@omniaseo/cli 0.1.3 → 0.1.5

package/README.md

@@ -5,7 +5,7 @@ Node 24 CLI for initializing a non-secret Omnia Connect workspace and connecting
 With Node 24 and Codex CLI installed, run the ready-to-use connection command from the Omniaseo Connect page. It downloads this CLI automatically, prints the authorization link for your usual browser and checks a workspace read; no manual OAuth settings are required. The command pins the release, for example:
 
 ```bash
-npx --yes @omniaseo/cli@0.1.3 connect codex --url https://connect.example.com/mcp --resource https://connect.example.com
+npx --yes @omniaseo/cli@0.1.5 connect codex --url https://connect.example.com/mcp --resource https://connect.example.com
 ```
 
 Use the command supplied by your workspace so its server addresses are correct. Already-open Codex applications must restart after setup to load the connection settings.
@@ -46,4 +46,29 @@ Selected areas are intersected with actual plan entitlements and effective conse
 
 Linux native CLI and native app-server reconnect were exercised with Codex 0.160.1 in an isolated HTTPS/PKCE fixture. Windows/macOS service adapters are implemented but require platform runtime acceptance before claiming equivalent proof. The legacy staging profile with a shared predefined synthetic client deliberately rejects receiver registration: use a dedicated synthetic acceptance profile with unique clients and exact-identity seeded fixture connections. Never attach multiple host keys to that shared client.
 
-Release distribution: publish the reviewed exact 0.1.3 archive under npm `next` before staging so the pinned version resolves. Promote npm `latest` only after production acceptance; package publication and product deployment each require their own readback.
+### Managed receiver maintenance
+
+Initial setup defaults to automatic compatible updates of this installation's receiver and supervisor. It never updates Codex, Node, global npm packages, or other connections. Existing installations preserve their selected policy when setup omits policy flags. Choose `--managed-policy manual` to check without automatic installation, or `--managed-policy pinned --managed-pin 0.1.5` to retain that locally available version. An unavailable initial pin is rejected before the receiver is stopped.
+
+```bash
+omnia maintenance status --name omnia-connect
+omnia maintenance check --name omnia-connect
+omnia maintenance update --name omnia-connect
+omnia doctor --name omnia-connect
+```
+
+`check` respects manual/pinned policies. `update` approves one local attempt at the exact authenticated approved archive while preserving the policy; a different version is refused when pinned. The approval expires after fifteen minutes and is consumed once, including across process restarts. A pending OAuth attempt leaves this manual operation visibly deferred: finish that attempt and request a fresh local update. Status and doctor expose the operation's exact target and completion/deferral independently of the executing CLI, installed package, freshly running receiver, and recently recommended version. Missing or stale health is reported as unknown; successful configuration or MCP access alone does not prove an updated receiver.
+
+Updates verify the bounded download's SHA-512 integrity and SHA-256 before private installation with npm lifecycle scripts disabled. Preparation leaves the current receiver running. A serialized switch acquires the authenticated idle fence, drains a claimed callback, starts the new child, and confirms its nonce, actual version, script hash, archive hash and fresh health before releasing that fence; failed startup restores and verifies the previous release before release. A pending OAuth attempt defers the switch while the current receiver stays healthy. Only two verified installation-owned releases are retained. The selected package supplies the supervisor too, so future updater fixes take effect after a switch.
+
+Legacy receivers need setup once to install the supervisor without changing their installation identity or OAuth authorization. Migration acquires an authenticated idle lease only after preparation; a pending OAuth attempt defers migration. A bootstrap before the approved manifest is available honestly records its archive identity as unknown. Once available, the exact approved archive must be installed and the child freshly verified, even when its version is unchanged.
+
+Version 0.1.1 predates the installation receiver. Setup cannot recover that native client's identity from Codex OAuth storage and never reads its tokens. It registers an owned receiver through normal first-party authorization; replacing an existing installation requires explicit consent. Existing grants are not forcibly revoked by the installer. The in-place identity proof above applies to installations that already have their receiver credentials, including 0.1.3.
+
+The owned Linux acceptance script exercises an actually running public 0.1.3 service, migration to 0.1.5, a second explicit restart with a fresh child, native callback forwarding, unchanged credentials and exact unit/process cleanup. Run `scripts/verify-managed-linux.mjs` as root with the mounted task scratch and separately verified 0.1.3 archive after building. macOS/Windows adapter code is covered statically; equivalent native runtime proof remains required on those platforms.
+
+`scripts/verify-managed-staging.mjs` is the companion for the guarded canonical staging fixture. Invoke it only after the official workflow has accepted the exact deployed SHA and the wrapper has validated the existing database anchor, controls, image and sole healthy task. Supply private receiver/fixture copies and the verified 0.1.3 archive; set `OMNIA_CONNECT_MANAGED_SYNTHETIC_ACCEPTANCE=true`. It migrates the owned local service, verifies the exact approved same-version archive with a fresh receiver, and emits the private native request filename for the separately guarded `consent-native` phase. Keep the fixture alive until the companion finishes, then run canonical terminal cleanup/readback. The companion removes only its own unit, processes and scratch; it does not replace canonical fixture revocation or prove untested native MCP clients.
+
+Atomic private-file reads keep the validated opened snapshot when a concurrent atomic replacement unlinks its inode. File ownership, permissions, symlink/hardlink checks and read-size limits remain enforced.
+
+Release distribution: publish the reviewed exact 0.1.5 archive under npm `next` before staging so the pinned version resolves. Promote npm `latest` only after production acceptance; package publication and product deployment each require their own readback.

