@north-light/cli 0.3.537 → 0.3.539

package/dist/daemon/api/reader.js

@@ -1 +1 @@
-var g=Object.defineProperty;var c=(n,e)=>g(n,"name",{value:e,configurable:!0});import{ApiError as d}from"../../api/index.js";import{readerFor as E}from"../../core/graph/reader.js";import{canRead as R}from"../../core/graph/access.js";import{ownersByHandle as y,resolveName as v,viewOf as x}from"../../core/graph/names.js";import{ensureOwner as h}from"../../core/graph/objects.js";import{checkoutsForCwd as F,reposForCwd as N}from"../../core/graph/repo-sync/repos.js";import{lookupProfile as j}from"../../core/profiles/manifest.js";import{filterAsync as L,mapAsync as _}from"../../core/async-array.js";async function T(n,e){return await E(n,e.principal,async o=>await F(n,o))}c(T,"readerFor");async function U(n,e,o){const r=await v(n,e,o);if("object"in r)return r.object;if("deleted"in r||"remote"in r)return r;if("ambiguous"in r){const s=await _(r.ambiguous,async m=>`${await A(n,m)}/${m.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one object: ${s.join(", ")}`,{candidates:s,next:"Read one of them by its full `<type>:<owner>/<name>`."})}const t=o.replace(/^\s*\[\[(.*)\]\]\s*$/,"$1").trim(),i=/^(person|app|repo|profile):([^/]+)$/.exec(t),a=await L(i?await y(n,i[2],i[1]):(await y(n,t)).filter(s=>s.type!=="node"),async s=>await R(n,e,s));if(a.length>0){const s=await x(n,e),m=c(w=>{const f=s.findIndex($=>$.id===w.id);return f<0?1/0:f},"rank"),l=[...a].sort((w,f)=>m(w)-m(f))[0];if(m(l)===1/0&&a.length>1){const w=a.map(f=>`${f.type}:${f.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one owner: ${w.join(", ")}`,{candidates:w,next:"Name one as `<type>:<handle>`."})}return l.deleted_at?{deleted:l}:l}const p=`'${o}' not found: no object by that name in your view`,u=`Search for it with \`crtr canvas search ${t}\`.`;throw new d(404,"not_found",p,{error:"not_found",message:p,next:u})}c(U,"resolveRef");async function A(n,e){if(e.owner===null)return"";const o=await n.prepare("SELECT type, id, name FROM objects WHERE id = ?").get(e.owner);return o.type==="node"?o.id:`${o.type}:${o.name}`}c(A,"typedOwnerHandle");async function B(n,e,o,r){const t=o??(e.class==="node"?"node":e.class==="person"?"user":"app"),i=c(a=>new d(400,"invalid_owner",a,{next:"Run `crtr doc write --owner -h`."}),"refuse");if(t==="node"){if(e.class!=="node")throw i("`--owner node` needs a node; you are not running as one");return e.node}if(t==="user")return await h(n,"person","local-user","user:local","user");if(t==="app"){if(e.class==="person")throw i("`--owner app` needs an app; a person has none \u2014 use `--owner user`");return e.app}if(t==="profile"){if(e.class!=="node"||!e.profile)throw i("`--owner profile` needs a profile; you have none");return e.profile}if(t==="repo"){const a=r?await N(n,r):[],p=a[0]?a:e.class==="node"?e.repos:[];if(!p[0])throw i(`\`--owner repo\` needs a repo; ${r??(e.class==="node"?e.cwd:"your directory")} is not inside one`);return p[0]}if(t.startsWith("repo:"))return await I(n,"repo",t.slice(5),i);if(t.startsWith("profile:")){const a=t.slice(8),p=await n.prepare("SELECT * FROM objects WHERE type = 'profile' AND name = ? AND home_machine IS NULL").get(a);if(p)return p;const u=j(a);if(u.kind!=="resolved")throw i(`no profile named '${a}'`);const s=e.class==="person"?e.person:e.app;return await h(n,"profile","profile",u.entry.profileId,u.entry.manifest.name,s)}throw i(`unknown --owner value '${t}'`)}c(B,"ownerFromFlag");async function I(n,e,o,r){const t=await n.prepare("SELECT * FROM objects WHERE type = ? AND name = ? AND deleted_at IS NULL AND home_machine IS NULL").get(e,o);if(!t)throw r(`no ${e} named '${o}'`);return t}c(I,"namedOwner");export{B as ownerFromFlag,T as readerFor,U as resolveRef};
+var $=Object.defineProperty;var c=(n,e)=>$(n,"name",{value:e,configurable:!0});import{ApiError as d}from"../../api/index.js";import{readerFor as g}from"../../core/graph/reader.js";import{canRead as E}from"../../core/graph/access.js";import{ownersByHandle as y,resolveName as F,viewOf as R}from"../../core/graph/names.js";import{ensureOwner as v,ownerForGrantee as x}from"../../core/graph/objects.js";import{checkoutsForCwd as N,reposForCwd as j}from"../../core/graph/repo-sync/repos.js";import{lookupProfile as L}from"../../core/profiles/manifest.js";import{filterAsync as _,mapAsync as A}from"../../core/async-array.js";import{personId as I}from"../../core/canvas/person.js";async function G(n,e){return await g(n,e.principal,async o=>await N(n,o))}c(G,"readerFor");async function P(n,e,o){const r=await F(n,e,o);if("object"in r)return r.object;if("deleted"in r||"remote"in r)return r;if("ambiguous"in r){const s=await A(r.ambiguous,async m=>`${await O(n,m)}/${m.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one object: ${s.join(", ")}`,{candidates:s,next:"Read one of them by its full `<type>:<owner>/<name>`."})}const t=o.replace(/^\s*\[\[(.*)\]\]\s*$/,"$1").trim(),a=/^(person|app|repo|profile):([^/]+)$/.exec(t),i=await _(a?await y(n,a[2],a[1]):(await y(n,t)).filter(s=>s.type!=="node"),async s=>await E(n,e,s));if(i.length>0){const s=await R(n,e),m=c(w=>{const f=s.findIndex(h=>h.id===w.id);return f<0?1/0:f},"rank"),l=[...i].sort((w,f)=>m(w)-m(f))[0];if(m(l)===1/0&&i.length>1){const w=i.map(f=>`${f.type}:${f.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one owner: ${w.join(", ")}`,{candidates:w,next:"Name one as `<type>:<handle>`."})}return l.deleted_at?{deleted:l}:l}const p=`'${o}' not found: no object by that name in your view`,u=`Search for it with \`crtr canvas search ${t}\`.`;throw new d(404,"not_found",p,{error:"not_found",message:p,next:u})}c(P,"resolveRef");async function O(n,e){if(e.owner===null)return"";const o=await n.prepare("SELECT type, id, name FROM objects WHERE id = ?").get(e.owner);return o.type==="node"?o.id:`${o.type}:${o.name}`}c(O,"typedOwnerHandle");async function q(n,e,o,r){const t=o??(e.class==="node"?"node":e.class==="person"?"user":"app"),a=c(i=>new d(400,"invalid_owner",i,{next:"Run `crtr doc write --owner -h`."}),"refuse");if(t==="node"){if(e.class!=="node")throw a("`--owner node` needs a node; you are not running as one");return e.node}if(t==="user")return await x(n,I());if(t==="app"){if(e.class==="person")throw a("`--owner app` needs an app; a person has none \u2014 use `--owner user`");return e.app}if(t==="profile"){if(e.class!=="node"||!e.profile)throw a("`--owner profile` needs a profile; you have none");return e.profile}if(t==="repo"){const i=r?await j(n,r):[],p=i[0]?i:e.class==="node"?e.repos:[];if(!p[0])throw a(`\`--owner repo\` needs a repo; ${r??(e.class==="node"?e.cwd:"your directory")} is not inside one`);return p[0]}if(t.startsWith("repo:"))return await S(n,"repo",t.slice(5),a);if(t.startsWith("profile:")){const i=t.slice(8),p=await n.prepare("SELECT * FROM objects WHERE type = 'profile' AND name = ? AND home_machine IS NULL").get(i);if(p)return p;const u=L(i);if(u.kind!=="resolved")throw a(`no profile named '${i}'`);const s=e.class==="person"?e.person:e.app;return await v(n,"profile","profile",u.entry.profileId,u.entry.manifest.name,s)}throw a(`unknown --owner value '${t}'`)}c(q,"ownerFromFlag");async function S(n,e,o,r){const t=await n.prepare("SELECT * FROM objects WHERE type = ? AND name = ? AND deleted_at IS NULL AND home_machine IS NULL").get(e,o);if(!t)throw r(`no ${e} named '${o}'`);return t}c(S,"namedOwner");export{q as ownerFromFlag,G as readerFor,P as resolveRef};

package/dist/daemon/api/router.js

@@ -1 +1 @@
-var W=Object.defineProperty;var u=(e,t)=>W(e,"name",{value:t,configurable:!0});import{toErrorBody as j}from"./map.js";import{emitEvent as p}from"../../core/events/emit.js";import{scopeAllowed as f,ScopeDeniedError as N}from"../../core/scopes.js";import{coveredByAny as J}from"../../shared/env.js";import{ApiError as c}from"../../api/errors.js";import{activeGrant as B,grantFor as x}from"../../core/grants/mirror.js";import{getNode as y}from"../../core/canvas/canvas.js";import{ownedRun as z,RunError as _}from"../../core/runs/operations.js";import{nodeMayReach as H,placeMayReach as S}from"../../core/runs/confinement.js";import{checkCronFire as M}from"../cron/authority.js";import{readConfig as P}from"../../core/config.js";import{SCOPE_VOCABULARY as I}from"../../core/scopes.js";import{operationFor as L}from"./operations.js";import{CONTROL_BODY_MAX_BYTES as F}from"../../core/llm/body-limits.js";import{getRequest as Y,getRequestByInboxTicket as V}from"../../core/human/requests.js";import{requireVisibleReview as R}from"../../core/review/store.js";import{getComment as O}from"../../core/review/comments.js";async function D(e,t,o,s,n){const r=e.path,a=n&&typeof n=="object"&&!Array.isArray(n)?n:{};if(r==="/v1/human/requests"||r==="/v1/human/reviews"){const d=r.endsWith("/reviews")?a.origin_node_id:a.requester_node_id,h=r==="/v1/human/requests"&&d==null;if(d!==t.node&&!h)throw new c(403,"other_app_run","a broker may create a human request only for its own node");const i=a.source;if(i&&typeof i=="object"&&"nodeId"in i&&i.nodeId!==t.node)throw new c(403,"other_app_run","request source must name the calling node")}if(r==="/v1/human/reviews/self/comments"&&e.method==="GET"&&s.get("actor_node_id")!==t.node)throw new c(403,"other_app_run","self review requires the calling node");if(r.includes("/comments")&&e.method!=="GET"&&a.actor_node_id!==t.node)throw new c(403,"other_app_run","comment author must be the calling node");if(o.comment_id&&!await O(o.comment_id))throw new c(404,"not_found","comment not found")}u(D,"authorizeHumanBody");function g(e){return e.class==="broker"||e.class==="cron"}u(g,"boundedByStoredScopes");function b(e){return e.class==="person"||e.class==="anonymous"||e.class==="machine"?null:e.class==="forwarded"?e.actor.kind==="app"?e.actor.app:null:e.app}u(b,"appOf");function q(e){return e.class==="person"||e.class==="forwarded"&&e.actor.kind==="person"}u(q,"actsAsPerson");async function $(e){const t=await x(e.actor.app,e.sub);if(!t)throw new c(403,"app_not_granted",`${e.actor.app} holds no active grant for ${e.sub} on this machine`);return t}u($,"forwardedGrant");async function v(e){if(e.class==="person"||e.class==="anonymous"||e.class==="machine")return[];if(e.class==="forwarded"){if(e.actor.kind==="person")return[];const{resolved:o}=await $(e),s=e.actor.node_scopes;return s===null?o:s.filter(n=>J(o,n))}if(e.class==="app")return e.scopes;if(e.class==="cron"){const o=await M({grantee:e.app,sub:e.sub,grant_id:e.grant,scopes:e.scopes});if(o.allowed)return o.effectiveScopes;throw o.reason==="grant_missing"||o.reason==="grant_revoked"?new c(401,"grant_revoked",o.message):new c(403,"scope_missing",o.message)}const t=e.grant?await B(e.grant):await x(e.app,e.sub);if(t&&t.grantee===e.app&&t.sub===e.sub)return t.resolved;if(e.app==="app:terminal"&&!P("user").runtime?.issuer)return I;throw new c(401,"grant_revoked","the node grant is not active")}u(v,"resolvedScopes");function k(e){return"class"in e?b(e):e.grantee}u(k,"runCallerApp");async function l(e,t,o){return t===void 0||!("class"in e)?!0:e.class==="cron"?await S({run:e.origin_run??"",isolated:e.isolated},e.app,t,o):e.class==="forwarded"?e.actor.kind!=="app"||await S(e.actor.place,e.actor.app,t,o):e.class!=="broker"?!0:await H(e.node,e.app,t,o)}u(l,"brokerMayReach");async function X(e,t,o){const s=k(e);if(s===t)return await l(e,o,t);if(s===null)return!0;const n="class"in e?null:await B(e.grant),r="class"in e?await v(e):n?.sub===e.sub&&n.grantee===e.grantee?n.resolved:[];return f(r,`crtr:conversations:read:${t}`)&&(!("class"in e)||!g(e)||f(e.scopes,`crtr:conversations:read:${t}`))}u(X,"canReadRun");async function Be(e,t,o=!1,s=!1){const n=await y(t);if(!n||n.parent!==null||n.run_id!==t||!n.grantee||n.deleting_at&&!s)throw new _(404,"not_found","run not found");if(!await X(e,n.grantee,t))throw new _(404,"not_found","run not found");if(o&&k(e)!==null&&k(e)!==n.grantee)throw new _(403,"other_app_run","cannot change another app's run");return await z(t,n.grantee,s)}u(Be,"requireRun");async function C(e,t,o){return q(e)?!0:e.class==="anonymous"||e.class==="machine"?!1:b(e)===t?await l(e,o,t):f(await v(e),`crtr:objects:read:${t}`)&&(!g(e)||f(e.scopes,`crtr:objects:read:${t}`))}u(C,"canReadNode");const K=new Set(["messages.post.58","messages.post.59"]);async function Q(e,t,o){if(!e.classes.includes(t.class)&&!(t.class!=="anonymous"&&t.class!=="machine"&&t.class!=="forwarded"&&e.classes.includes("anonymous")))throw new c(403,"permission_error","this operation is not available to the caller");if(t.class==="forwarded"&&t.actor.kind==="app"&&await $(t),t.class==="person"||t.class==="anonymous"||t.class==="machine"||q(t))return;const s=await v(t);if(e.scope&&(!f(s,e.scope)||g(t)&&!f(t.scopes,e.scope)))throw new c(403,"scope_missing",`missing scope ${e.scope}`);if(t.class==="app")return;const n=b(t);t.class==="broker"&&await Z(e,t,o,s);const r=o.id;if((e.resource==="node-read"||e.resource==="node-write")&&r!==void 0){const a=await y(r);if(!a)return;if(e.resource==="node-write"&&a.grantee!==n&&!(K.has(e.name)&&f(s,`crtr:objects:message:${a.grantee??"app:terminal"}`)))throw new c(403,"other_app_run","cannot change another app's node");if(e.resource==="node-write"&&!await l(t,r,a.grantee??"app:terminal"))throw new c(404,"not_found","node not found");if(e.resource==="node-read"&&!await C(t,a.grantee??"app:terminal",r))throw new c(404,"not_found","node not found")}}u(Q,"authorizeOperation");async function Z(e,t,o,s){if(e.resource==="daemon-bash"&&(!f(s,"crtr:files:rw:user:.")||!f(t.scopes,"crtr:files:rw:user:.")))throw new c(403,"scope_missing","missing scope crtr:files:rw:user:.");if(e.resource==="human"){const r=e.path,a=e.method==="GET";if(!a&&(r.endsWith("/respond")||r.endsWith("/submit")||r.endsWith("/dismiss")||r.endsWith("/progress")||r.endsWith("/comment-ranges")||r.includes("/feedback-comments")))throw new c(403,"permission_error","only the person may answer or edit the human inbox");const d=o.request_id?await Y(o.request_id):o.ticket_id?await V(o.ticket_id):null,h=o.comment_id?await O(o.comment_id):null,i=o.review_id?await R(o.review_id):h?await R(h.review_id):null,w=d?.requester_node_id??i?.origin_node_id;if(w!=null){const m=await y(w);if(m&&(a?!await C(t,m.grantee??"app:terminal",w):m.grantee!==t.app))throw new c(a?404:403,a?"not_found":"other_app_run","human request belongs to another app");if(m&&!a&&!await l(t,w,m.grantee??"app:terminal"))throw new c(404,"not_found","human request not found")}else if(d||i)throw new c(403,"permission_error","only the person may access a request without a node")}const n=o.id;if(e.resource==="node-own"&&n!==void 0&&n!==t.node)throw new c(403,"other_app_run","the operation requires the calling node")}u(Z,"authorizeBrokerOnly");function ee(e,t){if(!f(e,t))throw new N("the bearer token",t)}u(ee,"assertCeiling");function te(){return new c(403,"owner_only","this operation is owner-only; a scoped token does not reach it")}u(te,"ownerOnlyError");function xe(e){return e.map(t=>({...t,ownerOnly:!0}))}u(xe,"ownerOnly");class Se{static{u(this,"Router")}routes=[];register(t){const o=L(t.method,t.pattern);if(!o)throw new Error(`route has no operation row: ${t.method} ${t.pattern}`);if(this.routes.some(s=>s.method===t.method.toUpperCase()&&s.operation.path===t.pattern))throw new Error(`duplicate route: ${t.method} ${t.pattern}`);return this.routes.push({operation:o,method:t.method.toUpperCase(),segments:A(t.pattern),handler:t.handler,maxBodyBytes:t.maxBodyBytes??F}),this}registerAll(t){for(const o of t)this.register(o);return this}match(t,o){const s=t.toUpperCase(),n=A(o);for(const r of this.routes){if(r.method!==s)continue;const a=oe(r.segments,n);if(a!==null)return{handler:r.handler,params:a,operation:r.operation,maxBodyBytes:r.maxBodyBytes}}return null}async handle(t,o,s,n={class:"person"}){try{const r=new URL(t.url??"/","http://127.0.0.1"),a=(t.method??"GET").toUpperCase(),d=this.match(a,r.pathname);if(d===null){U(o,404,"not_found",`no route for ${a} ${r.pathname}`);return}if(await Q(d.operation,n,d.params),s!==null){if(d.operation.classes.length===1&&d.operation.classes[0]==="person")throw te();d.operation.scope&&ee(s,d.operation.scope)}let h;try{h=await ne(t,d.maxBodyBytes)}catch(m){const E=m instanceof T?"payload_too_large":"invalid_request";U(o,E==="payload_too_large"?413:400,E,m.message);return}n.class==="broker"&&d.operation.resource==="human"&&await D(d.operation,n,d.params,r.searchParams,h);const i={method:a,path:r.pathname,params:d.params,query:r.searchParams,body:h,ceiling:s,principal:n,...n.class==="anonymous"&&typeof t.headers.authorization=="string"?{publishToken:t.headers.authorization.slice(7)}:{},req:t,res:o},w=await d.handler(i);o.writableEnded||re(o,w)}catch(r){const{status:a,body:d}=j(r);a>=500&&p({event:"api.request.failed",level:"error",error:r instanceof Error?r:new Error(String(r)),...n.class==="broker"?{node_id:n.node}:{},fields:{method:(t.method??"GET").toUpperCase(),path:t.url??""}}),G(o,a,d)}}}function A(e){return e.split("/").filter(t=>t.length>0)}u(A,"splitPath");function oe(e,t){if(e.length!==t.length)return null;const o={};for(let s=0;s<e.length;s++){const n=e[s],r=t[s];if(n.startsWith(":"))o[n.slice(1)]=decodeURIComponent(r);else if(n!==r)return null}return o}u(oe,"matchSegments");class T extends Error{static{u(this,"BodyTooLargeError")}}async function ne(e,t){const o=[];let s=0;for await(const r of e){const a=r;if(s+=a.length,s>t)throw new T(`request body exceeds ${t} bytes`);o.push(a)}if(s===0)return;const n=Buffer.concat(o).toString("utf8").trim();if(n!=="")try{return JSON.parse(n)}catch{throw new Error("request body is not valid JSON")}}u(ne,"readJsonBody");function re(e,t){if(e.headersSent)return;const o={...t.headers??{}};if(t.rawBody!==void 0){e.writeHead(t.status,o),e.end(t.rawBody);return}if(t.status===204||t.body===void 0){e.writeHead(t.status,o),e.end();return}o["content-type"]===void 0&&(o["content-type"]="application/json; charset=utf-8"),e.writeHead(t.status,o),e.end(JSON.stringify(t.body))}u(re,"writeResult");function G(e,t,o){if(e.headersSent){e.end();return}e.writeHead(t,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify(o))}u(G,"writeJson");function U(e,t,o,s){G(e,t,{error:{code:o,message:s,origin:"runtime"}})}u(U,"writeError");export{Se as Router,q as actsAsPerson,b as appOf,ee as assertCeiling,l as brokerMayReach,C as canReadNode,X as canReadRun,xe as ownerOnly,te as ownerOnlyError,Be as requireRun,v as resolvedScopes,k as runCallerApp};
+var j=Object.defineProperty;var u=(e,t)=>j(e,"name",{value:t,configurable:!0});import{toErrorBody as N}from"./map.js";import{emitEvent as U}from"../../core/events/emit.js";import{scopeAllowed as f,ScopeDeniedError as J}from"../../core/scopes.js";import{coveredByAny as p}from"../../shared/env.js";import{ApiError as c}from"../../api/errors.js";import{activeGrant as B,grantFor as S}from"../../core/grants/mirror.js";import{getNode as y}from"../../core/canvas/canvas.js";import{ownedRun as z,RunError as g}from"../../core/runs/operations.js";import{nodeMayReach as H,placeMayReach as R}from"../../core/runs/confinement.js";import{checkCronFire as M}from"../cron/authority.js";import{operationFor as I}from"./operations.js";import{CONTROL_BODY_MAX_BYTES as P}from"../../core/llm/body-limits.js";import{getRequest as F,getRequestByInboxTicket as L}from"../../core/human/requests.js";import{requireVisibleReview as q}from"../../core/review/store.js";import{getComment as O}from"../../core/review/comments.js";async function Y(e,t,o,s,r){const n=e.path,a=r&&typeof r=="object"&&!Array.isArray(r)?r:{};if(n==="/v1/human/requests"||n==="/v1/human/reviews"){const d=n.endsWith("/reviews")?a.origin_node_id:a.requester_node_id,h=n==="/v1/human/requests"&&d==null;if(d!==t.node&&!h)throw new c(403,"other_app_run","a broker may create a human request only for its own node");const i=a.source;if(i&&typeof i=="object"&&"nodeId"in i&&i.nodeId!==t.node)throw new c(403,"other_app_run","request source must name the calling node")}if(n==="/v1/human/reviews/self/comments"&&e.method==="GET"&&s.get("actor_node_id")!==t.node)throw new c(403,"other_app_run","self review requires the calling node");if(n.includes("/comments")&&e.method!=="GET"&&a.actor_node_id!==t.node)throw new c(403,"other_app_run","comment author must be the calling node");if(o.comment_id&&!await O(o.comment_id))throw new c(404,"not_found","comment not found")}u(Y,"authorizeHumanBody");function _(e){return e.class==="broker"||e.class==="cron"}u(_,"boundedByStoredScopes");function b(e){return e.class==="person"||e.class==="anonymous"||e.class==="machine"?null:e.class==="forwarded"?e.actor.kind==="app"?e.actor.app:null:e.app}u(b,"appOf");function $(e){return e.class==="person"||e.class==="forwarded"&&e.actor.kind==="person"}u($,"actsAsPerson");async function A(e){const t=await S(e.actor.app,e.sub);if(!t)throw new c(403,"app_not_granted",`${e.actor.app} holds no active grant for ${e.sub} on this machine`);return t}u(A,"forwardedGrant");async function v(e){if(e.class==="person"||e.class==="anonymous"||e.class==="machine")return[];if(e.class==="forwarded"){if(e.actor.kind==="person")return[];const{resolved:o}=await A(e),s=e.actor.node_scopes;return s===null?o:s.filter(r=>p(o,r))}if(e.class==="app")return e.scopes;if(e.class==="cron"){const o=await M({grantee:e.app,sub:e.sub,grant_id:e.grant,scopes:e.scopes});if(o.allowed)return o.effectiveScopes;throw o.reason==="grant_missing"||o.reason==="grant_revoked"?new c(401,"grant_revoked",o.message):new c(403,"scope_missing",o.message)}const t=e.grant?await B(e.grant):await S(e.app,e.sub);if(t&&t.grantee===e.app&&t.sub===e.sub)return t.resolved;throw new c(401,"grant_revoked","the node grant is not active")}u(v,"resolvedScopes");function k(e){return"class"in e?b(e):e.grantee}u(k,"runCallerApp");async function l(e,t,o){return t===void 0||!("class"in e)?!0:e.class==="cron"?await R({run:e.origin_run??"",isolated:e.isolated},e.app,t,o):e.class==="forwarded"?e.actor.kind!=="app"||await R(e.actor.place,e.actor.app,t,o):e.class!=="broker"?!0:await H(e.node,e.app,t,o)}u(l,"brokerMayReach");async function D(e,t,o){const s=k(e);if(s===t)return await l(e,o,t);if(s===null)return!0;const r="class"in e?null:await B(e.grant),n="class"in e?await v(e):r?.sub===e.sub&&r.grantee===e.grantee?r.resolved:[];return f(n,`crtr:conversations:read:${t}`)&&(!("class"in e)||!_(e)||f(e.scopes,`crtr:conversations:read:${t}`))}u(D,"canReadRun");async function be(e,t,o=!1,s=!1){const r=await y(t);if(!r||r.parent!==null||r.run_id!==t||!r.grantee||r.deleting_at&&!s)throw new g(404,"not_found","run not found");if(!await D(e,r.grantee,t))throw new g(404,"not_found","run not found");if(o&&k(e)!==null&&k(e)!==r.grantee)throw new g(403,"other_app_run","cannot change another app's run");return await z(t,r.grantee,s)}u(be,"requireRun");async function C(e,t,o){return $(e)?!0:e.class==="anonymous"||e.class==="machine"?!1:b(e)===t?await l(e,o,t):f(await v(e),`crtr:objects:read:${t}`)&&(!_(e)||f(e.scopes,`crtr:objects:read:${t}`))}u(C,"canReadNode");const V=new Set(["messages.post.58","messages.post.59"]);async function X(e,t,o){if(!e.classes.includes(t.class)&&!(t.class!=="anonymous"&&t.class!=="machine"&&t.class!=="forwarded"&&e.classes.includes("anonymous")))throw new c(403,"permission_error","this operation is not available to the caller");if(t.class==="forwarded"&&t.actor.kind==="app"&&await A(t),t.class==="person"||t.class==="anonymous"||t.class==="machine"||$(t))return;const s=await v(t);if(e.scope&&(!f(s,e.scope)||_(t)&&!f(t.scopes,e.scope)))throw new c(403,"scope_missing",`missing scope ${e.scope}`);if(t.class==="app")return;const r=b(t);t.class==="broker"&&await K(e,t,o,s);const n=o.id;if((e.resource==="node-read"||e.resource==="node-write")&&n!==void 0){const a=await y(n);if(!a)return;if(e.resource==="node-write"&&a.grantee!==r&&!(V.has(e.name)&&f(s,`crtr:objects:message:${a.grantee??"app:terminal"}`)))throw new c(403,"other_app_run","cannot change another app's node");if(e.resource==="node-write"&&!await l(t,n,a.grantee??"app:terminal"))throw new c(404,"not_found","node not found");if(e.resource==="node-read"&&!await C(t,a.grantee??"app:terminal",n))throw new c(404,"not_found","node not found")}}u(X,"authorizeOperation");async function K(e,t,o,s){if(e.resource==="daemon-bash"&&(!f(s,"crtr:files:rw:user:.")||!f(t.scopes,"crtr:files:rw:user:.")))throw new c(403,"scope_missing","missing scope crtr:files:rw:user:.");if(e.resource==="human"){const n=e.path,a=e.method==="GET";if(!a&&(n.endsWith("/respond")||n.endsWith("/submit")||n.endsWith("/dismiss")||n.endsWith("/progress")||n.endsWith("/comment-ranges")||n.includes("/feedback-comments")))throw new c(403,"permission_error","only the person may answer or edit the human inbox");const d=o.request_id?await F(o.request_id):o.ticket_id?await L(o.ticket_id):null,h=o.comment_id?await O(o.comment_id):null,i=o.review_id?await q(o.review_id):h?await q(h.review_id):null,w=d?.requester_node_id??i?.origin_node_id;if(w!=null){const m=await y(w);if(m&&(a?!await C(t,m.grantee??"app:terminal",w):m.grantee!==t.app))throw new c(a?404:403,a?"not_found":"other_app_run","human request belongs to another app");if(m&&!a&&!await l(t,w,m.grantee??"app:terminal"))throw new c(404,"not_found","human request not found")}else if(d||i)throw new c(403,"permission_error","only the person may access a request without a node")}const r=o.id;if(e.resource==="node-own"&&r!==void 0&&r!==t.node)throw new c(403,"other_app_run","the operation requires the calling node")}u(K,"authorizeBrokerOnly");function Q(e,t){if(!f(e,t))throw new J("the bearer token",t)}u(Q,"assertCeiling");function Z(){return new c(403,"owner_only","this operation is owner-only; a scoped token does not reach it")}u(Z,"ownerOnlyError");function ve(e){return e.map(t=>({...t,ownerOnly:!0}))}u(ve,"ownerOnly");class ke{static{u(this,"Router")}routes=[];register(t){const o=I(t.method,t.pattern);if(!o)throw new Error(`route has no operation row: ${t.method} ${t.pattern}`);if(this.routes.some(s=>s.method===t.method.toUpperCase()&&s.operation.path===t.pattern))throw new Error(`duplicate route: ${t.method} ${t.pattern}`);return this.routes.push({operation:o,method:t.method.toUpperCase(),segments:T(t.pattern),handler:t.handler,maxBodyBytes:t.maxBodyBytes??P}),this}registerAll(t){for(const o of t)this.register(o);return this}match(t,o){const s=t.toUpperCase(),r=T(o);for(const n of this.routes){if(n.method!==s)continue;const a=ee(n.segments,r);if(a!==null)return{handler:n.handler,params:a,operation:n.operation,maxBodyBytes:n.maxBodyBytes}}return null}async handle(t,o,s,r={class:"person"}){try{const n=new URL(t.url??"/","http://127.0.0.1"),a=(t.method??"GET").toUpperCase(),d=this.match(a,n.pathname);if(d===null){W(o,404,"not_found",`no route for ${a} ${n.pathname}`);return}if(await X(d.operation,r,d.params),s!==null){if(d.operation.classes.length===1&&d.operation.classes[0]==="person")throw Z();d.operation.scope&&Q(s,d.operation.scope)}let h;try{h=await te(t,d.maxBodyBytes)}catch(m){const x=m instanceof G?"payload_too_large":"invalid_request";W(o,x==="payload_too_large"?413:400,x,m.message);return}r.class==="broker"&&d.operation.resource==="human"&&await Y(d.operation,r,d.params,n.searchParams,h);const i={method:a,path:n.pathname,params:d.params,query:n.searchParams,body:h,ceiling:s,principal:r,...r.class==="anonymous"&&typeof t.headers.authorization=="string"?{publishToken:t.headers.authorization.slice(7)}:{},req:t,res:o},w=await d.handler(i);o.writableEnded||oe(o,w)}catch(n){if(n instanceof Error&&n.code==="person_unresolved"){E(o,503,{error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}});return}const{status:a,body:d}=N(n);a>=500&&U({event:"api.request.failed",level:"error",error:n instanceof Error?n:new Error(String(n)),...r.class==="broker"?{node_id:r.node}:{},fields:{method:(t.method??"GET").toUpperCase(),path:t.url??""}}),E(o,a,d)}}}function T(e){return e.split("/").filter(t=>t.length>0)}u(T,"splitPath");function ee(e,t){if(e.length!==t.length)return null;const o={};for(let s=0;s<e.length;s++){const r=e[s],n=t[s];if(r.startsWith(":"))o[r.slice(1)]=decodeURIComponent(n);else if(r!==n)return null}return o}u(ee,"matchSegments");class G extends Error{static{u(this,"BodyTooLargeError")}}async function te(e,t){const o=[];let s=0;for await(const n of e){const a=n;if(s+=a.length,s>t)throw new G(`request body exceeds ${t} bytes`);o.push(a)}if(s===0)return;const r=Buffer.concat(o).toString("utf8").trim();if(r!=="")try{return JSON.parse(r)}catch{throw new Error("request body is not valid JSON")}}u(te,"readJsonBody");function oe(e,t){if(e.headersSent)return;const o={...t.headers??{}};if(t.rawBody!==void 0){e.writeHead(t.status,o),e.end(t.rawBody);return}if(t.status===204||t.body===void 0){e.writeHead(t.status,o),e.end();return}o["content-type"]===void 0&&(o["content-type"]="application/json; charset=utf-8"),e.writeHead(t.status,o),e.end(JSON.stringify(t.body))}u(oe,"writeResult");function E(e,t,o){if(e.headersSent){e.end();return}e.writeHead(t,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify(o))}u(E,"writeJson");function W(e,t,o,s){E(e,t,{error:{code:o,message:s,origin:"runtime"}})}u(W,"writeError");export{ke as Router,$ as actsAsPerson,b as appOf,Q as assertCeiling,l as brokerMayReach,C as canReadNode,D as canReadRun,ve as ownerOnly,Z as ownerOnlyError,be as requireRun,v as resolvedScopes,k as runCallerApp};

