@openagt/servers 0.0.0-stage → 0.0.2

package/dist/steps.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The steps of an install, in order: what each is called on the page, who runs it on the server,
+ * and the script itself. A step first looks whether its work is already done and then does
+ * nothing, so the same list is the first install, a second try after a failure, and an update.
+ *
+ * `root` is only who installs. What runs afterwards runs as the server's own user `openagent`:
+ * the programs are root's, so an agent that works there cannot change OpenAgent itself.
+ */
+export declare const STEP_IDS: readonly ['login', 'user', 'tools', 'openagent', 'agent', 'service', 'door'];
+export type StepId = (typeof STEP_IDS)[number];
+/** What a script is written for. */
+export interface Facts {
+    /** The server's number or name: what its certificate is for. */
+    address: string;
+    /** The OpenAgent the server gets: the one that runs on this computer. */
+    version: string;
+}
+export interface StepDef {
+    id: StepId;
+    /** The step's line on the page. */
+    label: string;
+    as: 'root' | 'openagent';
+    /** How long the step may take: a server that stopped answering is not waited for longer. */
+    timeoutMs: number;
+    script(facts: Facts): string;
+}
+/** The server's user everything runs as once it is installed. */
+export declare const SERVER_USER = "openagent";
+/** Where the server keeps the Claude login: root's file, which the service reads as it starts. An agent on the server works with the login, and so can read it; it cannot change the file. */
+export declare const CLAUDE_FILE = "/etc/openagent/claude.env";
+/** `value` as one word of a shell script, whatever it holds. */
+export declare function quoted(value: string): string;
+/** What the service file holds. `KillMode=process`: a run is a process of its own and goes on when OpenAgent starts again, as on a laptop. */
+export declare const SERVICE_UNIT = "[Unit]\nDescription=OpenAgent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nUser=openagent\nWorkingDirectory=/home/openagent\nEnvironment=PATH=/home/openagent/.local/bin:/opt/openagent/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nEnvironmentFile=-/etc/openagent/claude.env\nExecStart=/opt/openagent/node/bin/openagent\nRestart=always\nRestartSec=5\nKillMode=process\nAmbientCapabilities=CAP_NET_BIND_SERVICE\n\n[Install]\nWantedBy=multi-user.target";
+export declare const STEPS: readonly StepDef[];
+/** The script that asks the server's door for a link a new machine gets in with. Run as the server's own user. */
+export declare function linkScript(): string;
+/** A script that puts a login on the server or takes it off, and who runs it there. */
+export interface LoginScript {
+    as: StepDef['as'];
+    script: string;
+}
+/** How long a login's script may take: a server that stopped answering is not waited for longer. */
+export declare const LOGIN_TIMEOUT_MS: number;
+/**
+ * Give the server a GitHub login: `gh` keeps it in its own file, and git asks `gh` for it. The
+ * server then holds this one login, and answers whose it is; when any of that fails, it holds none.
+ *
+ * The login is a word of the script, which the server's shell reads where a program would read:
+ * it is on no command line, and no program the script starts finds it among what it was given.
+ */
+export declare function githubLoginScript(login: string): LoginScript;
+/** How long a person has to type the code at GitHub: GitHub's own limit is fifteen minutes. */
+export declare const GITHUB_CODE_TIMEOUT_MS: number;
+/**
+ * Have the server ask GitHub for a login of its own: its `gh` is started and left waiting, and
+ * GitHub answers with a short code that a person types at github.com/login/device. The script
+ * prints `<process> <file> <code>` and ends; {@link githubWaitScript} sees the rest. One that
+ * still waits from an earlier press is ended first. The login the server had goes, as with a
+ * copy: the server has one GitHub login, the last one asked for.
+ */
+export declare function githubCodeScript(): LoginScript;
+/**
+ * Wait until the server's `gh` has its answer from GitHub, for the code {@link githubCodeScript}
+ * printed, and say whose login it is. All of it or none, as with a copy.
+ */
+export declare function githubWaitScript(pid: string, log: string): LoginScript;
+/** Take the GitHub login off the server. */
+export declare function githubLogoutScript(): LoginScript;
+/**
+ * Give the server a Claude login: Claude Code is first asked, as the server's own user, whether
+ * it reads the login; then the login is written to root's file and OpenAgent is started again
+ * with it. A run that is at work goes on with the login it started with. When OpenAgent does not
+ * start with it, the file is put back as it was.
+ *
+ * Claude Code is the server user's own program: root asks it as that user, for half a minute at
+ * most, and without the lock root holds, which a program that never ended would hold with it.
+ */
+export declare function claudeLoginScript(login: string): LoginScript;
+/** Take the Claude login off the server, and start OpenAgent again without it. */
+export declare function claudeLogoutScript(): LoginScript;
+//# sourceMappingURL=steps.d.ts.map

package/dist/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../src/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,QAAQ,YAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAU,CAAA;AACpG,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9C,oCAAoC;AACpC,MAAM,WAAW,KAAK;IACpB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAA;IACf,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,GAAG,WAAW,CAAA;IACxB,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;CAC7B;AAED,iEAAiE;AACjE,eAAO,MAAM,WAAW,cAAc,CAAA;AAOtC,8LAA8L;AAC9L,eAAO,MAAM,WAAW,8BAA8B,CAAA;AAOtD,gEAAgE;AAChE,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AAgDD,8IAA8I;AAC9I,eAAO,MAAM,YAAY,yfAiBE,CAAA;AAE3B,eAAO,MAAM,KAAK,EAAE,SAAS,OAAO,EAqMnC,CAAA;AAED,kHAAkH;AAClH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,QAAa,CAAA;AAM1C;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAoB5D;AAED,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,QAAc,CAAA;AAqBjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAgC9C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CA8BtE;AAED,4CAA4C;AAC5C,wBAAgB,kBAAkB,IAAI,WAAW,CAahD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CA8B5D;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,IAAI,WAAW,CAchD"}

package/dist/steps.js

@@ -0,0 +1,427 @@
+/**
+ * The steps of an install, in order: what each is called on the page, who runs it on the server,
+ * and the script itself. A step first looks whether its work is already done and then does
+ * nothing, so the same list is the first install, a second try after a failure, and an update.