package/dist/auth/callback-receiver.d.ts

@@ -13,6 +13,8 @@ type Envelope = {
     data: string;
 };
 export declare function decryptCallback(envelope: Envelope, config: ReceiverConfig, now?: number): string;
-export declare function receiveCallbacks(config: ReceiverConfig, signal?: AbortSignal): Promise<void>;
+export declare function receiveCallbacks(config: ReceiverConfig, signal?: AbortSignal, lifecycle?: {
+    busy(value: boolean): void;
+}): Promise<void>;
 export {};
 //# sourceMappingURL=callback-receiver.d.ts.map

package/dist/auth/callback-receiver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback-receiver.d.ts","sourceRoot":"","sources":["../../src/auth/callback-receiver.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AACnI,KAAK,QAAQ,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAWxF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,SAAa,GAAG,MAAM,CAuBpG;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBlG"}
+{"version":3,"file":"callback-receiver.d.ts","sourceRoot":"","sources":["../../src/auth/callback-receiver.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AACnI,KAAK,QAAQ,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAWxF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,SAAa,GAAG,MAAM,CAuBpG;AAgBD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE;IAAE,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B9I"}

package/dist/auth/callback-receiver.js

@@ -1,8 +1,8 @@
 // Standalone receiver copied into the host's private installation directory.
 // Native Codex owns state validation, PKCE exchange and all OAuth tokens.
 import { readFile } from 'node:fs/promises';
-import { createDecipheriv, privateDecrypt } from 'node:crypto';
-import { pathToFileURL } from 'node:url';
+import { createDecipheriv, createHash, privateDecrypt } from 'node:crypto';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 function envelopeBytes(value, maximumBytes, exactBytes = maximumBytes) {
     if (typeof value !== 'string' || value.length > Math.ceil(maximumBytes * 4 / 3)
         || !/^[A-Za-z0-9_-]+$/u.test(value))
@@ -38,19 +38,42 @@ export function decryptCallback(envelope, config, now = Date.now()) {
         throw new Error('Callback installation or attempt does not match');
     return url.toString();
 }
-export async function receiveCallbacks(config, signal) {
+async function readEnvelope(response) {
+    if (Number(response.headers.get('content-length') || 0) > 65536 || !response.body)
+        throw new Error('Invalid callback envelope');
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const result = await reader.read();
+            if (result.done)
+                break;
+            size += result.value.byteLength;
+            if (size > 65536)
+                throw new Error('Invalid callback envelope');
+            chunks.push(result.value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+}
+export async function receiveCallbacks(config, signal, lifecycle) {
     const issuer = new URL(config.issuer);
     if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash)
         throw new Error('Invalid receiver issuer');
     let idlePolls = 0;
     while (!signal?.aborted) {
+        lifecycle?.busy(true);
         try {
             const response = await fetch(`${config.issuer}/relay/${encodeURIComponent(config.clientId)}/delivery`, {
                 method: 'POST', headers: { Authorization: `Bearer ${config.receiverSecret}` },
                 redirect: 'error', signal: AbortSignal.timeout(10_000),
             });
             if (response.ok && response.status !== 204 && Number(response.headers.get('content-length') || 0) <= 65536) {
-                const callback = decryptCallback(await response.json(), config);
+                const callback = decryptCallback(await readEnvelope(response), config);
                 // The only inbound listener is Codex's native loopback listener. A
                 // stopped/expired native login is never replaced by a token exchange here.
                 await fetch(callback, { redirect: 'error', signal: AbortSignal.timeout(5_000) });
@@ -64,11 +87,51 @@ export async function receiveCallbacks(config, signal) {
             // Delivery is single-use. Native interrupted logins resume with a new
             // attempt, never by replaying a saved code or printing it to the chat/log.
         }
-        await new Promise(resolve => setTimeout(resolve, Math.min(10_000, 2_000 * (idlePolls + 1))));
+        finally {
+            lifecycle?.busy(false);
+        }
+        await new Promise(resolve => {
+            const done = () => { clearTimeout(timer); signal?.removeEventListener('abort', done); resolve(); };
+            const timer = setTimeout(done, Math.min(10_000, 2_000 * (idlePolls + 1)));
+            if (signal?.aborted)
+                done();
+            else
+                signal?.addEventListener('abort', done, { once: true });
+        });
     }
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
     const config = JSON.parse(await readFile(process.argv[2] || '', 'utf8'));
-    await receiveCallbacks(config);
+    const controller = new AbortController();
+    process.once('SIGTERM', () => controller.abort());
+    process.once('SIGINT', () => controller.abort());
+    process.on('message', value => { if (value === 'stop')
+        controller.abort(); });
+    const healthPath = process.argv[3];
+    let busy = false;
+    let pulse = Promise.resolve();
+    let interval;
+    if (healthPath) {
+        const { privateWrite, packageVersion } = await import('./managed-files.js');
+        const actualHash = createHash('sha256').update(await readFile(fileURLToPath(import.meta.url))).digest('hex');
+        const version = await packageVersion();
+        const report = () => {
+            pulse = pulse.then(() => privateWrite(healthPath, { schemaVersion: 1, pid: process.pid,
+                runId: process.argv[4], runningVersion: version, artifactSha256: process.argv[5] === 'unknown' ? null : process.argv[5],
+                scriptSha256: actualHash, at: new Date().toISOString(), busy }));
+        };
+        report();
+        await pulse;
+        interval = setInterval(report, 5000);
+        process.send?.({ type: 'ready', runId: process.argv[4] });
+    }
+    try {
+        await receiveCallbacks(config, controller.signal, { busy: value => { busy = value; } });
+    }
+    finally {
+        if (interval)
+            clearInterval(interval);
+        await pulse;
+    }
 }
 //# sourceMappingURL=callback-receiver.js.map

