@source-repo/rpc-cli 3.0.0 → 3.2.0

package/dist/packages.js

@@ -0,0 +1,120 @@
+import { execFile } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+/**
+ * The dependencies a script directory is allowed to import.
+ *
+ * A script is an ordinary Node program, so sooner or later one wants something off the registry -
+ * a date library, a CSV parser, a driver for the thing on the other end of the serial port. Without
+ * this the only answer is "leave the conversation and run npm yourself", which is the wrong shape
+ * for a directory a model is otherwise managing end to end.
+ *
+ * **This is not a new grant.** `--scripts` already permits arbitrary Node processes, and a script
+ * could `child_process.exec('npm i …')` on its own. Putting it behind a second flag would be theatre;
+ * what a tool buys is that the model *declares* what it wants, where it can be seen in the tool log
+ * and in a committed package.json, rather than doing it sideways.
+ *
+ * What is worth defending against is different: **installing a package runs code from the registry
+ * that nobody reviewed.** So installs pass `--ignore-scripts` by default, which is the setting that
+ * stops a postinstall hook from being the attack. A package that genuinely needs one - anything with
+ * a native build - has to ask, and the asking is visible.
+ */
+/** How long an install may take before it is abandoned. A cold cache on a slow link is the case to allow for. */
+const INSTALL_BUDGET_MS = 180_000;
+/**
+ * The manifest a script directory needs anyway.
+ *
+ * `type: module` is the load-bearing field: a `.ts` script uses `import`, and Node decides whether
+ * that is legal from the nearest package.json. Inside a CommonJS project there is one, it does not
+ * say module, and every run then prints a reparse warning that lands in the script's own output.
+ * `private` because this is a directory of programs, not something anybody publishes.
+ */
+export const ensureManifest = (directory) => {
+    const file = join(resolve(directory), 'package.json');
+    if (existsSync(file))
+        return file;
+    writeFileSync(file, `${JSON.stringify({ name: 'source-rpc-scripts', private: true, type: 'module' }, null, 2)}\n`, 'utf8');
+    return file;
+};
+const manifest = (directory) => {
+    const file = join(resolve(directory), 'package.json');
+    if (!existsSync(file))
+        return {};
+    try {
+        return JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return {};
+    }
+};
+/** What is declared, and what is actually on disk - which differ when an install failed halfway. */
+export const listPackages = (directory) => Object.entries(manifest(directory).dependencies ?? {})
+    .map(([name, range]) => {
+    const installed = join(resolve(directory), 'node_modules', name, 'package.json');
+    let version;
+    try {
+        version = JSON.parse(readFileSync(installed, 'utf8')).version;
+    }
+    catch {
+        version = undefined;
+    }
+    return { name, range, ...(version ? { installed: version } : { installed: null }) };
+})
+    .sort((a, b) => a.name.localeCompare(b.name));
+/**
+ * A package name a shell would not reinterpret.
+ *
+ * The spec reaches npm as one argv element rather than through a shell, so this is not quoting - it
+ * is refusing the shapes that are not package specs at all: a flag that would change what npm does,
+ * or a path that would install something off disk.
+ */
+const SAFE_SPEC = /^(@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*(@[\w.^~*><=|\s-]+)?$/i;
+/**
+ * npm's own JavaScript entry point, run by the Node already running this - not the `npm` shim.
+ *
+ * On Windows the shim is `npm.cmd`, and since the fix for CVE-2024-27980 Node refuses to spawn a
+ * `.cmd` without `shell: true`. Turning the shell on would be worse than the problem: a version
+ * range is a legitimate part of a package spec and `>`, `<`, `|` and `^` are all permitted in one,
+ * which is ordinary text to `execFile` and metacharacters to `cmd.exe`. Reaching past the shim to
+ * the script it would have run keeps arguments as argv on every platform, which is the only version
+ * of this that is safe by construction rather than by quoting.
+ *
+ * Exported for the test, which checks both layouts without needing the other operating system.