+ *
+ * `root` is only who installs. What runs afterwards runs as the server's own user `openagent`:
+ * the programs are root's, so an agent that works there cannot change OpenAgent itself.
+ */
+export const STEP_IDS = ['login', 'user', 'tools', 'openagent', 'agent', 'service', 'door'];
+/** The server's user everything runs as once it is installed. */
+export const SERVER_USER = 'openagent';
+/** Where the install keeps what it brings: Node, and OpenAgent inside it. */
+const ROOT = '/opt/openagent';
+/** The Node the server gets: the newest of this line, read off nodejs.org with its checksum. */
+const NODE_LINE = 24;
+/** Where the server keeps the Claude login: root's file, which the service reads as it starts. An agent on the server works with the login, and so can read it; it cannot change the file. */
+export const CLAUDE_FILE = '/etc/openagent/claude.env';
+/** The name Claude Code reads a login under that was made for a computer nobody sits at. */
+const CLAUDE_NAME = 'CLAUDE_CODE_OAUTH_TOKEN';
+/** The door's own command, inside the OpenAgent the install brought. */
+const DOOR = `${ROOT}/node/bin/node ${ROOT}/node/lib/node_modules/@openagt/dashboard/node_modules/@openagt/remote-access/bin/remote-access`;
+/** `value` as one word of a shell script, whatever it holds. */
+export function quoted(value) {
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+/**
+ * Held by every script root runs, for as long as it runs: a script still at work after this computer stopped waiting for it is not joined by a second one.
+ * In a folder only root writes: the server's user cannot put a file of its own there first.
+ */
+const LOCK = '/run/openagent-install.lock';
+/**
+ * A whole script around `body`. The body is a function called once the shell has read all of
+ * it, with nothing to read from: the script itself comes in where a program it starts would
+ * otherwise read, and would be eaten by the first one that does.
+ *
+ * Root finds its programs in the system's own folders only, and nothing the server's user can
+ * write is ever on its way to one.
+ */
+function script(as, vars, body) {
+    const system = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+    return [
+        'set -euo pipefail',
+        'umask 022',
+        'export DEBIAN_FRONTEND=noninteractive',
+        `export PATH="${as === 'root' ? system : `$HOME/.local/bin:${ROOT}/node/bin:${system}`}"`,
+        ...Object.entries(vars).map(([name, value]) => `${name}=${quoted(value)}`),
+        'fail() { echo "$1" >&2; exit 1; }',
+        ...(as === 'root' ? [`exec 9>${LOCK}`, 'flock -n 9 || fail "Another install is still at work on this server. Try again in a moment."'] : []),
+        'main() {',
+        body.trim(),
+        '}',
+        'main </dev/null',
+        '',
+    ].join('\n');
+}
+const MINUTE = 60_000;
+/** Defines `started`, which waits until OpenAgent answers on the server; when it does not, it shows what the service last said and answers no. */
+const STARTED = `
+  started() {
+    for _ in $(seq 30); do
+      curl -fsS -o /dev/null http://127.0.0.1:4200/ 2>/dev/null && return 0
+      sleep 1
+    done
+    journalctl -u openagent -n 20 --no-pager >&2 || true
+    return 1
+  }`;
+const NOT_STARTED = 'fail "OpenAgent did not start on this server."';
+/** What the service file holds. `KillMode=process`: a run is a process of its own and goes on when OpenAgent starts again, as on a laptop. */
+export const SERVICE_UNIT = `[Unit]
+Description=OpenAgent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=${SERVER_USER}
+WorkingDirectory=/home/${SERVER_USER}
+Environment=PATH=/home/${SERVER_USER}/.local/bin:${ROOT}/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+EnvironmentFile=-${CLAUDE_FILE}
+ExecStart=${ROOT}/node/bin/openagent
+Restart=always
+RestartSec=5
+KillMode=process
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target`;
+export const STEPS = [
+    {
+        id: 'login',
+        label: 'Log in',
+        as: 'root',
+        timeoutMs: 2 * MINUTE,
+        script: () => script('root', {}, `
+  . /etc/os-release 2>/dev/null || true
+  case "\${ID:-}" in
+    ubuntu | debian) ;;
+    *) fail "OpenAgent installs on Ubuntu and Debian. This server runs \${PRETTY_NAME:-something else}." ;;
+  esac
+  case "$(uname -m)" in
+    x86_64 | aarch64) ;;
+    *) fail "OpenAgent has no install for this server's chip, $(uname -m)." ;;
+  esac
+  [ -d /run/systemd/system ] || fail "This server does not start its programs with systemd, which OpenAgent's service needs."