package/dist/auth/callback-receiver.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback-receiver.js","sourceRoot":"","sources":["../../src/auth/callback-receiver.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKzC,SAAS,aAAa,CAAC,KAAa,EAAE,YAAoB,EAAE,UAAU,GAAG,YAAY;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;WAC1E,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY;WACnE,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,MAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1F,IAAI,QAAQ,EAAE,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAEjG,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG;WACrH,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;WACpD,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;WACjG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;WAC5G,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;WAC/E,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;WACxF,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAsB,EAAE,MAAoB;IACjF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnJ,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,UAAU,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACrG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,cAAc,EAAE,EAAE;gBAC7E,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACvD,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC3G,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAc,EAAE,MAAM,CAAC,CAAC;gBAC5E,mEAAmE;gBACnE,2EAA2E;gBAC3E,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjF,SAAS,GAAG,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,2EAA2E;QAC7E,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAmB,CAAC;IAC3F,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"callback-receiver.js","sourceRoot":"","sources":["../../src/auth/callback-receiver.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKxD,SAAS,aAAa,CAAC,KAAa,EAAE,YAAoB,EAAE,UAAU,GAAG,YAAY;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;WAC1E,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY;WACnE,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,MAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1F,IAAI,QAAQ,EAAE,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAEjG,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG;WACrH,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;WACpD,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;WACjG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;WAC5G,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;WAC/E,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;WACxF,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAChI,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IAAC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YAC3D,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,IAAI,IAAI,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAa,CAAC;IACxE,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAsB,EAAE,MAAoB,EAAE,SAA0C;IAC7H,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnJ,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACxB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,UAAU,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACrG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,cAAc,EAAE,EAAE;gBAC7E,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACvD,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC3G,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;gBACvE,mEAAmE;gBACnE,2EAA2E;gBAC3E,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjF,SAAS,GAAG,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,2EAA2E;QAC7E,CAAC;gBACO,CAAC;YAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YAChC,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACzG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,MAAM,EAAE,OAAO;gBAAE,IAAI,EAAE,CAAC;;gBAAM,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAmB,CAAC;IAC3F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACpG,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,KAAK,MAAM;QAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,GAAG,KAAK,CAAC;IAAC,IAAI,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAAC,IAAI,QAAoC,CAAC;IAC1F,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,GAAS,EAAE;YAAG,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;gBACjH,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvH,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;QAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YACxF,CAAC;QAAC,IAAI,QAAQ;YAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACjE,CAAC"}

package/dist/auth/callback-relay.d.ts

@@ -7,5 +7,7 @@ export declare function prepareCallbackRelay(options: {
     env?: NodeJS.ProcessEnv;
     accessMode?: string;
     scopes?: readonly string[];
+    managedPolicy?: 'auto' | 'manual' | 'pinned';
+    managedPin?: string;
 }): Promise<ReceiverConfig>;
 //# sourceMappingURL=callback-relay.d.ts.map

