@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/runtime-credential-profiles.js

@@ -0,0 +1,280 @@
+/**
+ * Named CLI sign-ins ("credential profiles") for a Windows computer paired as a Runtime.
+ *
+ * AgEnD (the server) only ever sends a NAME. This module is the only place a name becomes a directory, and it does so under a
+ * root the Runtime owns on this computer. A path, a drive letter, "..", a link or a device name can never be selected from the
+ * outside. Sign-in data stays in the directory; only names (and a signed-in yes/no) are reported back.
+ *
+ * Built-ins only: it is loaded by the standalone Runtime and by AgEnD's server for the same name check.
+ */
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, win32 } from "node:path";
+import { atomicWriteFileSync } from "./atomic-write.js";
+import { parseAccountIdentity } from "./claude-auth-status.js";
+/** Same shape as the Linux/WSL `credential_profile` (src/backend/credential-profile.ts), plus the Windows file-name hazards below. */
+export const CREDENTIAL_PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/** Reported in the Runtime's capabilities so an AgEnD never asks an older Runtime for a profile it would ignore. */
+export const RUNTIME_CREDENTIAL_CAPABILITY = "credential-profiles";
+/** Only Claude Code for now (`CLAUDE_CONFIG_DIR`). A new CLI is one more entry; the directory shape stays the same. */
+export const CREDENTIAL_PROFILE_CLIS = Object.freeze({ "claude-code": "CLAUDE_CONFIG_DIR" });
+export const CREDENTIAL_PROFILES_DIRECTORY = "credential-profiles";
+const STATUS_FILE = "status.json";
+/** Windows treats these as devices whatever the extension, and silently drops trailing dots/spaces: both would alias another name. */
+const WINDOWS_DEVICE = /^(?:con|prn|aux|nul|conin\$|conout\$|com[0-9¹²³]|lpt[0-9¹²³])(?:\..*)?$/i;
+/**
+ * A refusal whose text is ours and safe to show anywhere: it names a profile and a command, never a path, an account or a secret.
+ * A pane host passes exactly this kind of message across its local link (anything else is flattened to a generic refusal).
+ */
+export class CredentialProfileRefusal extends Error {
+    constructor(message) { super(message); this.name = "CredentialProfileRefusal"; }
+}
+export function isCredentialProfileCli(value) {
+    return typeof value === "string" && Object.hasOwn(CREDENTIAL_PROFILE_CLIS, value);
+}
+/** True only for a name that is safe as a Linux profile name AND as a Windows folder name. */
+export function validCredentialProfileName(value) {
+    return typeof value === "string" && CREDENTIAL_PROFILE_NAME.test(value) && !value.endsWith(".") && !WINDOWS_DEVICE.test(value);
+}
+export function assertCredentialProfileName(value) {
+    if (validCredentialProfileName(value))
+        return value;
+    throw new Error("Credential profile names use 1-64 letters, digits, dots, hyphens or underscores, start with a letter or digit, and cannot end with a dot or be a Windows device name");
+}
+export function assertCredentialProfileCli(value) {
+    if (isCredentialProfileCli(value))
+        return value;
+    throw new Error("Credential profiles on a Windows Runtime support Claude Code only");
+}
+/** Why a profile cannot be used for a run, with the next step on that computer. Never says which account or what is stored. */
+export function credentialLoginRequired(cli, name, loggedIn) {
+    return new Error(loggedIn === false
+        ? `Credential profile "${name}" is not signed in on this computer. Sign in there: agend-runtime login ${cli} ${name}`
+        : `This computer could not confirm that credential profile "${name}" is signed in, so nothing was started. Check it there: agend-runtime profile list`);
+}
+export function credentialProfilesRoot(runtimeHome) { return join(runtimeHome, CREDENTIAL_PROFILES_DIRECTORY); }
+/**
+ * The directory a profile name stands for. Pure: it checks the name and joins; it never reads the disk. Whatever the name, the result is a
+ * direct child of `<root>\<cli>`; anything that would land elsewhere (even by a future change to the name rule) is refused here.
+ */
+export function credentialProfileDirectory(root, cli, name) {
+    const base = join(root, assertCredentialProfileCli(cli)), directory = join(base, assertCredentialProfileName(name));
+    const inside = relative(base, directory);
+    if (!inside || inside.startsWith("..") || isAbsolute(inside) || win32.isAbsolute(inside) || inside.includes("/") || inside.includes("\\"))
+        throw new Error("A credential profile must stay inside this Runtime's profile folder");
+    return directory;
+}
+function realDirectory(path, what) {
+    let stat;
+    try {
+        stat = lstatSync(path);
+    }
+    catch {
+        throw new Error(`${what} does not exist`);
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error(`${what} must be a real folder, not a link`);
+}
+const same = (a, b) => process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+/** Valid-named folders under `<root>\<cli>`, exactly as the disk spells them (real folders only, no links). */
+function profileFolders(root, cli) {
+    const base = join(root, cli);
+    try {
+        realDirectory(base, "The credential profile folder");
+    }
+    catch {
+        return [];
+    }
+    return readdirSync(base, { withFileTypes: true }).filter(entry => entry.isDirectory() && !entry.isSymbolicLink() && validCredentialProfileName(entry.name)).map(entry => entry.name);
+}
+/** Folders whose names differ only by letter case are the same folder on Windows: such a name is ambiguous, so it is neither listed nor usable. */
+function ambiguousFolders(names) {
+    const groups = new Map();
+    for (const name of names) {
+        const key = name.toLowerCase();
+        groups.set(key, [...(groups.get(key) ?? []), name]);
+    }
+    return new Set([...groups.values()].filter(group => group.length > 1).flat());
+}
+/**
+ * The directory of a profile that already exists. Fail closed: an unknown name, a name that is only a case variant of another, an ambiguous
+ * one, a name that is not a folder, or a link is an error with its next step. There is deliberately no "use the default account instead".
