@rubytech/create-siteoffice-code 0.1.256

package/payload/platform/services/claude-session-manager/dist/system-prompt.js

@@ -0,0 +1,445 @@
+// Composes the `--append-system-prompt` block injected into every spawned
+// `claude --verbose --remote-control` PTY. Sentinel-wrapped sections in
+// documented order:
+//
+//   <host> ... </host>                    — hostname, LAN IPv4, admin URL,
+//                                            tunnel URL (or "none")
+//   <identity> ... </identity>            — verbatim contents of
+//                                            <accountDir>/agents/<role>/IDENTITY.md
+//   <soul> ... </soul>                    — verbatim contents of
+//                                            <accountDir>/agents/<role>/SOUL.md
+//   <about-owner> ... </about-owner>      — operator-profile body produced
+//                                            by `formatProfileSummary` in
+//                                            neo4j-store.ts. Two prose lines:
+//                                            the first names what is known
+//                                            (or the literal token `NOTHING`),
+//                                            the second carries the standing
+//                                            MAXIMISE imperative. On caller
+//                                            ok:false the body keeps the same
+//                                            shape with the reason inline-coded
+//                                            inside line one. Omitted entirely
+//                                            when the caller supplies nothing
+//                                            (e.g. role=public flows that do
+//                                            not load an owner profile).
+//   <dormant-plugins> ... </dormant-plugins>
+//                                          — plugins installed on disk but
+//                                            absent from `account.enabledPlugins`.
+//                                            One line per plugin: name + PLUGIN.md
+//                                            `description`. Sentinel is omitted
+//                                            when the set is empty so the agent
+//                                            does not nudge against an empty list.
+//
+// The block is the only doctrine surface that survives Claude Code SDK
+// upgrades. Per the prompt-architecture doctrine, no skill carries a copy;
+// one edit here changes the ceiling or workaround for every agent in every
+// session.
+//
+// Per-spawn read (no cache) is the contract for IDENTITY.md / SOUL.md:
+// sidebar edits land on the next spawn without a manager restart. The owner
+// profile and dormant-plugins inputs are pre-computed by the caller (the UI
+// process, which already holds Neo4j credentials and the plugin manifest
+// walker) and passed through the HTTP /spawn body as resolved values; the
+// manager never queries Neo4j itself, keeping the service to its three-dep
+// budget (hono, @hono/node-server, node-pty).
+//
+// Two failure modes for the file reads:
+//   host-unresolved      — host.lanIPv4 is null (boot resolution failed).
+//   identity-unresolved  — IDENTITY.md or SOUL.md is missing, empty, or
+//                          unreadable under <accountDir>/agents/<role>/.
+// No silent fallback: the caller surfaces the literal path so the operator
+// can grep `[pty-spawn]` for the failed file. Neo4j unreachable does NOT
+// fail the spawn; the loud-fail surface is the prose unresolved body inside
+// `<about-owner>` — same two-line shape as the happy path, reason token
+// inline-coded so an operator can grep for it.
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveAgentIdentityDir } from './agent-identity-locator.js';
+function readIdentityFile(path) {
+    let content;
+    try {
+        content = readFileSync(path, 'utf-8');
+    }
+    catch (err) {
+        const code = err.code ?? 'EUNKNOWN';
+        return { ok: false, detail: `${path}:${code}` };
+    }
+    if (content.length === 0) {
+        return { ok: false, detail: `${path}:empty` };
+    }
+    return { ok: true, content };
+}
+function renderAboutOwner(block) {
+    if (!block)
+        return { body: null, bytes: 0 };
+    // Task 182: the failure branch matches the success branch's prose register
+    // — same two-line shape, NOTHING surfaced as the known state, and the
+    // reason token inline-coded so an operator can still grep for it. Reasons
+    // are short tokens (neo4j-unreachable, profile-not-found, missing-user-id);
+    // the surrounding sentence stays principled, not prescriptive.