package/dist/auth/callback-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback-relay.d.ts","sourceRoot":"","sources":["../../src/auth/callback-relay.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAC1G,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CA2DrG"}
+{"version":3,"file":"callback-relay.d.ts","sourceRoot":"","sources":["../../src/auth/callback-relay.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAI7D,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAC1G,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CA6DxK"}

package/dist/auth/callback-relay.js

@@ -2,18 +2,21 @@ import { generateKeyPairSync } from 'node:crypto';
 import { createServer } from 'node:net';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { mkdir, copyFile, chmod, lstat } from 'node:fs/promises';
-import { fileURLToPath } from 'node:url';
+import { mkdir, chmod, lstat } from 'node:fs/promises';
 import { atomicWrite, readText } from '../io/atomic.js';
 import { CliError, EXIT } from '../errors.js';
-import { installReceiverService, probeReceiverService } from './receiver-service.js';
+import { probeReceiverService } from './receiver-service.js';
+import { installManagedReceiver } from './managed-installation.js';
 export async function prepareCallbackRelay(options) {
     const env = options.env ?? process.env;
     const directory = join(env.CODEX_HOME ?? join(homedir(), '.codex'), 'omnia-connect', options.name);
     if (/[\r\n\0]/u.test(directory))
         throw new CliError('Invalid receiver storage path', 'CALLBACK_RECEIVER_STORAGE_UNSAFE', EXIT.AUTH_BLOCKED);
     const statePath = join(directory, 'receiver.json');
-    const scriptPath = join(directory, 'receiver.mjs');
+    if (options.managedPolicy && !['auto', 'manual', 'pinned'].includes(options.managedPolicy)
+        || options.managedPolicy === 'pinned' && !/^\d+\.\d+\.\d+$/u.test(options.managedPin || '')
+        || options.managedPin && options.managedPolicy !== 'pinned')
+        throw new CliError('Invalid managed update policy', 'MANAGED_POLICY_INVALID', EXIT.USAGE);
     probeReceiverService(options.runner);
     const stat = await lstat(statePath).catch(() => null);
     if (stat && (!stat.isFile() || stat.isSymbolicLink() || stat.size > 65536
@@ -72,9 +75,9 @@ export async function prepareCallbackRelay(options) {
         }
         await atomicWrite(statePath, JSON.stringify(config), 0o600);
     }
-    await copyFile(fileURLToPath(new URL('./callback-receiver.js', import.meta.url)), scriptPath);
-    await chmod(scriptPath, 0o600);
-    await installReceiverService({ directory, scriptPath, statePath, runner: options.runner });
+    await installManagedReceiver(directory, config, options.runner, { location: env.SSH_CONNECTION ? 'remote' : 'local',
+        ...(options.managedPolicy ? { autoUpdateEnabled: options.managedPolicy === 'auto' } : {}),
+        ...(options.managedPin ? { pin: options.managedPin } : {}) });
     return config;
 }
 //# sourceMappingURL=callback-relay.js.map

package/dist/auth/callback-relay.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback-relay.js","sourceRoot":"","sources":["../../src/auth/callback-relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAoB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAErF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OACiC;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACnG,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5I,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACnD,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;WACpE,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,wCAAwC,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACrL,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAAsB,CAAC;IAC3B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAmB,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,uCAAuC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrJ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0C,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,0CAA0C,EAAE,4BAA4B,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACjM,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,UAAU,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC1G,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,cAAc,EAAE,EAAE;YACjH,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC;SAAE,CAAC,CAAC;QAChI,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,iFAAiF,EAAE,+BAA+B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAChL,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,uCAAuC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrJ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0C,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,qBAAqB,EAAE,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/L,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACvM,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3K,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBAChC,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;gBACnD,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM;YACtG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACvG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,wDAAwD,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChJ,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwC,CAAC;QACjF,MAAM,GAAG,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;eAC7G,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,oBAAoB,YAAY,WAAW,EAAE,CAAC;YAC/H,MAAM,IAAI,QAAQ,CAAC,0DAA0D,EAAE,+BAA+B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,gBAAgB,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/D,MAAM,MAAM,GAAG,qHAAqH,gBAAgB,kFAAkF,CAAC;YACvO,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3O,CAAC;QACD,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9F,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"callback-relay.js","sourceRoot":"","sources":["../../src/auth/callback-relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,YAAY,EAAoB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OACoG;IAC7I,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACnG,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5I,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;WACrF,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;WACxF,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACzJ,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;WACpE,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,wCAAwC,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACrL,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAAsB,CAAC;IAC3B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAmB,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,uCAAuC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrJ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0C,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,0CAA0C,EAAE,4BAA4B,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACjM,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,UAAU,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC1G,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,cAAc,EAAE,EAAE;YACjH,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC;SAAE,CAAC,CAAC;QAChI,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,iFAAiF,EAAE,+BAA+B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAChL,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,uCAAuC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrJ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0C,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,qBAAqB,EAAE,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/L,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACvM,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3K,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBAChC,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;gBACnD,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM;YACtG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACvG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,wDAAwD,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChJ,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwC,CAAC;QACjF,MAAM,GAAG,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;eAC7G,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,oBAAoB,YAAY,WAAW,EAAE,CAAC;YAC/H,MAAM,IAAI,QAAQ,CAAC,0DAA0D,EAAE,+BAA+B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,gBAAgB,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/D,MAAM,MAAM,GAAG,qHAAqH,gBAAgB,kFAAkF,CAAC;YACvO,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,EAAE,kCAAkC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3O,CAAC;QACD,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;QACjH,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/managed-files.d.ts