+ */
+export function requireCredentialProfile(root, cli, name) {
+    const checked = assertCredentialProfileName(name), kind = assertCredentialProfileCli(cli), directory = credentialProfileDirectory(root, kind, checked);
+    const missing = new Error(`Credential profile "${checked}" does not exist on this computer. Create and sign in to it here: agend-runtime login ${kind} ${checked}`);
+    const folders = profileFolders(root, kind);
+    if (!folders.includes(checked)) {
+        // Windows would silently open "Work" for "work": say which one exists instead of aliasing it.
+        const alias = folders.find(other => other.toLowerCase() === checked.toLowerCase());
+        throw alias ? new Error(`Credential profile "${checked}" does not exist on this computer; "${alias}" does, and names are different if only the letter case differs. Use "${alias}".`) : missing;
+    }
+    if (ambiguousFolders(folders).has(checked))
+        throw new Error(`Credential profile "${checked}" is ambiguous: another folder differs from it only by letter case. Remove one of them from this Runtime's credential-profiles folder.`);
+    realDirectory(directory, `Credential profile "${checked}"`);
+    // A junction or a link anywhere on the way would have lstat above report a link; this also proves the real location is the fixed root's child.
+    const real = realpathSync(directory), expected = join(realpathSync(join(root, kind)), checked);
+    if (!same(real, expected))
+        throw new Error(`Credential profile "${checked}" is not inside this Runtime's profile folder`);
+    return directory;
+}
+/** Creates (or confirms) a profile folder, private to this Windows user. Names that differ only by case are the same folder on Windows, so they are refused. */
+export function ensureCredentialProfile(root, cli, name) {
+    const checked = assertCredentialProfileName(name), kind = assertCredentialProfileCli(cli), directory = credentialProfileDirectory(root, kind, checked);
+    for (const path of [root, join(root, kind)]) {
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+        realDirectory(path, "The credential profile folder");
+    }
+    const clash = profileFolders(root, kind).find(other => other.toLowerCase() === checked.toLowerCase() && other !== checked);
+    if (clash)
+        throw new Error(`Credential profile "${checked}" would be the same folder as "${clash}" on Windows; use that name or choose another`);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    realDirectory(directory, `Credential profile "${checked}"`);
+    return directory;
+}
+/** Names of the profile folders that exist, from the disk (the truth). Not listed: anything that is not a real folder with a valid name, and any name that is ambiguous by letter case. */
+export function listCredentialProfileNames(root, cli) {
+    const folders = profileFolders(root, assertCredentialProfileCli(cli)), ambiguous = ambiguousFolders(folders);
+    return folders.filter(name => !ambiguous.has(name)).sort((a, b) => a.localeCompare(b));
+}
+const dictionary = () => Object.create(null);
+function readStatusFile(root) {
+    const file = { version: 1, checkedAt: dictionary() };
+    try {
+        const path = join(root, STATUS_FILE), stat = lstatSync(path);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 64 * 1024)
+            return file;
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        const checked = value && typeof value === "object" && value.version === 1 ? value.checkedAt : undefined;
+        if (!checked || typeof checked !== "object")
+            return file;
+        for (const cli of Object.keys(checked)) {
+            const rows = checked[cli];
+            if (!isCredentialProfileCli(cli) || !rows || typeof rows !== "object")
+                continue;
+            const copy = file.checkedAt[cli] = dictionary();
+            for (const name of Object.keys(rows)) {
+                const row = rows[name];
+                if (validCredentialProfileName(name) && row && typeof row === "object" && (typeof row.loggedIn === "boolean" || row.loggedIn === null) && typeof row.at === "number") {
+                    // An identity that is not in its masked form (a hostile or hand-edited file) is dropped, never reported.
+                    let identity;
+                    try {
+                        identity = row.identity === undefined ? undefined : parseAccountIdentity(row.identity);
+                    }
+                    catch {
+                        identity = undefined;
+                    }
+                    copy[name] = { loggedIn: row.loggedIn, at: row.at, ...(identity && row.loggedIn === true ? { identity } : {}) };
+                }
+            }
+        }
+    }
+    catch { /* an unreadable cache is "unknown", never an error */ }
+    return file;
+}
+/** The last sign-in check this computer made for a profile (`login`, `profile list`, an explicit "Detect again"). Null when it has not been checked. */
+export function cachedCredentialLogin(root, cli, name) {
+    const rows = readStatusFile(root).checkedAt[cli];
+    return rows && Object.hasOwn(rows, name) ? rows[name].loggedIn : null;
+}
+/** The last answer with its account, for a profile checked before; null when it never was. */
+export function cachedCredentialStatus(root, cli, name) {
+    const rows = readStatusFile(root).checkedAt[cli];
+    if (!rows || !Object.hasOwn(rows, name))
+        return null;
+    const { loggedIn, identity } = rows[name];
+    return { loggedIn, ...(identity ? { identity } : {}) };
+}
+/** A sign-in answer with no account in it (the launch gate's yes/no, a test seam): it also forgets any account remembered before. */
+export function rememberCredentialLogin(root, cli, name, loggedIn, now = Date.now()) {
+    rememberCredentialStatus(root, cli, name, { loggedIn }, now);
+}
+export function rememberCredentialStatus(root, cli, name, answer, now = Date.now()) {
+    assertCredentialProfileName(name);
+    const identity = answer.loggedIn === true && answer.identity ? parseAccountIdentity(answer.identity) : undefined;
+    const file = readStatusFile(root);
+    (file.checkedAt[cli] ??= dictionary())[name] = { loggedIn: answer.loggedIn, at: now, ...(identity ? { identity } : {}) };
+    const plain = {};
+    for (const kind of Object.keys(file.checkedAt))
+        plain[kind] = Object.fromEntries(Object.entries(file.checkedAt[kind]));
+    try {
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+        atomicWriteFileSync(join(root, STATUS_FILE), JSON.stringify({ version: 1, checkedAt: plain }), { mode: 0o600 });
+    }
+    catch { /* a cache; the next check writes it again */ }
+}
+/** What this computer tells AgEnD: names and a signed-in yes/no (null = not checked yet). No path, e-mail, account or token. */
+export function credentialProfileReport(root, defaultName) {
+    const kind = "claude-code";
+    const profiles = listCredentialProfileNames(root, kind).map(name => { const known = cachedCredentialStatus(root, kind, name); return { name, loggedIn: known?.loggedIn ?? null, ...(known?.identity ? { identity: known.identity } : {}) }; });
+    return { profiles, ...(defaultName && profiles.some(row => row.name === defaultName) ? { default: defaultName } : {}) };
+}
+/** Bounded, closed parse of what a Runtime reports: only names and a signed-in yes/no. Anything else (a path, an e-mail) is a protocol error. */
+export function parseCredentialProfileReport(value) {
+    // The field that was wrong, never its value: a rejected report may carry an unmasked e-mail, and an error must not repeat it.