+    const inner = block.ok
+        ? block.body
+        : `This is what you know about the operator: NOTHING (operator-data source unavailable: \`${block.reason}\`).\nYou must seek to MAXIMISE what you know about the operator to do your job effectively.`;
+    return { body: inner, bytes: Buffer.byteLength(inner, 'utf8') };
+}
+function renderDormantPlugins(plugins) {
+    if (!plugins || plugins.length === 0)
+        return { body: null, bytes: 0 };
+    const lines = plugins.map((p) => `- ${p.name}: ${p.description}`);
+    const inner = lines.join('\n');
+    return { body: inner, bytes: Buffer.byteLength(inner, 'utf8') };
+}
+function renderPluginManifest(plugins) {
+    if (!plugins || plugins.length === 0)
+        return { body: null, bytes: 0 };
+    const parts = [];
+    for (const p of plugins) {
+        parts.push(`## ${p.name}`);
+        parts.push(p.description);
+        if (p.tools.length > 0) {
+            parts.push('Tools:');
+            for (const t of p.tools) {
+                parts.push(t.description ? `- ${t.name}: ${t.description}` : `- ${t.name}`);
+            }
+        }
+        if (p.skills.length > 0) {
+            parts.push('Skills:');
+            for (const s of p.skills) {
+                parts.push(s.description ? `- ${s.name}: ${s.description}` : `- ${s.name}`);
+            }
+        }
+        parts.push('');
+    }
+    const inner = parts.join('\n').replace(/\n+$/, '');
+    return { body: inner, bytes: Buffer.byteLength(inner, 'utf8') };
+}
+function renderSpecialistDomains(domains) {
+    if (!domains || domains.length === 0)
+        return { body: null, bytes: 0 };
+    const parts = [];
+    for (const d of domains) {
+        parts.push(`## ${d.name}`);
+        parts.push(d.description);
+        if (d.tools.length > 0) {
+            parts.push('Tools:');
+            for (const t of d.tools) {
+                parts.push(t.description ? `- ${t.name}: ${t.description}` : `- ${t.name}`);
+            }
+        }
+        parts.push('');
+    }
+    const inner = parts.join('\n').replace(/\n+$/, '');
+    return { body: inner, bytes: Buffer.byteLength(inner, 'utf8') };
+}
+/** Pure renderer — no file IO. The block layout is the source of truth for
+ *  both the production `composeAppendSystemPrompt` (which reads files first)
+ *  and the boot-time self-test (which feeds synthetic content). */
+function renderAppendBlock(host, identityContent, soulContent, 
+// Task 618 — verbatim KNOWLEDGE.md for role=public, rendered as
+// `<knowledge>` immediately after `<soul>`. null on admin (and the
+// boot self-test / drift assertion), which suppresses the block.
+knowledgeContent, extras) {
+    const aboutOwner = renderAboutOwner(extras.aboutOwner);
+    const dormantPlugins = renderDormantPlugins(extras.dormantPlugins);
+    const pluginManifest = renderPluginManifest(extras.activePlugins);
+    const specialistDomains = renderSpecialistDomains(extras.specialistDomains);
+    const chatSessionBody = extras.chatSessionKey ? `session_key: ${extras.chatSessionKey}` : null;
+    const chatSessionBytes = chatSessionBody ? Buffer.byteLength(chatSessionBody, 'utf8') : 0;
+    const tunnelLine = host.tunnelUrl ? host.tunnelUrl : 'none';
+    const sections = [
+        '<host>',
+        `hostname: ${host.hostname}`,
+        `lan-ipv4: ${host.lanIPv4}`,
+        `admin-url: ${host.adminUrl}`,
+        `tunnel-url: ${tunnelLine}`,
+        '</host>',
+        '<identity>',
+        identityContent,
+        '</identity>',
+        '<soul>',
+        soulContent,
+        '</soul>',
+    ];
+    const knowledgeBytes = knowledgeContent !== null ? Buffer.byteLength(knowledgeContent, 'utf8') : 0;
+    if (knowledgeContent !== null) {
+        sections.push('<knowledge>', knowledgeContent, '</knowledge>');
+    }
+    if (aboutOwner.body !== null) {
+        sections.push('<about-owner>', aboutOwner.body, '</about-owner>');
+    }
+    if (specialistDomains.body !== null) {
+        sections.push('<specialist-domains>', specialistDomains.body, '</specialist-domains>');
+    }
+    if (pluginManifest.body !== null) {
+        sections.push('<plugin-manifest>', pluginManifest.body, '</plugin-manifest>');
+    }
+    if (dormantPlugins.body !== null) {
+        sections.push('<dormant-plugins>', dormantPlugins.body, '</dormant-plugins>');
+    }
+    if (chatSessionBody !== null) {
+        sections.push('<chat-session>', chatSessionBody, '</chat-session>');
+    }
+    return {
+        block: sections.join('\n'),
+        knowledgeBytes,
+        aboutOwnerBytes: aboutOwner.bytes,
+        dormantPluginsBytes: dormantPlugins.bytes,
+        pluginManifestBytes: pluginManifest.bytes,
+        specialistDomainsBytes: specialistDomains.bytes,
+        chatSessionBytes,
+    };
+}
+export function composeAppendSystemPrompt(host, sources, extras = {}) {
+    if (!host.lanIPv4) {
+        return { ok: false, reason: 'host-unresolved', detail: 'host.lanIPv4 is null' };
+    }
+    const slug = sources.role === 'public' ? sources.agentSlug : 'admin';
+    const roleDir = resolveAgentIdentityDir(sources.accountDir, sources.role, slug);
+    const identityPath = join(roleDir, 'IDENTITY.md');
+    const soulPath = join(roleDir, 'SOUL.md');
+    const identity = readIdentityFile(identityPath);
+    if (!identity.ok) {
+        return { ok: false, reason: 'identity-unresolved', detail: identity.detail };
+    }
+    const soul = readIdentityFile(soulPath);
+    if (!soul.ok) {
+        // Task 618 — a public spawn with an empty/missing SOUL is a dud that must
+        // never serve; surface it as `soul-empty` so creation/Test-Greet names the
+        // file to author. Admin SOUL failure stays `identity-unresolved`.
