@raidiant/notifai 11.7.1 → 12.0.0-beta.11

package/data/install.ps1

@@ -0,0 +1,318 @@
+#requires -Version 5.1
+<# First execution trusts the HTTPS release channel. Hash checks detect changed
+   downloads; the installed verifier authenticates subsequent updates. This
+   script never changes execution policy or requires an installed Node runtime. #>
+[CmdletBinding()]
+param(
+  [string]$Version,
+  [ValidateSet('stable', 'beta')][string]$Channel,
+  [switch]$Json,
+  [switch]$NoInit,
+  [switch]$NoPath,
+  [switch]$MigrateNpm
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+function Test-NotifaiVersion([string]$Value) {
+  return $Value.Length -le 100 -and $Value -cmatch '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
+}
+function Get-NotifaiHash([string]$File) {
+  $stream = [IO.File]::OpenRead($File)
+  $sha = [Security.Cryptography.SHA256]::Create()
+  try { return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-', '').ToLowerInvariant() }
+  finally { $sha.Dispose(); $stream.Dispose() }
+}
+function Get-NotifaiDownload([string]$Url, [string]$Destination, [long]$Limit) {
+  $uri = [Uri]$Url
+  for ($redirect = 0; $redirect -le 5; $redirect++) {
+    if ($uri.Scheme -cne 'https' -or -not $uri.IsDefaultPort -or $uri.UserInfo -or
+        $uri.Host -notin @('github.com', 'raw.githubusercontent.com', 'release-assets.githubusercontent.com')) {
+      throw 'Release download left its trusted HTTPS origins'
+    }
+    $request = [Net.HttpWebRequest]::Create($uri)
+    $request.AllowAutoRedirect = $false
+    $request.Timeout = 30000
+    $request.ReadWriteTimeout = 30000
+    $request.UserAgent = 'notifai-installer'
+    $response = $request.GetResponse()
+    try {
+      $status = [int]$response.StatusCode
+      if ($status -in @(301, 302, 303, 307, 308)) {
+        if ($redirect -eq 5 -or -not $response.Headers['Location']) { throw 'Release download has too many redirects' }
+        $uri = [Uri]::new($uri, $response.Headers['Location'])
+        continue
+      }
+      if ($status -ne 200 -or $response.ContentLength -gt $Limit) { throw 'Release download was unavailable or too large' }
+      $inputStream = $response.GetResponseStream()
+      $outputStream = [IO.File]::Open($Destination, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
+      try {
+        $buffer = New-Object byte[] 65536
+        [long]$total = 0
+        while (($count = $inputStream.Read($buffer, 0, $buffer.Length)) -gt 0) {
+          $total += $count
+          if ($total -gt $Limit) { throw 'Release download exceeded its size limit' }
+          $outputStream.Write($buffer, 0, $count)
+        }
+        $outputStream.Flush($true)
+      } finally { $outputStream.Dispose(); $inputStream.Dispose() }
+      return
+    } finally { $response.Dispose() }
+  }
+}
+function Read-NotifaiChannel([string]$File, [string]$SelectedChannel) {
+  $lines = [IO.File]::ReadAllLines($File)
+  if ($lines.Length -lt 1 -or $lines.Length -gt 1001) { throw 'Invalid channel metadata' }
+  $header = $lines[0].Split([char]9)
+  if ($header.Length -ne 5 -or $header[0] -cne 'notifai-channel-v1' -or $header[1] -cne $SelectedChannel -or
+      $header[2] -cnotmatch '^[1-9][0-9]{0,15}$' -or -not (Test-NotifaiVersion $header[3]) -or $header[4] -cnotmatch '^[a-f0-9]{64}$') {
+    throw 'Invalid channel metadata'
+  }
+  $withdrawn = @()
+  for ($i = 1; $i -lt $lines.Length; $i++) {
+    $fields = $lines[$i].Split([char]9)
+    if ($fields.Length -ne 2 -or $fields[0] -cne 'withdrawn' -or -not (Test-NotifaiVersion $fields[1])) { throw 'Invalid channel withdrawal' }
+    $withdrawn += $fields[1]
+  }
+  if ($header[3] -cin $withdrawn -or ($SelectedChannel -eq 'stable' -and $header[3].Split('+')[0].Contains('-'))) { throw 'Channel recommends an ineligible release' }
+  return @{ Version = $header[3]; InventoryHash = $header[4]; Withdrawn = $withdrawn }
+}
+function Read-NotifaiArtifact([string]$File, [string]$SelectedVersion, [string]$Target) {
+  $lines = [IO.File]::ReadAllLines($File)
+  if ($lines.Length -lt 2 -or $lines.Length -gt 7) { throw 'Invalid release metadata' }
+  $header = $lines[0].Split([char]9)
+  if ($header.Length -ne 3 -or $header[0] -cne 'notifai-bootstrap-v1' -or $header[1] -cne $SelectedVersion -or $header[2] -cnotmatch '^[a-f0-9]{64}$') {
+    throw 'Release metadata identity differs'
+  }
+  $found = $null
+  $seen = @{}
+  for ($i = 1; $i -lt $lines.Length; $i++) {
+    $fields = $lines[$i].Split([char]9)
+    if ($fields.Length -ne 7 -or $fields[0] -cne 'artifact' -or
+        $fields[1] -cnotmatch '^bun-(darwin|linux|windows)-(arm64|x64)$' -or $seen.ContainsKey($fields[1]) -or
+        $fields[3] -cnotmatch '^[1-9][0-9]{0,8}$' -or [long]$fields[3] -gt 268435456 -or
+        $fields[4] -cnotmatch '^[a-f0-9]{64}$' -or $fields[5] -cnotmatch '^[a-f0-9]{64}$' -or $fields[6] -cnotmatch '^[a-f0-9]{64}$') {
+      throw 'Invalid release artifact metadata'
+    }
+    $suffix = if ($fields[1].StartsWith('bun-windows-')) { 'zip' } else { 'tar.gz' }
+    if ($fields[2] -cne "notifai-$SelectedVersion-$($fields[1].Substring(4)).$suffix") { throw 'Invalid release artifact filename' }
+    $seen[$fields[1]] = $true
+    if ($fields[1] -ceq $Target) {
+      $found = @{ Filename = $fields[2]; Bytes = [long]$fields[3]; Hash = $fields[4]; LauncherHash = $fields[5]; RuntimeHash = $fields[6]; InventoryHash = $header[2] }
+    }
+  }
+  if ($null -eq $found) { throw 'This release does not support the native Windows architecture' }
+  return $found
+}
+function Expand-NotifaiArchive([string]$Archive, [string]$Destination) {
+  Add-Type -AssemblyName System.IO.Compression, System.IO.Compression.FileSystem
+  $zip = [IO.Compression.ZipFile]::OpenRead($Archive)
+  try {
+    if ($zip.Entries.Count -lt 2 -or $zip.Entries.Count -gt 130) { throw 'Invalid release archive entry count' }
+    $seen = @{}
+    [long]$expanded = 0
+    foreach ($entry in $zip.Entries) {
+      $name = $entry.FullName
+      if ($name.Length -gt 240 -or $name.Split('/').Length -gt 8) { throw 'Invalid release archive path' }
+      foreach ($part in $name.Split('/')) {
+        if ($part -cnotmatch '^[A-Za-z0-9_-][A-Za-z0-9._-]*$' -or $part.EndsWith('.') -or $part -imatch '^(con|prn|aux|nul|com[0-9]|lpt[0-9])(\.|$)') { throw 'Unsafe release archive path' }