@@ -0,0 +1,8 @@
+export declare function privateDirectory(path: string): Promise<void>;
+export declare function privateRead<T>(path: string): Promise<T | undefined>;
+export declare function privateWrite(path: string, value: unknown): Promise<void>;
+export declare function privateWriteSource(path: string, content: string): Promise<void>;
+export declare function scriptHash(path: string): Promise<string>;
+export declare function packageVersion(): Promise<string>;
+export declare const pause: (ms: number, signal?: AbortSignal) => Promise<void>;
+//# sourceMappingURL=managed-files.d.ts.map

package/dist/auth/managed-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/auth/managed-files.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlE;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAyBzE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASrF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI9D;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAItD;AAED,eAAO,MAAM,KAAK,GAAI,IAAI,MAAM,EAAE,SAAS,WAAW,KAAG,OAAO,CAAC,IAAI,CAInE,CAAC"}

package/dist/auth/managed-files.js

@@ -0,0 +1,95 @@
+import { constants, chmod, lstat, mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+export async function privateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const stat = await lstat(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (process.getuid && stat.uid !== process.getuid()))
+        throw new Error('UNSAFE_STORAGE');
+    if (process.platform !== 'win32')
+        await chmod(path, 0o700);
+}
+export async function privateRead(path) {
+    const stat = await lstat(path).catch(error => {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    });
+    if (!stat)
+        return undefined;
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 65536
+        || (process.getuid && stat.uid !== process.getuid()) || (process.platform !== 'win32' && (stat.mode & 0o077)))
+        throw new Error('UNSAFE_STORAGE');
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    try {
+        const current = await handle.stat();
+        // Atomic writers can replace the inode between lstat and open. Validate the
+        // actual opened file instead; O_NOFOLLOW still rejects a raced symlink.
+        // A subsequent atomic replacement can unlink this safely opened snapshot
+        // before fstat. Zero links is safe; multiple links remain forbidden.
+        if (!current.isFile() || ![0, 1].includes(current.nlink) || current.size > 65536
+            || (process.getuid && current.uid !== process.getuid()) || (process.platform !== 'win32' && (current.mode & 0o077)))
+            throw new Error('UNSAFE_STORAGE');
+        const bytes = Buffer.alloc(65537);
+        let length = 0;
+        while (length < bytes.length) {
+            const result = await handle.read(bytes, length, bytes.length - length, length);
+            if (!result.bytesRead)
+                break;
+            length += result.bytesRead;
+        }
+        if (length > 65536)
+            throw new Error('UNSAFE_STORAGE');
+        return JSON.parse(bytes.subarray(0, length).toString('utf8'));
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function privateWrite(path, value) {
+    await privateWriteSource(path, JSON.stringify(value));
+}
+export async function privateWriteSource(path, content) {
+    if (Buffer.byteLength(content) > 1024 * 1024)
+        throw new Error('UNSAFE_STORAGE');
+    await privateDirectory(dirname(path));
+    const current = await lstat(path).catch(() => null);
+    if (current && (!current.isFile() || current.isSymbolicLink()))
+        throw new Error('UNSAFE_STORAGE');
+    const temporary = join(dirname(path), `.managed-${randomUUID()}.tmp`);
+    const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    try {
+        await handle.writeFile(content);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+export async function scriptHash(path) {
+    const stat = await lstat(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024)
+        throw new Error('UNSAFE_STORAGE');
+    return createHash('sha256').update(await readFile(path)).digest('hex');
+}
+export async function packageVersion() {
+    const manifest = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8'));
+    if (manifest.name !== '@omniaseo/cli' || !/^\d+\.\d+\.\d+$/u.test(manifest.version || ''))
+        throw new Error('UNSUPPORTED');
+    return manifest.version;
+}
+export const pause = (ms, signal) => new Promise(resolve => {
+    const done = () => { clearTimeout(timer); signal?.removeEventListener('abort', done); resolve(); };
+    const timer = setTimeout(done, ms);
+    if (signal?.aborted)
+        done();
+    else
+        signal?.addEventListener('abort', done, { once: true });
+});
+//# sourceMappingURL=managed-files.js.map