+ */
+export const npmEntryPoint = (execPath = process.execPath, platform = process.platform) => {
+    const here = dirname(execPath);
+    // Windows keeps npm beside node; the POSIX layout puts it under ../lib. Both are the standard
+    // install, and nvm, Volta and the Alpine image all follow whichever one their platform uses.
+    const candidates = platform === 'win32'
+        ? [join(here, 'node_modules', 'npm', 'bin', 'npm-cli.js')]
+        : [join(here, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'), join(here, '..', 'npm', 'bin', 'npm-cli.js')];
+    return candidates.find((candidate) => existsSync(candidate));
+};
+const npm = (directory, args) => new Promise((done) => {
+    const entry = npmEntryPoint();
+    if (!entry)
+        return done({
+            ok: false,
+            output: 'npm could not be found next to this Node, so packages cannot be managed from here. Install one alongside the other, or add the dependency by hand.'
+        });
+    execFile(process.execPath, [entry, ...args], { cwd: resolve(directory), timeout: INSTALL_BUDGET_MS, maxBuffer: 8 * 1024 * 1024 }, (error, stdout, stderr) => {
+        const output = `${stdout}${stderr}`.trim();
+        if (!error)
+            return done({ ok: true, output });
+        done({ ok: false, output: output || error.message });
+    });
+});
+export const addPackage = async (directory, spec, allowInstallScripts = false) => {
+    if (!SAFE_SPEC.test(spec))
+        throw new Error(`'${spec}' is not a package name. Give it \`lodash\` or \`@scope/name@^2\`, not a flag or a path.`);
+    ensureManifest(directory);
+    // --ignore-scripts unless asked: an install hook is code from the registry running here, and it
+    // is the part of `npm install` that is not about files at all.
+    return await npm(directory, ['install', '--save', ...(allowInstallScripts ? [] : ['--ignore-scripts']), spec]);
+};
+export const removePackage = async (directory, name) => {
+    if (!SAFE_SPEC.test(name))
+        throw new Error(`'${name}' is not a package name.`);
+    return await npm(directory, ['uninstall', '--save', name]);
+};
+//# sourceMappingURL=packages.js.map

package/dist/packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packages.js","sourceRoot":"","sources":["../src/packages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD;;;;;;;;;;;;;;;;;GAiBG;AAEH,iHAAiH;AACjH,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAEjC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,EAAE;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAA;IACrD,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1H,OAAO,IAAI,CAAA;AACf,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAiD,EAAE;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAA;IACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkD,CAAA;IAClG,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAA;IACb,CAAC;AACL,CAAC,CAAA;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAE,EAAE,CAC9C,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;KACjD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;IAChF,IAAI,OAA2B,CAAA;IAC/B,IAAI,CAAC;QACD,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAA0B,CAAC,OAAO,CAAA;IAC3F,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,GAAG,SAAS,CAAA;IACvB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AACvF,CAAC,CAAC;KACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,6DAA6D,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAE,EAAE;IACvG,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9B,8FAA8F;IAC9F,6FAA6F;IAC7F,MAAM,UAAU,GACZ,QAAQ,KAAK,OAAO;QAChB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AAChE,CAAC,CAAA;AAED,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAE,IAAc,EAAE,EAAE,CAC9C,IAAI,OAAO,CAAkC,CAAC,IAAI,EAAE,EAAE;IAClD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,IAAI,CAAC,KAAK;QACN,OAAO,IAAI,CAAC;YACR,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oJAAoJ;SAC/J,CAAC,CAAA;IACN,QAAQ,CACJ,OAAO,CAAC,QAAQ,EAChB,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAChB,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EACnF,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACxD,CAAC,CACJ,CAAA;AACL,CAAC,CAAC,CAAA;AAEN,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,SAAiB,EAAE,IAAY,EAAE,mBAAmB,GAAG,KAAK,EAAE,EAAE;IAC7F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,0FAA0F,CAAC,CAAA;IAC9I,cAAc,CAAC,SAAS,CAAC,CAAA;IACzB,gGAAgG;IAChG,+DAA+D;IAC/D,OAAO,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AAClH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,SAAiB,EAAE,IAAY,EAAE,EAAE;IACnE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,0BAA0B,CAAC,CAAA;IAC9E,OAAO,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA"}

package/dist/scripting.d.ts

@@ -0,0 +1,171 @@
+import { type RpcAuthorizer } from '@source-repo/rpc';
+import { type ScriptLanguage } from './scripts.js';
+/**
+ * Managing a node's scripts from another node, so a test hall is one place rather than a row of
+ * remote desktops.