package/dist/daemon/api/vendor-signin.js

@@ -1,4 +1,4 @@
-var A=Object.defineProperty;var o=(e,t)=>A(e,"name",{value:t,configurable:!0});import{randomBytes as E}from"node:crypto";import{joinedOwner as O}from"../../core/directory/join.js";import{consumeHandoffJti as j,handoffJtiConsumed as C}from"../../core/model-auth/handoff-jti.js";import{completeModelAuthFlow as P,modelAuthProvider as N,readModelAuthFlow as y,startModelAuthFlow as R,waitModelAuthFlow as H}from"../../core/model-auth/flows.js";import{RunError as d}from"../../core/runs/operations.js";import{LONG_POLL_MAX_WAIT_SECONDS as I}from"../../api/long-poll.js";const c="/signin/vendor",M=900,V=I*1e3,D="https://chatgpt.com/#settings/Security";function d1(e){return e===c||e.startsWith(`${c}/`)}o(d1,"isVendorSignInPath");function f(){return new d(401,"unauthorized","invalid vendor sign-in handoff")}o(f,"unauthorized");async function z(e,t){const n=await e.verifyHandoff(t);let r;try{r=O()}catch{r=null}if(n.sub!==r)throw f();return n}o(z,"verifyOwnerHandoff");function B(e){const t=e.headers.authorization;return t?.startsWith("Bearer ")&&t.length>7?t.slice(7):void 0}o(B,"bearer");function w(e,t){const n=e.getAll(t);return n.length===1?n[0]:void 0}o(w,"single");function F(e,t,n){const r=new URL(e);return r.searchParams.set("status",t),n&&r.searchParams.set("reason",n.slice(0,200)),r.toString()}o(F,"returnUrl");function u(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}o(u,"escapeHtml");function x(e,t,n){e.writeHead(t,{"Content-Type":"application/json; charset=utf-8","Cache-Control":"no-store"}),e.end(JSON.stringify(n))}o(x,"sendJson");async function G(e){const t=[];let n=0;for await(const i of e){if(n+=i.length,n>64*1024)throw new d(400,"invalid_request","request body too large");t.push(i)}let r;try{r=JSON.parse(Buffer.concat(t).toString("utf8"))}catch{throw new d(400,"invalid_request","invalid JSON body")}if(typeof r!="object"||r===null||Array.isArray(r))throw new d(400,"invalid_request","request body must be a JSON object");return r}o(G,"jsonBody");const U=`
+var O=Object.defineProperty;var i=(e,t)=>O(e,"name",{value:t,configurable:!0});import{randomBytes as E}from"node:crypto";import{joinedOwner as j}from"../../core/directory/join.js";import{consumeHandoffJti as P,handoffJtiConsumed as C}from"../../core/model-auth/handoff-jti.js";import{completeModelAuthFlow as N,modelAuthProvider as R,readModelAuthFlow as y,startModelAuthFlow as H,waitModelAuthFlow as I}from"../../core/model-auth/flows.js";import{emitEvent as f}from"../../core/events/emit.js";import{RunError as d}from"../../core/runs/operations.js";import{LONG_POLL_MAX_WAIT_SECONDS as V}from"../../api/long-poll.js";const c="/signin/vendor",M=900,D=V*1e3,B="https://chatgpt.com/#settings/Security";function h1(e){return e===c||e.startsWith(`${c}/`)}i(h1,"isVendorSignInPath");function u(){return new d(401,"unauthorized","invalid vendor sign-in handoff")}i(u,"unauthorized");async function z(e,t){const n=await e.verifyHandoff(t);let r;try{r=j()}catch{r=null}if(n.sub!==r)throw u();return n}i(z,"verifyOwnerHandoff");function F(e){const t=e.headers.authorization;return t?.startsWith("Bearer ")&&t.length>7?t.slice(7):void 0}i(F,"bearer");function w(e,t){const n=e.getAll(t);return n.length===1?n[0]:void 0}i(w,"single");function G(e,t,n){const r=new URL(e);return r.searchParams.set("status",t),n&&r.searchParams.set("reason",n.slice(0,200)),r.toString()}i(G,"returnUrl");function m(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}i(m,"escapeHtml");function x(e,t,n){e.writeHead(t,{"Content-Type":"application/json; charset=utf-8","Cache-Control":"no-store"}),e.end(JSON.stringify(n))}i(x,"sendJson");async function U(e){const t=[];let n=0;for await(const o of e){if(n+=o.length,n>64*1024)throw new d(400,"invalid_request","request body too large");t.push(o)}let r;try{r=JSON.parse(Buffer.concat(t).toString("utf8"))}catch{throw new d(400,"invalid_request","invalid JSON body")}if(typeof r!="object"||r===null||Array.isArray(r))throw new d(400,"invalid_request","request body must be a JSON object");return r}i(U,"jsonBody");const J=`
 :root{color-scheme:light dark;
 --canvas:#f0f2f4;--surface:#fff;--sunken:#e5e7ea;--zone:#e5e7ea;--neutral:#e5e7ea;--neutral-hover:#d7d9dc;--neutral-pressed:#cbcdd0;
 --accent:#217f51;--accent-hover:#1e6e46;--accent-pressed:#1a5e3c;--accent-border:#217f51;--accent-subtle:#d5f7e1;--accent-fg:#1e6e46;--on-accent:#fff;
@@ -84,7 +84,7 @@ form{display:flex;flex-direction:column;gap:.75rem}
 @keyframes spin{to{transform:rotate(360deg)}}
 @media (min-width:40rem){.top{padding:0 1.5rem}main{padding:3.5rem 1rem}}
 @media (max-width:30rem){.card{padding:1.25rem}.btn{padding-left:.875rem;padding-right:.875rem}#device-link{font-size:.84375rem}.steps>li{gap:.75rem}.alert .act{margin-left:1.875rem}}
-`,J=`
+`,Z=`
 (function(){
 var cfg=JSON.parse(document.getElementById('cfg').textContent);
 history.replaceState(null,'',location.pathname);
@@ -147,20 +147,20 @@ if(cfg.kind==='anthropic'){
   })();
 }
 })();
-`,Z={arrow:'<path d="M7 7h10v10"/><path d="M7 17 17 7"/>',copy:'<rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/>',clock:'<circle cx="12" cy="12" r="10"/><path d="M12 6v6l4 2"/>',warn:'<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/>',alert:'<circle cx="12" cy="12" r="10"/><path d="M12 8v4"/><path d="M12 16h.01"/>',check:'<path d="M20 6 9 18l-5-5"/>'};function s(e,t=""){return`<svg class="ic${t}" viewBox="0 0 24 24" aria-hidden="true" focusable="false">${Z[e]}</svg>`}o(s,"icon");const q='<svg viewBox="-77.5 12 931 931" aria-hidden="true" focusable="false"><path fill="currentColor" d="M234 294m0 0h2l-1 5-6 16-5 15-6 25-4 23-2 22-1 5v47l5 38 5 26 6 22 10 24 8 16 9 14 14 19 13 16 11 13 9 11 11 12 7 8 13 16 11 14 14 19 12 19 12 23 7 17 6 23 3 14 3-1 5-15 20-84 6-24 6-21 10-33 10-25 8-16 8-15 8-12 9-12 8-10 9-10 7-8 6-7 20-20h2l2-4 17-17 7-8 10-13 14-21 8-16 8-18 5-15 2-7 2 1 6 36 2 18v41l-4 28-5 19-7 19-10 21-8 13-10 15-13 17-11 13-12 14-9 10-7 8-9 11h-2l-2 4-9 11-14 19-8 12-15 25-11 21-12 26-9 23-5 12-13 38-12 39-5 18-5 17h-2l-9-29-9-27-14-38-13-29-8-16-11-18-10-13-7-9-25-25-3-2v-2l-3-1v-2l-4-2-10-9-8-7-14-12-20-18-13-13-9-11-12-16-12-20-12-25-7-19-6-23-4-24-1-11-1-3v-39l3-23 6-27 7-23 5-11 11-23 9-16 10-14 8-11 9-11 10-11zM430 22m0 0h2v2h2l7 8 10 11 9 11 12 16 9 15 8 16 6 15 5 19 2 11 1 12v18l-1 16-5 24-5 16-7 15-9 17-7 11-10 15-10 13-9 11-13 14-7 8-11 12-7 8-13 16-11 15-13 20-10 18-8 16-7 18-5 15-4 18-2 14-1 27 2 24 3 17 5 23 8 30 12 36 9 28 3 8 4 12v2l-4-2-68-102-13-22-11-23-9-24-7-26-4-23-2-16v-31l3-25 6-27 7-21 7-15 8-16 14-21 11-14 26-30 12-13 8-10h2l2-4 10-11 7-9 14-19 7-10 13-24 7-19 4-15 3-14 3-22 2-24v-20l-2-31zM615 384m0 0 2 1 6 36 2 18v41l-4 28-5 19-7 19-10 21-8 13-10 15-13 17-11 13-12 14-9 10-7 8-9 11h-2l-2 4-9 11-14 19-8 12-15 25-11 21-2 5h-3l-2 2h-13l-6-5-11-6 1-9h-2l2-14-2 3 1-8 9-36 6-21 10-33 10-25 8-16 8-15 8-12 9-12 8-10 9-10 7-8 6-7 20-20h2l2-4 17-17 7-8 10-13 14-21 8-16 8-18 5-15zM557 254m0 0 2 1 4 16 2 16v34l-2 18-5 20-8 24-14 28-10 16-11 16-13 15-12 14-11 13-11 14-14 19-12 20-8 16-7 19-6 20-4 20-4 35-3 41-3 52-4 28-1 3h-2l-8-42-10-52-7-33-7-43v-54l4-24 5-17 8-20 10-19 7-10 10-13 9-11 19-19 8-7 16-15 8-7 9-9 8-7 11-11 1-2h2l2-4 11-13 10-14 11-17 9-19 8-21zM185 615m0 0 4 5 6 10 9 12 2 1 3 5 5-2 1-1h8l5 5 2 3 7 3 6 3 4 5 8 6 5 3v2h2v2h6l4 3 6 1 1 8 10 3 4 2 9 2 5 6 6 1h6l8 8 7 1 9 7h5l1-4-4-6-10-13-7-9-1-3h-2l-7-9v-3l7 6 7 9 11 14 14 19 12 19 12 23 7 17 6 23 3 14 3-1 5-15 10-42 5-22h2l1-4 1 4-1 8h-2l3 4-1 8 11 6 5 4h13l4-3-1 6-8 17-9 23-5 12-13 38-12 39-5 18-5 17h-2l-9-29-9-27-14-38-13-29-8-16-11-18-10-13-7-9-25-25-3-2v-2l-3-1v-2l-4-2-10-9-8-7-14-12-20-18-13-13-9-11-12-16-9-15zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1v7l1 2 1 15 7 1 5-2 5 1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21 4-21h1v10l-4 30-3 34-4 69-4 28-1 3h-2l-8-42-10-52-7-33-6-37zM430 22m0 0h2v2h2l7 8 10 11 9 11 4 5 1 5 2 4 1 7 2 2-1 3-5-1h-7l-8-2-5 1v7l-1 1h-5l-2-8-1-2-1-15h-2l-2-31zM417 598m0 0h1v10l-4 30-3 34-4 69-4 28-1 3h-2l-7-37-1-16h8l2 1v-2h2l1-2 2-35v-13l-2-3-3-5-1-8 1-9-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21zM417 598m0 0h1v10l-4 30-3 34-1 17h-2v15l-1 12h-1v-18l1-17v-13l-2-3-3-5-1-8 1-9-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21zM310 619m0 0 4 2 4 6 5 8 7 9 3 5 2-1 2 1 2 10 6-1 2 1v2h-5l3 7 9 13 6 9 3 1v-2l-4-14h3l5 16 3 8 4 12v2l-4-2-60-90zM255 597m0 0 5 3 12 16 9 11 11 13 9 11 11 12 4 5-1 3-7-7-4-1-7-4v-2l-4-2-4-4 4 1 3-1v-3l-5-2-3-5v-2h-2l-6-8v-2l-3-1-1-2-8-1 1-2-2-8-3-4v-2h-2l-4-6-3-4zM425 181m0 0 7 1 1 3 12 2 2 3 3 1v-2h3l1 3-6 2-1 3h-2v2h-2l-1 7-5 1-2-5 2-3h3l1-5-3 1-3 3-1-4-5-2v-5h-6l-3-3zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1v7l1 2 1 15 2 1h-2l3 13 2 10v5l-3-4-5-25-4-26zM340 614m0 0 1 2h2l6 20 6 18 3 15-2-1-5-15-2-4v-5h-6l-3-2-9-2 2-3v2l5-4h4 2l-1-5-3-12zM296 649m0 0 5 2 11 12 4 5-1 3-7-7-4-1-7-4v-2l-4-2-4-4 4 1 3-1zM403 625m0 0h2l2 11-1 8-2 7-2 1v-9l-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3zM417 598m0 0h1v10l-4 30-2 24h-1l-1-17h-2l1-4 1-1 3-21zM163 561m0 0 2 3 5 16 2 6 2 1 3 9 2 4 4-1 1-2 1 3h-2l-2 5 3 6-1 2-3-3-11-24-4-11-2-10zM439 685m0 0 1 2h9l3 4v6l7 2 3 7-4-1-6-4-5-4v-7h-9l-2-2zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1-1 7-2-2v-7h-2zM434 687m0 0h1v6l-3 9-7 29-4 5 1-8 9-36zM317 672m0 0 6 4 9 11 11 14 6 8v2l-4-2-10-13-7-9-1-3h-2l-7-9zM276 622m0 0 5 5 11 13 7 8-1 2-7-4-3-5v-2h-2l-6-8v-2l-3-1-2-4zM310 619m0 0 4 2 4 6 5 8 7 9-1 4-4-5-8-11-7-11zM416 172m0 0 2 1-1 7h-2v5l4-1-1 3-5 2-3-1v-7l4-8zM381 664m0 0 2 4 6 27v5l-1-2h-2l-5-24zM443 655m0 0 1 4-7 25-1 2h-2l1-7 6-22h2zM163 561m0 0 2 3 5 16 2 6 2 1v5l-2 1-7-18-2-10zM490 702m0 0 1 3-10 15-3 5-4 3v-5l5-5 7-11zM387 698m0 0 1 2h2l3 16v14h-1l-5-26zM426 139m0 0 1 3-1 5-7 22-2-1 2-9 5-18h2zM466 739m0 0h2l-1 6-8 15-3 1 2-7 7-12zM411 636m0 0h2v12l-1 14h-1l-1-17h-2l1-4zM349 645m0 0h3l3 9 3 15-2-1-5-15-2-4zM335 694m0 0 5 3 9 12v2l-4-2-10-13zM386 633m0 0 7 1-3 2-4 1-2 4h-4l-2-6h5zM547 287m0 0 3 2-3 7-1 5h-2l-1 4-2-1 1-5zM557 254m0 0 2 1 3 13-4-1 1-2h-2l-1 3-1-3zM560 311m0 0 3 1-2 5-3 6-9-3v-1l9-1zM409 664m0 0h1v25h-1l-2-24zM340 614m0 0 1 2h2l4 16-4-2-3-12zM438 705m0 0 10 2 1 7-3-1-4-4h-5zM502 685m0 0 1 3-8 11-3 1 2-5zM422 191m0 0 4 1 3 4-2 4-5-3zM359 675m0 0h3l4 13-1 4-4-9zM225 599m0 0 5 2 12 6-3 1-9-4-6-3zM255 597m0 0 5 3 6 8-1 2-3-1-4-6-3-4zM414 180m0 0h1v5l4-1-1 3-5 2-3-1 1-5zM341 665m0 0 3 1 6 9-1 4-8-12zM370 608m0 0h1l1 9 3 1-2 10h-1l-2-12zM439 671m0 0 1 2-4 13h-2l1-7 3-7zM341 658m0 0 6 1v2h-5l-1 5-3-3 1-4zM373 625m0 0h2l1 9 2 1h-2l-1 5h-1l-1-6zM185 615m0 0 4 5 5 8-1 3-4-5-4-7zM434 687m0 0h1v6l-3 9-2 3 1-13zM385 686m0 0h2l2 9v5l-1-2h-2l-1-5zM390 711m0 0h2l1 8v11h-1l-2-10zM355 657m0 0 2 3 4 12v3l-3-1-2-10zM413 624m0 0h1v14l-1-2h-2l1-11zM494 120m0 0h2l2 6v10l-2-3-2-9zM163 561m0 0 2 3 4 13-1 3v-2h-2l-3-13zM489 106m0 0h2l4 10-2 4-4-11zM230 609m0 0 5 1 4 5 3 2-6-1-3-3v-2l-3-1zM392 660m0 0h2v2h2l5 5 2 1-1 4-10-10zM254 615m0 0 8 1 1 1v5l-2-1v-2l-6-2zM190 587m0 0 6 1 2-1 4 2 1 3-13-2zM417 598m0 0h1v10l-1 5-2-1 1-9zM273 545m0 0 2 3 3 8v3h-2l-3-8z"/></svg>',W={claude:'<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false"><rect width="48" height="48" fill="#F3E9D7"/><path transform="translate(24 24) scale(.13) translate(-124 -124)" fill="#D97757" d="M52.4285 162.873L98.7844 136.879L99.5485 134.602L98.7844 133.334H96.4921L88.7237 132.862L62.2346 132.153L39.3113 131.207L17.0249 130.026L11.4214 128.844L6.2 121.873L6.7094 118.447L11.4214 115.257L18.171 115.847L33.0711 116.911L55.485 118.447L71.6586 119.392L95.728 121.873H99.5485L100.058 120.337L98.7844 119.392L97.7656 118.447L74.5877 102.732L49.4995 86.1905L36.3823 76.62L29.3779 71.7757L25.8121 67.2858L24.2839 57.3608L30.6515 50.2716L39.3113 50.8623L41.4763 51.4531L50.2636 58.1879L68.9842 72.7209L93.4357 90.6804L97.0015 93.6343L98.4374 92.6652L98.6571 91.9801L97.0015 89.2625L83.757 65.2772L69.621 40.8192L63.2534 30.6579L61.5978 24.632C60.9565 22.1032 60.579 20.0111 60.579 17.4246L67.8381 7.49965L71.9133 6.19995L81.7193 7.49965L85.7946 11.0443L91.9074 24.9865L101.714 46.8451L116.996 76.62L121.453 85.4816L123.873 93.6343L124.764 96.1155H126.292V94.6976L127.566 77.9197L129.858 57.3608L132.15 30.8942L132.915 23.4505L136.608 14.4708L143.994 9.62643L149.725 12.344L154.437 19.0788L153.8 23.4505L150.998 41.6463L145.522 70.1215L141.957 89.2625H143.994L146.414 86.7813L156.093 74.0206L172.266 53.698L179.398 45.6635L187.803 36.802L193.152 32.5484H203.34L210.726 43.6549L207.415 55.1159L196.972 68.3492L188.312 79.5739L175.896 96.2095L168.191 109.585L168.882 110.689L170.738 110.53L198.755 104.504L213.91 101.787L231.994 98.7149L240.144 102.496L241.036 106.395L237.852 114.311L218.495 119.037L195.826 123.645L162.07 131.592L161.696 131.893L162.137 132.547L177.36 133.925L183.855 134.279H199.774L229.447 136.524L237.215 141.605L241.8 147.867L241.036 152.711L229.065 158.737L213.019 154.956L175.45 145.977L162.587 142.787H160.805V143.85L171.502 154.366L191.242 172.089L215.82 195.011L217.094 200.682L213.91 205.172L210.599 204.699L188.949 188.394L180.544 181.069L161.696 165.118H160.422V166.772L164.752 173.152L187.803 207.771L188.949 218.405L187.294 221.832L181.308 223.959L174.813 222.777L161.187 203.754L147.305 182.486L136.098 163.345L134.745 164.2L128.075 235.42L125.019 239.082L117.887 241.8L111.902 237.31L108.718 229.984L111.902 215.452L115.722 196.547L118.779 181.541L121.58 162.873L123.291 156.636L123.14 156.219L121.773 156.449L107.699 175.752L86.304 204.699L69.3663 222.777L65.291 224.431L58.2867 220.768L58.9235 214.27L62.8713 208.48L86.304 178.705L100.44 160.155L109.551 149.507L109.462 147.967L108.959 147.924L46.6977 188.512L35.6182 189.93L30.7788 185.44L31.4156 178.115L33.7079 175.752L52.4285 162.873Z"/></svg>',chatgpt:'<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false"><rect width="48" height="48" fill="#0D0D0D"/><path transform="translate(24 24) scale(2.35) translate(-7.98 -8)" fill="#FFF" d="M12.9851 6.93777C13.1163 6.54364 13.1618 6.12607 13.1186 5.71295C13.0754 5.29983 12.9444 4.90072 12.7344 4.54231C12.4232 4.00021 11.9478 3.57101 11.3768 3.31664C10.8058 3.06227 10.1687 2.99589 9.55751 3.12706C9.28184 2.81639 8.943 2.56818 8.56362 2.39905C8.18425 2.22993 7.77314 2.14379 7.3578 2.1464C6.73292 2.1449 6.1237 