package/dist/auth/managed-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-files.js","sourceRoot":"","sources":["../../src/auth/managed-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzI,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,IAAY;IAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QAC3C,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;WAC/E,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACnJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,4EAA4E;QAC5E,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,KAAK;eAC3E,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAClD,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/E,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM;YAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IACrE,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAc;IAC7D,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAe;IACpE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChF,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,UAAU,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrI,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC/F,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1G,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAwC,CAAC;IAC3I,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1H,OAAO,QAAQ,CAAC,OAAQ,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,MAAoB,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;IAC9F,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,OAAO;QAAE,IAAI,EAAE,CAAC;;QAAM,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC"}

package/dist/auth/managed-installation.d.ts

@@ -0,0 +1,26 @@
+import type { LocalUpdate } from './managed-updater.js';
+import type { ReceiverConfig } from './callback-receiver.js';
+import type { CommandRunner } from '../process/runner.js';
+export type ManagedPolicy = {
+    autoUpdateEnabled?: boolean;
+    pin?: string;
+    location: 'local' | 'remote';
+};
+export declare function installManagedReceiver(root: string, config: ReceiverConfig, runner: CommandRunner, policy: ManagedPolicy): Promise<void>;
+export declare function managedDiagnostic(root: string): Promise<{
+    installation: boolean;
+    healthy: boolean;
+    packageVersion: string | null;
+    runningVersion: string | null;
+    recommendedVersion: string | null;
+    artifactVerified: boolean;
+    policy: string;
+    reason: string;
+    localUpdate: LocalUpdate | null;
+}>;
+export declare function requestManagedCheck(root: string, action?: 'check' | 'update'): Promise<{
+    requested: true;
+    id: string;
+    action: 'check' | 'update';
+}>;
+//# sourceMappingURL=managed-installation.d.ts.map

package/dist/auth/managed-installation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-installation.d.ts","sourceRoot":"","sources":["../../src/auth/managed-installation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAyC,MAAM,sBAAsB,CAAC;AAE/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG1D,MAAM,MAAM,aAAa,GAAG;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC;AAExG,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAmF9I;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACtI,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,CAAC,CAehK;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,OAAO,GAAG,QAAkB,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC,CAKlK"}