+ *
+ * `--scripts` already lets a model write and run programs on the machine it is talking to. What it
+ * cannot do is reach the next machine along, and on a bench with a Linux box, a Windows PLC and a
+ * couple of devices, that is where the time goes: a remote desktop each, a file copied by hand, and
+ * the mistake you make on the fourth one.
+ *
+ * This is the same capability offered as an ordinary RPC namespace, which is the third time this
+ * codebase has reached for that shape - `bus.tap()` turned a restart-with-a-flag into a call, and
+ * `ConsoleService` let a browser and a model consume one surface. What it buys here is that
+ * everything already built for calling a peer works on it: argument checking from the contract,
+ * `describe()` so "which nodes can I script?" is answerable with `source-rpc peers`, the verbs
+ * (`source-rpc call node7 scripting.start deploy`), and the command semantics below.
+ *
+ * ## What this is
+ *
+ * **Remote code execution, offered as a method.** Not a reason to refuse to build it - it is what a
+ * test hall wants - but the trust model inverts and it is worth being exact about how.
+ *
+ * `--scripts` on its own is bounded by having a shell on the box: the model reaches it over stdio,
+ * as the user who started the server. Exposing this namespace replaces that boundary with "can
+ * reach the bus", and a broker relays for anyone that can open a socket to it unless told not to.
+ *
+ * So the rule is one line, and it is the strictest one that still works:
+ *
+ * **A call arriving over RPC is refused unless the caller is authenticated *and* named.**
+ *
+ * Local use does not go through this. The server that owns a node holds the object and calls its
+ * methods directly, which is what "local" means here - not a peer name to be compared, but no RPC
+ * at all. Anything that did arrive over the wire is by definition somebody else.
+ *
+ * ## Why authenticated *and* named
+ *
+ * A peer name off the wire is a claim. On socket.io a token pins the connection to one name and the
+ * transport drops frames claiming another, so an identity means something. **On MQTT there is no
+ * connection to authenticate**: `getIdentity` returns undefined unless frames are signed, so a
+ * network without `sign`/`verify` cannot tell anyone apart and this namespace refuses everybody.
+ * That is the correct failure, and it is worth knowing before wondering why the key is not working.
+ *
+ * ## Through a bus, sign
+ *
+ * The part that surprises, found by building it. **Identity is per connection, and does not survive
+ * a relay.** A bench authenticates to the broker; the node being scripted is connected to the broker
+ * too, so it has no connection to the bench and no way to learn who it is - and refuses, correctly,
+ * because the alternative is trusting a name that arrived through a third party.
+ *
+ * That rules out the arrangement most people would reach for first: a hall of nodes dialling one bus
+ * over socket.io, each expecting `--scriptable-by` to work through it. It does not, and no flag
+ * makes it, because the information genuinely is not there.
+ *
+ * What does work is signing, and it works because a signature is on the frame rather than on the
+ * link: whoever reads it can check it, whatever the broker did in between. So a relayed test hall is
+ * MQTT with `--sign` at both ends, each key file naming the other peer. There is a test for exactly
+ * that arrangement and one for the direct connection, and they are the two shapes worth copying.
+ */
+export interface ScriptingOptions {
+    /** Where scripts are written and run. The same directory `--scripts` names. */
+    directory: string;
+    /** Handed to each script it starts, so a script reads its broker url rather than carrying one. */
+    environment?: {
+        [key: string]: string;
+    };
+    /**
+     * Peer names permitted to script this node from elsewhere. Empty - the default - means nobody:
+     * the namespace can be exposed for a local server's own use without opening it to the bus.
+     *
+     * A name here is only as good as the transport's ability to prove it, which is why the guard
+     * insists on an identity as well. See `scriptingAuthorizer`.