+        return {
+            ok: false,
+            reason: sources.role === 'public' ? 'soul-empty' : 'identity-unresolved',
+            detail: soul.detail,
+        };
+    }
+    // Task 618 — KNOWLEDGE.md is the toolless public agent's only knowledge
+    // source, inlined as `<knowledge>`. Strict like IDENTITY/SOUL: empty/missing
+    // refuses the spawn rather than serving an ignorant agent. Admin reaches
+    // knowledge via tools and gets no `<knowledge>` block.
+    let knowledgeContent = null;
+    if (sources.role === 'public') {
+        const knowledge = readIdentityFile(join(roleDir, 'KNOWLEDGE.md'));
+        if (!knowledge.ok) {
+            return {
+                ok: false,
+                reason: knowledge.detail.endsWith(':empty') ? 'knowledge-empty' : 'knowledge-missing',
+                detail: knowledge.detail,
+            };
+        }
+        knowledgeContent = knowledge.content;
+    }
+    const rendered = renderAppendBlock(host, identity.content, soul.content, knowledgeContent, extras);
+    return {
+        ok: true,
+        block: rendered.block,
+        identityBytes: Buffer.byteLength(identity.content, 'utf8'),
+        soulBytes: Buffer.byteLength(soul.content, 'utf8'),
+        knowledgeBytes: rendered.knowledgeBytes,
+        aboutOwnerBytes: rendered.aboutOwnerBytes,
+        dormantPluginsBytes: rendered.dormantPluginsBytes,
+        pluginManifestBytes: rendered.pluginManifestBytes,
+        specialistDomainsBytes: rendered.specialistDomainsBytes,
+        chatSessionBytes: rendered.chatSessionBytes,
+    };
+}
+/** Forbidden-token classes the admin IDENTITY.md must not contain in prose.
+ *  See Task 437. The check is scoped past the "## How you sound" section
+ *  because the voice rules name forbidden classes (e.g. "MCP prefixes")
+ *  without being instances of them. */
+const FORBIDDEN_COUNTER_TOKENS = [
+    'learningsCount',
+    'preferencesCount',
+    'graphWriteCount',
+    'typedEdgesCount',
+    'nodesProcessed',
+];
+const FORBIDDEN_MCP_TOKENS = [
+    'memory-search',
+    'memory-write',
+    'memory-update',
+    'memory-report-list',
+    'memory-report-read-latest',
+    'memory-compiled-truth-history',
+    'memory-typed-edge-pass',
+    'profile-read',
+    'database-operator',
+    'session-retrospective-mark-complete',
+    'pre-turn-graph-pass-skip',
+    'per-turn-graph-pass-gate',
+    'web-search',
+    'WebSearch',
+    'WebFetch',
+];
+const FORBIDDEN_HOOK_NAMES = [
+    'UserPromptSubmit',
+    'PreToolUse',
+    'PostToolUse',
+    'SessionStart',
+    'SessionEnd',
+    'SubagentStop',
+    'Notification',
+];
+function stripVoiceSection(content) {
+    // Scope past the "## How you sound" section through end of file. Everything
+    // from that heading onward is voice/output/access prose that legitimately
+    // names forbidden classes and skill-load invocations (the plain-English and
+    // operator-voice passes) without being instances of them; only the
+    // behavioural prose above it is scanned.