+    const fail = (field = "report") => { throw new Error(`Invalid credential profile report: ${field}`); };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return fail();
+    const input = value;
+    if (Object.keys(input).some(key => key !== "profiles" && key !== "default") || !Array.isArray(input.profiles) || input.profiles.length > 64)
+        return fail();
+    const seen = new Set(), profiles = [];
+    for (const row of input.profiles) {
+        if (!row || typeof row !== "object" || Array.isArray(row))
+            return fail("profile");
+        const item = row;
+        if (Object.keys(item).some(key => key !== "name" && key !== "loggedIn" && key !== "identity"))
+            return fail("profile field");
+        if (!validCredentialProfileName(item.name) || ![true, false, null].includes(item.loggedIn) || seen.has(item.name.toLowerCase()))
+            return fail("name or loggedIn");
+        // The account is only a masked e-mail and a plan, and only for a signed-in profile; an unmasked e-mail is a protocol error.
+        if (item.identity !== undefined && item.loggedIn !== true)
+            return fail("identity");
+        let identity;
+        try {
+            identity = item.identity === undefined ? undefined : parseAccountIdentity(item.identity);
+        }
+        catch (error) {
+            return fail(`identity ${/^Invalid account identity: (identity|unknown field|maskedEmail|plan|apiKey)$/.exec(error.message)?.[1] ?? "invalid"}`);
+        }
+        seen.add(item.name.toLowerCase());
+        profiles.push({ name: item.name, loggedIn: item.loggedIn, ...(identity ? { identity } : {}) });
+    }
+    if (input.default !== undefined && (!validCredentialProfileName(input.default) || !profiles.some(row => row.name === input.default)))
+        return fail("default");
+    return { profiles, ...(input.default !== undefined ? { default: input.default } : {}) };
+}
+/**
+ * The environment of one CLI run on this computer, with the profile's directory in the CLI's own variable. Any ambient value of that
+ * variable (whatever its letter case) is removed first, so a profile can never be combined with, or lose to, another account.
+ */
+export function withCredentialProfile(env, cli, directory) {
+    const variable = CREDENTIAL_PROFILE_CLIS[assertCredentialProfileCli(cli)], out = {};
+    for (const [key, value] of Object.entries(env))
+        if (key.toUpperCase() !== variable)
+            out[key] = value;
+    out[variable] = directory;
+    return out;
+}
+/**
+ * A cheap fingerprint of what `agend-runtime login` / `profile default` last wrote for this pairing (the sign-in cache and the default's file),
+ * so a running Runtime notices a sign-in made in another window and re-reports it without being asked.
+ */
+export function credentialCacheStamp(root, defaultFile) {
+    const one = (path) => { try {
+        const stat = lstatSync(path);
+        return `${stat.mtimeMs}:${stat.size}`;
+    }
+    catch {
+        return "-";
+    } };
+    return `${one(join(root, STATUS_FILE))}|${defaultFile ? one(defaultFile) : "-"}`;
+}
+export function credentialProfileExists(root, cli, name) {
+    try {
+        return existsSync(requireCredentialProfile(root, cli, name));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=runtime-credential-profiles.js.map

package/dist/runtime-credential-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-credential-profiles.js","sourceRoot":"","sources":["../src/runtime-credential-profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAwB,MAAM,yBAAyB,CAAC;AAErF,sIAAsI;AACtI,MAAM,CAAC,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAC3E,oHAAoH;AACpH,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AACnE,uHAAuH;AACvH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAW,CAAC,CAAC;AAEtG,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AACnE,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,sIAAsI;AACtI,MAAM,cAAc,GAAG,0EAA0E,CAAC;AAElG;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAAG,YAAY,OAAe,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC,CAAC,CAAC;CAAE;AAKhJ,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC;AACD,8FAA8F;AAC9F,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjI,CAAC;AACD,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,0BAA0B,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,KAAK,CAAC,sKAAsK,CAAC,CAAC;AAC1L,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,sBAAsB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;AACvF,CAAC;AACD,+HAA+H;AAC/H,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,IAAY,EAAE,QAAwB;IACzF,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QACjC,CAAC,CAAC,uBAAuB,IAAI,2EAA2E,GAAG,IAAI,IAAI,EAAE;QACrH,CAAC,CAAC,4DAA4D,IAAI,oFAAoF,CAAC,CAAC;AAC5J,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,WAAmB,IAAY,OAAO,IAAI,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;AAChI;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,GAAY,EAAE,IAAa;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAClO,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY;IAC/C,IAAI,IAAI,CAAC;IAAC,IAAI,CAAC;QAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;IAAC,CAAC;IAC9F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oCAAoC,CAAC,CAAC;AACjH,CAAC;AACD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7H,+GAA+G;AAC/G,SAAS,cAAc,CAAC,IAAY,EAAE,GAAyB;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QAAC,aAAa,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAClF,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvL,CAAC;AACD,mJAAmJ;AACnJ,SAAS,gBAAgB,CAAC,KAAwB;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAAC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAClH,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AACD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,GAAY,EAAE,IAAa;IAChF,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,0BAA0B,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvJ,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,uBAAuB,OAAO,yFAAyF,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;IACpK,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,8FAA8F;QAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,OAAO,uCAAuC,KAAK,yEAAyE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClM,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,wIAAwI,CAAC,CAAC;IACpO,aAAa,CAAC,SAAS,EAAE,uBAAuB,OAAO,GAAG,CAAC,CAAC;IAC5D,+IAA+I;IAC/I,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,+CAA+C,CAAC,CAAC;IAC1H,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,gKAAgK;AAChK,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,GAAY,EAAE,IAAa;IAC/E,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,0BAA0B,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvJ,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,aAAa,