+  # Nothing is changed under an agent at work: its own programs would be replaced while it runs.
+  if pgrep -u ${SERVER_USER} -f 'agent-runner/bin/agent-runner run' >/dev/null 2>&1; then
+    fail "An agent is working on this server. Stop it, or wait until it ends, then try again."
+  fi
+  echo "\${PRETTY_NAME:-$ID}, $(uname -m)"
+`),
+    },
+    {
+        id: 'user',
+        label: `The user ${SERVER_USER}`,
+        as: 'root',
+        timeoutMs: 2 * MINUTE,
+        script: () => script('root', {}, `
+  id ${SERVER_USER} >/dev/null 2>&1 || useradd --create-home --shell /bin/bash ${SERVER_USER}
+`),
+    },
+    {
+        id: 'tools',
+        label: 'git, gh, Node and Chrome',
+        as: 'root',
+        timeoutMs: 20 * MINUTE,
+        script: () => script('root', {}, `
+  . /etc/os-release
+  # A server that was just made often installs its own updates in its first minutes: the install waits its turn.
+  apt() { apt-get -y -q -o DPkg::Lock::Timeout=600 "$@"; }
+  apt update
+  apt install git curl ca-certificates xz-utils procps
+  dir=$(mktemp -d)
+  trap 'rm -rf "$dir"' EXIT
+
+  # From GitHub's own package source, signed with its key: the gh these systems bring themselves is years old.
+  if ! command -v gh >/dev/null; then
+    install -d -m 755 /etc/apt/keyrings
+    curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o "$dir/gh.gpg"
+    install -m 644 "$dir/gh.gpg" /etc/apt/keyrings/githubcli-archive-keyring.gpg
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list
+    apt update
+    apt install gh
+  fi
+
+  have=$(${ROOT}/node/bin/node -p 'process.versions.node.split(".")[0]' 2>/dev/null || true)
+  if [ "$have" != ${NODE_LINE} ]; then
+    arch=x64
+    [ "$(uname -m)" = aarch64 ] && arch=arm64
+    from=https://nodejs.org/dist/latest-v${NODE_LINE}.x
+    curl -fsSL "$from/SHASUMS256.txt" -o "$dir/SHASUMS256.txt"
+    file=$(grep -o "node-v[0-9.]*-linux-$arch\\.tar\\.xz" "$dir/SHASUMS256.txt" | head -n 1 || true)
+    [ -n "$file" ] || fail "nodejs.org lists no Node ${NODE_LINE} for this server's chip."
+    curl -fsSL "$from/$file" -o "$dir/$file"
+    (cd "$dir" && grep " $file\\$" SHASUMS256.txt | sha256sum -c - >/dev/null) || fail "The Node that was downloaded is not the one nodejs.org lists."
+    rm -rf ${ROOT}/node.new
+    mkdir -p ${ROOT}/node.new
+    # Root's, whoever the download names as the files' owner: on a server that owner could be the user the agents run as.
+    tar -xJf "$dir/$file" -C ${ROOT}/node.new --strip-components=1 --no-same-owner
+    rm -rf ${ROOT}/node
+    mv ${ROOT}/node.new ${ROOT}/node
+    touch ${ROOT}/restart
+  fi
+  for bin in node npm npx; do ln -sf ${ROOT}/node/bin/$bin /usr/local/bin/$bin; done
+
+  # A browser that is there and does not start is none: Ubuntu's own package is only a pointer to its snap store.
+  browser() { for name in google-chrome chromium chromium-browser; do "$name" --version >/dev/null 2>&1 && return 0; done; return 1; }
+  if ! browser; then
+    if [ "$(uname -m)" = x86_64 ]; then
+      curl -fsSL https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb -o "$dir/chrome.deb"
+      apt install "$dir/chrome.deb"
+    elif [ "$ID" = debian ]; then
+      # Google ships no Chrome for this chip: Chromium is the same browser without its name.
+      apt install chromium
+    else
+      apt install chromium-browser
+    fi
+    browser || fail "Chrome was installed, and it does not start on this server."
+  fi
+`),
+    },
+    {
+        id: 'openagent',
+        label: 'OpenAgent',
+        as: 'root',
+        timeoutMs: 20 * MINUTE,
+        script: ({ version }) => script('root', { VERSION: version }, `
+  # Read off its file, not asked of OpenAgent itself: nothing a package brought runs as root, neither here nor at the install.
+  have=$(${ROOT}/node/bin/node -p 'require("${ROOT}/node/lib/node_modules/@openagt/dashboard/package.json").version' 2>/dev/null || true)
+  if [ "$have" != "$VERSION" ]; then
+    ${ROOT}/node/bin/npm install --global --ignore-scripts --no-fund --no-audit --loglevel=error "@openagt/dashboard@$VERSION"
+    touch ${ROOT}/restart
+  fi
+  ln -sf ${ROOT}/node/bin/openagent /usr/local/bin/openagent
+`),
+    },
+    {
+        id: 'agent',
+        label: 'Claude Code',
+        as: 'openagent',
+        timeoutMs: 10 * MINUTE,
+        script: () => script('openagent', {}, `
+  # Claude Code's own installer, into this user's home: it keeps itself up to date there, as on a laptop.
+  command -v claude >/dev/null || curl -fsSL https://claude.ai/install.sh | bash
+  command -v claude >/dev/null || fail "Claude Code's installer ended without a claude command."