2.34187 5.61797 2.70892C5.11225 3.07598 4.73616 3.59415 4.54391 4.18873C4.13684 4.27206 3.75225 4.44139 3.41591 4.68539C3.07957 4.92938 2.79924 5.24241 2.59368 5.60352C2.27994 6.14413 2.14602 6.77039 2.21123 7.39205C2.27644 8.01367 2.5374 8.59851 2.95649 9.06224C2.82527 9.45637 2.77975 9.87394 2.82297 10.2871C2.8662 10.7002 2.99718 11.0993 3.20713 11.4577C3.51841 11.9998 3.99385 12.4289 4.56484 12.6833C5.13584 12.9377 5.77289 13.0041 6.38407 12.8729C6.65975 13.1836 6.99862 13.4318 7.37796 13.601C7.75734 13.7701 8.16844 13.8562 8.58379 13.8536C9.20899 13.8552 9.81853 13.6582 10.3244 13.2909C10.8304 12.9236 11.2065 12.4051 11.3986 11.8101C11.8057 11.7268 12.1903 11.5575 12.5266 11.3135C12.8629 11.0695 13.1433 10.7564 13.3488 10.3953C13.6622 9.85477 13.7958 9.22866 13.7304 8.60726C13.6651 7.98587 13.4041 7.40129 12.9851 6.93777ZM8.58472 13.0883C8.0715 13.089 7.57441 12.9093 7.18031 12.5805C7.19808 12.5708 7.22925 12.5537 7.24956 12.5413L9.58061 11.1948C9.63911 11.1615 9.6877 11.1133 9.72136 11.055C9.75505 10.9967 9.77258 10.9305 9.77217 10.8632V7.57684L10.7575 8.14576C10.7626 8.14834 10.7671 8.15214 10.7704 8.15685C10.7738 8.16157 10.7759 8.16704 10.7766 8.17275V10.8943C10.7759 11.4756 10.5448 12.0329 10.1339 12.4441C9.72308 12.8554 9.16599 13.087 8.58472 13.0883ZM3.87091 11.075C3.61385 10.6309 3.5212 10.1105 3.60918 9.60485C3.62649 9.61524 3.65673 9.6337 3.67842 9.64617L6.00947 10.9926C6.06756 11.0266 6.13365 11.0445 6.20094 11.0445C6.2682 11.0445 6.33428 11.0266 6.39238 10.9926L9.23834 9.34936V10.4872C9.23867 10.493 9.23755 10.4988 9.23509 10.5041C9.23264 10.5094 9.22892 10.5139 9.22427 10.5174L6.86782 11.878C6.36379 12.1683 5.76516 12.2467 5.20333 12.0962C4.64148 11.9457 4.1623 11.5784 3.87091 11.075ZM3.25768 5.98617C3.51363 5.54141 3.91789 5.2009 4.39966 5.02421C4.39966 5.04429 4.39851 5.07985 4.39851 5.10452V7.79747C4.3981 7.86473 4.41561 7.93087 4.44924 7.98915C4.48287 8.04739 4.5314 8.09563 4.58984 8.1289L7.4358 9.77197L6.45054 10.3409C6.44568 10.3441 6.44009 10.346 6.43429 10.3465C6.4285 10.3471 6.42265 10.3462 6.41729 10.3439L4.06062 8.98216C3.55747 8.69077 3.19039 8.21176 3.03987 7.65013C2.88935 7.08853 2.96768 6.49014 3.25768 5.98617ZM11.3527 7.86994L8.50669 6.22667L9.49198 5.65799C9.49684 5.6548 9.50243 5.65283 9.50823 5.65231C9.51402 5.65178 9.51985 5.65272 9.5252 5.655L11.8819 7.01554C12.2429 7.2241 12.5371 7.53119 12.7299 7.90087C12.9228 8.27056 13.0063 8.68752 12.9707 9.10295C12.9351 9.51839 12.7819 9.91509 12.5291 10.2466C12.2762 10.5781 11.9341 10.8307 11.5428 10.9749C11.5428 10.9546 11.5428 10.919 11.5428 10.8943V8.20137C11.5434 8.13423 11.5261 8.06814 11.4926 8.0099C11.4592 7.95165 11.4109 7.90336 11.3527 7.86994ZM12.3333 6.394C12.316 6.38337 12.2858 6.36514 12.2641 6.3527L9.93303 5.00621C9.87493 4.97232 9.80887 4.95444 9.74158 4.95444C9.67432 4.95444 9.60824 4.97232 9.55014 5.00621L6.70418 6.64951V5.51167C6.70386 5.50585 6.70497 5.50005 6.70743 5.49479C6.70988 5.48952 6.7136 5.48492 6.71826 5.48144L9.0747 4.12203C9.4357 3.91387 9.84853 3.81281 10.2649 3.83068C10.6812 3.84856 11.0838 3.98462 11.4257 4.22296C11.7675 4.46129 12.0344 4.79204 12.1951 5.17652C12.3559 5.56099 12.4038 5.98327 12.3333 6.394ZM6.16851 8.42203L5.18299 7.85311C5.17784 7.85053 5.17336 7.84673 5.17002 7.84202C5.16668 7.8373 5.16455 7.83183 5.16385 7.82609V5.10452C5.16411 4.6877 5.28311 4.27956 5.5069 3.9279C5.73071 3.57623 6.05006 3.29559 6.42756 3.11883C6.80507 2.94206 7.22509 2.87649 7.63851 2.92977C8.05195 2.98306 8.44163 3.153 8.76197 3.41971C8.74421 3.42941 8.71327 3.44649 8.69272 3.45895L6.36168 4.80542C6.30317 4.83867 6.25462 4.8869 6.22093 4.94516C6.18727 5.0034 6.16974 5.06958 6.17012 5.13683L6.16851 8.42203ZM6.70371 7.26803L7.97126 6.53595L9.23878 7.26757V8.73127L7.97126 9.46292L6.70371 8.73127V7.26803Z"/></svg>'},k="team@northlight.ai";function $(e){const t=JSON.stringify(e.config).replace(/</g,"\\u003c");return`<!doctype html>
+`,q={arrow:'<path d="M7 7h10v10"/><path d="M7 17 17 7"/>',copy:'<rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/>',clock:'<circle cx="12" cy="12" r="10"/><path d="M12 6v6l4 2"/>',warn:'<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/>',alert:'<circle cx="12" cy="12" r="10"/><path d="M12 8v4"/><path d="M12 16h.01"/>',check:'<path d="M20 6 9 18l-5-5"/>'};function s(e,t=""){return`<svg class="ic${t}" viewBox="0 0 24 24" aria-hidden="true" focusable="false">${q[e]}</svg>`}i(s,"icon");const W='<svg viewBox="-77.5 12 931 931" aria-hidden="true" focusable="false"><path fill="currentColor" d="M234 294m0 0h2l-1 5-6 16-5 15-6 25-4 23-2 22-1 5v47l5 38 5 26 6 22 10 24 8 16 9 14 14 19 13 16 11 13 9 11 11 12 7 8 13 16 11 14 14 19 12 19 12 23 7 17 6 23 3 14 3-1 5-15 20-84 6-24 6-21 10-33 10-25 8-16 8-15 8-12 9-12 8-10 9-10 7-8 6-7 20-20h2l2-4 17-17 7-8 10-13 14-21 8-16 8-18 5-15 2-7 2 1 6 36 2 18v41l-4 28-5 19-7 19-10 21-8 13-10 15-13 17-11 13-12 14-9 10-7 8-9 11h-2l-2 4-9 11-14 19-8 12-15 25-11 21-12 26-9 23-5 12-13 38-12 39-5 18-5 17h-2l-9-29-9-27-14-38-13-29-8-16-11-18-10-13-7-9-25-25-3-2v-2l-3-1v-2l-4-2-10-9-8-7-14-12-20-18-13-13-9-11-12-16-12-20-12-25-7-19-6-23-4-24-1-11-1-3v-39l3-23 6-27 7-23 5-11 11-23 9-16 10-14 8-11 9-11 10-11zM430 22m0 0h2v2h2l7 8 10 11 9 11 12 16 9 15 8 16 6 15 5 19 2 11 1 12v18l-1 16-5 24-5 16-7 15-9 17-7 11-10 15-10 13-9 11-13 14-7 8-11 12-7 8-13 16-11 15-13 20-10 18-8 16-7 18-5 15-4 18-2 14-1 27 2 24 3 17 5 23 8 30 12 36 9 28 3 8 4 12v2l-4-2-68-102-13-22-11-23-9-24-7-26-4-23-2-16v-31l3-25 6-27 7-21 7-15 8-16 14-21 11-14 26-30 12-13 8-10h2l2-4 10-11 7-9 14-19 7-10 13-24 7-19 4-15 3-14 3-22 2-24v-20l-2-31zM615 384m0 0 2 1 6 36 2 18v41l-4 28-5 19-7 19-10 21-8 13-10 15-13 17-11 13-12 14-9 10-7 8-9 11h-2l-2 4-9 11-14 19-8 12-15 25-11 21-2 5h-3l-2 2h-13l-6-5-11-6 1-9h-2l2-14-2 3 1-8 9-36 6-21 10-33 10-25 8-16 8-15 8-12 9-12 8-10 9-10 7-8 6-7 20-20h2l2-4 17-17 7-8 10-13 14-21 8-16 8-18 5-15zM557 254m0 0 2 1 4 16 2 16v34l-2 18-5 20-8 24-14 28-10 16-11 16-13 15-12 14-11 13-11 14-14 19-12 20-8 16-7 19-6 20-4 20-4 35-3 41-3 52-4 28-1 3h-2l-8-42-10-52-7-33-7-43v-54l4-24 5-17 8-20 10-19 7-10 10-13 9-11 19-19 8-7 16-15 8-7 9-9 8-7 11-11 1-2h2l2-4 11-13 10-14 11-17 9-19 8-21zM185 615m0 0 4 5 6 10 9 12 2 1 3 5 5-2 1-1h8l5 5 2 3 7 3 6 3 4 5 8 6 5 3v2h2v2h6l4 3 6 1 1 8 10 3 4 2 9 2 5 6 6 1h6l8 8 7 1 9 7h5l1-4-4-6-10-13-7-9-1-3h-2l-7-9v-3l7 6 7 9 11 14 14 19 12 19 12 23 7 17 6 23 3 14 3-1 5-15 10-42 5-22h2l1-4 1 4-1 8h-2l3 4-1 8 11 6 5 4h13l4-3-1 6-8 17-9 23-5 12-13 38-12 39-5 18-5 17h-2l-9-29-9-27-14-38-13-29-8-16-11-18-10-13-7-9-25-25-3-2v-2l-3-1v-2l-4-2-10-9-8-7-14-12-20-18-13-13-9-11-12-16-9-15zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1v7l1 2 1 15 7 1 5-2 5 1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21 4-21h1v10l-4 30-3 34-4 69-4 28-1 3h-2l-8-42-10-52-7-33-6-37zM430 22m0 0h2v2h2l7 8 10 11 9 11 4 5 1 5 2 4 1 7 2 2-1 3-5-1h-7l-8-2-5 1v7l-1 1h-5l-2-8-1-2-1-15h-2l-2-31zM417 598m0 0h1v10l-4 30-3 34-4 69-4 28-1 3h-2l-7-37-1-16h8l2 1v-2h2l1-2 2-35v-13l-2-3-3-5-1-8 1-9-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21zM417 598m0 0h1v10l-4 30-3 34-1 17h-2v15l-1 12h-1v-18l1-17v-13l-2-3-3-5-1-8 1-9-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21zM310 619m0 0 4 2 4 6 5 8 7 9 3 5 2-1 2 1 2 10 6-1 2 1v2h-5l3 7 9 13 6 9 3 1v-2l-4-14h3l5 16 3 8 4 12v2l-4-2-60-90zM255 597m0 0 5 3 12 16 9 11 11 13 9 11 11 12 4 5-1 3-7-7-4-1-7-4v-2l-4-2-4-4 4 1 3-1v-3l-5-2-3-5v-2h-2l-6-8v-2l-3-1-1-2-8-1 1-2-2-8-3-4v-2h-2l-4-6-3-4zM425 181m0 0 7 1 1 3 12 2 2 3 3 1v-2h3l1 3-6 2-1 3h-2v2h-2l-1 7-5 1-2-5 2-3h3l1-5-3 1-3 3-1-4-5-2v-5h-6l-3-3zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1v7l1 2 1 15 2 1h-2l3 13 2 10v5l-3-4-5-25-4-26zM340 614m0 0 1 2h2l6 20 6 18 3 15-2-1-5-15-2-4v-5h-6l-3-2-9-2 2-3v2l5-4h4 2l-1-5-3-12zM296 649m0 0 5 2 11 12 4 5-1 3-7-7-4-1-7-4v-2l-4-2-4-4 4 1 3-1zM403 625m0 0h2l2 11-1 8-2 7-2 1v-9l-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3zM417 598m0 0h1v10l-4 30-2 24h-1l-1-17h-2l1-4 1-1 3-21zM163 561m0 0 2 3 5 16 2 6 2 1 3 9 2 4 4-1 1-2 1 3h-2l-2 5 3 6-1 2-3-3-11-24-4-11-2-10zM439 685m0 0 1 2h9l3 4v6l7 2 3 7-4-1-6-4-5-4v-7h-9l-2-2zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1-1 7-2-2v-7h-2zM434 687m0 0h1v6l-3 9-7 29-4 5 1-8 9-36zM317 672m0 0 6 4 9 11 11 14 6 8v2l-4-2-10-13-7-9-1-3h-2l-7-9zM276 622m0 0 5 5 11 13 7 8-1 2-7-4-3-5v-2h-2l-6-8v-2l-3-1-2-4zM310 619m0 0 4 2 4 6 5 8 7 9-1 4-4-5-8-11-7-11zM416 172m0 0 2 1-1 7h-2v5l4-1-1 3-5 2-3-1v-7l4-8zM381 664m0 0 2 4 6 27v5l-1-2h-2l-5-24zM443 655m0 0 1 4-7 25-1 2h-2l1-7 6-22h2zM163 561m0 0 2 3 5 16 2 6 2 1v5l-2 1-7-18-2-10zM490 702m0 0 1 3-10 15-3 5-4 3v-5l5-5 7-11zM387 698m0 0 1 2h2l3 16v14h-1l-5-26zM426 139m0 0 1 3-1 5-7 22-2-1 2-9 5-18h2zM466 739m0 0h2l-1 6-8 15-3 1 2-7 7-12zM411 636m0 0h2v12l-1 14h-1l-1-17h-2l1-4zM349 645m0 0h3l3 9 3 15-2-1-5-15-2-4zM335 694m0 0 5 3 9 12v2l-4-2-10-13zM386 633m0 0 7 1-3 2-4 1-2 4h-4l-2-6h5zM547 287m0 0 3 2-3 7-1 5h-2l-1 4-2-1 1-5zM557 254m0 0 2 1 3 13-4-1 1-2h-2l-1 3-1-3zM560 311m0 0 3 1-2 5-3 6-9-3v-1l9-1zM409 664m0 0h1v25h-1l-2-24zM340 614m0 0 1 2h2l4 16-4-2-3-12zM438 705m0 0 10 2 1 7-3-1-4-4h-5zM502 685m0 0 1 3-8 11-3 1 2-5zM422 191m0 0 4 1 3 4-2 4-5-3zM359 675m0 0h3l4 13-1 4-4-9zM225 599m0 0 5 2 12 6-3 1-9-4-6-3zM255 597m0 0 5 3 6 8-1 2-3-1-4-6-3-4zM414 180m0 0h1v5l4-1-1 3-5 2-3-1 1-5zM341 665m0 0 3 1 6 9-1 4-8-12zM370 608m0 0h1l1 9 3 1-2 10h-1l-2-12zM439 671m0 0 1 2-4 13h-2l1-7 3-7zM341 658m0 0 6 1v2h-5l-1 5-3-3 1-4zM373 625m0 0h2l1 9 2 1h-2l-1 5h-1l-1-6zM185 615m0 0 4 5 5 8-1 3-4-5-4-7zM434 687m0 0h1v6l-3 9-2 3 1-13zM385 686m0 0h2l2 9v5l-1-2h-2l-1-5zM390 711m0 0h2l1 8v11h-1l-2-10zM355 657m0 0 2 3 4 12v3l-3-1-2-10zM413 624m0 0h1v14l-1-2h-2l1-11zM494 120m0 0h2l2 6v10l-2-3-2-9zM163 561m0 0 2 3 4 13-1 3v-2h-2l-3-13zM489 106m0 0h2l4 10-2 4-4-11zM230 609m0 0 5 1 4 5 3 2-6-1-3-3v-2l-3-1zM392 660m0 0h2v2h2l5 5 2 1-1 4-10-10zM254 615m0 0 8 1 1 1v5l-2-1v-2l-6-2zM190 587m0 0 6 1 2-1 4 2 1 3-13-2zM417 598m0 0h1v10l-1 5-2-1 1-9zM273 545m0 0 2 3 3 8v3h-2l-3-8z"/></svg>',X={claude:'<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false"><rect width="48" height="48" fill="#F3E9D7"/><path transform="translate(24 24) scale(.13) translate(-124 -124)" fill="#D97757" d="M52.4285 162.873L98.7844 136.879L99.5485 134.602L98.7844 133.334H96.4921L88.7237 132.862L62.2346 132.153L39.3113 131.207L17.0249 130.026L11.4214 128.844L6.2 121.873L6.7094 118.447L11.4214 115.257L18.171 115.847L33.0711 116.911L55.485 118.447L71.6586 119.392L95.728 121.873H99.5485L100.058 120.337L98.7844 119.392L97.7656 118.447L74.5877 102.732L49.4995 86.1905L36.3823 76.62L29.3779 71.7757L25.8121 67.2858L24.2839 57.3608L30.6515 50.2716L39.3113 50.8623L41.4763 51.4531L50.2636 58.1879L68.9842 72.7209L93.4357 90.6804L97.0015 93.6343L98.4374 92.6652L98.6571 91.9801L97.0015 89.2625L83.757 65.2772L69.621 40.8192L63.2534 30.6579L61.5978 24.632C60.9565 22.1032 60.579 20.0111 60.579 17.4246L67.8381 7.49965L71.9133 6.19995L81.7193 7.49965L85.7946 11.0443L91.9074 24.9865L101.714 46.8451L116.996 76.62L121.453 85.4816L123.873 93.6343L124.764 96.1155H126.292V94.6976L127.566 77.9197L129.858 57.3608L132.15 30.8942L132.915 23.4505L136.608 14.4708L143.994 9.62643L149.725 12.344L154.437 19.0788L153.8 23.4505L150.998 41.6463L145.522 70.1215L141.957 89.2625H143.994L146.414 86.7813L156.093 74.0206L172.266 53.698L179.398 45.6635L187.803 36.802L193.152 32.5484H203.34L210.726 43.6549L207.415 55.1159L196.972 68.3492L188.312 79.5739L175.896 96.2095L168.191 109.585L168.882 110.689L170.738 110.53L198.755 104.504L213.91 101.787L231.994 98.7149L240.144 102.496L241.036 106.395L237.852 114.311L218.495 119.037L195.826 123.645L162.07 131.592L161.696 131.893L162.137 132.547L177.36 133.925L183.855 134.279H199.774L229.447 136.524L237.215 141.605L241.8 147.867L241.036 152.711L229.065 158.737L213.019 154.956L175.45 145.977L162.587 142.787H160.805V143.85L171.502 154.366L191.242 172.089L215.82 195.011L217.094 200.682L213.91 205.172L210.599 204.699L188.949 188.394L180.544 181.069L161.696 165.118H160.422V166.772L164.752 173.152L187.803 207.771L188.949 218.405L187.294 221.832L181.308 223.959L174.813 222.777L161.187 203.754L147.305 182.486L136.098 163.345L134.745 164.2L128.075 235.42L125.019 239.082L117.887 241.8L111.902 237.31L108.718 229.984L111.902 215.452L115.722 196.547L118.779 181.541L121.58 162.873L123.291 156.636L123.14 156.219L121.773 156.449L107.699 175.752L86.304 204.699L69.3663 222.777L65.291 224.431L58.2867 220.768L58.9235 214.27L62.8713 208.48L86.304 178.705L100.44 160.155L109.551 149.507L109.462 147.967L108.959 147.924L46.6977 188.512L35.6182 189.93L30.7788 185.44L31.4156 178.115L33.7079 175.752L52.4285 162.873Z"/></svg>',chatgpt:'<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false"><rect width="48" height="48" fill="#0D0D0D"/><path transform="translate(24 24) scale(2.35) translate(-7.98 -8)" fill="#FFF" d="M12.9851 6.93777C13.1163 6.54364 13.1618 6.12607 13.1186 5.71295C13.0754 5.29983 12.9444 4.90072 12.7344 4.54231C12.4232 4.00021 11.9478 3.57101 11.3768 3.31664C10.8058 3.06227 10.1687 2.99589 9.55751 3.12706C9.28184 2.81639 8.943 2.56818 8.56362 2.39905C8.18425 2.22993 7.77314 2.14379 7.3578 2.1464C6.73292 2.1449 6.1237 2.34187 5.61797 2.70892C5.11225 3.07598 4.73616 3.59415 4.54391 4.18873C4.13684 4.27206 3.75225 4.44139 3.41591 4.68539C3.07957 4.92938 2.79924 5.24241 2.59368 5.60352C2.27994 6.14413 2.14602 6.77039 2.21123 7.39205C2.27644 8.01367 2.5374 8.59851 2.95649 9.06224C2.82527 9.45637 2.77975 9.87394 2.82297 10.2871C2.8662 10.7002 2.99718 11.0993 3.20713 11.4577C3.51841 11.9998 3.99385 12.4289 4.56484 12.6833C5.13584 12.9377 5.77289 13.0041 6.38407 12.8729C6.65975 13.1836 6.99862 13.4318 7.37796 13.601C7.75734 13.7701 8.16844 13.8562 8.58379 13.8536C9.20899 13.8552 9.81853 13.6582 10.3244 13.2909C10.8304 12.9236 11.2065 12.4051 11.3986 11.8101C11.8057 11.7268 12.1903 11.5575 12.5266 11.3135C12.8629 11.0695 13.1433 10.7564 13.3488 10.3953C13.6622 9.85477 13.7958 9.22866 13.7304 8.60726C13.6651 7.98587 13.4041 7.40129 12.9851 6.93777ZM8.58472 13.0883C8.0715 13.089 7.57441 12.9093 7.18031 12.5805C7.19808 12.5708 7.22925 12.5537 7.24956 12.5413L9.58061 11.1948C9.63911 11.1615 9.6877 11.1133 9.72136 11.055C9.75505 10.9967 9.77258 10.9305 9.77217 10.8632V7.57684L10.7575 8.14576C10.7626 8.14834 10.7671 8.15214 