+    const lines = content.split('\n');
+    const start = lines.findIndex((l) => l.trim() === '## How you sound');
+    if (start === -1)
+        return content;
+    return lines.slice(0, start).join('\n');
+}
+export function runIdentityForbiddenTokenCheck(identityContent) {
+    const scanned = stripVoiceSection(identityContent);
+    const violations = [];
+    const seen = new Set();
+    const push = (cls, token) => {
+        const key = cls + ':' + token;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        violations.push({ class: cls, token });
+    };
+    let m;
+    const reBacktick = /`[^`\n]+`/g;
+    while ((m = reBacktick.exec(scanned)) !== null)
+        push('backtick-token', m[0]);
+    const reLabel = /:[A-Z][A-Za-z][A-Za-z0-9]*/g;
+    while ((m = reLabel.exec(scanned)) !== null)
+        push('node-label', m[0]);
+    const reTask = /\bTasks?\s+\d+\b/g;
+    while ((m = reTask.exec(scanned)) !== null)
+        push('task-number', m[0]);
+    const reCodePath = /\b[A-Za-z0-9_./-]*\.(?:ts|tsx|js|jsx|mjs|cjs|sh|py|json|yaml|yml|md)\b/g;
+    while ((m = reCodePath.exec(scanned)) !== null)
+        push('code-path', m[0]);
+    const reSentinel = /<[a-z][a-z0-9-]*>/g;
+    while ((m = reSentinel.exec(scanned)) !== null)
+        push('angle-sentinel', m[0]);
+    for (const tok of FORBIDDEN_COUNTER_TOKENS) {
+        if (new RegExp('\\b' + tok + '\\b').test(scanned))
+            push('counter-token', tok);
+    }
+    for (const tok of FORBIDDEN_MCP_TOKENS) {
+        if (new RegExp('\\b' + tok + '\\b').test(scanned))
+            push('mcp-prefix', tok);
+    }
+    for (const tok of FORBIDDEN_HOOK_NAMES) {
+        if (new RegExp('\\b' + tok + '\\b').test(scanned))
+            push('hook-name', tok);
+    }
+    return violations.length === 0 ? { ok: true } : { ok: false, violations };
+}
+/** Boot-time IDENTITY-vs-composer drift assertion. Parses IDENTITY.md at
+ *  `<accountDir>/agents/admin/IDENTITY.md`, extracts every `<sentinel-name>`
+ *  reference the prose makes, and confirms the composer would emit each one
+ *  for a sample admin session. The synthetic inputs exercise every optional
+ *  sentinel so a missing emit is visible regardless of operator state.
+ *
+ *  Returns ok:false with the first sentinel IDENTITY.md names that the
+ *  composer does not emit. The caller LOUD-FAILs the manager start. */
+export function runIdentityDriftAssertion(identityContent) {
+    // IDENTITY.md references sentinels as backticked `<name>` tokens in prose,
+    // e.g. "`<plugin-manifest>` lists each plugin …". Extract the inner names.
+    const referenced = new Set();
+    const re = /`<([a-z][a-z0-9-]*)>`/gi;
+    let m;
+    while ((m = re.exec(identityContent)) !== null) {
+        referenced.add(m[1]);
+    }
+    // Render with maximally-populated synthetic inputs.
+    const host = {
+        hostname: 'drift-check',
+        lanIPv4: '127.0.0.1',
+        adminUrl: 'http://drift-check:0',
+        tunnelUrl: null,
+    };
+    const rendered = renderAppendBlock(host, '# drift identity', '# drift soul', null, {
+        aboutOwner: { ok: true, body: 'drift owner' },
+        dormantPlugins: [{ name: 'p', description: 'd' }],
+        activePlugins: [{ name: 'p', description: 'd', tools: [{ name: 't' }], skills: [{ name: 's' }] }],
+        specialistDomains: [{ name: 'sp', description: 'd', tools: [{ name: 't' }] }],
+    });
+    const checked = Array.from(referenced).sort();
+    for (const name of checked) {
+        if (!rendered.block.includes(`<${name}>`)) {
+            return { ok: false, missing: name, sentinelsChecked: checked };
+        }
+    }
+    return { ok: true, sentinelsChecked: checked };
+}
+/** Boot-time self-test: render the block with synthetic inputs that exercise
+ *  every optional sentinel, and assert the expected tags appear. Returns
+ *  ok:true on success, ok:false with the first missing tag on drift. The
+ *  caller logs `[startup-self-test] system-prompt-sentinels=ok` or LOUD-FAILs
+ *  so future refactors that drop a sentinel surface at manager start, not at
+ *  runtime against a real spawn. */
+export function runSystemPromptSelfTest() {
+    const host = {
+        hostname: 'self-test',
+        lanIPv4: '127.0.0.1',
+        adminUrl: 'http://self-test:0',
+        tunnelUrl: null,
+    };
+    const rendered = renderAppendBlock(host, '# self-test identity', '# self-test soul', null, {
+        aboutOwner: {
+            ok: true,
+            body: 'This is what you know about the operator: name self-test owner.\n' +
+                'You must seek to MAXIMISE what you know about the operator to do your job effectively.',
+        },
+        dormantPlugins: [{ name: 'cloudflare', description: 'self-test plugin description' }],
+        activePlugins: [
+            {
+                name: 'self-test-plugin',
+                description: 'self-test plugin description',
+                tools: [{ name: 'self-test-tool', description: 'self-test tool description' }],
+                skills: [{ name: 'self-test-skill', description: 'self-test skill description' }],
+            },
+        ],
+        specialistDomains: [
+            {
+                name: 'self-test-specialist',
+                description: 'self-test specialist description',
+                tools: [{ name: 'self-test-specialist-tool', description: 'self-test specialist tool description' }],
+            },
+        ],
+    });
+    const required = [
+        '<host>',
+        '</host>',
+        '<identity>',
+        '</identity>',
+        '<soul>',
+        '</soul>',
+        '<about-owner>',
+        '</about-owner>',
+        '<plugin-manifest>',
+        '</plugin-manifest>',
+        '<specialist-domains>',
+        '</specialist-domains>',
+        '<dormant-plugins>',
+        '</dormant-plugins>',
+    ];
+    for (const tag of required) {
+        if (!rendered.block.includes(tag)) {
+            return { ok: false, missing: tag };
+        }
+    }
+    // Also exercise the failure branch — a refactor that drops the prose
+    // unresolved body would still pass the happy-path render but strand the
+    // operator-visible failure signal. Task 182 doctrine: the reason token
+    // stays inline-coded so an operator can grep for it; the surrounding
+    // sentence holds the MAXIMISE imperative regardless of resolve state.