+`),
+    },
+    {
+        id: 'service',
+        label: 'The service',
+        as: 'root',
+        timeoutMs: 3 * MINUTE,
+        script: () => script('root', { UNIT: SERVICE_UNIT }, `${STARTED}
+  file=/etc/systemd/system/openagent.service
+  if [ "$(cat "$file" 2>/dev/null || true)" != "$UNIT" ]; then
+    printf '%s\\n' "$UNIT" > "$file"
+    systemctl daemon-reload
+    touch ${ROOT}/restart
+  fi
+  # A firewall that is on lets the door's two ports through; one that is off is left off.
+  if command -v ufw >/dev/null && ufw status | grep '^Status: active' >/dev/null; then
+    ufw allow 80/tcp >/dev/null
+    ufw allow 443/tcp >/dev/null
+  fi
+  systemctl enable --quiet openagent
+  if [ -e ${ROOT}/restart ] || ! systemctl is-active --quiet openagent; then
+    systemctl restart openagent
+    rm -f ${ROOT}/restart
+  fi
+  started || ${NOT_STARTED}
+`),
+    },
+    {
+        id: 'door',
+        label: 'The door',
+        as: 'openagent',
+        timeoutMs: 6 * MINUTE,
+        script: ({ address }) => script('openagent', { ADDRESS: address }, `
+  open() { case "$(${DOOR} status)" in *'"listening":true'*'"address":"'"$ADDRESS"'"'*) return 0 ;; *) return 1 ;; esac; }
+  open && exit 0
+  ${DOOR} https "$ADDRESS" >/dev/null
+  # A certificate takes a moment: its office reads the proof on port 80 first.
+  for _ in $(seq 150); do
+    open && exit 0
+    sleep 2
+  done
+  ${DOOR} status | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>console.error(JSON.parse(s).problem??"The door did not open."))' || true
+  fail "The door needs ports 80 and 443 of this server open to the internet: check the firewall of the company the server is rented from."
+`),
+    },
+];
+/** The script that asks the server's door for a link a new machine gets in with. Run as the server's own user. */
+export function linkScript() {
+    return script(SERVER_USER, {}, `\n  ${DOOR} add\n`);
+}
+/** How long a login's script may take: a server that stopped answering is not waited for longer. */
+export const LOGIN_TIMEOUT_MS = 2 * MINUTE;
+/** `gh` reads and writes its own file in the server user's home, whatever that user's shell says of another place or another login. */
+const GH_OWN = 'unset GH_TOKEN GITHUB_TOKEN GH_CONFIG_DIR XDG_CONFIG_HOME';
+const GH_FILE = '"$HOME/.config/gh/hosts.yml"';
+/**
+ * Give the server a GitHub login: `gh` keeps it in its own file, and git asks `gh` for it. The
+ * server then holds this one login, and answers whose it is; when any of that fails, it holds none.
+ *
+ * The login is a word of the script, which the server's shell reads where a program would read:
+ * it is on no command line, and no program the script starts finds it among what it was given.
+ */
+export function githubLoginScript(login) {
+    return {
+        as: SERVER_USER,
+        script: script(SERVER_USER, { LOGIN: login }, `
+  ${GH_OWN}
+  ${GH_STOP_ASKING}
+  rm -f ${GH_FILE}
+  given() {
+    printf '%s\\n' "$LOGIN" | gh auth login --hostname github.com --git-protocol https --with-token &&
+      gh auth setup-git --hostname github.com &&
+      gh api --hostname github.com user --jq .login
+  }
+  # All of it or none: a login that is on the server and not known of on this computer could not be taken off from there.
+  given || { rm -f ${GH_FILE}; exit 1; }
+`),
+    };
+}
+/** How long a person has to type the code at GitHub: GitHub's own limit is fifteen minutes. */
+export const GITHUB_CODE_TIMEOUT_MS = 16 * MINUTE;
+/** Where the server's `gh` writes while it waits for the code to be typed, and the one that waits right now. */
+const GH_ASKING = '"$HOME/.cache/openagent-github-login"';
+/** Whether the process `$1` is a `gh` that asks GitHub for a login: a number kept in a file may be another process's by now. */
+const GH_IS_ASKING = `asking() { ps -o args= -p "$1" 2>/dev/null | grep -q 'gh auth login'; }`;
+/**
+ * End the server's `gh` that still waits for a code, when one does, and forget it: every script
+ * that changes the server's GitHub login starts with this, so a code from an earlier press brings
+ * nothing once the login was asked for anew, copied or taken off, and its wait changes nothing.
+ */
+const GH_STOP_ASKING = `${GH_IS_ASKING}
+  waiting=$(cat ${GH_ASKING}.pid 2>/dev/null || true)
+  case "$waiting" in
+    '' | *[!0-9]*) ;;
+    *) if asking "$waiting"; then kill "$waiting" 2>/dev/null || true; fi ;;
+  esac
+  rm -f ${GH_ASKING}.pid`;
+/**
+ * Have the server ask GitHub for a login of its own: its `gh` is started and left waiting, and
+ * GitHub answers with a short code that a person types at github.com/login/device. The script
+ * prints `<process> <file> <code>` and ends; {@link githubWaitScript} sees the rest. One that
+ * still waits from an earlier press is ended first. The login the server had goes, as with a
+ * copy: the server has one GitHub login, the last one asked for.
+ */
+export function githubCodeScript() {
+    return {
+        as: SERVER_USER,
+        script: script(SERVER_USER, {}, `
+  ${GH_OWN}
+  command -v gh >/dev/null || fail "gh is not on this server yet. Press Update on its row first."