+     */
+    allow?: string[];
+}
+/**
+ * An authorizer that refuses `scripting` to anyone this node has not named, and leaves every other
+ * namespace to whatever policy was already in place.
+ *
+ * Shipped with the service rather than left to the reader, because the failure mode of forgetting it
+ * is an open remote shell on the bus. Compose it with your own by passing that as `inner`.
+ */
+export declare const scriptingAuthorizer: (options: ScriptingOptions, inner?: RpcAuthorizer) => RpcAuthorizer;
+/**
+ * The namespace name, for the guard to compare against. Written out again in the decorator below
+ * rather than referenced, because the extraction CLI reads the source rather than running it and
+ * only understands a string literal there - a constant produces a contract with no namespaces in
+ * it, and the only sign is the count in the line it prints.
+ */
+export declare const SCRIPTING_NAMESPACE = "scripting";
+/**
+ * The scripts on one node, as methods.
+ *
+ * Every method here is what the MCP tools of the same name already do; the difference is that this
+ * one can be called from the next machine along. Semantics are declared because they are true and
+ * because a caller deciding whether to retry after a lost answer needs them: installing a package
+ * twice is not the same as listing them twice.
+ */
+export declare class ScriptingService {
+    private options;
+    private runner;
+    constructor(options: ScriptingOptions);
+    /** The scripts here, and which of them this node is running. */
+    list(): Promise<{
+        name: string;
+        language: ScriptLanguage;
+        running: boolean;
+        ended?: {
+            code: number | null;
+            signal: string | null;
+            at: number;
+        } | undefined;
+    }[]>;
+    /** Write one. Saving does not start it, the same as saving a file does not run it. */
+    save(name: string, source: string, language?: string): Promise<string>;
+    read(name: string): Promise<string>;
+    /** Stopped first if it is running, so a delete does not leave a process behind holding the name. */
+    remove(name: string): Promise<string>;
+    /**
+     * Run it, as a process of its own. Idempotent rather than non-repeatable because a second start
+     * is refused rather than obeyed - two of one script under one name is the thing to avoid.
+     */
+    start(name: string): Promise<{
+        name: string;
+        pid: number | null;
+        startedAt: number;
+    }>;
+    stop(name: string): Promise<{
+        name: string;
+        ended: {
+            code: number | null;
+            signal: string | null;
+            at: number;
+        } | null;
+    }>;
+    /** What it printed, with stderr lines marked. A script has no other channel back. */
+    output(name: string): Promise<{
+        name: string;
+        output: string[];
+        ended: {
+            code: number | null;
+            signal: string | null;
+            at: number;
+        } | null;
+        running: boolean;
+    }>;
+    packages(): Promise<({
+        name: string;
+        range: string;
+        installed: string;
+    } | {
+        name: string;
+        range: string;
+        installed: null;
+    })[]>;
+    /**
+     * Install one. Non-repeatable: it writes to node_modules and, if asked, runs the package's own
+     * install hooks - which is unreviewed code from the registry either way round.