10.7704 8.15685C10.7738 8.16157 10.7759 8.16704 10.7766 8.17275V10.8943C10.7759 11.4756 10.5448 12.0329 10.1339 12.4441C9.72308 12.8554 9.16599 13.087 8.58472 13.0883ZM3.87091 11.075C3.61385 10.6309 3.5212 10.1105 3.60918 9.60485C3.62649 9.61524 3.65673 9.6337 3.67842 9.64617L6.00947 10.9926C6.06756 11.0266 6.13365 11.0445 6.20094 11.0445C6.2682 11.0445 6.33428 11.0266 6.39238 10.9926L9.23834 9.34936V10.4872C9.23867 10.493 9.23755 10.4988 9.23509 10.5041C9.23264 10.5094 9.22892 10.5139 9.22427 10.5174L6.86782 11.878C6.36379 12.1683 5.76516 12.2467 5.20333 12.0962C4.64148 11.9457 4.1623 11.5784 3.87091 11.075ZM3.25768 5.98617C3.51363 5.54141 3.91789 5.2009 4.39966 5.02421C4.39966 5.04429 4.39851 5.07985 4.39851 5.10452V7.79747C4.3981 7.86473 4.41561 7.93087 4.44924 7.98915C4.48287 8.04739 4.5314 8.09563 4.58984 8.1289L7.4358 9.77197L6.45054 10.3409C6.44568 10.3441 6.44009 10.346 6.43429 10.3465C6.4285 10.3471 6.42265 10.3462 6.41729 10.3439L4.06062 8.98216C3.55747 8.69077 3.19039 8.21176 3.03987 7.65013C2.88935 7.08853 2.96768 6.49014 3.25768 5.98617ZM11.3527 7.86994L8.50669 6.22667L9.49198 5.65799C9.49684 5.6548 9.50243 5.65283 9.50823 5.65231C9.51402 5.65178 9.51985 5.65272 9.5252 5.655L11.8819 7.01554C12.2429 7.2241 12.5371 7.53119 12.7299 7.90087C12.9228 8.27056 13.0063 8.68752 12.9707 9.10295C12.9351 9.51839 12.7819 9.91509 12.5291 10.2466C12.2762 10.5781 11.9341 10.8307 11.5428 10.9749C11.5428 10.9546 11.5428 10.919 11.5428 10.8943V8.20137C11.5434 8.13423 11.5261 8.06814 11.4926 8.0099C11.4592 7.95165 11.4109 7.90336 11.3527 7.86994ZM12.3333 6.394C12.316 6.38337 12.2858 6.36514 12.2641 6.3527L9.93303 5.00621C9.87493 4.97232 9.80887 4.95444 9.74158 4.95444C9.67432 4.95444 9.60824 4.97232 9.55014 5.00621L6.70418 6.64951V5.51167C6.70386 5.50585 6.70497 5.50005 6.70743 5.49479C6.70988 5.48952 6.7136 5.48492 6.71826 5.48144L9.0747 4.12203C9.4357 3.91387 9.84853 3.81281 10.2649 3.83068C10.6812 3.84856 11.0838 3.98462 11.4257 4.22296C11.7675 4.46129 12.0344 4.79204 12.1951 5.17652C12.3559 5.56099 12.4038 5.98327 12.3333 6.394ZM6.16851 8.42203L5.18299 7.85311C5.17784 7.85053 5.17336 7.84673 5.17002 7.84202C5.16668 7.8373 5.16455 7.83183 5.16385 7.82609V5.10452C5.16411 4.6877 5.28311 4.27956 5.5069 3.9279C5.73071 3.57623 6.05006 3.29559 6.42756 3.11883C6.80507 2.94206 7.22509 2.87649 7.63851 2.92977C8.05195 2.98306 8.44163 3.153 8.76197 3.41971C8.74421 3.42941 8.71327 3.44649 8.69272 3.45895L6.36168 4.80542C6.30317 4.83867 6.25462 4.8869 6.22093 4.94516C6.18727 5.0034 6.16974 5.06958 6.17012 5.13683L6.16851 8.42203ZM6.70371 7.26803L7.97126 6.53595L9.23878 7.26757V8.73127L7.97126 9.46292L6.70371 8.73127V7.26803Z"/></svg>'},k="team@northlight.ai";function $(e){const t=JSON.stringify(e.config).replace(/</g,"\\u003c");return`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <meta name="color-scheme" content="light dark">
-<title>${u(e.title)}</title><style nonce="${e.nonce}">${U}</style></head>
+<title>${m(e.title)}</title><style nonce="${e.nonce}">${J}</style></head>
 <body>
-<header class="top">${q}<span>Northlight</span></header>
+<header class="top">${W}<span>Northlight</span></header>
 <main><div class="col">${e.body}</div></main>
 <footer class="foot"><span>Need help? Email <a href="mailto:${k}">${k}</a></span></footer>
 <script type="application/json" id="cfg">${t}<\/script>
-<script nonce="${e.nonce}">${J}<\/script>
-</body></html>`}o($,"page");function S(e,t){return`<div class="head"><div class="logo">${W[e]}</div><div><span class="eyebrow">AI subscription</span><h1>Connect your ${t} account</h1></div></div>`}o(S,"header");function h(e,t,n="",r=""){return`<li${r}><span class="n"><span>${e}</span>${s("check")}</span><div class="body"><span class="title">${t}</span>${n}</div></li>`}o(h,"step");function X(e,t,n,r){return $({nonce:t,title:"Connect Claude",body:`<div class="card">
-${S("claude","Claude")}
+<script nonce="${e.nonce}">${Z}<\/script>
+</body></html>`}i($,"page");function _(e,t){return`<div class="head"><div class="logo">${X[e]}</div><div><span class="eyebrow">AI subscription</span><h1>Connect your ${t} account</h1></div></div>`}i(_,"header");function h(e,t,n="",r=""){return`<li${r}><span class="n"><span>${e}</span>${s("check")}</span><div class="body"><span class="title">${t}</span>${n}</div></li>`}i(h,"step");function Y(e,t,n,r){return $({nonce:t,title:"Connect Claude",body:`<div class="card">
+${_("claude","Claude")}
 <ol class="steps">
-${h(1,"Sign in to Claude in a new tab",`<div><a class="btn" href="${u(e.url)}" target="_blank" rel="noopener noreferrer">Open claude.ai${s("arrow")}</a></div>`," data-pre")}
+${h(1,"Sign in to Claude in a new tab",`<div><a class="btn" href="${m(e.url)}" target="_blank" rel="noopener noreferrer">Open claude.ai${s("arrow")}</a></div>`," data-pre")}
 ${h(2,"Copy the code Claude shows you",""," data-pre")}
 ${h(3,"Paste it here",`<form id="paste" autocomplete="off">
 <div class="field"><label for="code">Code from Claude</label>
@@ -169,14 +169,14 @@ ${h(3,"Paste it here",`<form id="paste" autocomplete="off">
 <button class="btn primary lg wide" type="submit">Connect Claude</button>
 </form>`)}
 </ol>
-</div>`,config:{kind:"anthropic",base:`${c}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:r}})}o(X,"anthropicPage");function Y(e,t){const n=Date.parse(e.expires_at)-t;return Math.max(0,Math.floor(Math.min(Number.isNaN(n)?M*1e3:n,M*1e3)/1e3))}o(Y,"codeSecondsLeft");function K(e,t,n,r,i=Date.now()){const a=e.user_code??"";return $({nonce:t,title:"Connect ChatGPT",body:`<div class="card">
-${S("chatgpt","ChatGPT")}
+</div>`,config:{kind:"anthropic",base:`${c}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:r}})}i(Y,"anthropicPage");function K(e,t){const n=Date.parse(e.expires_at)-t;return Math.max(0,Math.floor(Math.min(Number.isNaN(n)?M*1e3:n,M*1e3)/1e3))}i(K,"codeSecondsLeft");function Q(e,t,n,r,o=Date.now()){const a=e.user_code??"";return $({nonce:t,title:"Connect ChatGPT",body:`<div class="card">
+${_("chatgpt","ChatGPT")}
 <div class="alert" id="settings" role="alert">${s("warn")}
 <div class="text"><strong>Turn on device code sign-in first</strong>OpenAI refuses this sign-in unless device code authorization for Codex is on in ChatGPT's Security settings.</div>
-<div class="act"><a class="btn sm" href="${D}" target="_blank" rel="noopener noreferrer">Open settings${s("arrow")}</a></div></div>
+<div class="act"><a class="btn sm" href="${B}" target="_blank" rel="noopener noreferrer">Open settings${s("arrow")}</a></div></div>
 <ol class="steps" id="device">
-${h(1,"Open the OpenAI device page",`<div><a class="btn" id="device-link" href="${u(e.url)}" target="_blank" rel="noopener noreferrer">${u(e.url.replace(/^https:\/\//,""))}${s("arrow")}</a></div>`)}
-${h(2,"Enter this code",`<div class="codebox"><span class="code" id="user-code">${u(a)}</span>
+${h(1,"Open the OpenAI device page",`<div><a class="btn" id="device-link" href="${m(e.url)}" target="_blank" rel="noopener noreferrer">${m(e.url.replace(/^https:\/\//,""))}${s("arrow")}</a></div>`)}
+${h(2,"Enter this code",`<div class="codebox"><span class="code" id="user-code">${m(a)}</span>
 <span class="badge" id="expired-badge" hidden>Expired</span>
 <button class="btn sm" type="button" id="copy">${s("copy")}<span id="copy-label">Copy</span></button></div>`)}
 ${h(3,"Approve the sign-in",`<span class="small">When OpenAI shows an account email, check it's the account you want to use: approving connects that account.</span>`)}
@@ -189,4 +189,4 @@ ${h(3,"Approve the sign-in",`<span class="small">When OpenAI shows an account em
 <div class="alert" id="expired" role="alert" hidden>${s("warn")}
 <div class="text"><strong>The code expired before it was approved</strong>Codes last 15 minutes. Getting a new one starts the sign-in over.</div>
 <div class="act"><button class="btn primary sm" type="button" id="renew">Get a new code</button></div></div>
-</div>`,config:{kind:"openai",base:`${c}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:r,userCode:a,expiresAt:e.expires_at,remainingSeconds:Y(e,i)}})}o(K,"openaiPage");async function Q(e,t,n,r){const i=w(n.searchParams,"handoff"),a=await z(r,i);if(C(a.jti))throw f();const l=w(n.searchParams,"return_to");let v;try{v=l===void 0?void 0:new URL(l).origin}catch{v=void 0}if(l===void 0||v!==new URL(r.issuer).origin)throw new d(400,"invalid_request","return_to must be an absolute URL on the directory origin","return_to");const p=w(n.searchParams,"vendor");if(p!=="anthropic"&&p!=="openai")throw new d(400,"invalid_request","vendor must be anthropic or openai","vendor");if(!j(a.jti,a.exp))throw f();let b;try{b=await R({provider:N(p),jti:a.jti})}catch(L){console.error("[vendor-signin] start failed:",L instanceof Error?L.message:L),t.writeHead(303,{Location:F(l,"failed","start_failed"),"Cache-Control":"no-store","Referrer-Policy":"no-referrer"}),t.end();return}const g=E(16).toString("base64"),T=p==="anthropic"?X(b,g,l,i):K(b,g,l,i);t.writeHead(200,{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Referrer-Policy":"no-referrer","X-Content-Type-Options":"nosniff","Content-Security-Policy":`default-src 'none'; script-src 'nonce-${g}'; style-src 'nonce-${g}'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`}),t.end(T)}o(Q,"startPage");function m(e,t,n){console.error(`[vendor-signin] failed flow=${t} reason=${n}`),x(e,200,{status:"failed",reason:n})}o(m,"sendFailed");async function _(e,t,n){let r;try{r=await z(t,B(e))}catch(a){throw console.error(`[vendor-signin] handoff rejected flow=${n} reason=${a instanceof Error?a.message:String(a)}`),a}const i=y(n);if(!i){if(C(r.jti))return!1;throw console.error(`[vendor-signin] unauthorized flow=${n} reason=unknown flow, handoff never started one`),f()}if(i.jti===void 0||i.jti!==r.jti)throw console.error(`[vendor-signin] unauthorized flow=${n} reason=handoff did not start this flow`),f();return!0}o(_,"followUpFlow");async function e1(e,t,n,r){if(!await _(e,n,r)){m(t,r,"flow_gone");return}const i=await G(e);try{await P(r,i.input),x(t,200,{status:"connected"})}catch(a){const l=y(r);if(l&&l.status!=="pending"){m(t,r,l.message??l.status);return}throw a}}o(e1,"submitCode");async function t1(e,t,n,r){if(!await _(e,n,r)){m(t,r,"flow_gone");return}const i=new AbortController;t.once("close",()=>i.abort());const a=await H(r,V,i.signal);if(!a){m(t,r,"flow_gone");return}if(a.status==="failed"){m(t,r,a.message??"failed");return}x(t,200,{status:a.status})}o(t1,"waitFlow");async function c1(e,t,n,r){const i=e.method??"GET";if(n.pathname===c&&i==="GET"){await Q(e,t,n,r);return}const a=n.pathname.slice(c.length+1).split("/");let l="";try{l=a[0]?decodeURIComponent(a[0]):""}catch{throw new d(404,"not_found","unknown operation")}if(l&&a.length===1&&i==="POST"){await e1(e,t,r,l);return}if(l&&a.length===2&&a[1]==="wait"&&i==="GET"){await t1(e,t,r,l);return}throw new d(404,"not_found","unknown operation")}o(c1,"handleVendorSignIn");export{c as VENDOR_SIGNIN_PATH,X as anthropicPage,u as escapeHtml,c1 as handleVendorSignIn,d1 as isVendorSignInPath,K as openaiPage};
+</div>`,config:{kind:"openai",base:`${c}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:r,userCode:a,expiresAt:e.expires_at,remainingSeconds:K(e,o)}})}i(Q,"openaiPage");async function e1(e,t,n,r){const o=w(n.searchParams,"handoff"),a=await z(r,o);if(C(a.jti))throw u();const l=w(n.searchParams,"return_to");let b;try{b=l===void 0?void 0:new URL(l).origin}catch{b=void 0}if(l===void 0||b!==new URL(r.issuer).origin)throw new d(400,"invalid_request","return_to must be an absolute URL on the directory origin","return_to");const v=w(n.searchParams,"vendor");if(v!=="anthropic"&&v!=="openai")throw new d(400,"invalid_request","vendor must be anthropic or openai","vendor");if(!P(a.jti,a.exp))throw u();let L;try{L=await H({provider:R(v),jti:a.jti})}catch(A){f({level:"error",event:"vendor_signin.start_failed",error:A}),t.writeHead(303,{Location:G(l,"failed","start_failed"),"Cache-Control":"no-store","Referrer-Policy":"no-referrer"}),t.end();return}const g=E(16).toString("base64"),T=v==="anthropic"?Y(L,g,l,o):Q(L,g,l,o);t.writeHead(200,{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Referrer-Policy":"no-referrer","X-Content-Type-Options":"nosniff","Content-Security-Policy":`default-src 'none'; script-src 'nonce-${g}'; style-src 'nonce-${g}'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`}),t.end(T)}i(e1,"startPage");function p(e,t,n){f({level:"warn",event:"vendor_signin.failed",fields:{flow_id:t,reason:n}}),x(e,200,{status:"failed",reason:n})}i(p,"sendFailed");async function S(e,t,n){let r;try{r=await z(t,F(e))}catch(a){throw f({level:"warn",event:"vendor_signin.handoff_rejected",error:a,fields:{flow_id:n}}),a}const o=y(n);if(!o){if(C(r.jti))return!1;throw f({level:"warn",event:"vendor_signin.unauthorized",fields:{flow_id:n,reason:"unknown flow, handoff never started one"}}),u()}if(o.jti===void 0||o.jti!==r.jti)throw f({level:"warn",event:"vendor_signin.unauthorized",fields:{flow_id:n,reason:"handoff did not start this flow"}}),u();return!0}i(S,"followUpFlow");async function t1(e,t,n,r){if(!await S(e,n,r)){p(t,r,"flow_gone");return}const o=await U(e);try{await N(r,o.input),x(t,200,{status:"connected"})}catch(a){const l=y(r);if(l&&l.status!=="pending"){p(t,r,l.message??l.status);return}throw a}}i(t1,"submitCode");async function n1(e,t,n,r){if(!await S(e,n,r)){p(t,r,"flow_gone");return}const o=new AbortController;t.once("close",()=>o.abort());const a=await I(r,D,o.signal);if(!a){p(t,r,"flow_gone");return}if(a.status==="failed"){p(t,r,a.message??"failed");return}x(t,200,{status:a.status})}i(n1,"waitFlow");async function f1(e,t,n,r){const o=e.method??"GET";if(n.pathname===c&&o==="GET"){await e1(e,t,n,r);return}const a=n.pathname.slice(c.length+1).split("/");let l="";try{l=a[0]?decodeURIComponent(a[0]):""}catch{throw new d(404,"not_found","unknown operation")}if(l&&a.length===1&&o==="POST"){await t1(e,t,r,l);return}if(l&&a.length===2&&a[1]==="wait"&&o==="GET"){await n1(e,t,r,l);return}throw new d(404,"not_found","unknown operation")}i(f1,"handleVendorSignIn");export{c as VENDOR_SIGNIN_PATH,Y as anthropicPage,m as escapeHtml,f1 as handleVendorSignIn,h1 as isVendorSignInPath,Q as openaiPage};