+    const unresolved = renderAppendBlock(host, '# i', '# s', null, {
+        aboutOwner: { ok: false, reason: 'self-test-reason' },
+    });
+    if (!unresolved.block.includes('operator-data source unavailable: `self-test-reason`')) {
+        return { ok: false, missing: 'unresolved reason token' };
+    }
+    if (!unresolved.block.includes('You must seek to MAXIMISE what you know about the operator')) {
+        return { ok: false, missing: 'unresolved MAXIMISE imperative' };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=system-prompt.js.map

package/payload/platform/services/claude-session-manager/dist/system-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-prompt.js","sourceRoot":"","sources":["../src/system-prompt.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,wEAAwE;AACxE,oBAAoB;AACpB,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,iEAAiE;AACjE,oFAAoF;AACpF,iEAAiE;AACjE,gFAAgF;AAChF,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,6CAA6C;AAC7C,2EAA2E;AAC3E,mFAAmF;AACnF,mFAAmF;AACnF,gFAAgF;AAChF,gFAAgF;AAChF,mFAAmF;AACnF,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,WAAW;AACX,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,8CAA8C;AAC9C,EAAE;AACF,wCAAwC;AACxC,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,wEAAwE;AACxE,+CAA+C;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AA0HrE,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,UAAU,CAAA;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAA;IACjD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC3C,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE;QACpB,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,0FAA0F,KAAK,CAAC,MAAM,8FAA8F,CAAA;IACxM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA6C;IACzE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA4C;IACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IACrE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QACzB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACrB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgD;IAC/E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IACrE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QACzB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;AACjE,CAAC;AAED;;mEAEmE;AACnE,SAAS,iBAAiB,CACxB,IAAiB,EACjB,eAAuB,EACvB,WAAmB;AACnB,gEAAgE;AAChE,mEAAmE;AACnE,iEAAiE;AACjE,gBAA+B,EAC/B,MAAqB;IAUrB,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAClE,MAAM,cAAc,GAAG,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IACjE,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAC3E,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9F,MAAM,gBAAgB,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IAC3D,MAAM,QAAQ,GAAa;QACzB,QAAQ;QACR,aAAa,IAAI,CAAC,QAAQ,EAAE;QAC5B,aAAa,IAAI,CAAC,OAAO,EAAE;QAC3B,cAAc,IAAI,CAAC,QAAQ,EAAE;QAC7B,eAAe,UAAU,EAAE;QAC3B,SAAS;QACT,YAAY;QACZ,eAAe;QACf,aAAa;QACb,QAAQ;QACR,WAAW;QACX,SAAS;KACV,CAAA;IACD,MAAM,cAAc,GAAG,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAClG,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAA;IACrE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,cAAc;QACd,eAAe,EAAE,UAAU,CAAC,KAAK;QACjC,mBAAmB,EAAE,cAAc,CAAC,KAAK;QACzC,mBAAmB,EAAE,cAAc,CAAC,KAAK;QACzC,sBAAsB,EAAE,iBAAiB,CAAC,KAAK;QAC/C,gBAAgB;KACjB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,IAAiB,EACjB,OAAwB,EACxB,SAAwB,EAAE;IAE1B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IACpE,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACvC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,0EAA0E;QAC1E,2EAA2E;QAC3E,kEAAkE;QAClE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB;YACxE,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAA;IACH,CAAC;IACD,wEAAwE;IACxE,6EAA6E;IAC7E,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,gBAAgB,GAAkB,IAAI,CAAA;IAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB;gBACrF,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAA;QACH,CAAC;QACD,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAA;IACtC,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAA;IAClG,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAC1D,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAClD,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KAC5C,CAAA;AACH,CAAC;AAED;;;uCAGuC;AACvC,MAAM,wBAAwB,GAAG;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;CACjB,CAAA;AACD,MAAM,oBAAoB,GAAG;IAC3B,eAAe;IACf,cAAc;IACd,eAAe;IACf,oBAAoB;IACpB,2BAA2B;IAC3B,+BAA+B;IAC/B,wBAAwB;IACxB,cAAc;IACd,mBAAmB;IACnB,qCAAqC;IACrC,0BAA0B;IAC1B,0BAA0B;IAC1B,YAAY;IACZ,WAAW;IACX,UAAU;CACX,CAAA;AACD,MAAM,oBAAoB,GAAG;IAC3B,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,cAAc;IACd,YAAY;IACZ,cAAc;IACd,cAAc;CACf,CAAA;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,yCAAyC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