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAAC,CAAC;IACzJ,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC;IAC3H,IAAI,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,kCAAkC,KAAK,+CAA+C,CAAC,CAAC;IACjJ,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,aAAa,CAAC,SAAS,EAAE,uBAAuB,OAAO,GAAG,CAAC,CAAC;IACpH,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,2LAA2L;AAC3L,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,GAAY;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7G,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAQD,MAAM,UAAU,GAAG,GAAyB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAsB,CAAC;AACxF,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,IAAI,GAAe,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;QAClF,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAoB,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAE,KAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACxI,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACxI,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,EAAa,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAI,IAAgC,CAAC,IAAI,CAA8B,CAAC;gBACjF,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACrK,yGAAyG;oBACzG,IAAI,QAAqC,CAAC;oBAAC,IAAI,CAAC;wBAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,QAAQ,GAAG,SAAS,CAAC;oBAAC,CAAC;oBAC1K,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AACD,wJAAwJ;AACxJ,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,GAAyB,EAAE,IAAY;IACzF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AACD,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,GAAyB,EAAE,IAAY;IAC1F,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpG,CAAC;AACD,qIAAqI;AACrI,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,GAAyB,EAAE,IAAY,EAAE,QAAwB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACvI,wBAAwB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,GAAyB,EAAE,IAAY,EAAE,MAAgE,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAChL,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,UAAU,EAAa,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvK,MAAM,KAAK,GAA8C,EAAE,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvH,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,6CAA6C,CAAC,CAAC;AACrO,CAAC;AACD,gIAAgI;AAChI,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,WAAoB;IACxE,MAAM,IAAI,GAAyB,aAAa,CAAC;IACjD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/O,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1H,CAAC;AACD,iJAAiJ;AACjJ,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,8HAA8H;IAC9H,MAAM,IAAI,GAAG,CAAC,KAAK,GAAG,QAAQ,EAAS,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,EAAE,CAAC;IAC3J,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,QAAQ,GAA8B,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,GAA8B,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5H,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAA0B,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnL,4HAA4H;QAC5H,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QACnF,IAAI,QAAqC,CAAC;QAC1C,IAAI,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QACjG,OAAO,KAAK,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,YAAY,8EAA8E,CAAC,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;QAC7K,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAA0B,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7J,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpG,CAAC;AACD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAsB,EAAE,GAAY,EAAE,SAAiB;IAC3F,MAAM,QAAQ,GAAG,uBAAuB,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAsB,EAAE,CAAC;IACvG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrG,GAAG,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1B,OAAO,GAAG,CAAC;AACb,CAAC;AACD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,WAAoB;IACrE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,GAAG,IAAI,CAAC;QAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IAC7I,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACnF,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,GAAyB,EAAE,IAAY;IAC3F,IAAI,CAAC;QAAC,OAAO,UAAU,CAAC,wBAAwB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC/F,CAAC"}

package/dist/runtime-install.d.ts

@@ -0,0 +1,50 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type RuntimeBundle } from "./runtime-bundle.js";
+export declare const RUNTIME_INSTALL_SCRIPT_PATH = "/runtime/install.ps1";
+export declare const RUNTIME_BUNDLE_PATH = "/runtime/v1/bundle/windows.zip";
+export declare const RUNTIME_BUNDLE_METADATA_PATH = "/runtime/v1/bundle/windows.json";
+/** Replaced in the template with values that were validated first; the script holds no other server-supplied text. */
+export declare const RUNTIME_INSTALL_VERSION_TOKEN = "@@AGEND_RUNTIME_VERSION@@";
+export declare const RUNTIME_INSTALL_SHA256_TOKEN = "@@AGEND_RUNTIME_SHA256@@";
+export declare const RUNTIME_INSTALL_MAX_SCRIPT_BYTES: number;
+/** Stamps the validated version and bundle hash into the template; an unvalidated value never reaches the script. */
+export declare function renderRuntimeInstallScript(template: string, bundle: Pick<RuntimeBundle, "version" | "sha256">): string;
+export interface RuntimeInstallOptions {
+    /** Tests substitute fixtures; production builds the real bundle from this installation's compiled modules. */
+    bundle?: () => RuntimeBundle;
+    template?: () => string;
+    now?: () => number;
+}
+/** What the dashboard shows an administrator so the copied command can pin the script. */
+export interface RuntimeInstallerInfo {
+    version: string;
+    scriptSha256: string;
+    scriptBytes: number;
+    bundleSha256: string;
+}
+export declare class RuntimeInstallService {
+    private readonly options;
+    private readonly buckets;
+    private files;
+    constructor(options?: RuntimeInstallOptions);
+    /** Tokens a bucket holds right now. One nobody has used holds its whole burst, and holds no table row. */
+    private tokens;
+    private spend;
+    /**
+     * The address's own bucket is asked first. A request it refuses costs the total nothing, so one address that hammers a route is held by
+     * its own bucket and cannot drain what everyone else shares. Only a request that bucket admits is charged to the total, and only then are
+     * both spent. A bucket that has refilled to full is forgotten, and a row is only created by an admitted request, so the table stays small
+     * without a cap.
+     */
+    private admit;
+    /**
+     * Built on first use and kept: a server version has one generic bundle, so the hash the script pins stays the hash of the
+     * archive every later request receives, and one script, so the hash Settings shows is the hash of every script sent. A
+     * failure is not remembered; the next request tries again (under the rate limit).