package/dist/daemon/cron/armed-context.js

@@ -1 +1 @@
-var p=Object.defineProperty;var o=(r,e)=>p(r,"name",{value:e,configurable:!0});import{envHomeOverride as m}from"../../shared/env.js";import{loadProfileManifest as h,lookupProfile as v}from"../../core/profiles/manifest.js";import{readProfileEnvVars as g}from"../../core/profiles/env-store.js";import{readAppEnvVars as R}from"../../core/profiles/app-env-store.js";import{ADMITTED_HOST_PATH_ENV as f,buildOperationalEnvBase as w}from"../../core/runtime/spawn-env.js";import{getNode as c}from"../../core/canvas/canvas.js";import{contextDir as y}from"../../core/canvas/paths.js";import{appendRunEvent as O}from"../../core/runs/events.js";import{payerOfGrant as b}from"../../core/grants/mirror.js";import{scopeAllowed as E}from"../../core/scopes.js";import{cronPrincipalOf as C}from"./authority.js";function _(r){if(r.profile==null)return null;let e;try{e=v(r.profile)}catch{return null}if(e.kind==="resolved")return e.entry.profileId;if(e.kind==="absent")return null;throw new l(`the armed profile "${r.profile}" is still on this host but its manifest could not be read (${e.manifestPath}) \u2014 running as root would silently give this cron a different identity, env store, and purview. Repair the manifest, or re-arm the cron under a profile that resolves.`)}o(_,"resolveLiveProfile");function M(r){return{...C(r),cron_id:r.cron_id,origin_run_id:r.origin_run_id,isolated:r.isolated,creator:r.created_by}}o(M,"cronBirthPrincipalOf");async function $(r,e){const n=r.creator===null?null:await c(r.creator);return n!==null&&r.origin_run_id!==null&&n.run_id===r.origin_run_id&&(await c(r.origin_run_id))?.deleting_at==null&&n.grantee===r.grantee&&(n.sub??"user:local")===r.sub&&(n.grant_id??null)===r.grant_id&&(r.scopes===null?n.scopes==null:r.scopes.every(t=>E(n.scopes,t)))?{parent:n.node_id,...r.scopes===null?{}:{scopes:[...r.scopes]}}:{root:!0,rootLifecycle:"terminal",...r.scopes===null?{}:{scopes:[...r.scopes]},run:{grantee:r.grantee,sub:r.sub,grant_id:r.grant_id,client_id:null,metadata_json:JSON.stringify({cron_id:r.cron_id}),run_id:e,event_cursor:1,usage_json:JSON.stringify({input_tokens:0,output_tokens:0,cache_read_tokens:0,cache_write_tokens:0,cost_usd:0})},withinCreate:o(async(t,a)=>{await O(t,e,e,"run.started",{scopes:a.scopes??null,payer:await b(r.grant_id),usage:JSON.parse(a.usage_json)})},"withinCreate")}}o($,"cronBirthPlacement");function B(r){try{return _(r)}catch{return null}}o(B,"resolveLiveProfileOrRoot");function V(r){if(r.profile!=null)try{return h(r.profile).manifest.name}catch{return}}o(V,"resolveLiveProfileName");class l extends Error{static{o(this,"ArmedContextError")}constructor(e){super(e),this.name="ArmedContextError"}}function N(r){if(r==null)return{};let e;try{e=JSON.parse(r)}catch(i){throw new l(`the armed env snapshot is not valid JSON (${i.message}) \u2014 this cron's stored env_json is corrupt, so the run would silently drop every armed variable. Re-arm the cron with a valid --env.`)}if(typeof e!="object"||e===null||Array.isArray(e))throw new l("the armed env snapshot is not a JSON object \u2014 this cron's stored env_json is corrupt. Re-arm the cron with a valid --env.");const n={};for(const[i,t]of Object.entries(e)){if(typeof t!="string")throw new l(`the armed env snapshot's value for "${i}" is not a string \u2014 this cron's stored env_json is corrupt, so the run would silently drop that variable. Re-arm the cron with a valid --env.`);n[i]=t}return n}o(N,"parseArmedEnv");async function F(r,e){const n=N(r.env_json),i=r.grantee==="app:terminal",t=i?_(r):null,a=w({targetCwd:r.cwd,targetProfileId:t,skipSpawnAllow:!i}),s={...a,...R(r.grantee),...i?g(t):{},...n,...t!==null?{CRTR_PROFILE_ID:t}:{},CRTR_CRON_ID:r.cron_id,CRTR_CRON_NAME:r.name,CRTR_RUN_ID:e},u=m();if(u!==void 0&&u!==""&&(s.CRTR_HOME=u),r.anchor_node!=null){s.CRTR_ANCHOR=r.anchor_node;const d=await c(r.anchor_node);d!==null&&(s.CRTR_CONTEXT_DIR=y(d.node_id,d.grantee))}return s[f]=a[f],{profileId:t,env:s}}o(F,"buildArmedRunContext");export{l as ArmedContextError,F as buildArmedRunContext,$ as cronBirthPlacement,M as cronBirthPrincipalOf,_ as resolveLiveProfile,V as resolveLiveProfileName,B as resolveLiveProfileOrRoot};
+var _=Object.defineProperty;var o=(r,e)=>_(r,"name",{value:e,configurable:!0});import{envHomeOverride as m}from"../../shared/env.js";import{loadProfileManifest as h,lookupProfile as v}from"../../core/profiles/manifest.js";import{readProfileEnvVars as g}from"../../core/profiles/env-store.js";import{readAppEnvVars as R}from"../../core/profiles/app-env-store.js";import{ADMITTED_HOST_PATH_ENV as f,buildOperationalEnvBase as w}from"../../core/runtime/spawn-env.js";import{getNode as c}from"../../core/canvas/canvas.js";import{contextDir as y}from"../../core/canvas/paths.js";import{appendRunEvent as O}from"../../core/runs/events.js";import{payerOfGrant as b}from"../../core/grants/mirror.js";import{scopeAllowed as E}from"../../core/scopes.js";import{cronPrincipalOf as C}from"./authority.js";import{personId as N}from"../../core/canvas/person.js";function p(r){if(r.profile==null)return null;let e;try{e=v(r.profile)}catch{return null}if(e.kind==="resolved")return e.entry.profileId;if(e.kind==="absent")return null;throw new l(`the armed profile "${r.profile}" is still on this host but its manifest could not be read (${e.manifestPath}) \u2014 running as root would silently give this cron a different identity, env store, and purview. Repair the manifest, or re-arm the cron under a profile that resolves.`)}o(p,"resolveLiveProfile");function B(r){return{...C(r),cron_id:r.cron_id,origin_run_id:r.origin_run_id,isolated:r.isolated,creator:r.created_by}}o(B,"cronBirthPrincipalOf");async function V(r,e){const n=r.creator===null?null:await c(r.creator);return n!==null&&r.origin_run_id!==null&&n.run_id===r.origin_run_id&&(await c(r.origin_run_id))?.deleting_at==null&&n.grantee===r.grantee&&(n.sub??N())===r.sub&&(n.grant_id??null)===r.grant_id&&(r.scopes===null?n.scopes==null:r.scopes.every(t=>E(n.scopes,t)))?{parent:n.node_id,...r.scopes===null?{}:{scopes:[...r.scopes]}}:{root:!0,rootLifecycle:"terminal",...r.scopes===null?{}:{scopes:[...r.scopes]},run:{grantee:r.grantee,sub:r.sub,grant_id:r.grant_id,client_id:null,metadata_json:JSON.stringify({cron_id:r.cron_id}),run_id:e,event_cursor:1,usage_json:JSON.stringify({input_tokens:0,output_tokens:0,cache_read_tokens:0,cache_write_tokens:0,cost_usd:0})},withinCreate:o(async(t,a)=>{await O(t,e,e,"run.started",{scopes:a.scopes??null,payer:await b(r.grant_id),usage:JSON.parse(a.usage_json)})},"withinCreate")}}o(V,"cronBirthPlacement");function F(r){try{return p(r)}catch{return null}}o(F,"resolveLiveProfileOrRoot");function G(r){if(r.profile!=null)try{return h(r.profile).manifest.name}catch{return}}o(G,"resolveLiveProfileName");class l extends Error{static{o(this,"ArmedContextError")}constructor(e){super(e),this.name="ArmedContextError"}}function x(r){if(r==null)return{};let e;try{e=JSON.parse(r)}catch(i){throw new l(`the armed env snapshot is not valid JSON (${i.message}) \u2014 this cron's stored env_json is corrupt, so the run would silently drop every armed variable. Re-arm the cron with a valid --env.`)}if(typeof e!="object"||e===null||Array.isArray(e))throw new l("the armed env snapshot is not a JSON object \u2014 this cron's stored env_json is corrupt. Re-arm the cron with a valid --env.");const n={};for(const[i,t]of Object.entries(e)){if(typeof t!="string")throw new l(`the armed env snapshot's value for "${i}" is not a string \u2014 this cron's stored env_json is corrupt, so the run would silently drop that variable. Re-arm the cron with a valid --env.`);n[i]=t}return n}o(x,"parseArmedEnv");async function U(r,e){const n=x(r.env_json),i=r.grantee==="app:terminal",t=i?p(r):null,a=w({targetCwd:r.cwd,targetProfileId:t,skipSpawnAllow:!i}),s={...a,...R(r.grantee),...i?g(t):{},...n,...t!==null?{CRTR_PROFILE_ID:t}:{},CRTR_CRON_ID:r.cron_id,CRTR_CRON_NAME:r.name,CRTR_RUN_ID:e},u=m();if(u!==void 0&&u!==""&&(s.CRTR_HOME=u),r.anchor_node!=null){s.CRTR_ANCHOR=r.anchor_node;const d=await c(r.anchor_node);d!==null&&(s.CRTR_CONTEXT_DIR=y(d.node_id,d.grantee))}return s[f]=a[f],{profileId:t,env:s}}o(U,"buildArmedRunContext");export{l as ArmedContextError,U as buildArmedRunContext,V as cronBirthPlacement,B as cronBirthPrincipalOf,p as resolveLiveProfile,G as resolveLiveProfileName,F as resolveLiveProfileOrRoot};

package/dist/daemon/cron/authority.d.ts

@@ -19,8 +19,7 @@ export type CronAuthority =
 };
 /** May this principal fire now? The grant row must exist, be active and unexpired for this
  *  grantee and sub; every stored scope must still be covered by it; `crtr:schedule` must be
- *  in the effective set. A null `grant_id` passes only for `app:terminal` on a runtime with
- *  no issuer. */
+ *  in the effective set. A null `grant_id` is `grant_missing`. */
 export declare function checkCronFire(p: CronPrincipal): Promise<CronAuthority>;
 /** May this principal start a node? The fire check plus `crtr:act`. */
 export declare function checkCronBirth(p: CronPrincipal): Promise<CronAuthority>;

package/dist/daemon/cron/authority.js

@@ -1 +1 @@
-var c=Object.defineProperty;var a=(r,e)=>c(r,"name",{value:e,configurable:!0});import{covers as u}from"@north-light/identity";import{activeRecord as g,grantRecord as d}from"../../core/grants/mirror.js";import{readConfig as l}from"../../core/config.js";import{isUnsandboxedMachine as f}from"../../core/runtime/unsandboxed.js";import{SCOPE_VOCABULARY as m,isOwnMemoryScope as _,scopeAllowed as i}from"../../core/scopes.js";function t(r,e){return{allowed:!1,reason:r,message:e}}a(t,"refuse");async function h(r){if(r.grantee!=="app:terminal"&&f())return t("unsandboxed_machine",`This computer runs only your own terminal agents; ${r.grantee} runs on your hosted machine.`);let e;if(r.grant_id===null){if(r.grantee!=="app:terminal"||l("user").runtime?.issuer)return t("grant_missing",`cron has no grant for ${r.grantee}; re-arm it from a node of that app`);e=m}else{const n=await d(r.grant_id);if(n===null)return t("grant_missing",`grant ${r.grant_id} is not in this runtime's grant mirror`);if(n.status!=="active")return t("grant_revoked",`grant ${r.grant_id} is ${n.status}`);if(n.expires_at!==null&&Date.parse(n.expires_at)<=Date.now())return t("grant_revoked",`grant ${r.grant_id} expired at ${n.expires_at}`);if(n.grantee!==r.grantee||n.sub!==r.sub)return t("grant_revoked",`grant ${r.grant_id} no longer belongs to ${r.grantee} for ${r.sub}`);const o=g(n);if(o===null)return t("grant_revoked",`grant ${r.grant_id} cannot be read`);e=o.resolved}if(r.scopes!==null){const n=r.scopes.find(o=>!_(o,r.grantee)&&!e.some(s=>u(s,o)));if(n!==void 0)return t("scope_narrowed",`scope ${n} is no longer covered by the grant`)}return!i(e,"crtr:schedule")||!i(r.scopes,"crtr:schedule")?t("scope_missing","the cron no longer holds crtr:schedule"):{allowed:!0,effectiveScopes:e}}a(h,"checkCronFire");async function y(r){const e=await h(r);return e.allowed&&(!i(e.effectiveScopes,"crtr:act")||!i(r.scopes,"crtr:act"))?t("scope_missing","the cron no longer holds crtr:act"):e}a(y,"checkCronBirth");function k(r){return{grantee:r.grantee,sub:r.sub,grant_id:r.grant_id,scopes:r.scopes}}a(k,"cronPrincipalOf");export{y as checkCronBirth,h as checkCronFire,k as cronPrincipalOf};
+var c=Object.defineProperty;var a=(r,e)=>c(r,"name",{value:e,configurable:!0});import{covers as u}from"@north-light/identity";import{activeRecord as g,grantRecord as d}from"../../core/grants/mirror.js";import{isUnsandboxedMachine as l}from"../../core/runtime/unsandboxed.js";import{isOwnMemoryScope as f,scopeAllowed as s}from"../../core/scopes.js";function t(r,e){return{allowed:!1,reason:r,message:e}}a(t,"refuse");async function m(r){if(r.grantee!=="app:terminal"&&l())return t("unsandboxed_machine",`This computer runs only your own terminal agents; ${r.grantee} runs on your hosted machine.`);let e;if(r.grant_id===null)return t("grant_missing",`cron has no grant for ${r.grantee}; re-arm it from a node of that app`);{const n=await d(r.grant_id);if(n===null)return t("grant_missing",`grant ${r.grant_id} is not in this runtime's grant mirror`);if(n.status!=="active")return t("grant_revoked",`grant ${r.grant_id} is ${n.status}`);if(n.expires_at!==null&&Date.parse(n.expires_at)<=Date.now())return t("grant_revoked",`grant ${r.grant_id} expired at ${n.expires_at}`);if(n.grantee!==r.grantee||n.sub!==r.sub)return t("grant_revoked",`grant ${r.grant_id} no longer belongs to ${r.grantee} for ${r.sub}`);const o=g(n);if(o===null)return t("grant_revoked",`grant ${r.grant_id} cannot be read`);e=o.resolved}if(r.scopes!==null){const n=r.scopes.find(o=>!f(o,r.grantee)&&!e.some(i=>u(i,o)));if(n!==void 0)return t("scope_narrowed",`scope ${n} is no longer covered by the grant`)}return!s(e,"crtr:schedule")||!s(r.scopes,"crtr:schedule")?t("scope_missing","the cron no longer holds crtr:schedule"):{allowed:!0,effectiveScopes:e}}a(m,"checkCronFire");async function w(r){const e=await m(r);return e.allowed&&(!s(e.effectiveScopes,"crtr:act")||!s(r.scopes,"crtr:act"))?t("scope_missing","the cron no longer holds crtr:act"):e}a(w,"checkCronBirth");function b(r){return{grantee:r.grantee,sub:r.sub,grant_id:r.grant_id,scopes:r.scopes}}a(b,"cronPrincipalOf");export{w as checkCronBirth,m as checkCronFire,b as cronPrincipalOf};