+     */
+    addPackage(spec: string, allowInstallScripts?: boolean): Promise<{
+        ok: boolean;
+        output: string;
+    }>;
+    removePackage(name: string): Promise<{
+        ok: boolean;
+        output: string;
+    }>;
+    /** Everything this node started goes with it, rather than being orphaned holding peer names. */
+    close(): Promise<void>;
+}
+//# sourceMappingURL=scripting.d.ts.map

package/dist/scripting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripting.d.ts","sourceRoot":"","sources":["../src/scripting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,aAAa,EAAuB,MAAM,kBAAkB,CAAA;AAE7F,OAAO,EAAmE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAA;AAEnH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,MAAM,WAAW,gBAAgB;IAC7B,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAA;IACjB,kGAAkG;IAClG,WAAW,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;IACvC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,YAAa,gBAAgB,UAAU,aAAa,KAAG,aAUtF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAA;AAE9C;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAGb,OAAO,CAAC,OAAO;IAF3B,OAAO,CAAC,MAAM,CAAc;IAE5B,YAAoB,OAAO,EAAE,gBAAgB,EAE5C;IAED,gEAAgE;IAE1D,IAAI;;;;;;;;;SAMT;IAED,sFAAsF;IAEhF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,mBAEzD;IAGK,IAAI,CAAC,IAAI,EAAE,MAAM,mBAEtB;IAED,oGAAoG;IAE9F,MAAM,CAAC,IAAI,EAAE,MAAM,mBAIxB;IAED;;;OAGG;IAEG,KAAK,CAAC,IAAI,EAAE,MAAM;;;;OAGvB;IAGK,IAAI,CAAC,IAAI,EAAE,MAAM;;;;;;;OAGtB;IAED,qFAAqF;IAE/E,MAAM,CAAC,IAAI,EAAE,MAAM;;;;;;;;;OAIxB;IAGK,QAAQ;;;;;;;;UAEb;IAED;;;OAGG;IAEG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,OAAO;;;OAE3D;IAGK,aAAa,CAAC,IAAI,EAAE,MAAM;;;OAE/B;IAED,gGAAgG;IAC1F,KAAK,kBAEV;CACJ"}

package/dist/scripting.js

@@ -0,0 +1,186 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { rpc, rpcNamespace } from '@source-repo/rpc';
+import { addPackage, listPackages, removePackage } from './packages.js';
+import { deleteScript, listScripts, readScript, saveScript, ScriptRunner } from './scripts.js';
+/**
+ * An authorizer that refuses `scripting` to anyone this node has not named, and leaves every other
+ * namespace to whatever policy was already in place.
+ *
+ * Shipped with the service rather than left to the reader, because the failure mode of forgetting it
+ * is an open remote shell on the bus. Compose it with your own by passing that as `inner`.
+ */
+export const scriptingAuthorizer = (options, inner) => {
+    const allowed = new Set(options.allow ?? []);
+    return async (context) => {
+        if (context.instanceName !== SCRIPTING_NAMESPACE)
+            return inner ? await inner(context) : true;
+        // No identity, no scripting. `source` is a claim until a transport has checked it, and on
+        // MQTT nothing checks it unless frames are signed - so an unsigned network refuses everyone,
+        // which is the answer that cannot be wrong.
+        if (!context.identity)
+            return false;
+        return allowed.has(context.identity.name);
+    };
+};
+/**
+ * The namespace name, for the guard to compare against. Written out again in the decorator below
+ * rather than referenced, because the extraction CLI reads the source rather than running it and
+ * only understands a string literal there - a constant produces a contract with no namespaces in
+ * it, and the only sign is the count in the line it prints.
+ */
+export const SCRIPTING_NAMESPACE = 'scripting';
+/**
+ * The scripts on one node, as methods.
+ *
+ * Every method here is what the MCP tools of the same name already do; the difference is that this
+ * one can be called from the next machine along. Semantics are declared because they are true and
+ * because a caller deciding whether to retry after a lost answer needs them: installing a package
+ * twice is not the same as listing them twice.