+     */
+    private build;
+    /** For the local administrator's dashboard. Throws when the installer cannot be built on this host. */
+    installer(): RuntimeInstallerInfo;
+    /** True for an install/metadata route (404 while off); false leaves every other path to the normal gate. */
+    handle(req: IncomingMessage, res: ServerResponse, url: URL): boolean;
+}

package/dist/runtime-install.js

@@ -0,0 +1,186 @@
+/**
+ * Unauthenticated, read-only delivery of the Windows Runtime installer:
+ *   GET /runtime/install.ps1             the installer script, stamped with this server's runtime version and bundle SHA-256
+ *   GET /runtime/v1/bundle/windows.zip   the same createRuntimeBundle() archive Settings offers as a download
+ *   GET /runtime/v1/bundle/windows.json  the version, SHA-256 and size of that exact cached archive
+ * These files are static for a given server version: the bundle is built once and kept, and the script is that bundle's
+ * version and SHA-256 stamped into a fixed template. The script is built once as bytes and those exact bytes are what every
+ * request receives (no newline rewriting, no compression, no per-request text), so the SHA-256 that Settings shows for it is
+ * the hash of what is sent: the copied command downloads the script, checks that hash and only then runs it, so the check
+ * does not depend on the TLS trust decision. The script in turn pins the bundle's hash. Nothing in a response depends on
+ * the request (no Host header, query, cookie or caller), and nothing in it is a credential, pairing code, profile, user data
+ * or server address: the page's command hands the server address to the script.
+ * They are served only while runtimes.remote_runtime is on (otherwise they answer 404), never through a public gateway link
+ * (404 there too), only over loopback or TLS (the installer must not travel over plain LAN HTTP), rate limited per client
+ * address with a small burst, and never larger than the bundle's own cap.
+ * Pairing stays exactly as it was: nothing here creates, accepts or approves a pairing.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createRuntimeBundle, RUNTIME_MAX_ARCHIVE_BYTES } from "./runtime-bundle.js";
+import { remoteRuntimeEnabled } from "./runtime-switches.js";
+import { gatewayRequestContext } from "./web-request-context.js";
+export const RUNTIME_INSTALL_SCRIPT_PATH = "/runtime/install.ps1";
+export const RUNTIME_BUNDLE_PATH = "/runtime/v1/bundle/windows.zip";
+export const RUNTIME_BUNDLE_METADATA_PATH = "/runtime/v1/bundle/windows.json";
+/** Replaced in the template with values that were validated first; the script holds no other server-supplied text. */
+export const RUNTIME_INSTALL_VERSION_TOKEN = "@@AGEND_RUNTIME_VERSION@@";
+export const RUNTIME_INSTALL_SHA256_TOKEN = "@@AGEND_RUNTIME_SHA256@@";
+export const RUNTIME_INSTALL_MAX_SCRIPT_BYTES = 64 * 1024;
+/**
+ * Token buckets: a person re-running an installer, not a crawler. Each client address may burst a few requests, then is held to the
+ * refill rate; everything together is bounded too, because a reverse proxy makes every client look like one address.
+ */
+const LIMITS = {
+    script: { burst: 10, perMinute: 30 },
+    bundle: { burst: 4, perMinute: 12 },
+    total: { burst: 60, perMinute: 240 },
+};
+const VERSION = /^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/, SHA256 = /^[a-f0-9]{64}$/;
+function defaultTemplate() {
+    const file = join(dirname(fileURLToPath(import.meta.url)), "..", "templates", "runtime-install", "install.ps1");
+    const bytes = readFileSync(file);
+    if (bytes.length > RUNTIME_INSTALL_MAX_SCRIPT_BYTES)
+        throw new Error("Runtime installer script is too large");
+    return bytes.toString("utf8");
+}
+/** Stamps the validated version and bundle hash into the template; an unvalidated value never reaches the script. */
+export function renderRuntimeInstallScript(template, bundle) {
+    if (!VERSION.test(bundle.version) || !SHA256.test(bundle.sha256))
+        throw new Error("Invalid runtime bundle identity");
+    if (!template.includes(RUNTIME_INSTALL_VERSION_TOKEN) || !template.includes(RUNTIME_INSTALL_SHA256_TOKEN))
+        throw new Error("Runtime installer template has no placeholders");
+    const script = template.replaceAll(RUNTIME_INSTALL_VERSION_TOKEN, bundle.version).replaceAll(RUNTIME_INSTALL_SHA256_TOKEN, bundle.sha256);
+    if (/@@AGEND_RUNTIME_/.test(script) || Buffer.byteLength(script) > RUNTIME_INSTALL_MAX_SCRIPT_BYTES)
+        throw new Error("Runtime installer script is invalid");
+    return script;
+}
+const loopback = (address) => address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+function protectedTransport(req) {
+    return loopback(req.socket.remoteAddress) || req.socket.encrypted === true;
+}
+function answer(res, status, body, headers = {}) {
+    if (res.destroyed || res.writableEnded)
+        return;
+    res.writeHead(status, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store", ...headers });
+    res.end(JSON.stringify(body));
+}
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export class RuntimeInstallService {
+    options;
+    buckets = new Map();
+    files;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    /** Tokens a bucket holds right now. One nobody has used holds its whole burst, and holds no table row. */
+    tokens(key, limit, now) {
+        const row = this.buckets.get(key);
+        return row ? Math.min(row.burst, row.tokens + Math.max(0, now - row.at) * row.perMs) : limit.burst;
+    }
+    spend(key, limit, now) {
+        const perMs = limit.perMinute / 60_000, row = this.buckets.get(key) ?? { tokens: limit.burst, at: now, burst: limit.burst, perMs };
+        row.tokens = Math.min(row.burst, row.tokens + Math.max(0, now - row.at) * row.perMs) - 1;
+        row.at = now;
+        this.buckets.set(key, row);
+    }
+    /**
+     * The address's own bucket is asked first. A request it refuses costs the total nothing, so one address that hammers a route is held by
+     * its own bucket and cannot drain what everyone else shares. Only a request that bucket admits is charged to the total, and only then are
+     * both spent. A bucket that has refilled to full is forgotten, and a row is only created by an admitted request, so the table stays small
+     * without a cap.