package/dist/daemon/crtrd.js

@@ -1,17 +1,17 @@
-var Ce=Object.defineProperty;var i=(n,s)=>Ce(n,"name",{value:s,configurable:!0});import{startPeerOutbox as Le}from"./peer/outbox.js";import{reportMachineStatus as $e}from"../core/peer/directory.js";import{createPeerRelay as Ae}from"./peer/relay-service.js";import{writeFileSync as Me,readFileSync as Ne,rmSync as Ge,mkdirSync as oe,existsSync as E,chmodSync as Oe}from"node:fs";import{createServer as ie}from"node:http";import{dirname as Fe}from"node:path";import{envCrtrdTcp as Be,envDocumentPort as He}from"../shared/env.js";import{serveCanvasConversationStore as je}from"../core/canvas/sessions.js";import{pollRunObservers as qe}from"./runs/observer.js";import{randomBytes as ae}from"node:crypto";import{apiSocketPath as ze,crtrHome as We}from"../core/canvas/paths.js";import{activeAppUsers as Ue}from"../core/spaces/users.js";import{ensureAppSpace as Ke,ensureUserFiles as Je}from"../core/spaces/space.js";import{LAUNCHER_SOCKET as I}from"../launcher/spec.js";import{launcherRequest as D}from"../launcher/client.js";import{installLauncherEventSink as Ve}from"./launcher-events.js";import{initializeEmptyLayout as Qe,layoutNeedsMigration as Ye,socketDir as se}from"../core/layout.js";import{migrateLooseKeys as Xe}from"../core/layout-migrate/loose-keys.js";import{relocateProfileFolders as Ze}from"../core/profiles/relocate.js";import{getNode as er,listNodesForSupervision as ce,listParkedResidentsWithWakeMail as rr,setFrozen as de}from"../core/canvas/index.js";import{createApiServer as tr}from"./api/server.js";import{createDocumentListener as nr}from"./api/document-listener.js";import{documentSecret as or}from"./api/document-secret.js";import{createAppListener as ir}from"./api/app-listener.js";import{installLocalTerminalGrant as ar}from"../core/grants/local.js";import{onRunEventAppended as sr}from"../core/runs/events.js";import{runNotices as cr}from"./run-notices.js";import{createGrantSync as dr,GRANT_SYNC_INTERVAL_S as lr}from"../core/grants/sync.js";import{runRemovalCascades as pr}from"../core/grants/remove.js";import{sweepSandboxes as mr}from"../core/grants/on-sync.js";import{rebuildCronExecutions as fr}from"./cron/run-socket.js";import{hasSyncedGrants as ur}from"../core/grants/mirror.js";import{readConfig as le}from"../core/config.js";import{reconcileUndeliveredTickets as wr}from"./human/sweep.js";import{resetHandedOffDeliveries as hr}from"../core/canvas/deliveries.js";import{resetHandedOffDaemonActions as vr}from"../core/canvas/daemon-actions.js";import{sweepReviews as gr}from"./review/sweep.js";import{pidfilePath as z}from"./pidfile.js";import{rendererWarning as yr}from"../core/runtime/package-health.js";import{DEFAULT_INTERVAL_MS as Sr}from"./supervise-cadence.js";import{createResumeDetector as _r}from"./resume-detector.js";import{setFatalFaultAnnouncer as br}from"../core/canvas/recovery.js";import{BrokerSupervisionReconciler as kr}from"./reconcilers/broker-supervision.js";import{ControllerDeathReconciler as Er}from"./reconcilers/controller-death.js";import{NodeLifecycleReconciler as Pr}from"./reconcilers/node-lifecycle/tick.js";import{NodeDeadlineReconciler as Rr}from"./reconcilers/node-deadline.js";import{CronLaneReconciler as xr}from"./reconcilers/cron-lane.js";import{DeliveryLaneReconciler as Ir}from"./reconcilers/delivery-lane.js";import{ActionLaneReconciler as Tr}from"./reconcilers/action-lane.js";import{endLiveExecution as Dr,migrateLegacyExecutionIdentities as Cr}from"../core/canvas/executions.js";import{revokePriorEpochNodeTokens as Lr}from"../core/canvas/node-tokens.js";import{PendingReviewSubmitReconciler as $r}from"./reconcilers/pending-review-submit.js";import{StorageMaintenanceReconciler as Ar}from"./reconcilers/storage-maintenance.js";import{StorageDueWorkReconciler as Mr}from"./reconcilers/storage-due-work.js";import{BashDeadlineReconciler as Nr}from"./reconcilers/bash-deadline.js";import{FaultRetryBackstopReconciler as Gr}from"./reconcilers/fault-retry-backstop.js";import{StructuredRequestReconciler as Or}from"./reconcilers/structured-request-lane.js";import{reconcileStructuredRequestSidecars as Fr}from"./structured-requests/boot.js";import{captureLivenessSnapshot as pe,capturePidCommand as Br,captureTeardownSnapshot as me,isPidAlive as Hr,isAnyPidAlive as fe,killProcessTreePids as ue}from"../core/canvas/pid.js";import{bindFleet as jr,boundFleet as qr}from"../core/runtime/fleet.js";import{bindDaemonControl as zr,clearDaemonControl as Wr}from"./control.js";import{execDaemon as Ur,spawnDaemon as Kr}from"./manage.js";import{reconcileAndMigrateBoot as Jr}from"../core/canvas/boot.js";import{resolveInstallId as Vr}from"../core/canvas/install-id.js";import{setInstallId as Qr}from"../core/runtime/nodes.js";import{claimDaemonOwnership as we,daemonOwnershipClaimed as Yr,releaseDaemonOwnership as he}from"../core/canvas/daemon-owner.js";import{canvasDatabaseUrl as Xr,closeAllDbs as W,openDb as ve,withCanvasWrite as Zr}from"../core/canvas/db.js";import{importSqliteCanvasIfPresent as et}from"../core/canvas/import-sqlite.js";import{ensurePostgres as rt,ensurePostgresHealthy as tt,stopPostgres as nt,withPostgresStartLock as ot}from"./postgres/index.js";import{brokerSignalBus as U}from"./broker-signals/bus.js";import{brokerSignalStreams as it}from"./api/handlers/broker-signals.js";import{reconcilePackages as at}from"../core/graph/package-reconcile.js";import{startRepoSync as st}from"../core/graph/repo-sync/index.js";import{prewarmRecentRecipes as ct,reapStaleSpares as dt}from"../core/runtime/warm-pool.js";import{DaemonFleet as lt}from"./fleet.js";import{BOOT_MIGRATIONS as pt}from"./boot-migrations.js";import{applyJoinedOwner as mt}from"./joined-owner.js";import{emitEvent as u}from"../core/events/emit.js";import{operationIdContext as _}from"../core/events/operation-id.js";import{bindDaemonEventSource as ft}from"../core/events/source.js";import{activateCanvasImport as ut,MigrationBlockedError as wt,runForcedCanvasImport as ht}from"../migrations/activation.js";import{convertLegacyProviderStore as vt,convertLegacyScopedStore as gt}from"../core/scoped-state/migrate.js";import{userScopeRoot as yt}from"../core/scope.js";import{secretsDir as St}from"../core/layout.js";function K(n,s){return n.includes(` --canvas-home ${s} `)}i(K,"brokerCommandDeclaresCanvasHome");function J(n){return/ --epoch (\S+) /.exec(n)?.[1]??null}i(J,"brokerCommandEpoch");const _t=5e3,ge=150;async function bt(n){const s=pe();if(s===null)throw u({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness"}}),new Error("prior-epoch broker census could not capture the process table");const l=We(),w=[];for(const[c,m]of s.processes){const v=m.command;if(m.zombie||!v.includes("broker-cli.js")||!K(v,l)||J(v)===n)continue;const k=v.trim().split(/\s+/).at(-1)??"";k===""||k.endsWith("broker-cli.js")||w.push({pid:c,nodeId:k})}let d=0;const t=[];for(const c of w){const m=Br(c.pid);if(m===null||!m.includes("broker-cli.js")||!K(m,l)||J(m)===n||m.trim().split(/\s+/).at(-1)!==c.nodeId)continue;const v=me(c.pid,null);if(!v.reused){try{process.platform==="linux"&&E(I)?await D({operation:"stop",pid:c.pid}):process.kill(c.pid,"SIGTERM")}catch{continue}d++,t.push({pid:c.pid,snap:v})}}const y=Date.now()+_t;for(;Date.now()<y&&t.some(c=>fe(c.snap.tree.length>0?c.snap.tree:[c.pid]));)await new Promise(c=>setTimeout(c,ge));let h=0;for(const c of t){const m=c.snap.tree.length>0?c.snap.tree:[c.pid];fe(m)&&(process.platform==="linux"&&E(I)?await D({operation:"stop",pid:c.pid}):ue(m,"SIGKILL",c.snap.identities),h++)}h>0&&await new Promise(c=>setTimeout(c,ge));const f=pe();if(f===null)throw u({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness",stage:"final"}}),new Error("prior-epoch broker census could not capture the final process table");const a=[];for(const[c,m]of f.processes){const v=m.command;m.zombie||!v.includes("broker-cli.js")||K(v,l)&&J(v)!==n&&a.push(c)}if(a.length>0)throw new Error(`prior-epoch broker census could not prove termination of pid(s): ${a.join(", ")}`);u({level:"info",event:"daemon.census.completed",fields:{prior_epoch_brokers:w.length,sigtermed:d,sigkilled:h}})}i(bt,"reapPriorEpochBrokers");const kt=5e3;async function Et(n){const s=Array.from(n.entries());if(s.length===0)return;for(const[t]of s){const y=(await er(t))?.status;(y==="active"||y==="idle")&&await de(t,new Date().toISOString())}const l=s.map(([,t])=>({pid:t.pid,snap:me(t.pid,null),exited:t.handle.exited}));for(const t of l)if(!t.snap.reused)try{process.platform==="linux"&&E(I)?await D({operation:"stop",pid:t.pid}):process.kill(t.pid,"SIGTERM")}catch{}const w=new Promise(t=>{setTimeout(t,kt).unref()});await Promise.allSettled(l.map(t=>Promise.race([t.exited.then(()=>{}),w])));const d=[];for(const t of l)Hr(t.pid)&&(process.platform==="linux"&&E(I)?await D({operation:"stop",pid:t.pid}):ue(t.snap.tree.length>0?t.snap.tree:[t.pid],"SIGKILL",t.snap.identities),d.push(t));await Promise.all(d.map(t=>t.exited));for(const[t]of s)await Dr(t,{reason:"daemon-teardown"});u({level:"info",event:"daemon.fleet_teardown.completed",fields:{brokers:l.length,sigkilled:d.length}})}i(Et,"teardownFleet");function ye(){oe(Fe(z()),{recursive:!0}),Me(z(),String(process.pid),"utf8")}i(ye,"writePidfile");function Se(n){return typeof n=="object"&&n!==null&&n.code==="ENOENT"}i(Se,"isMissingPathError");function _e(n){const s=z();let l;try{l=Ne(s,"utf8")}catch(w){if(Se(w))return;throw w}if(l.trim()!==String(n))throw new Error(`daemon readiness mirror does not name this invocation (expected pid ${n})`);try{Ge(s)}catch(w){if(Se(w))return;throw w}}i(_e,"removeOwnedPidfileMirror");const Pt={acceptsDetachedWork:i(()=>!0,"acceptsDetachedWork"),registerDetached:i(n=>{n.catch(()=>{})},"registerDetached")},O=new kr;br(n=>O.handleFatalFault(n,!1));const Rt=new Er,xt=new Pr,It=new Rr,Tt=new xr,Dt=new Ir,Ct=new Tr,Lt=new $r,$t=new Ar,At=new Mr,Mt=new Nr,Nt=new Gr,Gt=new Or;async function Ot(n=Date.now(),s=Pt){const l=qr(),w=await O.runFleetPreamble(l);let d,t;try{const h=await ce();d=h.filter(a=>a.status==="active"||a.status==="idle"),t=h.filter(a=>a.status==="done"||a.status==="canceled"||a.status==="dead");const f=new Set(t.map(a=>a.node_id));t.push(...(await rr()).filter(a=>!f.has(a.node_id)))}catch(h){u({level:"error",event:"canvas.node_list.failed",error:h});return}await O.run(n,{rows:d,fleet:l,lifecycle:s}),await Rt.run(n,{rows:d});const y=await xt.run(n,{rows:[...d,...t],fleet:l});await It.run(n),await Gt.run(n),await Tt.run(n,{lifecycle:s}),await Dt.run(n,{lifecycle:s}),await Ct.run(n,{lifecycle:s}),await Lt.run(n,{lifecycle:s}),await $t.run(n,{lifecycle:s,fleet:l}),At.run(n,{lifecycle:s}),await qe(),Nt.run(n,{fleet:l,lifecycle:s}),await Mt.run(n,{rows:d}),O.warnIfSaturated({fleet:l,lifecycle:s,thresholds:w,frozen:y})}i(Ot,"superviseTick");async function Ft(n){oe(se(),{recursive:!0,mode:493}),process.platform==="linux"&&Oe(se(),493);const s=ze();if(E(s))throw new Error(`layout refusal cannot bind occupied socket: ${s}`);const l=ie((f,a)=>{if(f.method==="GET"&&f.url==="/healthz"){a.writeHead(200,{"content-type":"application/json; charset=utf-8"}),a.end(JSON.stringify({ok:!1,daemon_up:!0,store_accessible:!1,brokers_reconciled:!1,startup_phase:"blocked",startup_blocked:"layout_migration_required"}));return}a.writeHead(503,{"content-type":"application/json; charset=utf-8"}),a.end(JSON.stringify({error:{code:"layout_migration_required",message:"run crtr sys migrate while the runtime is offline",type:"server_error",origin:"runtime",retryable:!1}}))});await new Promise((f,a)=>{l.once("error",a),l.listen(s,()=>{l.off("error",a),f()})});let w;const d=n.tcp??Be();if(d){const f=/^(.*):(\d+)$/.exec(d);if(!f||Number(f[2])>65535)throw new Error(`invalid refusal TCP address: ${d}`);const a=ie(l.listeners("request")[0]);await new Promise((c,m)=>{a.once("error",m),a.listen(Number(f[2]),f[1],()=>{a.off("error",m),c()})}),w=a}ye();let t;const y=i(()=>(t??=(async()=>{l.closeAllConnections(),w?.closeAllConnections(),await Promise.all([l,w].filter(f=>f!==void 0).map(f=>new Promise((a,c)=>f.close(m=>m?c(m):a())))),_e(process.pid),process.off("SIGINT",h),process.off("SIGTERM",h)})(),t),"cleanup"),h=i(()=>{y().then(()=>process.exit(0),f=>{process.stderr.write(`[crtrd] layout refusal cleanup failed: ${String(f)}
-`),process.exit(1)})},"onSignal");return process.on("SIGINT",h),process.on("SIGTERM",h),y}i(Ft,"serveLayoutRefusal");async function Bt(n={}){if(Ye())return Ft(n);Qe();const s=i(r=>{process.stderr.write(`[crtrd] ${r}
-`)},"logPostgres"),l=!!process.env.CRTR_TEST_PG_URL,{database:w,ownership:d}=l?{database:{url:await Xr()},ownership:await we(ae(16).toString("hex"))}:await ot(async()=>({database:await rt({log:s,startLockHeld:!0}),ownership:await we(ae(16).toString("hex"))}));if(!d.claimed){if(d.reason==="incumbent_alive")process.stderr.write(`[crtrd] already running (pid ${d.incumbentPid??"?"})
-`);else{const r=[d.incumbentPid!==void 0?`pid ${d.incumbentPid}`:void 0,d.verdict!==void 0?`verdict ${d.verdict}`:void 0].filter(o=>o!==void 0),e=r.length>0?` (${r.join(", ")})`:"";process.stderr.write(`[crtrd] claim lost: ${d.reason}${e}
-`),d.reason==="own_identity_indeterminate"&&process.stderr.write("[crtrd] cannot read its own process identity. crouter needs /proc on Linux, or the `ps` command elsewhere (Debian/Ubuntu: apt-get install procps).\n"),(d.reason==="own_identity_indeterminate"||d.reason==="incumbent_malformed")&&(process.exitCode=1)}return async()=>{}}const t=d.claim;let y=null;try{await bt(t.token),gt({kind:"user",root:yt()});for(const e of Ze())process.stderr.write(`[crtrd] ${e}
-`);if(process.platform==="darwin"){const{readConfig:e,updateConfig:o}=await import("../core/config.js");if(e("user").paths?.user_files===void 0){const{homedir:p}=await import("node:os");o("user",S=>{S.paths??={},S.paths.user_files??=p()})}}await vt(St());for(const e of Xe())process.stderr.write(`[crtrd] ${e}
-`);await ve(),await et(w.url,s),await U.listen(w.url);const r=await Zr(async e=>await at(e));for(const e of r.conflicts)process.stderr.write(`[crtrd] plugin documents not reconciled: ${e.message}
+var $e=Object.defineProperty;var a=(n,s)=>$e(n,"name",{value:s,configurable:!0});import{startPeerOutbox as Ae}from"./peer/outbox.js";import{reportMachineStatus as Me}from"../core/peer/directory.js";import{createPeerRelay as Ne}from"./peer/relay-service.js";import{writeFileSync as Fe,readFileSync as Ge,rmSync as Oe,mkdirSync as ae,existsSync as P,chmodSync as Be}from"node:fs";import{createServer as se}from"node:http";import{dirname as He}from"node:path";import{envCrtrdTcp as je,envDocumentPort as qe}from"../shared/env.js";import{serveCanvasConversationStore as ze}from"../core/canvas/sessions.js";import{pollRunObservers as We}from"./runs/observer.js";import{randomBytes as ce}from"node:crypto";import{apiSocketPath as Ue,crtrHome as Ke}from"../core/canvas/paths.js";import{activeAppUsers as Je}from"../core/spaces/users.js";import{ensureAppSpace as Ve,ensureUserFiles as Qe}from"../core/spaces/space.js";import{LAUNCHER_SOCKET as x}from"../launcher/spec.js";import{launcherRequest as C}from"../launcher/client.js";import{installLauncherEventSink as Ye}from"./launcher-events.js";import{initializeEmptyLayout as Xe,layoutNeedsMigration as Ze,socketDir as de}from"../core/layout.js";import{migrateLooseKeys as er}from"../core/layout-migrate/loose-keys.js";import{relocateProfileFolders as rr}from"../core/profiles/relocate.js";import{getNode as tr,listNodesForSupervision as le,listParkedResidentsWithWakeMail as nr,setFrozen as pe}from"../core/canvas/index.js";import{createApiServer as or}from"./api/server.js";import{createDocumentListener as ir}from"./api/document-listener.js";import{documentSecret as ar}from"./api/document-secret.js";import{createAppListener as sr}from"./api/app-listener.js";import{registerMachineEnvironment as cr}from"../core/environments.js";import{resolvePerson as dr,retireLocalPerson as lr,setPersonId as pr}from"../core/canvas/person.js";import{onRunEventAppended as mr}from"../core/runs/events.js";import{runNotices as fr}from"./run-notices.js";import{createGrantSync as ur,GRANT_SYNC_INTERVAL_S as wr}from"../core/grants/sync.js";import{runRemovalCascades as hr}from"../core/grants/remove.js";import{sweepSandboxes as vr}from"../core/grants/on-sync.js";import{rebuildCronExecutions as gr}from"./cron/run-socket.js";import{hasSyncedGrants as yr}from"../core/grants/mirror.js";import{readConfig as me}from"../core/config.js";import{reconcileUndeliveredTickets as Sr}from"./human/sweep.js";import{resetHandedOffDeliveries as _r}from"../core/canvas/deliveries.js";import{resetHandedOffDaemonActions as br}from"../core/canvas/daemon-actions.js";import{sweepReviews as kr}from"./review/sweep.js";import{pidfilePath as U}from"./pidfile.js";import{rendererWarning as Pr}from"../core/runtime/package-health.js";import{DEFAULT_INTERVAL_MS as Er}from"./supervise-cadence.js";import{createResumeDetector as Rr}from"./resume-detector.js";import{setFatalFaultAnnouncer as Ir}from"../core/canvas/recovery.js";import{BrokerSupervisionReconciler as xr}from"./reconcilers/broker-supervision.js";import{ControllerDeathReconciler as Dr}from"./reconcilers/controller-death.js";import{NodeLifecycleReconciler as Tr}from"./reconcilers/node-lifecycle/tick.js";import{NodeDeadlineReconciler as Cr}from"./reconcilers/node-deadline.js";import{CronLaneReconciler as Lr}from"./reconcilers/cron-lane.js";import{DeliveryLaneReconciler as $r}from"./reconcilers/delivery-lane.js";import{ActionLaneReconciler as Ar}from"./reconcilers/action-lane.js";import{endLiveExecution as Mr,migrateLegacyExecutionIdentities as Nr}from"../core/canvas/executions.js";import{revokePriorEpochNodeTokens as Fr}from"../core/canvas/node-tokens.js";import{PendingReviewSubmitReconciler as Gr}from"./reconcilers/pending-review-submit.js";import{StorageMaintenanceReconciler as Or}from"./reconcilers/storage-maintenance.js";import{StorageDueWorkReconciler as Br}from"./reconcilers/storage-due-work.js";import{BashDeadlineReconciler as Hr}from"./reconcilers/bash-deadline.js";import{FaultRetryBackstopReconciler as jr}from"./reconcilers/fault-retry-backstop.js";import{StructuredRequestReconciler as qr}from"./reconcilers/structured-request-lane.js";import{reconcileStructuredRequestSidecars as zr}from"./structured-requests/boot.js";import{captureLivenessSnapshot as fe,capturePidCommand as Wr,captureTeardownSnapshot as ue,isPidAlive as Ur,isAnyPidAlive as we,killProcessTreePids as he}from"../core/canvas/pid.js";import{bindFleet as Kr,boundFleet as Jr}from"../core/runtime/fleet.js";import{bindDaemonControl as Vr,clearDaemonControl as Qr}from"./control.js";import{execDaemon as Yr,spawnDaemon as Xr}from"./manage.js";import{reconcileAndMigrateBoot as Zr}from"../core/canvas/boot.js";import{resolveInstallId as et}from"../core/canvas/install-id.js";import{setInstallId as rt}from"../core/runtime/nodes.js";import{claimDaemonOwnership as ve,daemonOwnershipClaimed as tt,releaseDaemonOwnership as ge}from"../core/canvas/daemon-owner.js";import{canvasDatabaseUrl as nt,closeAllDbs as K,openDb as ye,withCanvasWrite as ot}from"../core/canvas/db.js";import{importSqliteCanvasIfPresent as it}from"../core/canvas/import-sqlite.js";import{ensurePostgres as at,ensurePostgresHealthy as st,stopPostgres as ct,withPostgresStartLock as dt}from"./postgres/index.js";import{brokerSignalBus as J}from"./broker-signals/bus.js";import{brokerSignalStreams as lt}from"./api/handlers/broker-signals.js";import{reconcilePackages as pt}from"../core/graph/package-reconcile.js";import{startRepoSync as mt}from"../core/graph/repo-sync/index.js";import{prewarmRecentRecipes as ft,reapStaleSpares as ut}from"../core/runtime/warm-pool.js";import{DaemonFleet as wt}from"./fleet.js";import{BOOT_MIGRATIONS as ht}from"./boot-migrations.js";import{emitEvent as m}from"../core/events/emit.js";import{operationIdContext as _}from"../core/events/operation-id.js";import{bindDaemonEventSource as vt}from"../core/events/source.js";import{activateCanvasImport as gt,MigrationBlockedError as yt,runForcedCanvasImport as St}from"../migrations/activation.js";import{convertLegacyProviderStore as _t,convertLegacyScopedStore as bt}from"../core/scoped-state/migrate.js";import{userScopeRoot as kt}from"../core/scope.js";import{secretsDir as Pt}from"../core/layout.js";function V(n,s){return n.includes(` --canvas-home ${s} `)}a(V,"brokerCommandDeclaresCanvasHome");function Q(n){return/ --epoch (\S+) /.exec(n)?.[1]??null}a(Q,"brokerCommandEpoch");const Et=5e3,Se=150;async function Rt(n){const s=fe();if(s===null)throw m({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness"}}),new Error("prior-epoch broker census could not capture the process table");const l=Ke(),w=[];for(const[c,f]of s.processes){const S=f.command;if(f.zombie||!S.includes("broker-cli.js")||!V(S,l)||Q(S)===n)continue;const k=S.trim().split(/\s+/).at(-1)??"";k===""||k.endsWith("broker-cli.js")||w.push({pid:c,nodeId:k})}let d=0;const t=[];for(const c of w){const f=Wr(c.pid);if(f===null||!f.includes("broker-cli.js")||!V(f,l)||Q(f)===n||f.trim().split(/\s+/).at(-1)!==c.nodeId)continue;const S=ue(c.pid,null);if(!S.reused){try{process.platform==="linux"&&P(x)?await C({operation:"stop",pid:c.pid}):process.kill(c.pid,"SIGTERM")}catch{continue}d++,t.push({pid:c.pid,snap:S})}}const g=Date.now()+Et;for(;Date.now()<g&&t.some(c=>we(c.snap.tree.length>0?c.snap.tree:[c.pid]));)await new Promise(c=>setTimeout(c,Se));let h=0;for(const c of t){const f=c.snap.tree.length>0?c.snap.tree:[c.pid];we(f)&&(process.platform==="linux"&&P(x)?await C({operation:"stop",pid:c.pid}):he(f,"SIGKILL",c.snap.identities),h++)}h>0&&await new Promise(c=>setTimeout(c,Se));const u=fe();if(u===null)throw m({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness",stage:"final"}}),new Error("prior-epoch broker census could not capture the final process table");const i=[];for(const[c,f]of u.processes){const S=f.command;f.zombie||!S.includes("broker-cli.js")||V(S,l)&&Q(S)!==n&&i.push(c)}if(i.length>0)throw new Error(`prior-epoch broker census could not prove termination of pid(s): ${i.join(", ")}`);m({level:"info",event:"daemon.census.completed",fields:{prior_epoch_brokers:w.length,sigtermed:d,sigkilled:h}})}a(Rt,"reapPriorEpochBrokers");const It=5e3;async function xt(n){const s=Array.from(n.entries());if(s.length===0)return;for(const[t]of s){const g=(await tr(t))?.status;(g==="active"||g==="idle")&&await pe(t,new Date().toISOString())}const l=s.map(([,t])=>({pid:t.pid,snap:ue(t.pid,null),exited:t.handle.exited}));for(const t of l)if(!t.snap.reused)try{process.platform==="linux"&&P(x)?await C({operation:"stop",pid:t.pid}):process.kill(t.pid,"SIGTERM")}catch{}const w=new Promise(t=>{setTimeout(t,It).unref()});await Promise.allSettled(l.map(t=>Promise.race([t.exited.then(()=>{}),w])));const d=[];for(const t of l)Ur(t.pid)&&(process.platform==="linux"&&P(x)?await C({operation:"stop",pid:t.pid}):he(t.snap.tree.length>0?t.snap.tree:[t.pid],"SIGKILL",t.snap.identities),d.push(t));await Promise.all(d.map(t=>t.exited));for(const[t]of s)await Mr(t,{reason:"daemon-teardown"});m({level:"info",event:"daemon.fleet_teardown.completed",fields:{brokers:l.length,sigkilled:d.length}})}a(xt,"teardownFleet");function _e(){ae(He(U()),{recursive:!0}),Fe(U(),String(process.pid),"utf8")}a(_e,"writePidfile");function be(n){return typeof n=="object"&&n!==null&&n.code==="ENOENT"}a(be,"isMissingPathError");function ke(n){const s=U();let l;try{l=Ge(s,"utf8")}catch(w){if(be(w))return;throw w}if(l.trim()!==String(n))throw new Error(`daemon readiness mirror does not name this invocation (expected pid ${n})`);try{Oe(s)}catch(w){if(be(w))return;throw w}}a(ke,"removeOwnedPidfileMirror");const Dt={acceptsDetachedWork:a(()=>!0,"acceptsDetachedWork"),registerDetached:a(n=>{n.catch(()=>{})},"registerDetached")},B=new xr;Ir(n=>B.handleFatalFault(n,!1));const Tt=new Dr,Ct=new Tr,Lt=new Cr,$t=new Lr,At=new $r,Mt=new Ar,Nt=new Gr,Ft=new Or,Gt=new Br,Ot=new Hr,Bt=new jr,Ht=new qr;async function jt(n=Date.now(),s=Dt){const l=Jr(),w=await B.runFleetPreamble(l);let d,t;try{const h=await le();d=h.filter(i=>i.status==="active"||i.status==="idle"),t=h.filter(i=>i.status==="done"||i.status==="canceled"||i.status==="dead");const u=new Set(t.map(i=>i.node_id));t.push(...(await nr()).filter(i=>!u.has(i.node_id)))}catch(h){m({level:"error",event:"canvas.node_list.failed",error:h});return}await B.run(n,{rows:d,fleet:l,lifecycle:s}),await Tt.run(n,{rows:d});const g=await Ct.run(n,{rows:[...d,...t],fleet:l});await Lt.run(n),await Ht.run(n),await $t.run(n,{lifecycle:s}),await At.run(n,{lifecycle:s}),await Mt.run(n,{lifecycle:s}),await Nt.run(n,{lifecycle:s}),await Ft.run(n,{lifecycle:s,fleet:l}),Gt.run(n,{lifecycle:s}),await We(),Bt.run(n,{fleet:l,lifecycle:s}),await Ot.run(n,{rows:d}),B.warnIfSaturated({fleet:l,lifecycle:s,thresholds:w,frozen:g})}a(jt,"superviseTick");async function qt(n){ae(de(),{recursive:!0,mode:493}),process.platform==="linux"&&Be(de(),493);const s=Ue();if(P(s))throw new Error(`layout refusal cannot bind occupied socket: ${s}`);const l=se((u,i)=>{if(u.method==="GET"&&u.url==="/healthz"){i.writeHead(200,{"content-type":"application/json; charset=utf-8"}),i.end(JSON.stringify({ok:!1,daemon_up:!0,store_accessible:!1,brokers_reconciled:!1,startup_phase:"blocked",startup_blocked:"layout_migration_required"}));return}i.writeHead(503,{"content-type":"application/json; charset=utf-8"}),i.end(JSON.stringify({error:{code:"layout_migration_required",message:"run crtr sys migrate while the runtime is offline",type:"server_error",origin:"runtime",retryable:!1}}))});await new Promise((u,i)=>{l.once("error",i),l.listen(s,()=>{l.off("error",i),u()})});let w;const d=n.tcp??je();if(d){const u=/^(.*):(\d+)$/.exec(d);if(!u||Number(u[2])>65535)throw new Error(`invalid refusal TCP address: ${d}`);const i=se(l.listeners("request")[0]);await new Promise((c,f)=>{i.once("error",f),i.listen(Number(u[2]),u[1],()=>{i.off("error",f),c()})}),w=i}_e();let t;const g=a(()=>(t??=(async()=>{l.closeAllConnections(),w?.closeAllConnections(),await Promise.all([l,w].filter(u=>u!==void 0).map(u=>new Promise((i,c)=>u.close(f=>f?c(f):i())))),ke(process.pid),process.off("SIGINT",h),process.off("SIGTERM",h)})(),t),"cleanup"),h=a(()=>{g().then(()=>process.exit(0),u=>{process.stderr.write(`[crtrd] layout refusal cleanup failed: ${String(u)}