,kBAAkB,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,CAAA;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzC,CAAC;AAID,MAAM,UAAU,8BAA8B,CAC5C,eAAuB;IAEvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAA;IAClD,MAAM,UAAU,GAAiC,EAAE,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,KAAK,CAAA;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IACxC,CAAC,CAAA;IAED,IAAI,CAAyB,CAAA;IAC7B,MAAM,UAAU,GAAG,YAAY,CAAA;IAC/B,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAE5E,MAAM,OAAO,GAAG,6BAA6B,CAAA;IAC7C,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAErE,MAAM,MAAM,GAAG,mBAAmB,CAAA;IAClC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAErE,MAAM,UAAU,GAAG,yEAAyE,CAAA;IAC5F,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAEvE,MAAM,UAAU,GAAG,oBAAoB,CAAA;IACvC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAE5E,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;QAC3C,IAAI,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACvC,IAAI,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACvC,IAAI,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;AAC3E,CAAC;AAED;;;;;;;uEAOuE;AACvE,MAAM,UAAU,yBAAyB,CACvC,eAAuB;IAEvB,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,MAAM,EAAE,GAAG,yBAAyB,CAAA;IACpC,IAAI,CAAyB,CAAA;IAC7B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB,CAAC;IACD,oDAAoD;IACpD,MAAM,IAAI,GAAgB;QACxB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,sBAAsB;QAChC,SAAS,EAAE,IAAI;KAChB,CAAA;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAAE,IAAI,EAAE;QACjF,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;QACjD,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACjG,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAA;QAChE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAA;AAChD,CAAC;AAED;;;;;oCAKoC;AACpC,MAAM,UAAU,uBAAuB;IACrC,MAAM,IAAI,GAAgB;QACxB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,oBAAoB;QAC9B,SAAS,EAAE,IAAI;KAChB,CAAA;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,IAAI,EAAE;QACzF,UAAU,EAAE;YACV,EAAE,EAAE,IAAI;YACR,IAAI,EACF,mEAAmE;gBACnE,wFAAwF;SAC3F;QACD,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;QACrF,aAAa,EAAE;YACb;gBACE,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,8BAA8B;gBAC3C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;gBAC9E,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;aAClF;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE,kCAAkC;gBAC/C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;aACrG;SACF;KACF,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG;QACf,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,SAAS;QACT,eAAe;QACf,gBAAgB;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,sBAAsB;QACtB,uBAAuB;QACvB,mBAAmB;QACnB,oBAAoB;KACrB,CAAA;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;QACpC,CAAC;IACH,CAAC;IACD,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;QAC7D,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACtD,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,sDAAsD,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,4DAA4D,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC"}

package/payload/platform/services/claude-session-manager/dist/systemd-scope.d.ts

@@ -0,0 +1,164 @@
+/** Single source of truth for the slice unit name. Used by the spawn argv,
+ *  the boot-seed list-units filter, and the installer's slice unit
+ *  emission. */
+export declare const CLAUDE_PTYS_SLICE = "claude-ptys.slice";
+/** Hard cap on SIGTERM→SIGKILL escalation inside the scope. systemd
+ *  delivers SIGTERM on stop, waits TimeoutStopSec, then SIGKILL. 5 s
+ *  matches the manager's prior killGraceMs (`config.killGraceMs`); the
+ *  manager no longer manages the escalation itself. */
+export declare const SCOPE_TIMEOUT_STOP_SEC = 5;
+/** Result of one systemctl invocation. Mirrors the shape of
+ *  spawnSync('utf8') return — exit code plus captured streams. The
+ *  scope-stop and list-units paths both go through this shape so tests
+ *  can inject a single stub. */
+export interface SystemctlResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/** Synchronous runner for `systemctl <args...>`. Default impl uses
+ *  spawnSync (matches uninstall.ts's existing idiom and keeps the call
+ *  site free of async glue for what is in practice a sub-50ms call).
+ *  Tests inject a recording stub. */
+export type SystemctlRunner = (args: readonly string[]) => SystemctlResult;
+export declare function defaultSystemctlRunner(args: readonly string[]): SystemctlResult;
+export declare function scopeUnitName(unitToken: string): string;
+/** Inverse of `scopeUnitName` — extracts the unitToken from a unit name
+ *  emitted by `systemctl --user list-units --type=scope 'claude-session-*.scope'`.