+  mkdir -p "$HOME/.cache"
+  ${GH_STOP_ASKING}
+  rm -f ${GH_FILE}
+  log=$(umask 077; mktemp ${GH_ASKING}.XXXXXX)
+  nohup setsid gh auth login --hostname github.com --git-protocol https --web >"$log" 2>&1 &
+  pid=$!
+  echo "$pid" > ${GH_ASKING}.pid
+  for _ in $(seq 1 150); do
+    grep -q 'one-time code' "$log" && break
+    asking "$pid" || break
+    sleep 0.2
+  done
+  code=$(grep -oE 'one-time code: [A-Z0-9]{4}-[A-Z0-9]{4}' "$log" | head -n 1 | awk '{print $NF}' || true)
+  if [ -z "$code" ]; then
+    kill "$pid" 2>/dev/null || true
+    tail -n 5 "$log" >&2
+    rm -f "$log" ${GH_ASKING}.pid
+    fail "GitHub gave the server no code."
+  fi
+  echo "$pid $log $code"
+`),
+    };
+}
+/**
+ * Wait until the server's `gh` has its answer from GitHub, for the code {@link githubCodeScript}
+ * printed, and say whose login it is. All of it or none, as with a copy.
+ */
+export function githubWaitScript(pid, log) {
+    return {
+        as: SERVER_USER,
+        script: script(SERVER_USER, { PID: pid, LOG: log }, `
+  ${GH_OWN}
+  ${GH_IS_ASKING}
+  while asking "$PID"; do sleep 1; done
+  # Asked for anew, copied or taken off in the meantime: the server's login is that change's to say, and none of it is this wait's.
+  if [ "$(cat ${GH_ASKING}.pid 2>/dev/null || true)" != "$PID" ]; then
+    rm -f "$LOG"
+    fail "The login was asked for anew, or changed another way, before the code was typed."
+  fi
+  rm -f ${GH_ASKING}.pid
+  # The login the server had was taken off before GitHub was asked: one that is there now came from GitHub.
+  given() {
+    gh auth setup-git --hostname github.com &&
+      gh api --hostname github.com user --jq .login
+  }
+  if ! given; then
+    grep -v 'one-time code' "$LOG" | tail -n 3 >&2 || true
+    rm -f "$LOG" ${GH_FILE}
+    fail "No login came from GitHub: the code was not typed in time, or it was refused."
+  fi
+  rm -f "$LOG"
+`),
+    };
+}
+/** Take the GitHub login off the server. */
+export function githubLogoutScript() {
+    return {
+        as: SERVER_USER,
+        script: script(SERVER_USER, {}, `
+  ${GH_OWN}
+  ${GH_STOP_ASKING}
+  rm -f ${GH_FILE}
+`),
+    };
+}
+/**
+ * Give the server a Claude login: Claude Code is first asked, as the server's own user, whether
+ * it reads the login; then the login is written to root's file and OpenAgent is started again
+ * with it. A run that is at work goes on with the login it started with. When OpenAgent does not
+ * start with it, the file is put back as it was.
+ *
+ * Claude Code is the server user's own program: root asks it as that user, for half a minute at
+ * most, and without the lock root holds, which a program that never ended would hold with it.
+ */
+export function claudeLoginScript(login) {
+    return {
+        as: 'root',
+        script: script('root', { LOGIN: login }, `${STARTED}
+  # What is written where the service reads its settings is a login's letters and nothing else.
+  case "$LOGIN" in '' | *[!A-Za-z0-9_-]*) fail "What was sent is no Claude login." ;; esac
+  said=$(${CLAUDE_NAME}="$LOGIN" timeout 30 runuser -u ${SERVER_USER} -- env HOME=/home/${SERVER_USER} /home/${SERVER_USER}/.local/bin/claude auth status 2>&1 9>&- || true)
+  printf '%s' "$said" | grep -Eq '"loggedIn": *true' || fail "Claude Code on this server does not take the login."
+  install -d -m 755 "$(dirname ${CLAUDE_FILE})"
+  rm -f ${CLAUDE_FILE}.old
+  [ ! -e ${CLAUDE_FILE} ] || cp -p ${CLAUDE_FILE} ${CLAUDE_FILE}.old
+  (umask 077 && printf '${CLAUDE_NAME}=%s\\n' "$LOGIN" > ${CLAUDE_FILE}.new)
+  mv ${CLAUDE_FILE}.new ${CLAUDE_FILE}
+  with_it() {
+    systemctl restart openagent && started &&
+      tr '\\0' '\\n' < "/proc/$(systemctl show -p MainPID --value openagent)/environ" | grep -q '^${CLAUDE_NAME}='
+  }
+  if ! with_it; then
+    # As it was: a login that is on the server and not known of on this computer could not be taken off from there.
+    if [ -e ${CLAUDE_FILE}.old ]; then mv ${CLAUDE_FILE}.old ${CLAUDE_FILE}; else rm -f ${CLAUDE_FILE}; fi
+    systemctl restart openagent || true
+    fail "OpenAgent did not start with the login. The server's Claude login is as it was before."