+`),process.exit(1)})},"onSignal");return process.on("SIGINT",h),process.on("SIGTERM",h),g}a(qt,"serveLayoutRefusal");async function zt(n={}){if(Ze())return qt(n);Xe();const s=a(r=>{process.stderr.write(`[crtrd] ${r}
+`)},"logPostgres"),l=!!process.env.CRTR_TEST_PG_URL,{database:w,ownership:d}=l?{database:{url:await nt()},ownership:await ve(ce(16).toString("hex"))}:await dt(async()=>({database:await at({log:s,startLockHeld:!0}),ownership:await ve(ce(16).toString("hex"))}));if(!d.claimed){if(d.reason==="incumbent_alive")process.stderr.write(`[crtrd] already running (pid ${d.incumbentPid??"?"})
+`);else{const r=[d.incumbentPid!==void 0?`pid ${d.incumbentPid}`:void 0,d.verdict!==void 0?`verdict ${d.verdict}`:void 0].filter(y=>y!==void 0),e=r.length>0?` (${r.join(", ")})`:"";process.stderr.write(`[crtrd] claim lost: ${d.reason}${e}
+`),d.reason==="own_identity_indeterminate"&&process.stderr.write("[crtrd] cannot read its own process identity. crouter needs /proc on Linux, or the `ps` command elsewhere (Debian/Ubuntu: apt-get install procps).\n"),(d.reason==="own_identity_indeterminate"||d.reason==="incumbent_malformed")&&(process.exitCode=1)}return async()=>{}}const t=d.claim;let g=null,h=null,u="";try{await Rt(t.token),bt({kind:"user",root:kt()});for(const e of rr())process.stderr.write(`[crtrd] ${e}
+`);if(process.platform==="darwin"){const{readConfig:e,updateConfig:y}=await import("../core/config.js");if(e("user").paths?.user_files===void 0){const{homedir:o}=await import("node:os");y("user",p=>{p.paths??={},p.paths.user_files??=o()})}}await _t(Pt());for(const e of er())process.stderr.write(`[crtrd] ${e}
+`);await ye(),await it(w.url,s),await J.listen(w.url);const r=await ot(async e=>await pt(e));for(const e of r.conflicts)process.stderr.write(`[crtrd] plugin documents not reconciled: ${e.message}
 `);for(const e of r.invalid)process.stderr.write(`[crtrd] package file is not a document: ${e.path}: ${e.error}
 `);for(const e of r.quarantined)process.stderr.write(`[crtrd] plugin "${e.name}" has a damaged ${e.file} (${e.reason}); ${e.movedTo!==void 0?`moved to ${e.movedTo}`:"left in place and skipped"}
 `);for(const e of r.kinds.refused)process.stderr.write(`[crtrd] plugin "${e.plugin}" kind ${e.kind} not registered: ${e.message}
 `);for(const e of r.kinds.invalid)process.stderr.write(`[crtrd] plugin "${e.plugin}" declares invalid object kinds or scopes; no kinds registered and no app token: ${e.error}
-`);y=await mt(),process.platform==="linux"&&E(I)&&(Ve(),await D({operation:"users.sync",users:await Ue()})),await Lr(t.token)}catch(r){await U.close();try{const{released:e}=await he(t);if(!e)throw new Error("daemon ownership claim was not released");await W()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}let h=!0,f,a=Promise.resolve(),c=!1,m,v;const k=new Set;let F=!1,V=!1,P,M,B,Q=!1,N,C,L,$,H;const be=_r();let R,g={phase:"initializing",message:"daemon startup is running the canvas import and normal services are unavailable",blockerPaths:[]},T="initial startup activation",ke=null;function Ee(){return g.phase==="ready"?null:{phase:g.phase,message:g.message,blockerPaths:g.blockerPaths}}i(Ee,"startupBlock");function b(r){k.add(r),r.finally(()=>{k.delete(r)}).catch(()=>{})}i(b,"registerDetached");const Y={acceptsDetachedWork:i(()=>h,"acceptsDetachedWork"),registerDetached:b};await st(Y,ve);async function Pe(){try{h=!1,it.close(),await U.close(),m!==void 0&&(clearInterval(m),m=void 0),L!==void 0&&(clearInterval(L),L=void 0),H?.(),H=void 0;let r;do r=a,await r;while(r!==a);for(;k.size>0;)await Promise.allSettled([...k]);if(v!==void 0&&(await Et(v),await v.exitsSettled(),v.dispose()),B!==void 0&&await B.close(),M!==void 0&&!Q&&(Q=!0,await M.close()),$!==void 0){const e=$;$=void 0,await e.stop()}if(C!==void 0){const e=C;C=void 0,await e.close()}if(N!==void 0){const e=N;N=void 0,await e.close()}if(F||(_e(process.pid),F=!0),F&&!V){const{released:e}=await he(t);if(!e)throw new Error("daemon ownership claim was not released");V=!0,await W()}}finally{Wr(),process.off("SIGINT",ee),process.off("SIGTERM",re),process.off("exit",te)}}i(Pe,"cleanupAttempt");const G=1e3;let X=!1;function Re(){return X?{graceMs:G}:(X=!0,_.fresh(()=>{u({level:"info",event:"daemon.handover.armed",fields:{pid:process.pid,grace_ms:G}})}),setTimeout(()=>{xe()},G),{graceMs:G})}i(Re,"requestHandover");async function xe(){try{await x()}catch(r){const e=r instanceof Error?r.stack??r.message:String(r);process.stderr.write(`[crtrd] handover cleanup failed:
+`);u=await et(),rt(u),g=await dr(),g!==null&&(pr(g.id),h=await lr()),process.platform==="linux"&&P(x)&&(Ye(),await C({operation:"users.sync",users:await Je()})),await Fr(t.token)}catch(r){await J.close();try{const{released:e}=await ge(t);if(!e)throw new Error("daemon ownership claim was not released");await K()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}let i=!0,c,f=Promise.resolve(),S=!1,k,D;const N=new Set;let H=!1,Y=!1,E,F,j,X=!1,G,L,$,A,q;const Pe=Rr();let R,v={phase:"initializing",message:"daemon startup is running the canvas import and normal services are unavailable",blockerPaths:[]},T="initial startup activation",Ee=null;function Re(){return v.phase==="ready"?null:{phase:v.phase,message:v.message,blockerPaths:v.blockerPaths}}a(Re,"startupBlock");function b(r){N.add(r),r.finally(()=>{N.delete(r)}).catch(()=>{})}a(b,"registerDetached");const Z={acceptsDetachedWork:a(()=>i,"acceptsDetachedWork"),registerDetached:b};await mt(Z,ye);async function Ie(){try{i=!1,lt.close(),await J.close(),k!==void 0&&(clearInterval(k),k=void 0),$!==void 0&&(clearInterval($),$=void 0),q?.(),q=void 0;let r;do r=f,await r;while(r!==f);for(;N.size>0;)await Promise.allSettled([...N]);if(D!==void 0&&(await xt(D),await D.exitsSettled(),D.dispose()),j!==void 0&&await j.close(),F!==void 0&&!X&&(X=!0,await F.close()),A!==void 0){const e=A;A=void 0,await e.stop()}if(L!==void 0){const e=L;L=void 0,await e.close()}if(G!==void 0){const e=G;G=void 0,await e.close()}if(H||(ke(process.pid),H=!0),H&&!Y){const{released:e}=await ge(t);if(!e)throw new Error("daemon ownership claim was not released");Y=!0,await K()}}finally{Qr(),process.off("SIGINT",te),process.off("SIGTERM",ne),process.off("exit",oe)}}a(Ie,"cleanupAttempt");const O=1e3;let ee=!1;function xe(){return ee?{graceMs:O}:(ee=!0,_.fresh(()=>{m({level:"info",event:"daemon.handover.armed",fields:{pid:process.pid,grace_ms:O}})}),setTimeout(()=>{De()},O),{graceMs:O})}a(xe,"requestHandover");async function De(){try{await I()}catch(r){const e=r instanceof Error?r.stack??r.message:String(r);process.stderr.write(`[crtrd] handover cleanup failed:
 ${e}
-`),process.exit(1)}try{process.platform==="linux"&&E(I)&&(await D({operation:"daemon.handover"}),process.exit(0)),process.pid===1&&await Ur();const r=await Kr({waitForJoinLock:!0});_.fresh(()=>{u({level:"info",event:"daemon.handover.completed",fields:{predecessor_pid:process.pid,successor_pid:r.pid??r.existing_pid??null,spawned:r.started}})})}catch(r){_.fresh(()=>{u({level:"error",event:"daemon.handover.successor_failed",error:r})});const e=r instanceof Error?r.message:String(r);process.stderr.write(`[crtrd] handover successor failed to start: ${e}
-`),process.exit(1)}process.exit(0)}i(xe,"performHandover");function x(){if(P!==void 0)return P;const r=Pe();return P=r,r.then(()=>{P===r&&(P=void 0)},()=>{P===r&&(P=void 0)}),r}i(x,"requestCleanup");async function Z(r){try{await x(),await nt({claimed:i(async()=>{try{return await Yr()}finally{await W()}},"claimed")}),process.exit(0)}catch(e){process.exitCode=1;const o=e instanceof Error?e.stack??`${e.name}: ${e.message}`:String(e);process.stderr.write(`[crtrd] ${r} cleanup failed:
-${o}
-`),process.exit(1)}}i(Z,"handleSignal");function ee(){Z("SIGINT")}i(ee,"onSigint");function re(){Z("SIGTERM")}i(re,"onSigterm");function te(){x().catch(()=>{})}i(te,"onExit");async function j(r){h&&(a=a.then(r).then(()=>{},e=>{_.fresh(()=>{u({level:"error",event:"daemon.lane_job.failed",error:e})})}))}i(j,"enqueue");async function ne(){!h||c||(be.check()&&R&&(u({level:"info",event:"daemon.resume.detected"}),b(R().catch(()=>{}))),c=!0,await j(async()=>{if(c=!1,!!h)try{l||await tt({log:s}),await Ot(Date.now(),Y)}catch(r){_.fresh(()=>{u({level:"error",event:"daemon.tick.failed",error:r})})}}))}i(ne,"enqueueTick");let A=null;async function Ie(){if(A!==null)throw{status:500,code:"admission_failed",message:`daemon admission previously failed: ${A instanceof Error?A.message:String(A)}`};if(g.phase==="ready")return{admitted:!1,already_admitted:!0,startup_phase:"ready"};if(g.phase!=="prepared"&&g.phase!=="recovering")throw{status:409,code:"not_prepared",message:g.message};const r=g.phase==="prepared";try{return await q(),g={phase:"ready",message:"",blockerPaths:[]},r?{admitted:!0,already_admitted:!1,startup_phase:"ready"}:{admitted:!1,already_admitted:!0,startup_phase:"ready"}}catch(e){throw A=e,{status:500,code:"admission_failed",message:`daemon admission failed: ${e instanceof Error?e.message:String(e)}`}}}i(Ie,"admitStartup");async function Te(r){if(T!==null)throw{status:409,code:"migration_in_progress",message:`the canvas import is already running (${T})`};T="repair";try{const e=await ht({dryRun:r.dryRun});if(r.dryRun||e.pending||g.phase!=="blocked")return{result:e,resumed:!1};if(n.prepare)return g={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]},{result:e,resumed:!1};try{return await q(),g={phase:"ready",message:"",blockerPaths:[]},{result:e,resumed:!0}}catch(o){const p=o instanceof Error?o.message:String(o);return setTimeout(()=>{x().catch(()=>{})},1e3),{result:e,resumed:!1,resumeError:p}}}finally{T=null}}i(Te,"repairMigrations");async function De(){f=n.intervalMs??Sr;const r=t.token;v=new lt({epoch:r,enqueue:j}),jr(v),g={phase:"recovering",message:"daemon startup recovery is running and normal services are unavailable",blockerPaths:[]},_.fresh(()=>{u({level:"info",event:"daemon.started",fields:{pid:process.pid,interval_ms:f}})});const e=await Vr();if(Qr(e),_.fresh(()=>{u({level:"info",event:"daemon.install_id.resolved",fields:{install_id:e}})}),_.fresh(()=>{let o;try{o=yr()}catch{return}o!==null&&u({level:"warn",event:"daemon.startup.warning",fields:{stage:"termrender",warning:o.slice(0,2048)}})}),await _.fresh(async()=>{await gr(),await wr(),await hr(Date.now()),await vr(Date.now())}),await _.fresh(async()=>{const{reconcile:o,migrated:p}=await Jr(Cr);o.changed&&u({level:"info",event:"daemon.boot_change.reconciled",fields:{cleared_count:o.cleared.length,same_boot_proven:o.sameBootProven}}),p.length>0&&u({level:"info",event:"daemon.pid_identity.migrated",fields:{migrated_count:p.length}})}),await _.fresh(async()=>{for(const o of await ce())o.status!=="active"||o.pi_pid!=null||o.frozen_at!=null||o.respawn_not_before!=null||(await de(o.node_id,new Date().toISOString()),u({level:"warn",event:"daemon.startup.launch_debt_recorded",node_id:o.node_id}))}),await _.fresh(async()=>{await Fr();for(const o of pt){const p=o.apply();p.changed&&u({level:"info",event:"daemon.boot_migration.applied",fields:{migration:o.id,...p.summary}})}}),b(fr()),R){const o=i(()=>{b(R().catch(()=>{})),b($e().then(p=>$?.observe(p)).then(()=>{},p=>{u({level:"warn",event:"daemon.peer.status_failed",error:p})}))},"refresh");b(pr().catch(()=>{})),b(mr().then(({completion:p})=>p).catch(p=>{u({level:"error",event:"daemon.grants.sweep_failed",error:p})})),o(),L=setInterval(o,lr*1e3),L.unref(),H=Le({joined:!0,register:b})}await j(async()=>{await dt(),await ct()}),m=setInterval(()=>{ne().catch(o=>u({level:"error",event:"daemon.tick.failed",error:o}))},f),await ne()}i(De,"completeStartup");function q(){return ke??=De().catch(r=>{throw g={phase:"initializing",message:"daemon startup recovery failed and normal services are unavailable",blockerPaths:[]},r})}i(q,"resumeStartup");try{process.on("SIGINT",ee),process.on("SIGTERM",re),process.on("exit",te),ft(),y!==null&&u({level:"info",event:"daemon.joined_owner.applied",fields:{owner:y.owner,rows:y.rows}}),N=await je();const r=t.token;zr({epoch:r,requestHandover:Re,registerDetached:b,startupBlock:Ee,admitStartup:Ie,repairMigrations:Te}),ye(),M=tr({tcp:n.tcp}),await M.ready;const e=He()??le("user").document_port,o=nr(e,or());try{await o.ready,B=o}catch(S){u({level:"warn",event:"daemon.document_listener.bind_failed",fields:{port:e,error:S instanceof Error?S.message:String(S)}})}const p=le("user").runtime;p?.issuer?(R=dr(p.issuer,b),p.unsandboxed===!0&&($=Ae({syncGrants:R})),sr(S=>cr().appended(S))):await ar(),p?.unsandboxed===!0&&p.listener!==void 0&&u({level:"warn",event:"daemon.app_listener.refused_unsandboxed",fields:{reason:"runtime.unsandboxed is set; runtime.listener is ignored"}}),p!==void 0&&p.listener!==void 0&&p.unsandboxed!==!0&&(C=await ir(p,async()=>await ur(p.issuer.replace(/\/$/,"")),R),await C.ready);try{await ut()}catch(S){if(T=null,S instanceof wt)return g={phase:"blocked",message:S.message,blockerPaths:S.blockerPaths},x;throw S}process.platform==="linux"&&E(I)&&(Je(),await Ke("app:terminal"));try{n.prepare?g={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]}:(await q(),g={phase:"ready",message:"",blockerPaths:[]})}finally{T=null}return x}catch(r){try{await x()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}}i(Bt,"runDaemon");var So=Bt;export{K as brokerCommandDeclaresCanvasHome,J as brokerCommandEpoch,So as default,Bt as runDaemon,Ot as superviseTick,Et as teardownFleet};
+`),process.exit(1)}try{process.platform==="linux"&&P(x)&&(await C({operation:"daemon.handover"}),process.exit(0)),process.pid===1&&await Yr();const r=await Xr({waitForJoinLock:!0});_.fresh(()=>{m({level:"info",event:"daemon.handover.completed",fields:{predecessor_pid:process.pid,successor_pid:r.pid??r.existing_pid??null,spawned:r.started}})})}catch(r){_.fresh(()=>{m({level:"error",event:"daemon.handover.successor_failed",error:r})});const e=r instanceof Error?r.message:String(r);process.stderr.write(`[crtrd] handover successor failed to start: ${e}
+`),process.exit(1)}process.exit(0)}a(De,"performHandover");function I(){if(E!==void 0)return E;const r=Ie();return E=r,r.then(()=>{E===r&&(E=void 0)},()=>{E===r&&(E=void 0)}),r}a(I,"requestCleanup");async function re(r){try{await I(),await ct({claimed:a(async()=>{try{return await tt()}finally{await K()}},"claimed")}),process.exit(0)}catch(e){process.exitCode=1;const y=e instanceof Error?e.stack??`${e.name}: ${e.message}`:String(e);process.stderr.write(`[crtrd] ${r} cleanup failed:
+${y}
+`),process.exit(1)}}a(re,"handleSignal");function te(){re("SIGINT")}a(te,"onSigint");function ne(){re("SIGTERM")}a(ne,"onSigterm");function oe(){I().catch(()=>{})}a(oe,"onExit");async function z(r){i&&(f=f.then(r).then(()=>{},e=>{_.fresh(()=>{m({level:"error",event:"daemon.lane_job.failed",error:e})})}))}a(z,"enqueue");async function ie(){!i||S||(Pe.check()&&R&&(m({level:"info",event:"daemon.resume.detected"}),b(R().catch(()=>{}))),S=!0,await z(async()=>{if(S=!1,!!i)try{l||await st({log:s}),await jt(Date.now(),Z)}catch(r){_.fresh(()=>{m({level:"error",event:"daemon.tick.failed",error:r})})}}))}a(ie,"enqueueTick");let M=null;async function Te(){if(M!==null)throw{status:500,code:"admission_failed",message:`daemon admission previously failed: ${M instanceof Error?M.message:String(M)}`};if(v.phase==="ready")return{admitted:!1,already_admitted:!0,startup_phase:"ready"};if(v.phase!=="prepared"&&v.phase!=="recovering")throw{status:409,code:"not_prepared",message:v.message};const r=v.phase==="prepared";try{return await W(),v={phase:"ready",message:"",blockerPaths:[]},r?{admitted:!0,already_admitted:!1,startup_phase:"ready"}:{admitted:!1,already_admitted:!0,startup_phase:"ready"}}catch(e){throw M=e,{status:500,code:"admission_failed",message:`daemon admission failed: ${e instanceof Error?e.message:String(e)}`}}}a(Te,"admitStartup");async function Ce(r){if(T!==null)throw{status:409,code:"migration_in_progress",message:`the canvas import is already running (${T})`};T="repair";try{const e=await St({dryRun:r.dryRun});if(r.dryRun||e.pending||v.phase!=="blocked")return{result:e,resumed:!1};if(n.prepare)return v={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]},{result:e,resumed:!1};try{return await W(),v={phase:"ready",message:"",blockerPaths:[]},{result:e,resumed:!0}}catch(y){const o=y instanceof Error?y.message:String(y);return setTimeout(()=>{I().catch(()=>{})},1e3),{result:e,resumed:!1,resumeError:o}}}finally{T=null}}a(Ce,"repairMigrations");async function Le(){c=n.intervalMs??Er;const r=t.token;D=new wt({epoch:r,enqueue:z}),Kr(D),v={phase:"recovering",message:"daemon startup recovery is running and normal services are unavailable",blockerPaths:[]},_.fresh(()=>{m({level:"info",event:"daemon.started",fields:{pid:process.pid,interval_ms:c}})});const e=u;_.fresh(()=>{m({level:"info",event:"daemon.install_id.resolved",fields:{install_id:e}})});const y=await cr(e);if(_.fresh(()=>{m({level:"info",event:"daemon.environment.registered",fields:{environment_id:y.environmentId,created:y.created}})}),_.fresh(()=>{let o;try{o=Pr()}catch{return}o!==null&&m({level:"warn",event:"daemon.startup.warning",fields:{stage:"termrender",warning:o.slice(0,2048)}})}),await _.fresh(async()=>{await kr(),await Sr(),await _r(Date.now()),await br(Date.now())}),await _.fresh(async()=>{const{reconcile:o,migrated:p}=await Zr(Nr);o.changed&&m({level:"info",event:"daemon.boot_change.reconciled",fields:{cleared_count:o.cleared.length,same_boot_proven:o.sameBootProven}}),p.length>0&&m({level:"info",event:"daemon.pid_identity.migrated",fields:{migrated_count:p.length}})}),await _.fresh(async()=>{for(const o of await le())o.status!=="active"||o.pi_pid!=null||o.frozen_at!=null||o.respawn_not_before!=null||(await pe(o.node_id,new Date().toISOString()),m({level:"warn",event:"daemon.startup.launch_debt_recorded",node_id:o.node_id}))}),await _.fresh(async()=>{await zr();for(const o of ht){const p=o.apply();p.changed&&m({level:"info",event:"daemon.boot_migration.applied",fields:{migration:o.id,...p.summary}})}}),b(gr()),R){const o=a(()=>{b(R().catch(()=>{})),b(Me().then(p=>A?.observe(p)).then(()=>{},p=>{m({level:"warn",event:"daemon.peer.status_failed",error:p})}))},"refresh");b(hr().catch(()=>{})),b(vr().then(({completion:p})=>p).catch(p=>{m({level:"error",event:"daemon.grants.sweep_failed",error:p})})),o(),$=setInterval(o,wr*1e3),$.unref(),q=Ae({joined:!0,register:b})}await z(async()=>{await ut(),await ft()}),k=setInterval(()=>{ie().catch(o=>m({level:"error",event:"daemon.tick.failed",error:o}))},c),await ie()}a(Le,"completeStartup");function W(){return Ee??=Le().catch(r=>{throw v={phase:"initializing",message:"daemon startup recovery failed and normal services are unavailable",blockerPaths:[]},r})}a(W,"resumeStartup");try{process.on("SIGINT",te),process.on("SIGTERM",ne),process.on("exit",oe),vt(),g!==null&&m({level:"info",event:"daemon.person.resolved",fields:{person_id:g.id,source:g.source}}),h!==null&&m({level:"info",event:"daemon.person.retired",fields:{person_id:h.person,joined_from:h.joinedFrom,retired:h.retired,columns:h.columns}}),G=await ze();const r=t.token;Vr({epoch:r,requestHandover:xe,registerDetached:b,startupBlock:Re,admitStartup:Te,repairMigrations:Ce}),_e(),F=or({tcp:n.tcp}),await F.ready;const e=qe()??me("user").document_port,y=ir(e,ar());try{await y.ready,j=y}catch(p){m({level:"warn",event:"daemon.document_listener.bind_failed",fields:{port:e,error:p instanceof Error?p.message:String(p)}})}const o=me("user").runtime;o?.issuer&&(R=ur(o.issuer,b),o.unsandboxed===!0&&(A=Ne({syncGrants:R})),mr(p=>fr().appended(p))),o?.unsandboxed===!0&&o.listener!==void 0&&m({level:"warn",event:"daemon.app_listener.refused_unsandboxed",fields:{reason:"runtime.unsandboxed is set; runtime.listener is ignored"}}),o!==void 0&&o.listener!==void 0&&o.unsandboxed!==!0&&(L=await sr(o,async()=>await yr(o.issuer.replace(/\/$/,"")),R),await L.ready);try{await gt()}catch(p){if(T=null,p instanceof yt)return v={phase:"blocked",message:p.message,blockerPaths:p.blockerPaths},I;throw p}process.platform==="linux"&&P(x)&&(Qe(),await Ve("app:terminal"));try{n.prepare?v={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]}:(await W(),v={phase:"ready",message:"",blockerPaths:[]})}finally{T=null}return I}catch(r){try{await I()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}}a(zt,"runDaemon");var Po=zt;export{V as brokerCommandDeclaresCanvasHome,Q as brokerCommandEpoch,Po as default,zt as runDaemon,jt as superviseTick,xt as teardownFleet};