+ *  Returns null when the name doesn't match the prefix/suffix shape. */
+export declare function unitTokenFromScopeUnit(unit: string): string | null;
+/** One row from `systemctl --user list-units --type=scope --no-legend
+ *  'claude-session-*.scope'`. The `loaded`/`active`/`sub` columns let the
+ *  boot-seed reconciler ignore units that are draining (`sub=stop-sigterm`)
+ *  vs running (`sub=running`). */
+export interface SurvivingScope {
+    unitName: string;
+    unitToken: string;
+    loaded: string;
+    active: string;
+    sub: string;
+}
+/** Parse the `--no-legend` output of `systemctl --user list-units`.
+ *  Tolerant of leading column whitespace and trailing description column.
+ *  Rows whose unit name doesn't extract a unitToken are skipped (defensive
+ *  against future systemctl-output drift). */
+export declare function parseSurvivingScopes(stdout: string): SurvivingScope[];
+/** Issue `systemctl --user list-units --type=scope --no-legend
+ *  'claude-session-*.scope'` and return the parsed rows. The boot-seed
+ *  uses this to discover surviving PTYs across a manager restart. */
+export declare function listSurvivingScopes(run: SystemctlRunner): {
+    scopes: SurvivingScope[];
+    result: SystemctlResult;
+};
+/** Stop any orphan rc scope units left over from prior session-manager
+ *  boots. Called from the session-manager startup BEFORE the rc-daemon
+ *  supervisor's first spawn and BEFORE the HTTP server begins accepting
+ *  /rc-spawn requests, so no in-flight scope can be misidentified as an
+ *  orphan. Idempotent and safe to call on every boot — if nothing
+ *  matches, no stop is issued. */
+export declare function reapOrphanNonPtyScopes(run: SystemctlRunner, logger: (line: string) => void): Promise<void>;
+/** Outcome surface for a scope-stop attempt.
+ *
+ *  Task 451 — `outcome=ok` means **unit stopped AND pid is gone**. Pre-451,
+ *  `ok` was emitted whenever `systemctl stop` exited 0, even when the unit
+ *  was already collapsed and the underlying claude pid had been reparented
+ *  outside the scope cgroup (still running). The added post-flight
+ *  `kill(pid, 0)` check distinguishes that case:
+ *
+ *    - `ok`               — stop returned 0 AND (pid was not supplied OR pid is gone)
+ *    - `already-gone`     — stop returned exit code 5 (unit not loaded)
+ *    - `escalated-term`   — pid survived `systemctl stop`; SIGTERM cleared it within grace
+ *    - `escalated-kill`   — SIGTERM didn't suffice; SIGKILL cleared it
+ *    - `failed-pid-survives` — pid is still alive after SIGKILL (rare; signal-blocked
+ *      process, or a zombie whose parent has not reaped). Caller surfaces as a
+ *      distinct error class.
+ *    - `error`            — systemctl exit was non-zero and non-5 (a real systemctl
+ *      failure unrelated to unit state)
+ */
+export type StopScopeOutcome = 'ok' | 'already-gone' | 'escalated-term' | 'escalated-kill' | 'failed-pid-survives' | 'error';
+export interface StopScopeResult {
+    outcome: StopScopeOutcome;
+    exitCode: number;
+    stderr: string;
+}
+/** Injectable killer + alive-check for tests; production wires
+ *  `process.kill`. `kill(pid, 0)` returns whether the pid is currently
+ *  reachable (alive AND signal-permitted by the caller's uid). */
+export interface ProcessSignals {
+    /** Send `signal` to `pid`. Throws on ESRCH (no such pid) or EPERM. */
+    kill(pid: number, signal: number | string): void;
+    /** True when `pid` is alive and the caller has permission to signal it.
+     *  ESRCH → false. EPERM → true (alive but not ours; treat as alive so
+     *  we never mistakenly call the pid dead). Any other throw → true,
+     *  on the same "fail safe, escalate" principle. */
+    isAlive(pid: number): boolean;
+}
+export declare const defaultProcessSignals: ProcessSignals;
+/** Issue `systemctl --user stop --no-block <unit>` and verify the kill.
+ *
+ *  Task 451 — when `pid` is supplied, after `systemctl stop` returns we
+ *  check `kill(pid, 0)`. If the pid is still alive (the scope was already
+ *  collapsed before stop ran, so the pid was reparented outside the cgroup
+ *  and stop's `exit=0` was a lie), escalate: SIGTERM → wait `killGraceMs`
+ *  → re-check → SIGKILL → wait → re-check. Outcome reflects the path
+ *  taken. When `pid` is null (caller cannot supply, e.g. genuine orphan
+ *  with no MainPID), the function behaves as pre-451 — exit code is the
+ *  only signal.
+ *
+ *  The --no-block flag returns once the stop request is queued; the
+ *  scope's TimeoutStopSec=5 handles in-cgroup SIGTERM→SIGKILL escalation.