+  fi
+  rm -f ${CLAUDE_FILE}.old
+`),
+    };
+}
+/** Take the Claude login off the server, and start OpenAgent again without it. */
+export function claudeLogoutScript() {
+    return {
+        as: 'root',
+        script: script('root', {}, `${STARTED}
+  [ -e ${CLAUDE_FILE} ] || exit 0
+  rm -f ${CLAUDE_FILE} ${CLAUDE_FILE}.old
+  systemctl restart openagent
+  started || ${NOT_STARTED}
+`),
+    };
+}
+//# sourceMappingURL=steps.js.map

package/dist/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../src/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAU,CAAA;AAqBpG,iEAAiE;AACjE,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAA;AAEtC,6EAA6E;AAC7E,MAAM,IAAI,GAAG,gBAAgB,CAAA;AAC7B,gGAAgG;AAChG,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB,8LAA8L;AAC9L,MAAM,CAAC,MAAM,WAAW,GAAG,2BAA2B,CAAA;AACtD,4FAA4F;AAC5F,MAAM,WAAW,GAAG,yBAAyB,CAAA;AAE7C,wEAAwE;AACxE,MAAM,IAAI,GAAG,GAAG,IAAI,kBAAkB,IAAI,iGAAiG,CAAA;AAE3I,gEAAgE;AAChE,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,IAAI,GAAG,6BAA6B,CAAA;AAE1C;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,EAAiB,EAAE,IAA4B,EAAE,IAAY;IAC3E,MAAM,MAAM,GAAG,8DAA8D,CAAA;IAC7E,OAAO;QACL,mBAAmB;QACnB,WAAW;QACX,uCAAuC;QACvC,gBAAgB,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,IAAI,aAAa,MAAM,EAAE,GAAG;QACzF,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,mCAAmC;QACnC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,8FAA8F,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5I,UAAU;QACV,IAAI,CAAC,IAAI,EAAE;QACX,GAAG;QACH,iBAAiB;QACjB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,CAAA;AAErB,kJAAkJ;AAClJ,MAAM,OAAO,GAAG;;;;;;;;IAQZ,CAAA;AACJ,MAAM,WAAW,GAAG,gDAAgD,CAAA;AAEpE,8IAA8I;AAC9I,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;OAMrB,WAAW;yBACO,WAAW;yBACX,WAAW,eAAe,IAAI;mBACpC,WAAW;YAClB,IAAI;;;;;;;2BAOW,CAAA;AAE3B,MAAM,CAAC,MAAM,KAAK,GAAuB;IACvC;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,QAAQ;QACf,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,CAAC,GAAG,MAAM;QACrB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CACJ,MAAM,EACN,EAAE,EACF;;;;;;;;;;;;gBAYQ,WAAW;;;;CAI1B,CACM;KACJ;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,YAAY,WAAW,EAAE;QAChC,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,CAAC,GAAG,MAAM;QACrB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CACJ,MAAM,EACN,EAAE,EACF;OACD,WAAW,+DAA+D,WAAW;CAC3F,CACM;KACJ;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,0BAA0B;QACjC,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,EAAE,GAAG,MAAM;QACtB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CACJ,MAAM,EACN,EAAE,EACF;;;;;;;;;;;;;;;;;;;WAmBG,IAAI;oBACK,SAAS;;;2CAGc,SAAS;;;uDAGG,SAAS;;;aAGnD,IAAI;eACF,IAAI;;+BAEY,IAAI;aACtB,IAAI;SACR,IAAI,aAAa,IAAI;YAClB,IAAI;;uCAEuB,IAAI;;;;;;;;;;;;;;;;CAgB1C,CACM;KACJ;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,EAAE,GAAG,MAAM;QACtB,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtB,MAAM,CACJ,MAAM,EACN,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB;;WAEG,IAAI,+BAA+B,IAAI;;MAE5C,IAAI;YACE,IAAI;;WAEL,IAAI;CACd,CACM;KACJ;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,aAAa;QACpB,EAAE,EAAE,WAAW;QACf,SAAS,EAAE,EAAE,GAAG,MAAM;QACtB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CACJ,WAAW,EACX,EAAE,EACF;;;;CAIP,CACM;KACJ;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,aAAa;QACpB,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,CAAC,GAAG,MAAM;QACrB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CACJ,MAAM,EACN,EAAE,IAAI,EAAE,YAAY,EAAE,EACtB,GAAG,OAAO;;;;;YAKN,IAAI;;;;;;;;YAQJ,IAAI;;YAEJ,IAAI;;eAED,WAAW;CACzB,CACM;KACJ;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,UAAU;QACjB,EAAE,EAAE,WAAW;QACf,SAAS,EAAE,CAAC,GAAG,MAAM;QACrB,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtB,MAAM,CACJ,WAAW,EACX,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB;qBACa,IAAI;;IAErB,IAAI;;;;;;IAMJ,IAAI;;CAEP,CACM;KACJ;CACF,CAAA;AAED,kHAAkH;AAClH,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,IAAI,QAAQ,CAAC,CAAA;AACrD,CAAC;AAQD,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAA;AAE1C,uIAAuI;AACvI,MAAM,MAAM,GAAG,2DAA2D,CAAA;AAC1E,MAAM,OAAO,GAAG,8BAA8B,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO;QACL,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,MAAM,CACZ,WAAW,EACX,EAAE,KAAK,EAAE,KAAK,EAAE,EAChB;IACF,MAAM;IACN,cAAc;UACR,OAAO;;;;;;;qBAOI,OAAO;CAC3B,CACI;KACF,CAAA;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,MAAM,CAAA;AAEjD,gHAAgH;AAChH,MAAM,SAAS,GAAG,uCAAuC,CAAA;AAEzD,gIAAgI;AAChI,MAAM,YAAY,GAAG,yEAAyE,CAAA;AAE9F;;;;GAIG;AACH,MAAM,cAAc,GAAG,GAAG,YAAY;kBACpB,SAAS;;;;;UAKjB,SAAS,MAAM,CAAA;AAEzB;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,MAAM,CACZ,WAAW,EACX,EAAE