+      }
+      $type = ($entry.ExternalAttributes -shr 16) -band 61440
+      if ($type -notin @(0, 32768) -or $seen.ContainsKey($name) -or $entry.Length -gt 536870912) { throw 'Unsafe release archive member' }
+      foreach ($prior in $seen.Keys) {
+        if ($name.StartsWith("$prior/", [StringComparison]::OrdinalIgnoreCase) -or $prior.StartsWith("$name/", [StringComparison]::OrdinalIgnoreCase)) { throw 'Conflicting release archive paths' }
+      }
+      $seen[$name] = $true
+      $expanded += $entry.Length
+      if ($expanded -gt 805306368) { throw 'Expanded release archive exceeds its size limit' }
+    }
+    if (-not $seen.ContainsKey('notifai.exe') -or -not $seen.ContainsKey('notifai-runtime.exe')) { throw 'Release executables are missing' }
+    [void][IO.Directory]::CreateDirectory($Destination)
+    foreach ($entry in $zip.Entries) {
+      $file = [IO.Path]::Combine($Destination, $entry.FullName.Replace('/', [IO.Path]::DirectorySeparatorChar))
+      [void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($file))
+      $inputStream = $entry.Open()
+      $outputStream = [IO.File]::Open($file, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
+      try {
+        $buffer = New-Object byte[] 65536
+        [long]$total = 0
+        while (($count = $inputStream.Read($buffer, 0, $buffer.Length)) -gt 0) {
+          $total += $count
+          if ($total -gt $entry.Length) { throw 'Release archive member exceeded its declared size' }
+          $outputStream.Write($buffer, 0, $count)
+        }
+        if ($total -ne $entry.Length) { throw 'Release archive member is truncated' }
+        $outputStream.Flush($true)
+      } finally { $outputStream.Dispose(); $inputStream.Dispose() }
+    }
+  } finally { $zip.Dispose() }
+}
+function Get-NotifaiWindowsTarget {
+  if (-not ('NotifaiBootstrap.Native' -as [type])) {
+    Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+namespace NotifaiBootstrap {
+  public static class Native {
+    [DllImport("kernel32.dll", SetLastError=true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    public static extern bool IsWow64Process2(IntPtr process, out ushort processMachine, out ushort nativeMachine);
+  }
+}
+'@
+  }
+  [UInt16]$processMachine = 0
+  [UInt16]$nativeMachine = 0
+  if (-not [NotifaiBootstrap.Native]::IsWow64Process2([IntPtr](-1), [ref]$processMachine, [ref]$nativeMachine)) { throw 'Cannot establish native Windows architecture' }
+  switch ($nativeMachine) {
+    34404 { return 'bun-windows-x64' }
+    43620 { return 'bun-windows-arm64' }
+    default { throw 'This native Windows architecture is not supported' }
+  }
+}
+function Get-NotifaiAccessControl([string]$File, [IO.FileAttributes]$Attributes) {
+  $info = if (($Attributes -band [IO.FileAttributes]::Directory) -ne 0) { [IO.DirectoryInfo]::new($File) } else { [IO.FileInfo]::new($File) }
+  # Keep this bootstrap lookup independent of filesystem/security cmdlet
+  # module discovery. Windows PowerShell and PowerShell use different .NET APIs.
+  if ($PSVersionTable.PSEdition -eq 'Desktop') { return $info.GetAccessControl() }
+  return [IO.FileSystemAclExtensions]::GetAccessControl($info)
+}
+function New-NotifaiPrivateDirectory([string]$Directory) {
+  if ([IO.Directory]::Exists($Directory) -or [IO.File]::Exists($Directory)) { throw 'Installer temporary directory already exists' }
+  $user = [Security.Principal.WindowsIdentity]::GetCurrent().User
+  $security = New-Object Security.AccessControl.DirectorySecurity
+  $security.SetOwner($user)
+  $security.SetAccessRuleProtection($true, $false)
+  foreach ($sid in @($user, [Security.Principal.SecurityIdentifier]::new('S-1-5-18'), [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))) {
+    $rule = [Security.AccessControl.FileSystemAccessRule]::new($sid, [Security.AccessControl.FileSystemRights]::FullControl,
+      [Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit', [Security.AccessControl.PropagationFlags]::None,
+      [Security.AccessControl.AccessControlType]::Allow)
+    [void]$security.AddAccessRule($rule)
+  }
+  $overload = [IO.Directory].GetMethods() | Where-Object { $_.Name -eq 'CreateDirectory' -and $_.GetParameters().Length -eq 2 -and $_.GetParameters()[1].ParameterType -eq [Security.AccessControl.DirectorySecurity] }
+  if ($overload) { [void][IO.Directory]::CreateDirectory($Directory, $security) }
+  else { [IO.FileSystemAclExtensions]::Create([IO.DirectoryInfo]::new($Directory), $security) }
+  $attributes = [IO.File]::GetAttributes($Directory)
+  $actual = Get-NotifaiAccessControl $Directory $attributes
+  if (($attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or -not $actual.AreAccessRulesProtected -or
+      $actual.GetOwner([Security.Principal.SecurityIdentifier]).Value -ne $user.Value) { throw 'Installer temporary directory is not privately owned' }
+  foreach ($rule in $actual.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+    if ($rule.AccessControlType -eq [Security.AccessControl.AccessControlType]::Allow -and $rule.IdentityReference.Value -notin @($user.Value, 'S-1-5-18', 'S-1-5-32-544')) { throw 'Installer temporary directory permits another account' }
+  }
+}
+function Invoke-NotifaiCandidate([string]$Launcher, [string[]]$NativeArgs) {
+  & $Launcher @NativeArgs
+  $script:NotifaiBootstrapExitCode = $LASTEXITCODE
+}
+function Get-NotifaiAccountHome {
+  $accountHome = [Environment]::GetFolderPath([Environment+SpecialFolder]::UserProfile)
+  if (-not $accountHome -or -not [IO.Path]::IsPathRooted($accountHome)) { throw 'Cannot resolve this account home' }
+  foreach ($value in @($env:USERPROFILE, $env:HOME)) {
+    # Git Bash's POSIX HOME is not a Windows account relocation.
+    if ($value -and $value -match '^(?:[A-Za-z]:[\\/]|\\\\)') {
+      if (-not [String]::Equals([IO.Path]::GetFullPath($value).TrimEnd('\', '/'), $accountHome.TrimEnd('\', '/'), [StringComparison]::OrdinalIgnoreCase)) { throw 'HOME or USERPROFILE differs from the OS account home' }
+    }
+  }
+  return $accountHome
+}
+# Read-only inspection of an existing path. npm can inherit a token's default
+# owner. The OS-confirmed profile can belong to Windows itself; this exception
+# must never admit a system-owned npm package or managed installation path.