+ *  Exit code 5 ("not loaded") still means the scope retired naturally —
+ *  treated as `already-gone`. */
+export declare function stopScopeUnit(run: SystemctlRunner, unitToken: string, opts?: {
+    pid?: number | null;
+    killGraceMs?: number;
+    signals?: ProcessSignals;
+}): Promise<StopScopeResult>;
+/** Argv shape produced by `buildSystemdRunArgv`. The cmd is always
+ *  `systemd-run`; the manager passes this to node-pty. */
+export interface SystemdRunArgv {
+    cmd: 'systemd-run';
+    args: string[];
+}
+export interface BuildSystemdRunArgvParams {
+    unitToken: string;
+    claudeBin: string;
+    claudeArgs: readonly string[];
+    /** Full env map to thread into the scope via `--setenv=KEY=VAL`. Every
+     *  pair lands as one flag. The default systemd-run inherit-from-caller
+     *  is NOT relied on; spawnPtyAdapter composes the explicit env block
+     *  (per-spawn overrides + a copy of process.env it wants in the scope)
+     *  and the helper threads exactly that shape. */
+    env: Readonly<Record<string, string>>;
+    /** Working directory passed via `--working-directory=`. The manager's
+     *  prior node-pty spawn passed `cwd`; the scope receives it the same way. */
+    cwd: string;
+}
+/** Build the systemd-run argv that node-pty wraps for one claude spawn.
+ *  Inside the scope, `/bin/sh -c 'trap "" HUP; exec "$@"' sh <claudeBin> <claudeArgs...>`
+ *  wraps the launch so:
+ *
+ *  - **claude ignores SIGHUP** when the manager closes the PTY master fd
+ *    on restart. Without the trap, master-close → kernel SIGHUP →
+ *    claude exits.
+ *  - **`exec` keeps the pid stable** through the chain (sh → claude
+ *    reuse the original pid via execve), preserving the
+ *    `pty.pid == claude.pid` invariant the watcher.waitForPid path
+ *    depends on.
+ *
+ *  Task 573 — node-pty allocates the TTY for the child. The earlier
+ *  script(1) wrap (Task 556) plus the non-PTY scope primitive it served
+ *  are gone. */
+export declare function buildSystemdRunArgv(p: BuildSystemdRunArgvParams): SystemdRunArgv;
+/** Query `systemctl --user show -p MainPID claude-session-<token>.scope`
+ *  and return the main pid (the claude process). Boot-seed uses this to
+ *  bridge from the surviving scope unit to the PID file claude wrote at
+ *  `$CLAUDE_CONFIG_DIR/sessions/<pid>.json`, which in turn carries claude's
+ *  intrinsic sessionId. Returns null when the unit has no main pid (the
+ *  scope is draining) or when the systemctl call fails. */
+export declare function getScopeMainPid(run: SystemctlRunner, unitToken: string): number | null;
+/** Slice unit declared at install time so every claude scope shares one
+ *  cohort cgroup. `systemctl --user status claude-ptys.slice` gives the
+ *  operator a one-glance view of total live-session memory + CPU. */
+export declare function buildClaudePtysSliceUnitFile(): string;
+//# sourceMappingURL=systemd-scope.d.ts.map

package/payload/platform/services/claude-session-manager/dist/systemd-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd-scope.d.ts","sourceRoot":"","sources":["../src/systemd-scope.ts"],"names":[],"mappings":"AAuBA;;gBAEgB;AAChB,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AAEpD;;;uDAGuD;AACvD,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;gCAGgC;AAChC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;qCAGqC;AACrC,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,eAAe,CAAA;AAE1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAU/E;AAiBD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;;wEAEwE;AACxE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED;;;kCAGkC;AAClC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;8CAG8C;AAC9C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAiBrE;AAED;;qEAEqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG;IACzD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,EAAE,eAAe,CAAA;CACxB,CAaA;AASD;;;;;kCAKkC;AAClC,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,OAAO,CAAA;AAEX,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;kEAEkE;AAClE,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAChD;;;uDAGmD;IACnD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAC9B;AAED,eAAO,MAAM,qBAAqB,EAAE,cAcnC,CAAA;AAUD;;;;;;;;;;;;;;iCAciC;AACjC,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,cAAc,CAAA;CACpB,GACL,OAAO,CAAC,eAAe,CAAC,CAiC1B;AAED;0DAC0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,aAAa,CAAA;IAClB,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B;;;;qDAIiD;IACjD,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC;iFAC6E;IAC7E,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;;;;;;;;;gBAcgB;AAChB,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,yBAAyB,GAAG,cAAc,CA8BhF;AAED;;;;;2DAK2D;AAC3D,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAQf;AAED;;qEAEqE;AACrE,wBAAgB,4BAA4B,IAAI,MAAM,CAWrD"}