+ */
+let ScriptingService = (() => {
+    let _classDecorators = [rpcNamespace('scripting', { version: '1', execution: 'serial' })];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _instanceExtraInitializers = [];
+    let _list_decorators;
+    let _save_decorators;
+    let _read_decorators;
+    let _remove_decorators;
+    let _start_decorators;
+    let _stop_decorators;
+    let _output_decorators;
+    let _packages_decorators;
+    let _addPackage_decorators;
+    let _removePackage_decorators;
+    var ScriptingService = class {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _list_decorators = [rpc({ semantics: 'query' })];
+            _save_decorators = [rpc({ semantics: 'idempotent-command' })];
+            _read_decorators = [rpc({ semantics: 'query' })];
+            _remove_decorators = [rpc({ semantics: 'idempotent-command' })];
+            _start_decorators = [rpc({ semantics: 'idempotent-command' })];
+            _stop_decorators = [rpc({ semantics: 'idempotent-command' })];
+            _output_decorators = [rpc({ semantics: 'query' })];
+            _packages_decorators = [rpc({ semantics: 'query' })];
+            _addPackage_decorators = [rpc({ semantics: 'non-repeatable-command' })];
+            _removePackage_decorators = [rpc({ semantics: 'non-repeatable-command' })];
+            __esDecorate(this, null, _list_decorators, { kind: "method", name: "list", static: false, private: false, access: { has: obj => "list" in obj, get: obj => obj.list }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _save_decorators, { kind: "method", name: "save", static: false, private: false, access: { has: obj => "save" in obj, get: obj => obj.save }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _read_decorators, { kind: "method", name: "read", static: false, private: false, access: { has: obj => "read" in obj, get: obj => obj.read }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _remove_decorators, { kind: "method", name: "remove", static: false, private: false, access: { has: obj => "remove" in obj, get: obj => obj.remove }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _start_decorators, { kind: "method", name: "start", static: false, private: false, access: { has: obj => "start" in obj, get: obj => obj.start }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _stop_decorators, { kind: "method", name: "stop", static: false, private: false, access: { has: obj => "stop" in obj, get: obj => obj.stop }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _output_decorators, { kind: "method", name: "output", static: false, private: false, access: { has: obj => "output" in obj, get: obj => obj.output }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _packages_decorators, { kind: "method", name: "packages", static: false, private: false, access: { has: obj => "packages" in obj, get: obj => obj.packages }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _addPackage_decorators, { kind: "method", name: "addPackage", static: false, private: false, access: { has: obj => "addPackage" in obj, get: obj => obj.addPackage }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _removePackage_decorators, { kind: "method", name: "removePackage", static: false, private: false, access: { has: obj => "removePackage" in obj, get: obj => obj.removePackage }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            ScriptingService = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        options = __runInitializers(this, _instanceExtraInitializers);
+        runner;
+        constructor(options) {
+            this.options = options;
+            this.runner = new ScriptRunner(options.directory, options.environment ?? {});
+        }
+        /** The scripts here, and which of them this node is running. */
+        async list() {
+            return listScripts(this.options.directory).map((script) => ({
+                ...script,
+                running: this.runner.isRunning(script.name),
+                ...(this.runner.status(script.name)?.ended ? { ended: this.runner.status(script.name).ended } : {})
+            }));
+        }
+        /** Write one. Saving does not start it, the same as saving a file does not run it. */
+        async save(name, source, language) {
+            return saveScript(this.options.directory, name, source, language === 'mjs' ? 'mjs' : 'ts');
+        }
+        async read(name) {
+            return readScript(this.options.directory, name);
+        }
+        /** Stopped first if it is running, so a delete does not leave a process behind holding the name. */
+        async remove(name) {
+            if (this.runner.isRunning(name))
+                await this.runner.stop(name);
+            deleteScript(this.options.directory, name);
+            return name;
+        }
+        /**
+         * Run it, as a process of its own. Idempotent rather than non-repeatable because a second start
+         * is refused rather than obeyed - two of one script under one name is the thing to avoid.
+         */
+        async start(name) {
+            const started = this.runner.start(name);
+            return { name: started.name, pid: started.pid ?? null, startedAt: started.startedAt };
+        }
+        async stop(name) {
+            const record = await this.runner.stop(name);
+            return { name: record.name, ended: record.ended ?? null };
+        }
+        /** What it printed, with stderr lines marked. A script has no other channel back. */
+        async output(name) {
+            const record = this.runner.status(name);
+            if (!record)
+                throw Object.assign(new Error(`'${name}' has not been started here`), { code: 'MethodNotFound' });
+            return { name, output: record.output, ended: record.ended ?? null, running: this.runner.isRunning(name) };
+        }
+        async packages() {
+            return listPackages(this.options.directory);
+        }
+        /**
+         * Install one. Non-repeatable: it writes to node_modules and, if asked, runs the package's own
+         * install hooks - which is unreviewed code from the registry either way round.