+function Assert-NotifaiPathAccess([string]$File, [switch]$AllowDefaultOwner, [switch]$RequireProtected, [switch]$AccountHome) {
+  $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+  $user = $identity.User.Value
+  $attributes = [IO.File]::GetAttributes($File)
+  $acl = Get-NotifaiAccessControl $File $attributes
+  $owner = $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value
+  $defaultOwner = $AllowDefaultOwner -and $identity.Owner.Value -eq 'S-1-5-32-544' -and $owner -eq $identity.Owner.Value
+  $profileOwner = $false
+  if ($AccountHome) {
+    $expectedHome = Get-NotifaiAccountHome
+    if (-not [String]::Equals([IO.Path]::GetFullPath($File).TrimEnd('\', '/'), $expectedHome.TrimEnd('\', '/'), [StringComparison]::OrdinalIgnoreCase) -or
+        ($attributes -band [IO.FileAttributes]::Directory) -eq 0) { throw 'Account home access check requires the exact OS profile directory' }
+    $profileOwner = $owner -in @('S-1-5-18', 'S-1-5-32-544')
+  }
+  if (($attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or
+      ($owner -ne $user -and -not $defaultOwner -and -not $profileOwner) -or
+      ($RequireProtected -and -not $acl.AreAccessRulesProtected)) { throw 'Existing path is not privately owned; inspect it before repair' }
+  $writes = [int64][Security.AccessControl.FileSystemRights]'Write, Delete, DeleteSubdirectoriesAndFiles, ChangePermissions, TakeOwnership' -bor 0x50000000
+  foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+    if ($rule.AccessControlType -eq [Security.AccessControl.AccessControlType]::Allow -and
+        ([int64]$rule.FileSystemRights -band $writes) -ne 0 -and
+        $rule.IdentityReference.Value -notin @($user, 'S-1-5-18', 'S-1-5-32-544')) { throw 'Existing path permits another writer; inspect it before repair' }
+  }
+}
+function Get-NotifaiInstalledCommand {
+  $accountHome = Get-NotifaiAccountHome
+  $managed = [IO.Path]::Combine($accountHome, '.notifai')
+  $bin = [IO.Path]::Combine($managed, 'bin')
+  $command = [IO.Path]::Combine($bin, 'notifai.exe')
+  try { [void][IO.File]::GetAttributes($command) }
+  catch [IO.FileNotFoundException] { return $null }
+  catch [IO.DirectoryNotFoundException] { return $null }
+  foreach ($file in @($accountHome, $managed, $bin, $command)) {
+    Assert-NotifaiPathAccess $file -AccountHome:($file -eq $accountHome) -RequireProtected:($file -eq $managed -or $file -eq $bin)
+  }
+  if (-not [IO.File]::Exists($command)) { throw 'Existing launcher is not a regular file; repair it explicitly' }
+  return $command
+}
+function Get-NotifaiInstallArguments {
+  $nativeArgs = @('install', '--source', 'powershell')
+  if ($Channel) { $nativeArgs += @('--channel', $Channel) }
+  if ($Version) { $nativeArgs += @('--version', $Version) }
+  if ($Json) { $nativeArgs += '--json' }
+  if ($NoInit) { $nativeArgs += '--no-init' }
+  if ($NoPath) { $nativeArgs += '--no-path' }
+  if ($MigrateNpm) { $nativeArgs += '--migrate-npm' }
+  return $nativeArgs
+}
+function Invoke-NotifaiBootstrap {
+  $selectedChannel = if ($Channel) { $Channel } else { 'stable' }
+  if ($Version -and -not (Test-NotifaiVersion $Version)) { throw 'Version must be an exact semantic version' }
+  $existing = Get-NotifaiInstalledCommand
+  if ($existing) {
+    Invoke-NotifaiCandidate $existing (Get-NotifaiInstallArguments)
+    return
+  }
+  if ($selectedChannel -eq 'stable' -and $Version -and $Version.Split('+')[0].Contains('-')) { throw 'A prerelease requires -Channel beta' }
+  $target = Get-NotifaiWindowsTarget
+  $temporary = [IO.Path]::Combine([IO.Path]::GetTempPath(), "notifai-install-$([Guid]::NewGuid().ToString('N'))")
+  New-NotifaiPrivateDirectory $temporary
+  try {
+    $channelFile = [IO.Path]::Combine($temporary, 'channel.tsv')
+    Get-NotifaiDownload "https://raw.githubusercontent.com/Raidiant-io/notifai/release-metadata/$selectedChannel.bootstrap.tsv" $channelFile 262144
+    $release = Read-NotifaiChannel $channelFile $selectedChannel
+    $selectedVersion = if ($Version) { $Version } else { $release.Version }
+    if ($selectedVersion -cin $release.Withdrawn) { throw 'The requested release has been withdrawn' }
+    $base = "https://github.com/Raidiant-io/notifai/releases/download/v$selectedVersion"
+    $artifactFile = [IO.Path]::Combine($temporary, 'bootstrap.tsv')
+    Get-NotifaiDownload "$base/bootstrap.tsv" $artifactFile 262144
+    $artifact = Read-NotifaiArtifact $artifactFile $selectedVersion $target
+    if ($selectedVersion -ceq $release.Version -and $artifact.InventoryHash -cne $release.InventoryHash) { throw 'Channel and release inventory differ' }