+     */
+    admit(peerKey, peerLimit) {
+        const now = (this.options.now ?? Date.now)();
+        for (const [id, row] of this.buckets)
+            if (row.tokens + (now - row.at) * row.perMs >= row.burst)
+                this.buckets.delete(id);
+        if (this.tokens(peerKey, peerLimit, now) < 1 || this.tokens("total", LIMITS.total, now) < 1)
+            return false;
+        this.spend("total", LIMITS.total, now);
+        this.spend(peerKey, peerLimit, now);
+        return true;
+    }
+    /**
+     * Built on first use and kept: a server version has one generic bundle, so the hash the script pins stays the hash of the
+     * archive every later request receives, and one script, so the hash Settings shows is the hash of every script sent. A
+     * failure is not remembered; the next request tries again (under the rate limit).
+     */
+    build() {
+        if (this.files)
+            return this.files;
+        const bundle = (this.options.bundle ?? createRuntimeBundle)();
+        if (!bundle.bytes.length || bundle.bytes.length > RUNTIME_MAX_ARCHIVE_BYTES)
+            throw new Error("Runtime bundle exceeded its archive size limit");
+        const script = Buffer.from(renderRuntimeInstallScript((this.options.template ?? defaultTemplate)(), bundle), "utf8");
+        const metadata = Buffer.from(JSON.stringify({ version: bundle.version, sha256: bundle.sha256, bytes: bundle.bytes.length }) + "\n");
+        return this.files = { bundle, metadata, script, scriptSha256: sha256(script), etag: `"${bundle.version}-${bundle.sha256}"` };
+    }
+    /** For the local administrator's dashboard. Throws when the installer cannot be built on this host. */
+    installer() {
+        const { bundle, script, scriptSha256 } = this.build();
+        return { version: bundle.version, scriptSha256, scriptBytes: script.length, bundleSha256: bundle.sha256 };
+    }
+    /** True for an install/metadata route (404 while off); false leaves every other path to the normal gate. */
+    handle(req, res, url) {
+        const isScript = url.pathname === RUNTIME_INSTALL_SCRIPT_PATH;
+        const isMetadata = url.pathname === RUNTIME_BUNDLE_METADATA_PATH;
+        if (!isScript && !isMetadata && url.pathname !== RUNTIME_BUNDLE_PATH)
+            return false;
+        // Off, or reached through a public gateway link: these routes do not exist there. 404 is the same answer as any
+        // unknown route, and it does not reveal whether remote runtimes are configured. No bundle is built for it.
+        if (!remoteRuntimeEnabled() || gatewayRequestContext(req)) {
+            answer(res, 404, { error: "Not found" });
+            return true;
+        }
+        const method = req.method ?? "GET";
+        if (method !== "GET" && method !== "HEAD") {
+            answer(res, 405, { error: "Runtime installer files are read-only" }, { Allow: "GET, HEAD" });
+            return true;
+        }
+        if (url.search) {
+            answer(res, 400, { error: "Runtime installer files do not accept options" });
+            return true;
+        }
+        if (!protectedTransport(req)) {
+            answer(res, 403, { error: "The Runtime installer is served only over HTTPS or localhost" });
+            return true;
+        }
+        // ZIP and metadata share an allowance, including conditional and HEAD requests.
+        const peer = req.socket.remoteAddress ?? "unknown", kind = isScript ? "script" : "bundle";
+        if (!this.admit(`${kind}:${peer}`, LIMITS[kind])) {
+            answer(res, 429, { error: "Too many Runtime installer requests. Wait a minute and try again." }, { "Retry-After": "30" });
+            return true;
+        }
+        try {
+            const { bundle, metadata, script, etag } = this.build();
+            const common = { "X-Content-Type-Options": "nosniff" };
+            if (isScript) {
+                // never cached anywhere: a stale script would not match the hash the page shows
+                res.writeHead(200, { ...common, "Cache-Control": "no-store", "Content-Type": "text/plain; charset=utf-8", "Content-Length": script.length });
+                res.end(method === "HEAD" ? undefined : script);
+            }
+            else if ((req.headers["if-none-match"] ?? "").split(",").some(tag => tag.trim() === etag)) {
+                // The archive is immutable for this server version, so a client may ask whether its copy is still current. The installer
+                // still verifies the SHA-256 pinned in the script, so a cached copy is never trusted on its own.