,EACF;IACF,MAAM;;;IAGN,cAAc;UACR,OAAO;4BACW,SAAS;;;kBAGnB,SAAS;;;;;;;;;;mBAUR,SAAS;;;;CAI3B,CACI;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW;IACvD,OAAO;QACL,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,MAAM,CACZ,WAAW,EACX,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EACtB;IACF,MAAM;IACN,YAAY;;;gBAGA,SAAS;;;;UAIf,SAAS;;;;;;;;mBAQA,OAAO;;;;CAIzB,CACI;KACF,CAAA;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,MAAM,CACZ,WAAW,EACX,EAAE,EACF;IACF,MAAM;IACN,cAAc;UACR,OAAO;CAChB,CACI;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO;QACL,EAAE,EAAE,MAAM;QACV,MAAM,EAAE,MAAM,CACZ,MAAM,EACN,EAAE,KAAK,EAAE,KAAK,EAAE,EAChB,GAAG,OAAO;;;WAGL,WAAW,mCAAmC,WAAW,sBAAsB,WAAW,UAAU,WAAW;;iCAEzF,WAAW;UAClC,WAAW;WACV,WAAW,eAAe,WAAW,IAAI,WAAW;0BACrC,WAAW,sBAAsB,WAAW;OAC/D,WAAW,QAAQ,WAAW;;;oGAG+D,WAAW;;;;cAIjG,WAAW,mBAAmB,WAAW,QAAQ,WAAW,gBAAgB,WAAW;;;;UAI3F,WAAW;CACpB,CACI;KACF,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,EAAE,EAAE,MAAM;QACV,MAAM,EAAE,MAAM,CACZ,MAAM,EACN,EAAE,EACF,GAAG,OAAO;SACP,WAAW;UACV,WAAW,IAAI,WAAW;;eAErB,WAAW;CACzB,CACI;KACF,CAAA;AACH,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,126 @@
+import { type StepId } from './steps.js';
+/**
+ * The servers this computer installed OpenAgent on, in the person's home folder: where each is,
+ * who logs in there, and how far its install got. The command and the install's own process both
+ * write it, so every change goes through {@link update}.
+ *
+ * It holds no key, no password and no login: the way in is this computer's own SSH keys, the key
+ * the server's door gives is OpenAgent's, kept with its machines, and a GitHub or Claude login
+ * goes to the server and is not kept here.
+ */
+export type StepState = 'waiting' | 'running' | 'done' | 'failed';
+export interface Step {
+    id: StepId;
+    state: StepState;
+    /** For a step that failed: what the server said, its last lines. */
+    said?: string;
+}
+/** The install's own process. */
+export interface Worker {
+    pid: number;
+    /** ISO 8601: written again every few seconds for as long as the process works. */
+    seen: string;
+}
+/** The two logins a server works with. */
+export declare const LOGIN_KINDS: readonly ['github', 'claude'];
+export type LoginKind = (typeof LOGIN_KINDS)[number];
+/**
+ * One login of a server, as this computer left it. The login itself is never kept here: only
+ * that it was put there, when, and for GitHub whose it is.
+ */
+export interface Login {
+    /** ISO 8601: when this computer put the login on the server. Absent while the server has none from here. */
+    since?: string;
+    /** GitHub: the account, as the server's own `gh` answered. */
+    account?: string;
+    /** GitHub: to be copied once the install's steps are done. */
+    wanted?: boolean;
+    /** Why the last try ended without a login. */
+    failed?: string;
+    /** The process that changes the login right now, and when it last said it still does. */
+    worker?: Worker;
+    /** That process waits for the person: for a yes in this computer's browser (Claude), or for a code typed at GitHub. */
+    asking?: boolean;
+    /** GitHub: the code the person types at github.com/login/device while the server waits for it. It is no login: it says which waiting server a person's yes is for. */
+    code?: string;
+}
+export interface Server {
+    /** The server's number or name: what a person typed, and what its certificate is for. */
+    address: string;
+    /** Who logs in over SSH: `root`, or a user that becomes root without a password. */
+    user: string;
+    /** What the server's key is known by, as SSH showed it when this computer first met it. */
+    fingerprint?: string;
+    steps: Step[];
+    /** The process that installs right now, and when it last said it still does. */
+    worker?: Worker;
+    /** The install was asked for and the server is not among the machines yet: the page adds it once the steps are done. */
+    adding: boolean;
+    /** The GitHub login this computer copied to the server. */
+    github?: Login;
+    /** The Claude login this computer made for the server. */
+    claude?: Login;
+}
+export interface Store {
+    servers: Server[];
+}
+/** A cap, so a file edited by hand cannot bloat it. */
+export declare const MAX_SERVERS = 50;
+/** The file's path: beside OpenAgent's own home file, by the same rule. */
+export declare function storePath(env: NodeJS.ProcessEnv): string;
+/**
+ * `said` as a server's address is kept, or `undefined` for what is none: a number, or a name, in
+ * the one form the server's door keeps it in too, so the two always read the same. Nothing that
+ * could be read as an option of a command passes.