+    $inventory = [IO.Path]::Combine($temporary, 'inventory.json')
+    Get-NotifaiDownload "$base/inventory.json" $inventory 262144
+    if ((Get-NotifaiHash $inventory) -cne $artifact.InventoryHash) { throw 'Release inventory digest differs' }
+    $archive = [IO.Path]::Combine($temporary, $artifact.Filename)
+    Get-NotifaiDownload "$base/$($artifact.Filename)" $archive $artifact.Bytes
+    if ((Get-Item -LiteralPath $archive).Length -ne $artifact.Bytes -or (Get-NotifaiHash $archive) -cne $artifact.Hash) { throw 'Release archive digest or size differs' }
+    $extracted = [IO.Path]::Combine($temporary, 'release')
+    Expand-NotifaiArchive $archive $extracted
+    $launcher = [IO.Path]::Combine($extracted, 'notifai.exe')
+    if ((Get-NotifaiHash $launcher) -cne $artifact.LauncherHash -or (Get-NotifaiHash ([IO.Path]::Combine($extracted, 'notifai-runtime.exe'))) -cne $artifact.RuntimeHash) { throw 'Release executable digests differ' }
+    $nativeArgs = @(Get-NotifaiInstallArguments) + @('--directory', $extracted, '--inventory', $inventory)
+    Invoke-NotifaiCandidate $launcher $nativeArgs
+  } finally {
+    if ([IO.Directory]::Exists($temporary)) {
+      try { [IO.Directory]::Delete($temporary, $true) }
+      catch { [Console]::Error.WriteLine("Temporary installer files remain at $temporary; remove them after running commands finish.") }
+    }
+  }
+}
+if ($MyInvocation.InvocationName -ne '.') {
+  try { Invoke-NotifaiBootstrap; exit $script:NotifaiBootstrapExitCode }
+  catch {
+    if ($Json) { @{ ok = $false; code = 'bootstrap_failed'; message = $_.Exception.Message } | ConvertTo-Json -Compress }
+    else { [Console]::Error.WriteLine("Notifai installation failed: $($_.Exception.Message)") }
+    exit 1
+  }
+}

package/data/release.json

@@ -0,0 +1 @@
+{"version":"12.0.0-beta.11","source_revision":"29b033b35eb72cf2c4235a604d865b70bb9c516a"}

package/inventory.json

@@ -0,0 +1 @@
+{"key_id":"notifai-release-2026-10","payload":"eyJzY2hlbWEiOjEsInZlcnNpb24iOiIxMi4wLjAtYmV0YS4xMSIsInNvdXJjZV9yZXZpc2lvbiI6IjI5YjAzM2IzNWViNzJjZjJjNDIzNWE2MDRkODY1YjcwYmI5YzUxNmEiLCJzdG9yZV9zY2hlbWEiOjEsImxhdW5jaGVyX3NjaGVtYSI6MSwiYXJ0aWZhY3RzIjpbeyJ0YXJnZXQiOiJidW4tZGFyd2luLWFybTY0IiwiZmlsZW5hbWUiOiJub3RpZmFpLTEyLjAuMC1iZXRhLjExLWRhcndpbi1hcm02NC50YXIuZ3oiLCJieXRlcyI6Mjc3NjkwMzgsInNoYTI1NiI6IjFiZWQ1MmRlOGQ4NzhmNmE2OWU4ZmNmYTNjZTFmYjZlZDE4ZGEwNTg3YjZjODFmNDFlYTcyM2Q0MmRkOWVhMDQiLCJydW50aW1lX3NoYTI1NiI6IjdmNDYwYjlkYmUzMDUzYWJlODdkZWJmODZiMTFkZjVlMzZjMmZhYjI3ZmVkMTI5NWM4MTg1NjkyNjM2YmQxMmQiLCJsYXVuY2hlcl9zaGEyNTYiOiI3ZWYxNDdiNmUxZTIxMDIzY2QwN2ZhNmQ3Y2Y5NzJlOWFhZDljNjFmMmMzZTZjNGM0NzFkZGJkMmJlYWRkZTNkIiwibWF0ZXJpYWxzIjpbeyJwYXRoIjoiQlVOLUxJQ0VOU0UubWQiLCJieXRlcyI6NTYxMywic2hhMjU2IjoiYjljYWY1MjcyODY5MWI0MDU3ZTM3MTIzMmMyMjFhMTMyODgzMTk4YmUyZjNkMmRkZjkyYzkwNDA0Yzk4NGIxYSJ9LHsicGF0aCI6IkNPUlJFU1BPTkRJTkctU09VUkNFUy5qc29uIiwiYnl0ZXMiOjIwMjAsInNoYTI1NiI6ImZhNGMzNDQ4MDExNTQ4NzJkNjE3OWVlMmVmNDk5MjNkYzlmODkwOWVmMDFlNTNiODZlOGY1N2M2MjU4MjMyNzQifSx7InBhdGgiOiJMSUNFTlNFLnR4dCIsImJ5dGVzIjoxMTM0Niwic2hhMjU2IjoiOTQ0YzEzZmYwZmU3OTVlMjkxZmQxYzQ5NDczZjk4ZDRmZGYxZjc0NjM4ZTAxZjg4Mjc2OWNkNGNhZTc4YjczZCJ9LHsicGF0aCI6Ik5PVElDRS1QUk9WRU5BTkNFLmpzb24iLCJieXRlcyI6NDUwMjY0LCJzaGEyNTYiOiI1MzRkZDU5ZmQ0YzE1ZGQxMzgyZTgyN2YwYjg1YzE5ZjdjNjk4ZTIzNWY5Mjk5ZWFhMjAyZGI1NDAwODM0Mjg4In0seyJwYXRoIjoiTk9USUNFLnR4dCIsImJ5dGVzIjo2MjYsInNoYTI1NiI6IjFkZmJmNDQ5OGRjMDI2YjIwNTljMGIwYjVlYjVmYTFkODJhZTMzNGU1OGZmMTFlN2MyOTczMzMyN2YyNWM0ZWIifSx7InBhdGgiOiJSRUJVSUxESU5HLm1kIiwiYnl0ZXMiOjM4NDIsInNoYTI1NiI6ImNlNjA1YjVmZGIwMzE5MzM5ZjlmODNmMmZlN2NjY2JjN2U1NzI2ZmRmNDk0ZGE2ZTI4NDMzYmVmODI5ZWIwYmUifSx7InBhdGgiOiJTT1VSQ0UtTk9USUNFUy50eHQiLCJieXRlcyI6OTAxNzc3MSwic2hhMjU2IjoiODk5NzZiZWNjMjU2NTQwZTZkMmU4MDdiNDdhNGUwNWU4ODk5ODJjMDYyMmZjMDQ0MTNhN2JmN2U3N2E3N2UzNyJ9LHsicGF0aCI6IlRISVJELVBBUlRZLU5PVElDRVMudHh0IiwiYnl0ZXMiOjI0OTE0OTYsInNoYTI1NiI6IjExNjQ0N2VmZjc3ODkzNTExNzk3ZWY0NzYwMTFkZWM4MDAyMjRmOTFlMzM0MmUzZDY1NzA3MDg3MTJiNGI3NzIifSx7InBhdGgiOiJsaWNlbnNlcy9ucG0tY21kLXNoaW0udHh0IiwiYnl0ZXMiOjgxMywic2hhMjU2IjoiYWZmZmRmMTIwODExMjI3NDljNGI3MWM1YjFjMTFiYzY1OWQ3OTI0MmQxOWUxOGY1ZThkYmFiMDRhNDVlMzZiYiJ9LHsicGF0aCI6Im5wbS1hZGFwdGVyLWZpbGVzLmpzb24iLCJieXRlcyI6MTUyNCwic2hhMjU2IjoiZmYxMzFiMDMxNTkyOGNhY2FkNjY5MzcxNTQ2MTk4MzcwNWRkOWI3YTY0NDU1YzQ3M2NjN2YxZmY5ZjVmNmFlOSJ9XX0seyJ0YXJnZXQiOiJidW4tZGFyd2luLXg2NCIsImZpbGVuYW1lIjoibm90aWZhaS0xMi4wLjAtYmV0YS4xMS1kYXJ3aW4teDY0LnRhci5neiIsImJ5dGVzIjozMDAwNzMzNywic2hhMjU2IjoiMzI3MjEzMjdlNmQ5Y2NjNjZiMmMyMmI4MGQwZjgyMzEyOTMzMjM2NDgzNDRiOTZjYjcwNDlkMmJmYmIwY2FlYiIsInJ1bnRpbWVfc2hhMjU2IjoiMTFlODgwNTA3YzVmMjc0NjM1YzdkMzdlN2UzZDhkMDg5ZjE5Mjc3MDE2YzdlMzlkNjU4OWE2OGZjZWM1ZTA4MiIsImxhdW5jaGVyX3NoYTI1NiI6ImJiNDM3YTQ2NmFiMWM2YTRiZjU0Nzk0MDg3NmZhMTMwMTZlNmYwZTlhNjljODU3NzM0YjllNmViNWExZjNiYmYiLCJtYXRlcmlhbHMiOlt7InBhdGgiOiJCVU4tTElDRU5TRS5tZCIsImJ5dGVzIjo1NjEzLCJzaGEyNTYiOiJiOWNhZjUyNzI4NjkxYjQwNTdlMzcxMjMyYzIyMWExMzI4ODMxOThiZTJmM2QyZGRmOTJjOTA0MDRjOTg0YjFhIn0seyJwYXRoIjoiQ09SUkVTUE9ORElORy1TT1VSQ0VTLmpzb24iLCJieXRlcyI6MjAyMCwic2hhMjU2IjoiZmE0YzM0NDgwMTE1NDg3MmQ2MTc5ZWUyZWY0OTkyM2RjOWY4OTA5ZWYwMWU1M2I4NmU4ZjU3YzYyNTgyMzI3NCJ9LHsicGF0aCI6IkxJQ0VOU0UudHh0IiwiYnl0ZXMiOjExMzQ2LCJzaGEyNTYiOiI5NDRjMTNmZjBmZTc5NWUyOTFmZDFjNDk0NzNmOThkNGZkZjFmNzQ2MzhlMDFmODgyNzY5Y2Q0Y2FlNzhiNzNkIn0seyJwYXRoIjoiTk9USUNFLVBST1ZFTkFOQ0UuanNvbiIsImJ5dGVzIjo0NTAyNjQsInNoYTI1NiI6IjUzNGRkNTlmZDRjMTVkZDEzODJlODI3ZjBiODVjMTlmN2M2OThlMjM1ZjkyOTllYWEyMDJkYjU0MDA4MzQyODgifSx7InBhdGgiOiJOT1RJQ0UudHh0IiwiYnl0ZXMiOjYyNiwic2hhMjU2IjoiMWRmYmY0NDk4ZGMwMjZiMjA1OWMwYjBiNWViNWZhMWQ4MmFlMzM0ZTU4ZmYxMWU3YzI5NzMzMzI3ZjI1YzRlYiJ9LHsicGF0aCI6IlJFQlVJTERJTkcubWQiLCJieXRlcyI6Mzg0Miwic2hhMjU2IjoiY2U2MDViNWZkYjAzMTkzMzlmOWY4M2YyZmU3Y2NjYmM3ZTU3MjZmZGY0OTRkYTZlMjg0MzNiZWY4MjllYjBiZSJ9LHsicGF0aCI6IlNPVVJDRS1OT1RJQ0VTLnR4dCIsImJ5dGVzIjo5MDE3NzcxLCJzaGEyNTYiOiI4OTk3NmJlY2MyNTY1NDBlNmQyZTgwN2I0N2E0ZTA1ZTg4OTk4MmMwNjIyZmMwNDQxM2E3YmY3ZTc3YTc3ZTM3In0seyJwYXRoIjoiVEhJUkQtUEFSVFktTk9USUNFUy50eHQiLCJieXRlcyI6MjQ5MTQ5Niwic2hhMjU2IjoiMTE2NDQ3ZWZmNzc4OTM1MTE3OTdlZjQ3NjAxMWRlYzgwMDIyNGY5MWUzMzQyZTNkNjU3MDcwODcxMmI0Yjc3MiJ9LHsicGF0aCI6ImxpY2Vuc2VzL25wbS1jbWQtc2hpbS50eHQiLCJieXRlcyI6ODEzLCJzaGEyNTYiOiJhZmZmZGYxMjA4MTEyMjc0OWM0YjcxYzViMWMxMWJjNjU5ZDc5MjQyZDE5ZTE4ZjVlOGRiYWIwNGE0NWUzNmJiIn0seyJwYXRoIjoibnBtLWFkYXB0ZXItZmlsZXMuanNvbiIsImJ5dGVzIjoxNTI0LCJzaGEyNTYiOiJmZjEzMWIwMzE1OTI4Y2FjYWQ2NjkzNzE1NDYxOTgzNzA1ZGQ5YjdhNjQ0NTVjNDczY2M3ZjFmZjlmNWY2YWU5In1dfSx7InRhcmdldCI6ImJ1bi1saW51eC1hcm02NCIsImZpbGVuYW1lIjoibm90aWZhaS0xMi4wLjAtYmV0YS4xMS1saW51eC1hcm02NC50YXIuZ3oiLCJieXRlcyI6MzkzMTY2NjgsInNoYTI1NiI6IjE4ODhjZWNmNzMwMDZlMTgwMGU2NWZmODJiZTA3NGQ5ZjE5NzRkMzdiNmYwNjQwNWUyY2RmMDkzZmUzOGUzYzAiLCJydW50aW1lX3NoYTI1NiI6IjBkY2E2YmQxMmM5YmRmNzBlMzNiMzI3N2JkYTA4NjdiMDQ3OTcwZjlmN2ZkMWMwODRjYTczZDAyODJkMTBiNDgiLCJsYXVuY2hlcl9zaGEyNTYiOiJjMTllMzMyYzgyMWI3MTI4Y2IyNWY2MWU0YWI3ZTBiM2M2MzM0NWYwNGUyYWI1YWI5NWQ0NTFhNGE2ZmJkYzQ1IiwibWF0ZXJpYWxzIjpbeyJwYXRoIjoiQlVOLUxJQ0VOU0UubWQiLCJieXRlcyI6NTYxMywic2hhMjU2IjoiYjljYWY1MjcyODY5MWI0MDU3ZTM3MTIzMmMyMjFhMTMyODgzMTk4YmUyZjNkMmRkZjkyYzkwNDA0Yzk4NGIxYSJ9LHsicGF0aCI6IkNPUlJFU1BPTkRJTkctU09VUkNFUy5qc29uIiwiYnl0ZXMiOjIwMjAsInNoYTI1NiI6ImZhNGMzNDQ4MDExNTQ4NzJkNjE3OWVlMmVmNDk5MjNkYzlmODkwOWVmMDFlNTNiODZlOGY1N2M2MjU4MjMyNzQifSx7InBhdGgiOiJMSUNFTlNFLnR4dCIsImJ5dGVzIjoxMTM0Niwic2hhMjU2IjoiOTQ0YzEzZmYwZmU3OTVlMjkxZmQxYzQ5NDczZjk4ZDRmZGYxZjc0NjM4ZTAxZjg4Mjc2OWNkNGNhZTc4YjczZCJ9LHsicGF0aCI6Ik5PVElDRS1QUk9WRU5BTkNFLmpzb24iLCJieXRlcyI6NDUwMjY0LCJzaGEyNTYiOiI1MzRkZDU5ZmQ0YzE1ZGQxMzgyZTgyN2YwYjg1YzE5ZjdjNjk4ZTIzNWY5Mjk5ZWFhMjAyZGI1NDAwODM0Mjg4In0seyJwYXRoIjoiTk9USUNFLnR4dCIsImJ5dGVzIjo2MjYsInNoYTI1NiI6IjFkZmJmNDQ5OGRjMDI2YjIwNTljMGIwYjVlYjVmYTFkODJhZTMzNGU1OGZmMTFlN2MyOTczMzMyN2YyNWM0ZWIifSx7InBhdGgiOiJSRUJVSUxESU5HLm1kIiwiYnl0ZXMiOjM4NDIsInNoYTI1NiI6ImNlNjA1YjVmZGIwMzE5MzM5ZjlmODNmMmZlN2NjY2JjN2U1NzI2ZmRmNDk0ZGE2ZTI4NDMzYmVmODI5ZWIwYmUifSx7InBhdGgiOiJTT1VSQ0UtTk9USUNFUy50eHQiLCJieXRlcyI6OTAxNzc3MSwic2hhMjU2IjoiODk5NzZiZWNjMjU2NTQwZTZkMmU4MDdiNDdhNGUwNWU4ODk5ODJjMDYyMmZjMDQ0MTNhN2JmN2U3N2E3N2UzNyJ9LHsicGF0aCI6IlRISVJELVBBUlRZLU5PVElDRVMudHh0IiwiYnl0ZXMiOjI0OTE0OTYsInNoYTI1NiI6IjExNjQ0N2VmZjc3ODkzNTExNzk3ZWY0NzYwMTFkZWM4MDAyMjRmOTFlMzM0MmUzZDY1NzA3MDg3MTJiNGI3NzIifSx7InBhdGgiOiJsaWNlbnNlcy9ucG0tY21kLXNoaW0udHh0IiwiYnl0ZXMiOjgxMywic2hhMjU2IjoiYWZmZmRmMTIwODExMjI3NDljNGI3MWM1YjFjMTFiYzY1OWQ3OTI0MmQxOWUxOGY1ZThkYmFiMDRhNDVlMzZiYiJ9LHsicGF0aCI6Im5wbS1hZGFwdGVyLWZpbGVzLmpzb24iLCJieXRlcyI6MTUyNCwic2hhMjU2IjoiZmYxMzFiMDMxNTkyOGNhY2FkNjY5MzcxNTQ2MTk4MzcwNWRkOWI3YTY0NDU1YzQ3M2NjN2YxZmY5ZjVmNmFlOSJ9XX0seyJ0YXJnZXQiOiJidW4tbGludXgteDY0IiwiZmlsZW5hbWUiOiJub3RpZmFpLTEyLjAuMC1iZXRhLjExLWxpbnV4LXg2NC50YXIuZ3oiLCJieXRlcyI6Mzg4Nzk2MDcsInNoYTI1NiI6IjU3M2Y2M2ZjNDBjNzU2NzM4YTkwMzYzY2I3ZDQ3ZDQ4Y2E1N2RjZTlmYWYxYjc2MGM0Y2M4ZWRmZTY3ZDY3NzkiLCJydW50aW1lX3NoYTI1NiI6IjYwMDJlYWI0ZTMwM2JkMGYwZGE2OWY3MWIzYTNjYmM5ODNhYjA4M2FlMmZmNDcyMmIwMjE0ZTAzZGJmZWE0ZDUiLCJsYXVuY2hlcl9zaGEyNTYiOiJiZGY4ZDQ3ZGY4NTgxYWNlMjliNTc5MDQ1N2NiYzZjMjZkMTJiM2NiMTRjMGRkYWIzMzc5YTcyNzVkOWVhNGIxIiwibWF0ZXJpYWxzIjpbeyJwYXRoIjoiQlVOLUxJQ0VOU0UubWQiLCJieXRlcyI6NTYxMywic2hhMjU2IjoiYjljYWY1MjcyODY5MWI0MDU3ZTM3MTIzMmMyMjFhMTMyODgzMTk4YmUyZjNkMmRkZjkyYzkwNDA0Yzk4NGIxYSJ9LHsicGF0aCI6IkNPUlJFU1BPTkRJTkctU09VUkNFUy5qc29uIiwiYnl0ZXMiOjIwMjAsInNoYTI1NiI6ImZhNGMzNDQ4MDExNTQ4NzJkNjE3OWVlMmVmNDk5MjNkYzlmODkwOWVmMDFlNTNiODZlOGY1N2M2MjU4MjMyNzQifSx7InBhdGgiOiJMSUNFTlNFLnR4dCIsImJ5dGVzIjoxMTM0Niwic2hhMjU2IjoiOTQ0YzEzZmYwZmU3OTVlMjkxZmQxYzQ5NDczZjk4ZDRmZGYxZjc0NjM4ZTAxZjg4Mjc2OWNkNGNhZTc4YjczZCJ9LHsicGF0aCI6Ik5PVElDRS1QUk9WRU5BTkNFLmpzb24iLCJieXRlcyI6NDUwMjY0LCJzaGEyNTYiOiI1MzRkZDU5ZmQ0YzE1ZGQxMzgyZTgyN2YwYjg1YzE5ZjdjNjk4ZTIzNWY5Mjk5ZWFhMjAyZGI1NDAwODM0Mjg4In0seyJwYXRoIjoiTk9USUNFLnR4dCIsImJ5dGVzIjo2MjYsInNoYTI1NiI6IjFkZmJmNDQ5OGRjMDI2YjIwNTljMGIwYjVlYjVmYTFkODJhZTMzNGU1OGZmMTFlN2MyOTczMzMyN2YyNWM0ZWIifSx7InBhdGgiOiJSRUJVSUxESU5HLm1kIiwiYnl0ZXMiOjM4NDIsInNoYTI1NiI6ImNlNjA1YjVmZGIwMzE5MzM5ZjlmODNmMmZlN2NjY2JjN2U1NzI2ZmRmNDk0ZGE2ZTI4NDMzYmVmODI5ZWIwYmUifSx7InBhdGgiOiJTT1VSQ0UtTk9USUNFUy50eHQiLCJieXRlcyI6OTAxNzc3MSwic2hhMjU2IjoiODk5NzZiZWNjMjU2NTQwZTZkMmU4MDdiNDdhNGUwNWU4ODk5ODJjMDYyMmZjMDQ0MTNhN2JmN2U3N2E3N2UzNyJ9LHsicGF0aCI6IlRISVJELVBBUlRZLU5PVElDRVMudHh0IiwiYnl0ZXMiOjI0OTE0OTYsInNoYTI1NiI6IjExNjQ0N2VmZjc3ODkzNTExNzk3ZWY0NzYwMTFkZWM4MDAyMjRmOTFlMzM0MmUzZDY1NzA3MDg3MTJiNGI3NzIifSx7InBhdGgiOiJsaWNlbnNlcy9ucG0tY21kLXNoaW0udHh0IiwiYnl0ZXMiOjgxMywic2hhMjU2IjoiYWZmZmRmMTIwODExMjI3NDljNGI3MWM1YjFjMTFiYzY1OWQ3OTI0MmQxOWUxOGY1ZThkYmFiMDRhNDVlMzZiYiJ9LHsicGF0aCI6Im5wbS1hZGFwdGVyLWZpbGVzLmpzb24iLCJieXRlcyI6MTUyNCwic2hhMjU2IjoiZmYxMzFiMDMxNTkyOGNhY2FkNjY5MzcxNTQ2MTk4MzcwNWRkOWI3YTY0NDU1YzQ3M2NjN2YxZmY5ZjVmNmFlOSJ9XX0seyJ0YXJnZXQiOiJidW4td2luZG93cy1hcm02NCIsImZpbGVuYW1lIjoibm90aWZhaS0xMi4wLjAtYmV0YS4xMS13aW5kb3dzLWFybTY0LnppcCIsImJ5dGVzIjozODcxMTIyNSwic2hhMjU2IjoiMzIwMDgzM2U5MmQ0ZGUyNGY0ZWQ0YzdkY2JlYTE3ZjBmODE0NzdhZWIzOTIzMGQ3OWQ4YmI0NmFiOTUyNzU3YyIsInJ1bnRpbWVfc2hhMjU2IjoiY2E3ZTIxMDA3ZmY5NTM5NjRjNDdhZjM2OGNmZDAxOGMyMTg4Nzc5OTdlY2Y4OWQxNTQxMGRkOTU2MjZiMjgxYSIsImxhdW5jaGVyX3NoYTI1NiI6ImQ0N2MyMGFmYjQxYzQ0MzA5OTE0NjRmM2RjNjg1OTMzNDU0MmI0ZDE0Yzg5ZGI4MjZiOTk4M2Q1ZmE0YWZjMjciLCJtYXRlcmlhbHMiOlt7InBhdGgiOiJCVU4tTElDRU5TRS5tZCIsImJ5dGVzIjo1NjEzLCJzaGEyNTYiOiJiOWNhZjUyNzI4NjkxYjQwNTdlMzcxMjMyYzIyMWExMzI4ODMxOThiZTJmM2QyZGRmOTJjOTA0MDRjOTg0YjFhIn0seyJwYXRoIjoiQ09SUkVTUE9ORElORy1TT1VSQ0VTLmpzb24iLCJieXRlcyI6MjAyMCwic2hhMjU2IjoiZmE0YzM0NDgwMTE1NDg3MmQ2MTc5ZWUyZWY0OTkyM2RjOWY4OTA5ZWYwMWU1M2I4NmU4ZjU3YzYyNTgyMzI3NCJ9LHsicGF0aCI6IkxJQ0VOU0UudHh0IiwiYnl0ZXMiOjExMzQ2LCJzaGEyNTYiOiI5NDRjMTNmZjBmZTc5NWUyOTFmZDFjNDk0NzNmOThkNGZkZjFmNzQ2MzhlMDFmODgyNzY5Y2Q0Y2FlNzhiNzNkIn0seyJwYXRoIjoiTk9USUNFLVBST1ZFTkFOQ0UuanNvbiIsImJ5dGVzIjo0NTAyNjQsInNoYTI1NiI6IjUzNGRkNTlmZDRjMTVkZDEzODJlODI3ZjBiODVjMTlmN2M2OThlMjM1ZjkyOTllYWEyMDJkYjU0MDA4MzQyODgifSx7InBhdGgiOiJOT1RJQ0UudHh0IiwiYnl0ZXMiOjYyNiwic2hhMjU2IjoiMWRmYmY0NDk4ZGMwMjZiMjA1OWMwYjBiNWViNWZhMWQ4MmFlMzM0ZTU4ZmYxMWU3YzI5NzMzMzI3ZjI1YzRlYiJ9LHsicGF0aCI6IlJFQlVJTERJTkcubWQiLCJieXRlcyI6Mzg0Miwic2hhMjU2IjoiY2U2MDViNWZkYjAzMTkzMzlmOWY4M2YyZmU3Y2NjYmM3ZTU3MjZmZGY0OTRkYTZlMjg0MzNiZWY4MjllYjBiZSJ9LHsicGF0aCI6IlNPVVJDRS1OT1RJQ0VTLnR4dCIsImJ5dGVzIjo5MDE3NzcxLCJzaGEyNTYiOiI4OTk3NmJlY2MyNTY1NDBlNmQyZTgwN2I0N2E0ZTA1ZTg4OTk4MmMwNjIyZmMwNDQxM2E3YmY3ZTc3YTc3ZTM3In0seyJwYXRoIjoiVEhJUkQtUEFSVFktTk9USUNFUy50eHQiLCJieXRlcyI6MjQ5MTQ5Niwic2hhMjU2IjoiMTE2NDQ3ZWZmNzc4OTM1MTE3OTdlZjQ3NjAxMWRlYzgwMDIyNGY5MWUzMzQyZTNkNjU3MDcwODcxMmI0Yjc3MiJ9LHsicGF0aCI6ImxpY2Vuc2VzL25wbS1jbWQtc2hpbS50eHQiLCJieXRlcyI6ODEzLCJzaGEyNTYiOiJhZmZmZGYxMjA4MTEyMjc0OWM0YjcxYzViMWMxMWJjNjU5ZDc5MjQyZDE5ZTE4ZjVlOGRiYWIwNGE0NWUzNmJiIn0seyJwYXRoIjoibnBtLWFkYXB0ZXItZmlsZXMuanNvbiIsImJ5dGVzIjoxNTI0LCJzaGEyNTYiOiJmZjEzMWIwMzE1OTI4Y2FjYWQ2NjkzNzE1NDYxOTgzNzA1ZGQ5YjdhNjQ0NTVjNDczY2M3ZjFmZjlmNWY2YWU5In1dfSx7InRhcmdldCI6ImJ1bi13aW5kb3dzLXg2NCIsImZpbGVuYW1lIjoibm90aWZhaS0xMi4wLjAtYmV0YS4xMS13aW5kb3dzLXg2NC56aXAiLCJieXRlcyI6NDE4NTcwNDEsInNoYTI1NiI6IjJiZjJkN2EyZTRhNTY5NzkyNmZmZDRjMGU4NDk2MWYwMzRjODdkNzBiYTMxOTMxMWYwMjM4ODhmNWJmMjJhMjkiLCJydW50aW1lX3NoYTI1NiI6ImRlMDkzMTc2YzM1MGRjMzYyMzQzMGJiMTdiN2M3NWEyODc1ZjdiNWI1MTEwMmZiYjg3ODYxODRkMjA0ZGI4YTUiLCJsYXVuY2hlcl9zaGEyNTYiOiJlMzNhZGU2MjJhOTQ3NDczMmRiMDdmNzE3ZGI4NzdhODFjYzkzM2I2OTM5ODJiNDFlMWFlNTc5MTMwM2ExYjQ4IiwibWF0ZXJpYWxzIjpbeyJwYXRoIjoiQlVOLUxJQ0VOU0UubWQiLCJieXRlcyI6NTYxMywic2hhMjU2IjoiYjljYWY1MjcyODY5MWI0MDU3ZTM3MTIzMmMyMjFhMTMyODgzMTk4YmUyZjNkMmRkZjkyYzkwNDA0Yzk4NGIxYSJ9LHsicGF0aCI6IkNPUlJFU1BPTkRJTkctU09VUkNFUy5qc29uIiwiYnl0ZXMiOjIwMjAsInNoYTI1NiI6ImZhNGMzNDQ4MDExNTQ4NzJkNjE3OWVlMmVmNDk5MjNkYzlmODkwOWVmMDFlNTNiODZlOGY1N2M2MjU4MjMyNzQifSx7InBhdGgiOiJMSUNFTlNFLnR4dCIsImJ5dGVzIjoxMTM0Niwic2hhMjU2IjoiOTQ0YzEzZmYwZmU3OTVlMjkxZmQxYzQ5NDczZjk4ZDRmZGYxZjc0NjM4ZTAxZjg4Mjc2OWNkNGNhZTc4YjczZCJ9LHsicGF0aCI6Ik5PVElDRS1QUk9WRU5BTkNFLmpzb24iLCJieXRlcyI6NDUwMjY0LCJzaGEyNTYiOiI1MzRkZDU5ZmQ0YzE1ZGQxMzgyZTgyN2YwYjg1YzE5ZjdjNjk4ZTIzNWY5Mjk5ZWFhMjAyZGI1NDAwODM0Mjg4In0seyJwYXRoIjoiTk9USUNFLnR4dCIsImJ5dGVzIjo2MjYsInNoYTI1NiI6IjFkZmJmNDQ5OGRjMDI2YjIwNTljMGIwYjVlYjVmYTFkODJhZTMzNGU1OGZmMTFlN2MyOTczMzMyN2YyNWM0ZWIifSx7InBhdGgiOiJSRUJVSUxESU5HLm1kIiwiYnl0ZXMiOjM4NDIsInNoYTI1NiI6ImNlNjA1YjVmZGIwMzE5MzM5ZjlmODNmMmZlN2NjY2JjN2U1NzI2ZmRmNDk0ZGE2ZTI4NDMzYmVmODI5ZWIwYmUifSx7InBhdGgiOiJTT1VSQ0UtTk9USUNFUy50eHQiLCJieXRlcyI6OTAxNzc3MSwic2hhMjU2IjoiODk5NzZiZWNjMjU2NTQwZTZkMmU4MDdiNDdhNGUwNWU4ODk5ODJjMDYyMmZjMDQ0MTNhN2JmN2U3N2E3N2UzNyJ9LHsicGF0aCI6IlRISVJELVBBUlRZLU5PVElDRVMudHh0IiwiYnl0ZXMiOjI0OTE0OTYsInNoYTI1NiI6IjExNjQ0N2VmZjc3ODkzNTExNzk3ZWY0NzYwMTFkZWM4MDAyMjRmOTFlMzM0MmUzZDY1NzA3MDg3MTJiNGI3NzIifSx7InBhdGgiOiJsaWNlbnNlcy9ucG0tY21kLXNoaW0udHh0IiwiYnl0ZXMiOjgxMywic2hhMjU2IjoiYWZmZmRmMTIwODExMjI3NDljNGI3MWM1YjFjMTFiYzY1OWQ3OTI0MmQxOWUxOGY1ZThkYmFiMDRhNDVlMzZiYiJ9LHsicGF0aCI6Im5wbS1hZGFwdGVyLWZpbGVzLmpzb24iLCJieXRlcyI6MTUyNCwic2hhMjU2IjoiZmYxMzFiMDMxNTkyOGNhY2FkNjY5MzcxNTQ2MTk4MzcwNWRkOWI3YTY0NDU1YzQ3M2NjN2YxZmY5ZjVmNmFlOSJ9XX1dfQ==","signature":"JZNPkt8v63dNCXxEZyQ9yDXRhJeCn1btpbH3lN1BucKFnRUWAAC7hnHq++5heCzDv4no4yy06y0PPiLA6EYTCA=="}

package/npm-adapter-files.json

@@ -0,0 +1,52 @@
+{
+  "schema": 1,
+  "package": "@raidiant/notifai",
+  "adapter_version": "12.0.0-beta.11",
+  "native": {
+    "version": "12.0.0-beta.11",
+    "source_revision": "29b033b35eb72cf2c4235a604d865b70bb9c516a",
+    "inventory_url": "https://github.com/Raidiant-io/notifai/releases/download/v12.0.0-beta.11/inventory.json"
+  },
+  "files": [
+    {
+      "path": "CHANGELOG.md",
+      "bytes": 61471,
+      "sha256": "5cafd85af6f1b7a64e74d8b7a4b415d7aa206d0b0bd05c46510e47f20aacced3"
+    },
+    {
+      "path": "LICENSE",
+      "bytes": 11346,
+      "sha256": "944c13ff0fe795e291fd1c49473f98d4fdf1f74638e01f882769cd4cae78b73d"
+    },
+    {
+      "path": "NOTICE",
+      "bytes": 626,
+      "sha256": "1dfbf4498dc026b2059c0b0b5eb5fa1d82ae334e58ff11e7c29733327f25c4eb"
+    },
+    {
+      "path": "THIRD_PARTY_NOTICES",
+      "bytes": 39652,
+      "sha256": "4639bc49701f661f67baf3d0408436d2cb80fd0c9799e68b9be3684f5ad69b91"
+    },
+    {
+      "path": "bin/notifai.mjs",
+      "bytes": 520496,
+      "sha256": "94eb5ae58a5ee49e7cd07552806a93d17bf83038c221a477c82c8341a9ae5d04"
+    },
+    {
+      "path": "data/install.ps1",
+      "bytes": 18811,
+      "sha256": "2925b84fb7890110695249d7f651a4ca0878f6ace2e127f44b7b4ad835073c5f"
+    },
+    {
+      "path": "data/release.json",
+      "bytes": 90,
+      "sha256": "ac4bc6b446c4eac56f8e7b9e01c6eed6844bb646908ae6913986de3db6dd1bb6"
+    },
+    {
+      "path": "package.json",
+      "bytes": 815,
+      "sha256": "d06b32f9a60aee9048f22a063e49a19f5ef3cd85a64ad7d2d86aa4967c088be9"
+    }
+  ]
+}

package/package.json

@@ -1,34 +1,22 @@
 {
   "name": "@raidiant/notifai",
-  "version": "11.7.1",
+  "version": "12.0.0-beta.11",
   "type": "module",
-  "description": "Send native device notifications from agents and local programs",
+  "description": "Launch the independently managed native Notifai CLI",
   "bin": {
-    "notifai": "dist/main.js"
+    "notifai": "bin/notifai.mjs"
   },
   "files": [
-    "dist",
+    "bin",
+    "data",
+    "package.json",
+    "npm-adapter-files.json",
+    "inventory.json",
+    "LICENSE",
+    "NOTICE",
+    "THIRD_PARTY_NOTICES",
     "CHANGELOG.md"
   ],
-  "dependencies": {
-    "@clack/prompts": "^1.7.0",
-    "@raidiant/notifai-protocol": "8.2.1",
-    "commander": "^14.0.0",
-    "jsonc-parser": "^3.3.1",
-    "picocolors": "^1.1.1",
-    "qrcode": "1.5.4",
-    "smol-toml": "^1.4.0",
-    "ws": "8.21.0"
-  },
-  "devDependencies": {
-    "@types/pngjs": "6.0.5",
-    "@types/qrcode": "1.5.6",
-    "@types/ws": "8.18.1",
-    "jsqr": "1.4.0",
-    "pngjs": "7.0.0",
-    "typescript": "^5.8.0",
-    "vitest": "4.1.11"
-  },
   "engines": {
     "node": ">=20.12.0"
   },
@@ -38,30 +26,12 @@
   "bugs": {
     "url": "https://github.com/Raidiant-io/notifai/issues"
   },
-  "publishConfig": {
-    "access": "public"
-  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Raidiant-io/notifai.git",
     "directory": "apps/cli"
   },
-  "keywords": [
-    "notifications",
-    "cli",
-    "agents",
-    "apns",
-    "fcm",
-    "android",
-    "push",
-    "ai",
-    "claude",
-    "codex"
-  ],
-  "scripts": {
-    "build": "node ../../scripts/clean-dist.mjs && tsc -p tsconfig.json && node ../../scripts/copy-shipped-skill.mjs && node ../../scripts/chmod-cli-bin.mjs",
-    "pretest": "pnpm run build",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "node ../../scripts/run-cli-tests.mjs"
+  "publishConfig": {
+    "access": "public"
   }
-}
+}

package/README.md

@@ -1,168 +0,0 @@
-# notifai
-
-Send native phone notifications from agents and local programs.