+                res.writeHead(304, { ...common, "Cache-Control": "no-cache", ETag: etag });
+                res.end();
+            }
+            else {
+                const bytes = isMetadata ? metadata : bundle.bytes;
+                res.writeHead(200, { ...common, "Cache-Control": "no-cache", ETag: etag,
+                    "Content-Type": isMetadata ? "application/json; charset=utf-8" : "application/zip",
+                    ...(isMetadata ? {} : { "Content-Disposition": `attachment; filename="${bundle.filename}"`, "X-Agend-SHA256": bundle.sha256 }),
+                    "Content-Length": bytes.length });
+                res.end(method === "HEAD" ? undefined : bytes);
+            }
+        }
+        catch {
+            answer(res, 503, { error: "The Windows Runtime installer is unavailable on this host. Update or reinstall AgEnD and retry." });
+        }
+        return true;
+    }
+}
+//# sourceMappingURL=runtime-install.js.map

package/dist/runtime-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-install.js","sourceRoot":"","sources":["../src/runtime-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAsB,MAAM,qBAAqB,CAAC;AACzG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAC9E,sHAAsH;AACtH,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AACzE,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1D;;;GAGG;AACH,MAAM,MAAM,GAAG;IACb,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;IACpC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;IACnC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;CAC5B,CAAC;AACX,MAAM,OAAO,GAAG,wCAAwC,EAAE,MAAM,GAAG,gBAAgB,CAAC;AAEpF,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,gCAAgC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC9G,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AACD,qHAAqH;AACrH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,MAAiD;IAC5G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC7K,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,6BAA6B,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1I,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,gCAAgC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5J,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,OAA2B,EAAW,EAAE,CAAC,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,kBAAkB,CAAC;AAC1I,SAAS,kBAAkB,CAAC,GAAoB;IAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAK,GAAG,CAAC,MAAsD,CAAC,SAAS,KAAK,IAAI,CAAC;AAC9H,CAAC;AACD,SAAS,MAAM,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAE,OAAO,GAA2B,EAAE;IACtG,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO;IAC/C,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAYD,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/F,MAAM,OAAO,qBAAqB;IAGH,OAAO;IAFnB,OAAO,GAAG,IAAI,GAAG,EAAwE,CAAC;IACnG,KAAK,CAAkC;IAC/C,YAA6B,OAAO,GAA0B,EAAE;uBAAnC,OAAO;IAA+B,CAAC;IACpE,0GAA0G;IAClG,MAAM,CAAC,GAAW,EAAE,KAAwB,EAAE,GAAW;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACrG,CAAC;IACO,KAAK,CAAC,GAAW,EAAE,KAA2C,EAAE,GAAW;QACjF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QACnI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC;QACvG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD;;;;;OAKG;IACK,KAAK,CAAC,OAAe,EAAE,SAA+C;QAC5E,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1G,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD;;;;OAIG;IACK,KAAK;QACX,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,yBAAyB;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/I,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpI,OAAO,IAAI,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC/H,CAAC;IACD,uGAAuG;IACvG,SAAS;QACP,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5G,CAAC;IACD,4GAA4G;IAC5G,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,2BAA2B,CAAC;QAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,KAAK,4BAA4B,CAAC;QACjE,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB;YAAE,OAAO,KAAK,CAAC;QACnF,gHAAgH;QAChH,2GAA2G;QAC3G,IAAI,CAAC,oBAAoB,EAAE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QACnC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACzJ,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC9G,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC3I,gFAAgF;QAChF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,EAAE,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1F,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mEAAmE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QACzI,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,gFAAgF;gBAChF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC7I,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC5F,yHAAyH;gBACzH,iGAAiG;gBACjG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACxF,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI;oBACrE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,iBAAiB;oBAClF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,yBAAyB,MAAM,CAAC,QAAQ,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;oBAC9H,gBAAgB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iGAAiG,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/runtime-pane-assets.d.ts

@@ -12,6 +12,6 @@ export declare const RUNTIME_PANE_ASSETS: readonly [{
     readonly version: "1.1.0";
     readonly files: readonly ["package.json", "LICENSE", "CONPTY-LICENSE", "CONPTY-NOTICE.md", "lib/index.js", "lib/windowsConoutConnection.js", "lib/eventEmitter2.js", "lib/types.js", "lib/windowsTerminal.js", "lib/utils.js", "lib/worker/conoutSocketWorker.js", "lib/conpty_console_list_agent.js", "lib/interfaces.js", "lib/windowsPtyAgent.js", "lib/shared/conout.js", "lib/terminal.js", "lib/unixTerminal.js", ...string[]];
 }];
-export declare const RUNTIME_PANE_MODULES: readonly ["general-role.js", "runtime-general-protocol.js", "runtime-general-workspace.js", "runtime-pane-output.js", "local-pane-stage.ps1", "runtime-pane-stdio.js", "runtime-pane-stdio-protocol.js", "runtime-pane-protocol.js", "runtime-pane-mcp-protocol.js", "runtime-pane-mcp-relay.js", "windows-pane-mcp.js", "runtime-pane-link.js", "runtime-pane-private.js", "runtime-pane-private.ps1", "runtime-pane-service.js", "runtime-pane-assets.js", "runtime-pane-host.js", "runtime-pane-screen.js", "runtime-pane-store.js", "runtime-pane-boot.js", "runtime-pane-native.js", "runtime-pane-config.js", "runtime-pane-transcript.js", "runtime-pane-codex-index.js", "runtime-pane-transcript-protocol.js", "transcript-records.js", "transcript-needles.js", "transcript-turns.js", "runtime-pane-process.js", "runtime-pane-worker.js", "runtime-pane-job-owner.js", "runtime-pane-job.ps1"];