+         */
+        async addPackage(spec, allowInstallScripts) {
+            return await addPackage(this.options.directory, spec, allowInstallScripts === true);
+        }
+        async removePackage(name) {
+            return await removePackage(this.options.directory, name);
+        }
+        /** Everything this node started goes with it, rather than being orphaned holding peer names. */
+        async close() {
+            await this.runner.stopAll();
+        }
+    };
+    return ScriptingService = _classThis;
+})();
+export { ScriptingService };
+//# sourceMappingURL=scripting.js.map

package/dist/scripting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripting.js","sourceRoot":"","sources":["../src/scripting.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,YAAY,EAA2C,MAAM,kBAAkB,CAAA;AAC7F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAuB,MAAM,cAAc,CAAA;AA2EnH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAyB,EAAE,KAAqB,EAAiB,EAAE;IACnG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC5C,OAAO,KAAK,EAAE,OAAuB,EAAE,EAAE;QACrC,IAAI,OAAO,CAAC,YAAY,KAAK,mBAAmB;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5F,0FAA0F;QAC1F,6FAA6F;QAC7F,4CAA4C;QAC5C,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAA;AACL,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAE9C;;;;;;;GAOG;IAEU,gBAAgB;4BAD5B,YAAY,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;;;;;;;;;;;;;;;;;;;gCAS5D,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;gCAU3B,GAAG,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;gCAKxC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;kCAM3B,GAAG,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;iCAWxC,GAAG,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;gCAMxC,GAAG,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;kCAOxC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;oCAO3B,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;sCAS3B,GAAG,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;yCAK5C,GAAG,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;YAjE7C,+JAAM,IAAI,6DAMT;YAID,+JAAM,IAAI,6DAET;YAGD,+JAAM,IAAI,6DAET;YAID,qKAAM,MAAM,6DAIX;YAOD,kKAAM,KAAK,6DAGV;YAGD,+JAAM,IAAI,6DAGT;YAID,qKAAM,MAAM,6DAIX;YAGD,2KAAM,QAAQ,6DAEb;YAOD,iLAAM,UAAU,6DAEf;YAGD,0LAAM,aAAa,6DAElB;YA7EL,6KAmFC;;;YAnFY,uDAAgB;;QAGL,OAAO,GAHlB,mDAAgB;QACjB,MAAM,CAAc;QAE5B,YAAoB,OAAyB;2BAAzB,OAAO;YACvB,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAChF,CAAC;QAED,gEAAgE;QAEhE,KAAK,CAAC,IAAI;YACN,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACxD,GAAG,MAAM;gBACT,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvG,CAAC,CAAC,CAAA;QACP,CAAC;QAED,sFAAsF;QAEtF,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,MAAc,EAAE,QAAiB;YACtD,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAuB,CAAC,CAAA;QAClH,CAAC;QAGD,KAAK,CAAC,IAAI,CAAC,IAAY;YACnB,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACnD,CAAC;QAED,oGAAoG;QAEpG,KAAK,CAAC,MAAM,CAAC,IAAY;YACrB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC7D,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QACf,CAAC;QAED;;;WAGG;QAEH,KAAK,CAAC,KAAK,CAAC,IAAY;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACvC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;QACzF,CAAC;QAGD,KAAK,CAAC,IAAI,CAAC,IAAY;YACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAA;QAC7D,CAAC;QAED,qFAAqF;QAErF,KAAK,CAAC,MAAM,CAAC,IAAY;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACvC,IAAI,CAAC,MAAM;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,6BAA6B,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC9G,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;QAC7G,CAAC;QAGD,KAAK,CAAC,QAAQ;YACV,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/C,CAAC;QAED;;;WAGG;QAEH,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,mBAA6B;YACxD,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAA;QACvF,CAAC;QAGD,KAAK,CAAC,aAAa,CAAC,IAAY;YAC5B,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC5D,CAAC;QAED,gGAAgG;QAChG,KAAK,CAAC,KAAK;YACP,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QAC/B,CAAC;;;;SAlFQ,gBAAgB"}

package/dist/scripts.d.ts

@@ -0,0 +1,62 @@
+import type { NetworkOptions } from './network.js';
+/** TypeScript first; `.mjs` for a Node too old to run it, or an author who would rather not. */
+export declare const SCRIPT_EXTENSIONS: readonly ['.ts', '.mjs'];
+export type ScriptLanguage = 'ts' | 'mjs';
+/** Where a script of this language would be written. Proven to stay inside the directory. */
+export declare const scriptPath: (directory: string, name: string, language?: ScriptLanguage) => string;
+/** The file a saved script actually occupies, whichever language it was written in. */
+export declare const scriptFile: (directory: string, name: string) => string;
+export declare const saveScript: (directory: string, name: string, source: string, language?: ScriptLanguage) => string;
+export declare const readScript: (directory: string, name: string) => string;
+export declare const deleteScript: (directory: string, name: string) => void;
+export declare const listScripts: (directory: string) => {
+    name: string;
+    language: ScriptLanguage;
+}[];
+/**
+ * What this Node needs in order to run that file.