-
-An agent working while you are away has no way to reach you, so it either
-guesses or sits blocked in a terminal nobody is watching. `notifai` gives
-it a way to tell you something finished, and a way to ask you a question
-and get your answer back as a banner on your phone.
-
-```sh
-npm install -g @raidiant/notifai
-notifai init
-```
-
-The `notifai` command is always a machine-wide install. Setup scope (this
-project vs this machine) does not change that. If you do not want a global
-bin, `npx --yes @raidiant/notifai@<version>` is supported. Pin the version.
-`hooks install` then writes that same pinned npx invocation into the harness
-adapter. This is slower than a real install and is not the default path.
-
-Run `notifai doctor` or `notifai update --check --json` to check for a newer
-CLI and inspect release notes, guidance, and session requirements. Enabled
-Projects give root agents a quiet update offer at most once every seven days
-across the machine. A release does not install itself or restart an Agent
-Session automatically. The package includes its changelog.
-
-Use `notifai update` for later global updates. It repairs the installation the
-shell actually selects and keeps the stable hook adapter on that same CLI. It
-fails instead of moving the command to a different PATH slot when it cannot
-verify the selected installation or retarget an existing adapter safely.
-
-`init` walks the setup one step at a time and tells you the single next
-thing to do. Run it again after each step; it works out what remains.
-
-At a human terminal, `init` asks once whether this setup is for this project
-or for every project on this machine. That answer is skill, hooks, and
-config together. Pairing, devices, and credentials stay on this machine
-either way. An unattended caller passes the same choice as a flag:
-`notifai init --setup-scope project` or `notifai init --setup-scope global`.
-`--skills-scope` is an alias of that flag when `--skills` is set. Shared
-project config may live in the repo; personal project preferences live under
-the user config directory and never require a `.gitignore` edit.
-
-## Telling you something happened
-
-```sh
-notifai send --kind done \
-  --title "Deploy finished" \
-  --summary "The staging deployment is live." \
-  --body "The staging deployment is live and ready for review."
-```
-
-Write a brief title whose substance is immediately understandable; type lives
-in `--kind`, and Project identity is inferred from the invocation directory.
-Every Notification Request has a purpose-written, one-line plain-text Summary
-for native banners and list views. It is required and limited to 240 Unicode
-characters. Body is optional standalone Markdown for focused detail; when it is
-absent, the focused view shows Summary. Use `--body-file <path|->` for long
-content. Repeat `--image` for an ordered image
-collection (up to eight) and pair each with `--image-alt`. Every attached
-image appears in the gallery; to place one where the words refer to it, write
-Markdown image syntax with its 1-based position, `![what it shows](media:1)`.
-A bare `media:1` or a link to it is refused before sending.
-
-## Asking you a question
-
-```sh
-notifai ask "Deploy the migration to production?" \
-  --choice Yes --choice No
-```
-
-The agent registers the question and starts background submission immediately;
-it can continue independent work while your answer is outstanding. Registration
-alone does not prove Provider Acceptance. Question Routing keeps the exact
-Agent Session's answer path for the complete answer window. Claude Code on
-macOS/Linux and Codex observe answers out of band; Claude Code on Windows
-returns answers through a held Stop. Codex queues a wake-up, then drains current
-notes and answers together at a supported hook or `notifai receive` boundary.
-Queue success proves wake storage, not presentation.
-
-By default submission begins without waiting for the turn to end
-(`ask_grace_seconds = 0`). Set a positive grace period for a terminal-only
-answer window first.
-
-When you answer, the agent acknowledges it before it does anything else, so you
-find out your reply landed and what it set in motion — not just that you sent
-it. Answering from your phone and wondering whether anything happened is the
-whole problem this solves.
-
-For a harness that cannot resume an idle agent turn, `notifai send --reply`
-owns the complete answer window in the foreground: keep it alive and set
-`--reply-timeout` equal to `--reply-window`. After a timeout, retain the request
-ID and inspect that original with `notifai replies` and `notifai status`; never
-send a duplicate.
-
-## Agent harnesses
-
-The CLI and managed hook adapters support macOS, Linux, and Windows. iPhone
-and Android Companion Apps are both active: Android is distributed as a
-directly downloadable signed APK (no Google Play listing yet), with a separate
-invitation-only Firebase App Distribution test lane. Native desktop Companion
-Apps are not shipped.
-
-```sh
-notifai hooks install
-```
-
-Wires lifecycle hooks into every supported harness detected on this
-machine (Claude Code, Codex, Cursor, OpenCode, OpenClaw, Grok). `notifai init` does the
-same and, at a terminal, lets you keep the detected set, pick a subset,
-or add one it did not see. This is what lets an agent's question reach
-your phone without the agent having to cooperate — no question detection,
-no state in a context window that compaction will eat. Grok's managed hooks
-observe lifecycle events and hold Stop through the complete answer window,
-then return the answer to the same Agent Session. They cannot inject activation
-guidance; load the Notifai skill directly. Exact Source Context comes from
-`GROK_SESSION_ID`.
-
-Every harness definition calls one stable user-level adapter under the account
-home (`~/.notifai/bin/hook-adapter` on macOS/Linux and the corresponding user
-profile path on Windows). Node, package manager, CLI version, checkout,
-configuration directories, and notification preferences are resolved behind
-it, so upgrades and configuration changes do not rewrite trusted hook
-definitions. Windows invokes its JavaScript adapter through the registered Node
-executable; macOS/Linux retain the POSIX adapter and its stable command bytes.
-Codex SessionStart guidance stays within Codex's built-in inline-context budget,
-so its stable definition does not need an output-limit override that would
-create a different approval identity.
-Claude Code Stop returns immediately into the live inbox route on macOS/Linux;
-on Windows, where upstream exposes no inbox socket, Stop stays open and returns
-the accepted answer through the harness continuation. The first migration may
-require one Codex `/hooks` approval; later repairs keep the same source and
-definition identity.
-Codex's Stop definition declares the full-window timeout explicitly; that
-one-time definition change is why the migration needs approval. Prompt-submit
-and session-end retain fixed short limits.
-
-`notifai doctor` compares Codex trust on a best-effort basis against Codex's
-current persisted representation. Notifai never writes that trust store;
-Codex's `/hooks` review is authoritative if the diagnostic and UI disagree.
-
-Uninstall removes only the selected harness definition. It intentionally keeps
-the shared adapter because definitions for other harnesses or projects may
-still invoke it and cannot all be discovered from one working directory.
-
-## Checking it works
-
-```sh
-notifai doctor
-```
-
-Reports every part of the setup and names where to start if something is
-wrong. Any `FAIL` line makes the command exit nonzero; informational `--` lines
-do not. `--json` emits the same result with an explicit `exit_code`.
-
-## Reference
-
-`notifai <command> --help` is the exhaustive and current flag surface.
-Everything useful is possible non-interactively, so an agent never
-reaches a prompt and hangs.
-
-Source, issues and the public/private boundary policy:
-<https://github.com/Raidiant-io/notifai>
-
-The URL, self-host exception, guidance-authority and non-exfiltration policy is
-documented in [`docs/TRUST.md`](https://github.com/Raidiant-io/notifai/blob/main/docs/TRUST.md).
-
-Apache-2.0.

package/dist/agent-update-notice.d.ts

@@ -1,7 +0,0 @@
-/** One optional notice per machine-local state directory, across roots and harnesses. */
-export declare function agentUpdateNotice(options: {
-    env: NodeJS.ProcessEnv;
-    now: number;
-    updateCommand: string;
-    fetchImpl?: typeof fetch;
-}): Promise<string | undefined>;