+export declare const RUNTIME_PANE_MODULES: readonly ["general-role.js", "runtime-general-protocol.js", "runtime-general-workspace.js", "runtime-pane-output.js", "local-pane-stage.ps1", "runtime-pane-stdio.js", "runtime-pane-stdio-protocol.js", "runtime-pane-protocol.js", "runtime-pane-mcp-protocol.js", "runtime-pane-mcp-relay.js", "windows-pane-mcp.js", "runtime-pane-link.js", "runtime-pane-private.js", "runtime-pane-private.ps1", "runtime-pane-service.js", "runtime-pane-assets.js", "runtime-pane-host.js", "runtime-pane-screen.js", "runtime-pane-store.js", "runtime-pane-boot.js", "runtime-pane-native.js", "runtime-pane-config.js", "runtime-pane-transcript.js", "runtime-pane-quota-history.js", "pane-quota-history.js", "runtime-pane-codex-index.js", "runtime-pane-transcript-protocol.js", "transcript-records.js", "transcript-needles.js", "transcript-turns.js", "runtime-pane-process.js", "runtime-pane-worker.js", "runtime-pane-job-owner.js", "runtime-pane-job.ps1"];
 /** node-pty@1.1.0 npm prebuilds (lockfile integrity), bundled ConPTY 1.23.251008001. */
 export declare const PANE_NATIVE_SHA256: Readonly<Record<string, string>>;

package/dist/runtime-pane-assets.js

@@ -8,7 +8,7 @@ export const RUNTIME_PANE_ASSETS = [
             ...["win32-x64", "win32-arm64"].flatMap(platform => ["conpty.node", "conpty_console_list.node", "conpty/OpenConsole.exe", "conpty/conpty.dll"].map(file => `prebuilds/${platform}/${file}`)),
         ] },
 ];
-export const RUNTIME_PANE_MODULES = ["general-role.js", "runtime-general-protocol.js", "runtime-general-workspace.js", "runtime-pane-output.js", "local-pane-stage.ps1", "runtime-pane-stdio.js", "runtime-pane-stdio-protocol.js", "runtime-pane-protocol.js", "runtime-pane-mcp-protocol.js", "runtime-pane-mcp-relay.js", "windows-pane-mcp.js", "runtime-pane-link.js", "runtime-pane-private.js", "runtime-pane-private.ps1", "runtime-pane-service.js", "runtime-pane-assets.js", "runtime-pane-host.js", "runtime-pane-screen.js", "runtime-pane-store.js", "runtime-pane-boot.js", "runtime-pane-native.js", "runtime-pane-config.js", "runtime-pane-transcript.js", "runtime-pane-codex-index.js", "runtime-pane-transcript-protocol.js", "transcript-records.js", "transcript-needles.js", "transcript-turns.js", "runtime-pane-process.js", "runtime-pane-worker.js", "runtime-pane-job-owner.js", "runtime-pane-job.ps1"];
+export const RUNTIME_PANE_MODULES = ["general-role.js", "runtime-general-protocol.js", "runtime-general-workspace.js", "runtime-pane-output.js", "local-pane-stage.ps1", "runtime-pane-stdio.js", "runtime-pane-stdio-protocol.js", "runtime-pane-protocol.js", "runtime-pane-mcp-protocol.js", "runtime-pane-mcp-relay.js", "windows-pane-mcp.js", "runtime-pane-link.js", "runtime-pane-private.js", "runtime-pane-private.ps1", "runtime-pane-service.js", "runtime-pane-assets.js", "runtime-pane-host.js", "runtime-pane-screen.js", "runtime-pane-store.js", "runtime-pane-boot.js", "runtime-pane-native.js", "runtime-pane-config.js", "runtime-pane-transcript.js", "runtime-pane-quota-history.js", "pane-quota-history.js", "runtime-pane-codex-index.js", "runtime-pane-transcript-protocol.js", "transcript-records.js", "transcript-needles.js", "transcript-turns.js", "runtime-pane-process.js", "runtime-pane-worker.js", "runtime-pane-job-owner.js", "runtime-pane-job.ps1"];
 /** node-pty@1.1.0 npm prebuilds (lockfile integrity), bundled ConPTY 1.23.251008001. */
 export const PANE_NATIVE_SHA256 = {
     "prebuilds/win32-x64/conpty.node": "ee8f4e6f4dad71939eecfda11de249400e34bfefe4c8b48af13f3b5476f4035b",

package/dist/runtime-pane-assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-pane-assets.js","sourceRoot":"","sources":["../src/runtime-pane-assets.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,gCAAgC,EAAE,iCAAiC,CAAC,EAAE;IACtJ,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,EAAE;IAC9I,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YAC3C,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,cAAc,EAAE,wBAAwB,EAAE,cAAc;YACnM,kCAAkC,EAAE,kCAAkC,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB;YACvL,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,mBAAmB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;SAC7L,EAAE;CACK,CAAC;AACX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,iBAAiB,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,sBAAsB,CAAU,CAAC;AAE/4B,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAqC;IAClE,iCAAiC,EAAE,kEAAkE;IACrG,8CAA8C,EAAE,kEAAkE;IAClH,uCAAuC,EAAE,kEAAkE;IAC3G,4CAA4C,EAAE,kEAAkE;IAChH,mCAAmC,EAAE,kEAAkE;IACvG,gDAAgD,EAAE,kEAAkE;IACpH,yCAAyC,EAAE,kEAAkE;IAC7G,8CAA8C,EAAE,kEAAkE;CACnH,CAAC"}
+{"version":3,"file":"runtime-pane-assets.js","sourceRoot":"","sources":["../src/runtime-pane-assets.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,gCAAgC,EAAE,iCAAiC,CAAC,EAAE;IACtJ,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,EAAE;IAC9I,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YAC3C,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,cAAc,EAAE,wBAAwB,EAAE,cAAc;YACnM,kCAAkC,EAAE,kCAAkC,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB;YACvL,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,mBAAmB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;SAC7L,EAAE;CACK,CAAC;AACX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,iBAAiB,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,+BAA+B,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,qCAAqC,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,sBAAsB,CAAU,CAAC;AAEz8B,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAqC;IAClE,iCAAiC,EAAE,kEAAkE;IACrG,8CAA8C,EAAE,kEAAkE;IAClH,uCAAuC,EAAE,kEAAkE;IAC3G,4CAA4C,EAAE,kEAAkE;IAChH,mCAAmC,EAAE,kEAAkE;IACvG,gDAAgD,EAAE,kEAAkE;IACpH,yCAAyC,EAAE,kEAAkE;IAC7G,8CAA8C,EAAE,kEAAkE;CACnH,CAAC"}

package/dist/runtime-pane-boot.d.ts

@@ -1,2 +1,9 @@
 export declare function paneSystemBootId(ticks: string): string;
 export declare function readPaneSystemBootId(): Promise<string | undefined>;
+/** Command line of a process, read-only; unknown (undefined) when it cannot be read, which is never evidence either way. */
+export declare function readProcessCommandLine(pid: number): Promise<string | undefined>;
+/**
+ * The profile lock's PID when a readable command line shows it is no Runtime (Windows reuses PIDs after a restart), else undefined.
+ * A Runtime that is really running, or one whose command line cannot be read, is never reported, so it keeps its lock.
+ */
+export declare function reusedRuntimeLockPid(holder: number | undefined, readCommandLine?: (pid: number) => Promise<string | undefined>): Promise<number | undefined>;