package/dist/auth/managed-installation.js

@@ -0,0 +1,151 @@
+import { chmod, copyFile, cp, lstat, mkdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+import { ProfileLock } from './profile-lock.js';
+import { packageVersion, privateDirectory, privateRead, privateWrite, privateWriteSource, scriptHash, pause } from './managed-files.js';
+import { prepareRelease, relayJson, verifiedSelection, withMigrationLease } from './managed-updater.js';
+import { matchingHealth } from './managed-supervisor.js';
+import { installReceiverService } from './receiver-service.js';
+export async function installManagedReceiver(root, config, runner, policy) {
+    await privateDirectory(root);
+    await new ProfileLock('managed-install', join(root, '.locks')).run(async () => {
+        const previousHealth = await privateRead(join(root, 'health.json'));
+        let state = await privateRead(join(root, 'operational.json'));
+        if (state)
+            await verifiedSelection(root, state.selected);
+        const requestedVersion = state?.selected.version || await packageVersion();
+        if (policy.pin !== undefined && policy.pin !== requestedVersion)
+            throw new Error('PINNED');
+        if (!state) {
+            const source = fileURLToPath(new URL('../../', import.meta.url));
+            const version = await packageVersion();
+            const releaseRoot = join(root, 'releases', 'bootstrap');
+            const target = join(releaseRoot, 'node_modules', '@omniaseo', 'cli');
+            let selected;
+            if (await lstat(releaseRoot).catch(() => null)) {
+                const marker = await privateRead(join(releaseRoot, 'release.json'));
+                if (!marker || marker.selection.id !== 'bootstrap' || marker.selection.version !== version
+                    || marker.selection.scriptSha256 !== await scriptHash(join(source, 'dist', 'auth', 'callback-receiver.js'))
+                    || marker.selection.supervisorSha256 !== await scriptHash(join(source, 'dist', 'auth', 'managed-supervisor.js')))
+                    throw new Error('UNSAFE_STORAGE');
+                await verifiedSelection(root, marker.selection);
+                selected = marker.selection;
+            }
+            else {
+                await mkdir(target, { recursive: true, mode: 0o700 });
+                await chmod(releaseRoot, 0o700);
+                await cp(join(source, 'dist'), join(target, 'dist'), { recursive: true, dereference: false, errorOnExist: true, force: false });
+                await copyFile(join(source, 'package.json'), join(target, 'package.json'));
+                selected = { id: 'bootstrap', version, artifactSha256: null,
+                    scriptSha256: await scriptHash(join(target, 'dist', 'auth', 'callback-receiver.js')),
+                    supervisorSha256: await scriptHash(join(target, 'dist', 'auth', 'managed-supervisor.js')) };
+                await privateWrite(join(releaseRoot, 'release.json'), { schemaVersion: 1, selection: selected, release: null });
+            }
+            state = { schemaVersion: 1, selected, previous: null, pending: false, autoUpdateEnabled: policy.autoUpdateEnabled ?? true, channel: policy.pin ? 'pinned' : 'stable', selectedPin: policy.pin || null,
+                location: policy.location, lastCheck: null, lastConfirmedUpdate: null, state: 'current', reason: 'NONE', requestAck: null };
+            // An explicit initial bootstrap is allowed before the approved production
+            // manifest exists. Its archive hash stays unknown; it cannot claim current
+            // against the approved release until that exact archive is installed.
+            try {
+                const observed = await relayJson(config, 'release');
+                if (observed.release && state.autoUpdateEnabled && state.channel === 'stable') {
+                    state.selected = await prepareRelease(root, observed.release);
+                    state.previous = selected;
+                    state.pending = true;
+                }
+            }
+            catch { /* Keep the explicitly executed bootstrap; never invent a hash. */ }
+        }
+        if (policy.pin !== undefined) {
+            if (policy.pin !== state.selected.version)
+                throw new Error('PINNED');
+            state = { ...state, channel: 'pinned', selectedPin: policy.pin, autoUpdateEnabled: false };
+        }
+        else if (policy.autoUpdateEnabled !== undefined) {
+            state = { ...state, autoUpdateEnabled: policy.autoUpdateEnabled, channel: 'stable', selectedPin: null };
+        }
+        state = { ...state, location: policy.location };
+        const runtime = fileURLToPath(new URL('./', import.meta.url));
+        const runtimeRoot = join(root, 'runtime');
+        await privateDirectory(join(runtimeRoot, 'auth'));
+        for (const name of ['managed-launcher.js', 'managed-files.js', 'managed-updater.js', 'profile-lock.js']) {
+            await privateWriteSource(join(runtimeRoot, 'auth', name), await readFile(join(runtime, name), 'utf8'));
+        }
+        await privateWriteSource(join(runtimeRoot, 'errors.js'), await readFile(join(runtime, '..', 'errors.js'), 'utf8'));
+        await privateWrite(join(root, 'package.json'), { private: true, type: 'module' });
+        const selectedState = state;
+        const restart = async (expiresAt) => {
+            const checkLease = () => { if (Date.now() >= expiresAt)
+                throw new Error('MIGRATION_BUSY'); };
+            checkLease();
+            if (previousHealth && Date.parse(previousHealth.at) > Date.now() - 15_000) {
+                await privateWrite(join(root, 'restart-request.json'), { id: randomUUID(), at: new Date().toISOString() });
+                const deadline = Date.now() + 30_000;
+                while (true) {
+                    try {
+                        process.kill(previousHealth.pid, 0);
+                    }
+                    catch {
+                        break;
+                    }
+                    if (Date.now() >= deadline)
+                        throw new Error('HEALTH');
+                    checkLease();
+                    await pause(100);
+                }
+            }
+            if (Date.now() + 65_000 >= expiresAt)
+                throw new Error('MIGRATION_BUSY');
+            await privateWrite(join(root, 'operational.json'), selectedState);
+            await installReceiverService({ directory: root, scriptPath: join(runtimeRoot, 'auth', 'managed-launcher.js'), statePath: root, runner });
+            const deadline = Date.now() + 20_000;
+            while (Date.now() < deadline) {
+                checkLease();
+                const health = await privateRead(join(root, 'health.json'));
+                if (health && health.runId !== previousHealth?.runId && matchingHealth(health, selectedState.selected, health.runId, health.pid)) {
+                    try {
+                        process.kill(health.pid, 0);
+                        return;
+                    }
+                    catch { /* Never confirm a stopped process. */ }
+                }
+                await pause(100);
+            }
+            throw new Error('HEALTH');
+        };
+        await withMigrationLease(config, restart);
+    });
+}
+export async function managedDiagnostic(root) {
+    const state = await privateRead(join(root, 'operational.json'));
+    if (!state)
+        return { installation: false, healthy: false, packageVersion: null, runningVersion: null, recommendedVersion: null, artifactVerified: false, policy: 'unknown', reason: 'MIGRATION_REQUIRED', localUpdate: null };
+    await verifiedSelection(root, state.selected);
+    const health = await privateRead(join(root, 'health.json'));
+    const localRequest = await privateRead(join(root, 'check-request.json'));
+    const queued = localRequest?.action === 'update' && localRequest.id !== state.lastLocalRequestId
+        && /^[a-f0-9-]{36}$/u.test(localRequest.id) && Number.isFinite(Date.parse(localRequest.at));
+    const localUpdate = queued ? { id: localRequest.id, at: localRequest.at, targetVersion: null, targetSha256: null,
+        status: Date.parse(localRequest.at) + 15 * 60_000 <= Date.now() || Date.parse(localRequest.at) > Date.now() + 1000 ? 'failed' : 'checking' } : state.localUpdate || null;
+    let healthy = Boolean(health && matchingHealth(health, state.selected, health.runId, health.pid));
+    if (health && healthy)
+        try {
+            process.kill(health.pid, 0);
+        }
+        catch {
+            healthy = false;
+        }
+    return { installation: true, healthy, packageVersion: state.selected.version, runningVersion: healthy ? health.runningVersion : null,
+        recommendedVersion: Date.parse(state.lastCheck || '') > Date.now() - 2 * 3600_000 ? state.recommendedVersion || null : null,
+        artifactVerified: healthy && state.selected.artifactSha256 !== null, policy: state.channel, reason: state.reason, localUpdate };
+}
+export async function requestManagedCheck(root, action = 'check') {
+    const state = await privateRead(join(root, 'operational.json'));
+    if (!state)
+        throw new Error('UNSUPPORTED');
+    const id = randomUUID();
+    await privateWrite(join(root, 'check-request.json'), { id, action, at: new Date().toISOString() });
+    return { requested: true, id, action };
+}
+//# sourceMappingURL=managed-installation.js.map

