string, uid: number): Promise<LaunchctlResult>;
 /**
  * Remove the service from the domain. Sends SIGTERM and — unlike a plain kill —
  * prevents KeepAlive from relaunching it. Caller tolerates "not loaded".

package/dist/launchd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launchd.d.ts","sourceRoot":"","sources":["../src/launchd.ts"],"names":[],"mappings":"AAWA;;;;GAIG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEpF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,yEAAyE;IACzE,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,8BAA8B,CAAC;CACtD;AAQD,eAAO,MAAM,wCAAwC,8BAA8B,CAAC;AACpF,eAAO,MAAM,mCAAmC,uCAAuC,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,MAA+B,GAAG,YAAY,CAUlG;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,MAA+B,GACpC,uBAAuB,CAMzB;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CA0CvD;AAED,oFAAoF;AACpF,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAuCpF;AAED,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAgD7D;AAED,gEAAgE;AAChE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAoBjF;AAED,6EAA6E;AAC7E,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,qBAAqB,GAC3B,SAAS,MAAM,EAAE,CAoBnB;AAED,0DAA0D;AAC1D,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,MAAM,EAAE,CAkBvF;AAwBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAY5F;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,mBAAmB,IAAI,eAAe,CAmBrD;AAED,sEAAsE;AACtE,wBAAsB,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpG;AAED,sEAAsE;AACtE,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC,CAK7B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAUnC;AAED,8EAA8E;AAC9E,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,GACb,8BAA8B,GAAG,SAAS,CAyF5C;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,8FAA8F;AAC9F,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEjH;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAE3G"}
+{"version":3,"file":"launchd.d.ts","sourceRoot":"","sources":["../src/launchd.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAE3F;;;;GAIG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEpF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,yEAAyE;IACzE,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,6BAA6B,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,uEAAuE;IACvE,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,8BAA8B,CAAC;CACtD;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,CAAC,EAAE,+BAA+B,CAAC;CACvD;AAQD,eAAO,MAAM,wCAAwC,8BAA8B,CAAC;AACpF,eAAO,MAAM,mCAAmC,uCAAuC,CAAC;AACxF,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AACtD,eAAO,MAAM,6BAA6B,mCAAmC,CAAC;AAC9E,eAAO,MAAM,oCAAoC,0BAA0B,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,MAA+B,GAAG,YAAY,CAUlG;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED,+EAA+E;AAC/E,wBAAgB,gCAAgC,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,gFAAgF;AAChF,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAKtF;AAED,qFAAqF;AACrF,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,MAA0B,GAAG,MAAM,CAEtF;AAED,0FAA0F;AAC1F,wBAAgB,+BAA+B,CAAC,KAAK,GAAE,MAA0B,GAAG,MAAM,CAEzF;AAgBD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,MAA+B,GACpC,uBAAuB,CAMzB;AAED,6EAA6E;AAC7E,wBAAgB,sCAAsC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAM9E;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CA0CvD;AAED,oFAAoF;AACpF,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CA4CpF;AAED,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAgDnF;AAED,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAgD7D;AAED,gEAAgE;AAChE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAoBjF;AAED,6EAA6E;AAC7E,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,qBAAqB,GAC3B,SAAS,MAAM,EAAE,CAsBnB;AAED,iFAAiF;AACjF,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wBAAwB,GAC9B,SAAS,MAAM,EAAE,CAgBnB;AAED,0DAA0D;AAC1D,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,MAAM,EAAE,CAkBvF;AAED,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,EAAE,CAUjG;AAQD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAI1D;AAMD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAY5F;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,mBAAmB,IAAI,eAAe,CAmBrD;AAED,sEAAsE;AACtE,wBAAsB,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpG;AAED,sEAAsE;AACtE,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC,CAK7B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAUnC;AAED,+EAA+E;AAC/E,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,yBAAyB,CAAC,CAUpC;AAED,kFAAkF;AAClF,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,MAAM,GACb,+BAA+B,GAAG,SAAS,CA2D7C;AAED,8EAA8E;AAC9E,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,GACb,8BAA8B,GAAG,SAAS,CAyF5C;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,8FAA8F;AAC9F,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEjH;AAED,2FAA2F;AAC3F,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAE7G;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAE3G"}