package/dist/daemon/reconcilers/storage-maintenance.d.ts

@@ -16,6 +16,7 @@ export interface StorageMaintenanceContext {
 export declare class StorageMaintenanceReconciler {
     private lastSpareSweepAt;
     private lastCreateRequestSweepAt;
+    private lastEnvironmentTouchAt;
     private lastRunExpiryAt;
     private lastRunEventPassAt;
     private runEventCursor;
@@ -58,6 +59,8 @@ export declare class StorageMaintenanceReconciler {
     private gcStaleFocuses;
     /** Delete create idempotency keys once their bounded recovery window ends. */
     private gcCreateRequests;
+    /** Stamp the machine environment as seen. A failed stamp is an event, never an error out of the tick. */
+    private touchEnvironment;
     /** Collect dead or expired hidden warm-pool spares. */
     private gcWarmPool;
 }

package/dist/daemon/reconcilers/storage-maintenance.js

@@ -1 +1 @@
-var I=Object.defineProperty;var l=(f,t)=>I(f,"name",{value:t,configurable:!0});import{rm as E}from"node:fs/promises";import{closeFocusRow as y,getFocusById as S,listFocuses as A,listNodes as N}from"../../core/canvas/index.js";import{pruneExpiredIdempotencyKeys as w}from"../../core/runs/operations.js";import{getNode as R,lastActivityMs as u,listTerminalPlacementResidue as g,pruneExpiredCreateRequests as T,pruneNodes as C}from"../../core/canvas/canvas.js";import{lastContextStripMs as F,stripContextDir as x}from"../../core/canvas/context-strip.js";import{isAppRun as P}from"../../core/canvas/app-run.js";import{isSafeNodeId as c}from"../../core/canvas/paths.js";import{emitEvent as s}from"../../core/events/emit.js";import{operationIdContext as n}from"../../core/events/operation-id.js";import{listLivePanesAsync as D,tearDownNode as G}from"../../core/runtime/placement.js";import{reapStaleSpares as V}from"../../core/runtime/warm-pool.js";import{GroveInstanceSweepReconciler as b}from"./grove-instance-sweep.js";import{ManagedWorktreeSweepReconciler as M}from"./managed-worktree-sweep.js";import{compactRunEvents as W,expireRunEvents as Y}from"../../core/runs/events.js";import{openDb as k}from"../../core/canvas/db.js";import{retentionHold as _}from"./live-obligation.js";import{pruneMemoryReads as q}from"../../core/canvas/memory-reads.js";import{existsSync as L}from"node:fs";import{launcherRequest as O}from"../../launcher/client.js";import{LAUNCHER_SOCKET as z}from"../../launcher/spec.js";import{cachePassDue as U}from"../../launcher/limits/policy.js";const H=10*6e4,K=60*1e3,$=60*1e3,m=5*6e4,B=14,Q=1440*6e4,X=2e3;class Ee{static{l(this,"StorageMaintenanceReconciler")}lastSpareSweepAt=Number.NEGATIVE_INFINITY;lastCreateRequestSweepAt=Number.NEGATIVE_INFINITY;lastRunExpiryAt=Number.NEGATIVE_INFINITY;lastRunEventPassAt=Number.NEGATIVE_INFINITY;runEventCursor=0;lastAnalyzeAt=Number.NEGATIVE_INFINITY;lastRetentionSweepAt=Number.NEGATIVE_INFINITY;lastContextStripAt=Number.NEGATIVE_INFINITY;contextStripInFlight=!1;focusGcInFlight=!1;lastCachePassAt=null;cachePassInFlight=!1;worktreeSweep=new M;groveInstanceSweep=new b;async run(t,r){if(await this.reapDeadResidue(t),this.scheduleFocusGc(r),await this.gcWarmPool(t),await this.gcCreateRequests(t),t-this.lastRunEventPassAt>=X){this.lastRunEventPassAt=t;try{await Y(t);const e=await W(t,this.runEventCursor);this.runEventCursor=e.cursor}catch(e){console.warn(`run event maintenance failed: ${String(e)}`)}}if(t-this.lastRunExpiryAt>=60*6e4){try{await q(t)}catch(e){console.warn(`memory-read log prune failed: ${String(e)}`)}this.lastRunExpiryAt=t}t-this.lastAnalyzeAt>=1440*6e4&&(await(await k()).exec("ANALYZE"),this.lastAnalyzeAt=t),await this.sweepRetention(t,r),this.scheduleCachePass(t,r),this.scheduleContextStrip(t,r),this.worktreeSweep.run(t,r),this.groveInstanceSweep.run(t,r)}scheduleCachePass(t,r){this.cachePassInFlight||!U(this.lastCachePassAt,t)||process.platform!=="linux"||!L(z)||r.lifecycle.acceptsDetachedWork()&&(this.lastCachePassAt=t,this.cachePassInFlight=!0,r.lifecycle.registerDetached(O({operation:"cache.purge"}).then(()=>{}).catch(e=>{n.fresh(()=>{s({level:"warn",event:"app.cache.pass_failed",error:e})})}).then(()=>{this.cachePassInFlight=!1})))}msSinceTerminalActivity(t,r){const e=u(t);return e===0?Number.POSITIVE_INFINITY:r-e}async sweepRetention(t,r){t-this.lastRetentionSweepAt<m||r.lifecycle.acceptsDetachedWork()&&(this.lastRetentionSweepAt=t,await n.fresh(async()=>{try{const e=await C({ttlDays:B,held:await _(r.fleet),removeDirs:l(a=>{r.lifecycle.registerDetached(Promise.all(a.map(o=>E(o,{recursive:!0,force:!0}))).then(()=>{}).catch(o=>{n.fresh(()=>{s({level:"error",event:"canvas.retention.failed",error:o})})}))},"removeDirs")});e.pruned.length>0&&s({level:"info",event:"canvas.retention.pruned",outcome:"succeeded",fields:{pruned_count:e.pruned.length}})}catch(e){s({level:"error",event:"canvas.retention.failed",error:e})}}))}scheduleContextStrip(t,r){if(this.contextStripInFlight||t-this.lastContextStripAt<m||!r.lifecycle.acceptsDetachedWork())return;this.lastContextStripAt=t,this.contextStripInFlight=!0;const e=this.stripFinishedContexts(t,r).finally(()=>{this.contextStripInFlight=!1});r.lifecycle.registerDetached(e)}async stripFinishedContexts(t,r){const e=await _(r.fleet),a=l(async i=>i!==null&&["done","canceled","dead"].includes(i.status)&&(i.pi_pid??null)===null&&(i.frozen_at??null)===null&&!P(i)&&u(i)<t-Q&&!await e(i.node_id),"eligible");let o=0,p=0;try{for(const i of await N({status:["done","canceled","dead"]})){if(!c(i.node_id)||!await a(i))continue;const h=await F(i.node_id);if(h!==null&&h>=u(i)||!await a(await R(i.node_id)))continue;let d;try{d=await x(i.node_id)}catch(v){n.fresh(()=>{s({level:"warn",event:"canvas.context_strip.node_failed",error:v,fields:{node_id:i.node_id}})});continue}d.removed.length>0&&(o+=1,p+=d.bytes)}}catch(i){n.fresh(()=>{s({level:"error",event:"canvas.context_strip.failed",error:i})})}o>0&&n.fresh(()=>{s({level:"info",event:"canvas.context_strip.completed",outcome:"succeeded",fields:{node_count:o,bytes:p}})})}async reapDeadResidue(t){let r;try{r=await g()}catch(e){n.fresh(()=>{s({level:"error",event:"residue.reap_scan.failed",error:e})});return}for(const e of r){try{if(this.msSinceTerminalActivity(e,t)<H)continue}catch(a){n.fresh(()=>{s({level:"error",event:"residue.reap.failed",...c(e.node_id)?{node_id:e.node_id}:{},error:a,fields:{...c(e.node_id)?{}:{affected_node_id:e.node_id},pane:e.pane,window:e.window,tmux_session:e.tmux_session}})});continue}await n.fresh(async()=>{try{s({level:"info",event:"residue.reaped",...c(e.node_id)?{node_id:e.node_id}:{},fields:{...c(e.node_id)?{}:{affected_node_id:e.node_id},pane:e.pane,window:e.window,tmux_session:e.tmux_session}}),await G(e.node_id)}catch(a){s({level:"error",event:"residue.reap.failed",...c(e.node_id)?{node_id:e.node_id}:{},error:a,fields:{...c(e.node_id)?{}:{affected_node_id:e.node_id},pane:e.pane,window:e.window,tmux_session:e.tmux_session}})}})}}scheduleFocusGc(t){if(this.focusGcInFlight||!t.lifecycle.acceptsDetachedWork())return;this.focusGcInFlight=!0;const r=this.gcStaleFocuses().finally(()=>{this.focusGcInFlight=!1});t.lifecycle.registerDetached(r)}async gcStaleFocuses(){let t;try{t=await A()}catch(e){n.fresh(()=>{s({level:"error",event:"focus.gc.failed",error:e})});return}if(t.length===0)return;let r;try{r=await D()}catch(e){n.fresh(()=>{s({level:"error",event:"focus.gc.failed",error:e})});return}if(r!==null)for(const e of t){if(e.pane===null||r.has(e.pane))continue;if(!await n.fresh(async()=>{try{return(await S(e.focus_id))?.pane!==e.pane||(s({level:"info",event:"focus.gc.removed",...c(e.node_id)?{node_id:e.node_id}:{},fields:{focus_id:e.focus_id,focus_node_id:e.node_id,pane:e.pane}}),await y(e.focus_id)),!0}catch(o){return s({level:"error",event:"focus.gc.failed",error:o}),!1}}))return}}async gcCreateRequests(t){t-this.lastCreateRequestSweepAt<$||(this.lastCreateRequestSweepAt=t,await n.fresh(async()=>{const r=await T(t),e=await w(t);e>0&&s({level:"info",event:"canvas.idempotency_keys.reaped",outcome:"succeeded",fields:{reaped_count:e}}),r>0&&s({level:"info",event:"canvas.create_requests.reaped",outcome:"succeeded",fields:{reaped_count:r}})}))}async gcWarmPool(t){t-this.lastSpareSweepAt<K||(this.lastSpareSweepAt=t,await n.fresh(async()=>{const r=await V();r.length>0&&s({level:"info",event:"warm_pool.spares_reaped",outcome:"succeeded",fields:{reaped_count:r.length}})}))}}export{Q as CONTEXT_STRIP_GRACE_MS,H as DEAD_REAP_GRACE_MS,m as RETENTION_SWEEP_INTERVAL_MS,B as RETENTION_TTL_DAYS,Ee as StorageMaintenanceReconciler};
+var I=Object.defineProperty;var l=(f,t)=>I(f,"name",{value:t,configurable:!0});import{rm as y}from"node:fs/promises";import{closeFocusRow as A,getFocusById as S,listFocuses as N,listNodes as w}from"../../core/canvas/index.js";import{pruneExpiredIdempotencyKeys as R}from"../../core/runs/operations.js";import{getNode as g,lastActivityMs as u,listTerminalPlacementResidue as T,pruneExpiredCreateRequests as C,pruneNodes as F}from"../../core/canvas/canvas.js";import{lastContextStripMs as x,stripContextDir as P}from"../../core/canvas/context-strip.js";import{isAppRun as D}from"../../core/canvas/app-run.js";import{isSafeNodeId as c}from"../../core/canvas/paths.js";import{emitEvent as i}from"../../core/events/emit.js";import{operationIdContext as s}from"../../core/events/operation-id.js";import{listLivePanesAsync as G,tearDownNode as V}from"../../core/runtime/placement.js";import{reapStaleSpares as b}from"../../core/runtime/warm-pool.js";import{GroveInstanceSweepReconciler as M}from"./grove-instance-sweep.js";import{ManagedWorktreeSweepReconciler as Y}from"./managed-worktree-sweep.js";import{compactRunEvents as W,expireRunEvents as k}from"../../core/runs/events.js";import{openDb as q}from"../../core/canvas/db.js";import{touchMachineEnvironment as L}from"../../core/environments.js";import{retentionHold as _}from"./live-obligation.js";import{pruneMemoryReads as O}from"../../core/canvas/memory-reads.js";import{existsSync as z}from"node:fs";import{launcherRequest as U}from"../../launcher/client.js";import{LAUNCHER_SOCKET as H}from"../../launcher/spec.js";import{cachePassDue as K}from"../../launcher/limits/policy.js";const $=10*6e4,m=60*1e3,B=60*1e3,v=5*6e4,Q=14,X=1440*6e4,Z=2e3;class Ae{static{l(this,"StorageMaintenanceReconciler")}lastSpareSweepAt=Number.NEGATIVE_INFINITY;lastCreateRequestSweepAt=Number.NEGATIVE_INFINITY;lastEnvironmentTouchAt=Number.NEGATIVE_INFINITY;lastRunExpiryAt=Number.NEGATIVE_INFINITY;lastRunEventPassAt=Number.NEGATIVE_INFINITY;runEventCursor=0;lastAnalyzeAt=Number.NEGATIVE_INFINITY;lastRetentionSweepAt=Number.NEGATIVE_INFINITY;lastContextStripAt=Number.NEGATIVE_INFINITY;contextStripInFlight=!1;focusGcInFlight=!1;lastCachePassAt=null;cachePassInFlight=!1;worktreeSweep=new Y;groveInstanceSweep=new M;async run(t,r){if(await this.reapDeadResidue(t),this.scheduleFocusGc(r),await this.gcWarmPool(t),await this.touchEnvironment(t),await this.gcCreateRequests(t),t-this.lastRunEventPassAt>=Z){this.lastRunEventPassAt=t;try{await k(t);const e=await W(t,this.runEventCursor);this.runEventCursor=e.cursor}catch(e){console.warn(`run event maintenance failed: ${String(e)}`)}}if(t-this.lastRunExpiryAt>=60*6e4){try{await O(t)}catch(e){console.warn(`memory-read log prune failed: ${String(e)}`)}this.lastRunExpiryAt=t}t-this.lastAnalyzeAt>=1440*6e4&&(await(await q()).exec("ANALYZE"),this.lastAnalyzeAt=t),await this.sweepRetention(t,r),this.scheduleCachePass(t,r),this.scheduleContextStrip(t,r),this.worktreeSweep.run(t,r),this.groveInstanceSweep.run(t,r)}scheduleCachePass(t,r){this.cachePassInFlight||!K(this.lastCachePassAt,t)||process.platform!=="linux"||!z(H)||r.lifecycle.acceptsDetachedWork()&&(this.lastCachePassAt=t,this.cachePassInFlight=!0,r.lifecycle.registerDetached(U({operation:"cache.purge"}).then(()=>{}).catch(e=>{s.fresh(()=>{i({level:"warn",event:"app.cache.pass_failed",error:e})})}).then(()=>{this.cachePassInFlight=!1})))}msSinceTerminalActivity(t,r){const e=u(t);return e===0?Number.POSITIVE_INFINITY:r-e}async sweepRetention(t,r){t-this.lastRetentionSweepAt<v||r.lifecycle.acceptsDetachedWork()&&(this.lastRetentionSweepAt=t,await s.fresh(async()=>{try{const e=await F({ttlDays:Q,held:await _(r.fleet),removeDirs:l(a=>{r.lifecycle.registerDetached(Promise.all(a.map(o=>y(o,{recursive:!0,force:!0}))).then(()=>{}).catch(o=>{s.fresh(()=>{i({level:"error",event:"canvas.retention.failed",error:o})})}))},"removeDirs")});e.pruned.length>0&&i({level:"info",event:"canvas.retention.pruned",outcome:"succeeded",fields:{pruned_count:e.pruned.length}})}catch(e){i({level:"error",event:"canvas.retention.failed",error:e})}}))}scheduleContextStrip(t,r){if(this.contextStripInFlight||t-this.lastContextStripAt<v||!r.lifecycle.acceptsDetachedWork())return;this.lastContextStripAt=t,this.contextStripInFlight=!0;const e=this.stripFinishedContexts(t,r).finally(()=>{this.contextStripInFlight=!1});r.lifecycle.registerDetached(e)}async stripFinishedContexts(t,r){const e=await _(r.fleet),a=l(async n=>n!==null&&["done","canceled","dead"].includes(n.status)&&(n.pi_pid??null)===null&&(n.frozen_at??null)===null&&!D(n)&&u(n)<t-X&&!await e(n.node_id),"eligible");let o=0,p=0;try{for(const n of await w({status:["done","canceled","dead"]})){if(!c(n.node_id)||!await a(n))continue;const h=await x(n.node_id);if(h!==null&&h>=u(n)||!await a(await g(n.node_id)))continue;let d;try{d=await P(n.node_id)}catch(E){s.fresh(()=>{i({level:"warn",event:"canvas.context_strip.node_failed",error:E,fields:{node_id:n.node_id}})});continue}d.removed.length>0&&(o+=1,p+=d.bytes)}}catch(n){s.fresh(()=>{i({level:"error",event:"canvas.context_strip.failed",error:n})})}o>0&&s.fresh(()=>{i({level:"info",event:"canvas.context_strip.completed",outcome:"succeeded",fields:{node_count:o,bytes:p}})})}async reapDeadResidue(t){let r;try{r=await T()}catch(e){s.fresh(()=>{i({level:"error",event:"residue.reap_scan.failed",error:e})});return}for(const e of r){try{if(this.msSinceTerminalActivity(e,t)<$)continue}catch(a){s.fresh(()=>{i({level:"error",event:"residue.reap.failed",...c(e.node_id)?{node_id:e.node_id}:{},error:a,fields:{...c(e.node_id)?{}:{affected_node_id:e.node_id},pane:e.pane,window:e.window,tmux_session:e.tmux_session}})});continue}await s.fresh(async()=>{try{i({level:"info",event:"residue.reaped",...c(e.node_id)?{node_id:e.node_id}:{},fields:{...c(e.node_id)?{}:{affected_node_id:e.node_id},pane:e.pane,window:e.window,tmux_session:e.tmux_session}}),await V(e.node_id)}catch(a){i({level:"error",event:"residue.reap.failed",...c(e.node_id)?{node_id:e.node_id}:{},error:a,fields:{...c(e.node_id)?{}:{affected_node_id:e.node_id},pane:e.pane,window:e.window,tmux_session:e.tmux_session}})}})}}scheduleFocusGc(t){if(this.focusGcInFlight||!t.lifecycle.acceptsDetachedWork())return;this.focusGcInFlight=!0;const r=this.gcStaleFocuses().finally(()=>{this.focusGcInFlight=!1});t.lifecycle.registerDetached(r)}async gcStaleFocuses(){let t;try{t=await N()}catch(e){s.fresh(()=>{i({level:"error",event:"focus.gc.failed",error:e})});return}if(t.length===0)return;let r;try{r=await G()}catch(e){s.fresh(()=>{i({level:"error",event:"focus.gc.failed",error:e})});return}if(r!==null)for(const e of t){if(e.pane===null||r.has(e.pane))continue;if(!await s.fresh(async()=>{try{return(await S(e.focus_id))?.pane!==e.pane||(i({level:"info",event:"focus.gc.removed",...c(e.node_id)?{node_id:e.node_id}:{},fields:{focus_id:e.focus_id,focus_node_id:e.node_id,pane:e.pane}}),await A(e.focus_id)),!0}catch(o){return i({level:"error",event:"focus.gc.failed",error:o}),!1}}))return}}async gcCreateRequests(t){t-this.lastCreateRequestSweepAt<B||(this.lastCreateRequestSweepAt=t,await s.fresh(async()=>{const r=await C(t),e=await R(t);e>0&&i({level:"info",event:"canvas.idempotency_keys.reaped",outcome:"succeeded",fields:{reaped_count:e}}),r>0&&i({level:"info",event:"canvas.create_requests.reaped",outcome:"succeeded",fields:{reaped_count:r}})}))}async touchEnvironment(t){t-this.lastEnvironmentTouchAt<m||(this.lastEnvironmentTouchAt=t,await s.fresh(async()=>{try{await L(new Date(t).toISOString())}catch(r){i({level:"warn",event:"environment.touch.failed",error:r})}}))}async gcWarmPool(t){t-this.lastSpareSweepAt<m||(this.lastSpareSweepAt=t,await s.fresh(async()=>{const r=await b();r.length>0&&i({level:"info",event:"warm_pool.spares_reaped",outcome:"succeeded",fields:{reaped_count:r.length}})}))}}export{X as CONTEXT_STRIP_GRACE_MS,$ as DEAD_REAP_GRACE_MS,v as RETENTION_SWEEP_INTERVAL_MS,Q as RETENTION_TTL_DAYS,Ae as StorageMaintenanceReconciler};

package/dist/migrations/004-canvas-documents/apply.js

@@ -1 +1 @@
-var x=Object.defineProperty;var d=(n,r)=>x(n,"name",{value:r,configurable:!0});import{put as N}from"../../core/graph/bodies.js";import{importDocument as O}from"../../core/graph/documents.js";import{linksIn as _}from"../../core/graph/documents.js";import{recordActedOn as M,setLinks as R}from"../../core/graph/edges.js";import{resolveName as $}from"../../core/graph/names.js";import{ensureOwner as y,nodeObject as k,ownerForGrantee as b}from"../../core/graph/objects.js";import{ensureRepo as S}from"../../core/graph/repo-sync/repos.js";import{recordWatch as T}from"../../core/graph/watches.js";import{mapAsync as A}from"../../core/async-array.js";const v="canvas-import",K="004-canvas-documents";async function G(n){const r=await n.prepareUncached("SELECT value FROM canvas_meta WHERE key = ?").get(v);if(r===void 0)return null;const p=JSON.parse(r.value).report;return{...p,resolutions:p.resolutions??[]}}d(G,"readImportRecord");function V(n){const r=new Map;for(const p of n.documents)for(const i of p.revisions)r.has(i.body)||r.set(i.body,N(i.body));return r}d(V,"storePlanBodies");async function Y(n,r,p){const i=new Map(r.owners.map(e=>[e.key,e])),m=new Map,w=d(async e=>{const t=m.get(e.key);if(t)return t;let o;switch(e.type){case"person":o=await b(n,"user:local");break;case"app":o=await y(n,"app","app",`app:${e.handle}`,e.handle);break;case"profile":{const c=i.get(e.ownerKey);if(!c)throw new Error(`import: profile ${e.key} names unplanned app ${e.ownerKey}`);o=await y(n,"profile","profile",e.key.slice(8),e.handle,await w(c));break}case"repo":o=await S(n,{scheme:e.scheme,externalId:e.externalId,handleHint:e.handle},e.handle);break;case"node":o=await k(n,e.handle);break}if(e.type!=="node"&&o.name!==e.handle)throw new Error(`import: owner ${e.key} holds handle ${o.name}, planned ${e.handle}`);return m.set(e.key,o),o},"ownerRow"),I={class:"person",person:await w(i.get("person")??{key:"person",type:"person",handle:"user"})},f=new Map,u=d(async e=>{let t=f.get(e);return t||f.set(e,t=await k(n,e)),t},"node"),h=[];for(const e of r.documents){const t=await w(i.get(e.ownerKey)),o=await O(n,{owner:t,name:e.name,kind:e.kind,preview:e.preview,privacy:e.privacy,summary:e.summary,whyItExists:e.whyItExists,unlisted:e.unlisted,rules:e.rules,lintIgnore:e.lintIgnore,extensions:e.extensions,revisions:await A(e.revisions,async a=>({body_hash:p.get(a.body),author:a.authorNodeId===null?null:await u(a.authorNodeId),rationale:a.rationale,created_at:a.createdAt}))}),c=new Set(e.revisions.flatMap(a=>a.authorNodeId===null?[]:[a.authorNodeId]));h.push({doc:o,owner:t,body:e.revisions[e.revisions.length-1].body,authors:c})}for(const{doc:e,owner:t,body:o,authors:c}of h){const a=[];for(const s of _(o)){const g=s.includes("/")?[s]:[`${t.type==="node"?t.id:t.name}/${s}`,s];for(const E of g){const l=await $(n,I,E);if("object"in l){a.push({written_as:s,dst:l.object});break}if("deleted"in l){a.push({written_as:s,dst:l.deleted});break}}}await R(n,e,a);for(const s of c)await M(n,await u(s),e),await T(n,await u(s),e,"write")}await n.prepareUncached("INSERT INTO canvas_meta (key, value) VALUES (?, ?)").run(v,JSON.stringify({id:K,report:r.report}))}d(Y,"applyPlan");export{v as IMPORT_DONE_KEY,K as IMPORT_ID,Y as applyPlan,G as readImportRecord,V as storePlanBodies};
+var x=Object.defineProperty;var d=(n,r)=>x(n,"name",{value:r,configurable:!0});import{put as N}from"../../core/graph/bodies.js";import{importDocument as O}from"../../core/graph/documents.js";import{linksIn as _}from"../../core/graph/documents.js";import{recordActedOn as M,setLinks as R}from"../../core/graph/edges.js";import{resolveName as $}from"../../core/graph/names.js";import{ensureOwner as y,nodeObject as k,ownerForGrantee as b}from"../../core/graph/objects.js";import{ensureRepo as S}from"../../core/graph/repo-sync/repos.js";import{recordWatch as T}from"../../core/graph/watches.js";import{mapAsync as A}from"../../core/async-array.js";import{personId as K}from"../../core/canvas/person.js";const v="canvas-import",P="004-canvas-documents";async function Y(n){const r=await n.prepareUncached("SELECT value FROM canvas_meta WHERE key = ?").get(v);if(r===void 0)return null;const p=JSON.parse(r.value).report;return{...p,resolutions:p.resolutions??[]}}d(Y,"readImportRecord");function q(n){const r=new Map;for(const p of n.documents)for(const i of p.revisions)r.has(i.body)||r.set(i.body,N(i.body));return r}d(q,"storePlanBodies");async function z(n,r,p){const i=new Map(r.owners.map(e=>[e.key,e])),u=new Map,w=d(async e=>{const t=u.get(e.key);if(t)return t;let o;switch(e.type){case"person":o=await b(n,K());break;case"app":o=await y(n,"app","app",`app:${e.handle}`,e.handle);break;case"profile":{const c=i.get(e.ownerKey);if(!c)throw new Error(`import: profile ${e.key} names unplanned app ${e.ownerKey}`);o=await y(n,"profile","profile",e.key.slice(8),e.handle,await w(c));break}case"repo":o=await S(n,{scheme:e.scheme,externalId:e.externalId,handleHint:e.handle},e.handle);break;case"node":o=await k(n,e.handle);break}if(e.type!=="node"&&o.name!==e.handle)throw new Error(`import: owner ${e.key} holds handle ${o.name}, planned ${e.handle}`);return u.set(e.key,o),o},"ownerRow"),I={class:"person",person:await w(i.get("person")??{key:"person",type:"person",handle:"user"})},f=new Map,m=d(async e=>{let t=f.get(e);return t||f.set(e,t=await k(n,e)),t},"node"),h=[];for(const e of r.documents){const t=await w(i.get(e.ownerKey)),o=await O(n,{owner:t,name:e.name,kind:e.kind,preview:e.preview,privacy:e.privacy,summary:e.summary,whyItExists:e.whyItExists,unlisted:e.unlisted,rules:e.rules,lintIgnore:e.lintIgnore,extensions:e.extensions,revisions:await A(e.revisions,async a=>({body_hash:p.get(a.body),author:a.authorNodeId===null?null:await m(a.authorNodeId),rationale:a.rationale,created_at:a.createdAt}))}),c=new Set(e.revisions.flatMap(a=>a.authorNodeId===null?[]:[a.authorNodeId]));h.push({doc:o,owner:t,body:e.revisions[e.revisions.length-1].body,authors:c})}for(const{doc:e,owner:t,body:o,authors:c}of h){const a=[];for(const s of _(o)){const g=s.includes("/")?[s]:[`${t.type==="node"?t.id:t.name}/${s}`,s];for(const E of g){const l=await $(n,I,E);if("object"in l){a.push({written_as:s,dst:l.object});break}if("deleted"in l){a.push({written_as:s,dst:l.deleted});break}}}await R(n,e,a);for(const s of c)await M(n,await m(s),e),await T(n,await m(s),e,"write")}await n.prepareUncached("INSERT INTO canvas_meta (key, value) VALUES (?, ?)").run(v,JSON.stringify({id:P,report:r.report}))}d(z,"applyPlan");export{v as IMPORT_DONE_KEY,P as IMPORT_ID,z as applyPlan,Y as readImportRecord,q as storePlanBodies};