package/dist/auth/managed-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-installation.js","sourceRoot":"","sources":["../../src/auth/managed-installation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACxI,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAIxG,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAI/D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAAsB,EAAE,MAAqB,EAAE,MAAqB;IAC7H,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;QAC5E,MAAM,cAAc,GAAG,MAAM,WAAW,CAAc,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACjF,IAAI,KAAK,GAAG,MAAM,WAAW,CAAc,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC3E,IAAI,KAAK;YAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,KAAK,EAAE,QAAQ,CAAC,OAAO,IAAI,MAAM,cAAc,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACrE,IAAI,QAAmB,CAAC;YACxB,IAAI,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAgB,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;gBACnF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO;uBACrF,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;uBACxG,MAAM,CAAC,SAAS,CAAC,gBAAgB,KAAK,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACtJ,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;gBACvF,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChI,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;gBAC3E,QAAQ,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI;oBACzD,YAAY,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;oBACpF,gBAAgB,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,EAAE,CAAC;gBAC9F,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAA0B,CAAC,CAAC;YAC1I,CAAC;YACD,KAAK,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI;gBACnM,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC9H,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAA0B,CAAC;gBAC7E,IAAI,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAAC,KAAK,CAAC,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAAC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;oBAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,CAAC;YACpM,CAAC;YAAC,MAAM,CAAC,CAAC,kEAAkE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrE,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;QAC7F,CAAC;aAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAClD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC1G,CAAC;QACD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7F,KAAK,MAAM,IAAI,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACxG,MAAM,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACnH,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,KAAK,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;YACzD,MAAM,UAAU,GAAG,GAAS,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,UAAU,EAAE,CAAC;YACb,IAAI,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;gBAC1E,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAC3G,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;gBACrC,OAAO,IAAI,EAAE,CAAC;oBACZ,IAAI,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBAC7D,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACtD,UAAU,EAAE,CAAC;oBACb,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACxE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,aAAa,CAAC,CAAC;YAClE,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACzI,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;YACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7B,UAAU,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,MAAM,WAAW,CAAc,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;gBACzE,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,EAAE,KAAK,IAAI,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjI,IAAI,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;gBAC/F,CAAC;gBACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC,CAAC;QACF,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAElD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAc,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9N,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAc,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,MAAM,WAAW,CAA6C,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,YAAY,EAAE,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC,EAAE,KAAK,KAAK,CAAC,kBAAkB;WAC3F,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,MAAM,WAAW,GAAuB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;QAClI,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;IAC3K,IAAI,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,IAAI,MAAM,IAAI,OAAO;QAAE,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,KAAK,CAAC;QAAC,CAAC;IACtF,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,MAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACnI,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;QAC3H,gBAAgB,EAAE,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;AACpI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,SAA6B,OAAO;IAC1F,MAAM,KAAK,GAAG,MAAM,WAAW,CAAc,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IAAC,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5H,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC"}