+ */
+export declare function addressOf(said: string): string | undefined;
+/** Whether `said` is a user name a Linux server has. */
+export declare const isUser: (said: unknown) => said is string;
+/** Whether `said` is a version npm keeps a package under. */
+export declare const isVersion: (said: unknown) => said is string;
+/** Whether `said` reads as the code GitHub gives a device to show: two groups of four. */
+export declare const isGithubCode: (said: unknown) => said is string;
+/** How often the install's process says it still works, and after how long of silence it is taken for gone. */
+export declare const BEAT_MS = 10000;
+export declare const SILENT_MS = 45000;
+/**
+ * Say again and again that a work is alive: `beat` every `everyMs`, one at a time, a failed one
+ * left at that. `stop` ends it and waits for the one on its way: a beat changes the file, and
+ * one that landed after the work's own last word would write when the work has ended.
+ */
+export declare function heartbeat(beat: () => Promise<unknown>, everyMs: number): {
+    stop(): Promise<void>;
+};
+/**
+ * Whether the server's install runs right now: its process is there, and said so a moment ago.
+ * The process's number alone is no proof: one that died without a word (a laptop that was
+ * switched off) leaves its number in the file, and the system gives it to another program later.
+ */
+export declare function working(server: Server, now?: number): boolean;
+/** Whether a process that wrote itself to the file is still at work: it is there, and said so a moment ago. */
+export declare function atWork(worker: Worker | undefined, now?: number): boolean;
+/** Whether `said` is a GitHub account's name. */
+export declare const isAccount: (said: unknown) => said is string;
+/** Where the door of the server at `address` answers: what OpenAgent's machines know it by. */
+export declare function doorUrl(address: string): string;
+/** Every step, not started. */
+export declare const freshSteps: () => Step[];
+/** Read what a file holds, forgivingly: anything malformed is left out, never a reason to fail. */
+export declare function sanitize(value: unknown): Store;
+/** The file is there and cannot be read as what it should hold: a typo made by hand, a disk that failed. */
+export declare class Unreadable extends Error {
+    constructor(path: string);
+}
+/** The file as it stands; no file reads as no server. Throws {@link Unreadable} for a file that is there and cannot be read. */
+export declare function readStore(env: NodeJS.ProcessEnv): Promise<Store>;
+/**
+ * Change the file: read it, apply `change`, write it back, with no other writer in between.
+ * Written to a temporary file and renamed, so a reader never sees half a file, owner-only.
+ * `change` answers what the caller wants to know of the change.
+ */
+export declare function update<T>(env: NodeJS.ProcessEnv, change: (store: Store) => T): Promise<T>;
+/** Change the one server at `address`, when the file still holds it; answers what `apply` did, or `undefined` for a server that is gone. */
+export declare function changeServer<T>(env: NodeJS.ProcessEnv, address: string, apply: (server: Server) => T): Promise<T | undefined>;
+/** Whether a process with this id is running. */
+export declare function pidAlive(pid: number): boolean;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAY,KAAK,MAAM,EAAE,MAAM,YAAY,CAAA;AAElD;;;;;;;;GAQG;AAEH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEjE,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,SAAS,CAAA;IAChB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAA;CACb;AAED,0CAA0C;AAC1C,eAAO,MAAM,WAAW,YAAI,QAAQ,EAAE,QAAQ,CAAU,CAAA;AACxD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,4GAA4G;IAC5G,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uHAAuH;IACvH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,sKAAsK;IACtK,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,MAAM;IACrB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAA;IACf,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,IAAI,EAAE,CAAA;IACb,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wHAAwH;IACxH,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,KAAK,CAAA;IACd,0DAA0D;IAC1D,MAAM,CAAC,EAAE,KAAK,CAAA;CACf;AAED,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,uDAAuD;AACvD,eAAO,MAAM,WAAW,KAAK,CAAA;AAK7B,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ1D;AAED,wDAAwD;AACxD,eAAO,MAAM,MAAM,SAAU,OAAO,KAAG,IAAI,IAAI,MAA2E,CAAA;AAE1H,6DAA6D;AAC7D,eAAO,MAAM,SAAS,SAAU,OAAO,KAAG,IAAI,IAAI,MAAyG,CAAA;AAE3J,0FAA0F;AAC1F,eAAO,MAAM,YAAY,SAAU,OAAO,KAAG,IAAI,IAAI,MAA4E,CAAA;AAEjI,+GAA+G;AAC/G,eAAO,MAAM,OAAO,QAAS,CAAA;AAC7B,eAAO,MAAM,SAAS,QAAS,CAAA;AAE/B;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAclG;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAEjE;AAED,+GAA+G;AAC/G,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAa,GAAG,OAAO,CAE5E;AAED,iDAAiD;AACjD,eAAO,MAAM,SAAS,SAAU,OAAO,KAAG,IAAI,IAAI,MAAoF,CAAA;AAEtI,+FAA+F;AAC/F,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,+BAA+B;AAC/B,eAAO,MAAM,UAAU,QAAO,IAAI,EAAoD,CAAA;AAyBtF,mGAAmG;AACnG,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CA8B9C;AAED,4GAA4G;AAC5G,qBAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,IAAI,EAAE,MAAM,EAEvB;CACF;AAED,gIAAgI;AAChI,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAgBtE;AAwCD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAU/F;AAED,4IAA4I;AAC5I,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAK7H;AAED,iDAAiD;AACjD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO7C"}