+ *
+ * Type stripping landed behind `--experimental-strip-types` in 22.6 and became the default in 23.6,
+ * so the flag is passed only where it is both needed and understood - passing it to 24 is a warning,
+ * and passing it to 22.5 is an error about an unknown option rather than about TypeScript.
+ */
+export declare const nodeArgvFor: (file: string, version?: string) => string[];
+/**
+ * The network this server is on, handed to a script as environment.
+ *
+ * So a script does not hardcode a broker url that is right on one machine and wrong on the next -
+ * and so a model writing one has something to read rather than a value to invent. The names match
+ * the flags they came from, and `SOURCE_RPC_TOKEN` is the one the CLI already reads for credentials.
+ */
+export declare const environmentFor: (options: NetworkOptions) => {
+    [key: string]: string;
+};
+export interface RunningScript {
+    name: string;
+    pid?: number;
+    startedAt: number;
+    /** Set once it has ended, so a stopped script reports why rather than merely being absent. */
+    ended?: {
+        code: number | null;
+        signal: string | null;
+        at: number;
+    };
+    output: string[];
+}
+/** Starts, stops and remembers the scripts this server is running. */
+export declare class ScriptRunner {
+    private directory;
+    private environment;
+    private running;
+    private finished;
+    constructor(directory: string, environment?: {
+        [key: string]: string;
+    });
+    isRunning(name: string): boolean;
+    start(name: string): RunningScript;
+    stop(name: string): Promise<RunningScript>;
+    status(name: string): RunningScript | undefined;
+    all(): RunningScript[];
+    stopAll(): Promise<void>;
+}
+//# sourceMappingURL=scripts.d.ts.map

package/dist/scripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts.d.ts","sourceRoot":"","sources":["../src/scripts.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AA8BlD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,YAAI,KAAK,EAAE,MAAM,CAAU,CAAA;AACzD,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,KAAK,CAAA;AASzC,6FAA6F;AAC7F,eAAO,MAAM,UAAU,cAAe,MAAM,QAAQ,MAAM,aAAY,cAAc,WAMnF,CAAA;AAED,uFAAuF;AACvF,eAAO,MAAM,UAAU,cAAe,MAAM,QAAQ,MAAM,WAOzD,CAAA;AAED,eAAO,MAAM,UAAU,cAAe,MAAM,QAAQ,MAAM,UAAU,MAAM,aAAY,cAAc,WAcnG,CAAA;AAED,eAAO,MAAM,UAAU,cAAe,MAAM,QAAQ,MAAM,WAAsD,CAAA;AAEhH,eAAO,MAAM,YAAY,cAAe,MAAM,QAAQ,MAAM,SAAwC,CAAA;AAEpG,eAAO,MAAM,WAAW,cAAe,MAAM;;cAIiE,cAAc;GAM3H,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,SAAU,MAAM,+BAQvC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,YAAa,cAAc,KAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAO9E,CAAA;AAEF,MAAM,WAAW,aAAa;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,8FAA8F;IAC9F,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,MAAM,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,sEAAsE;AACtE,qBAAa,YAAY;IAKjB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,WAAW;IALvB,OAAO,CAAC,OAAO,CAAoE;IACnF,OAAO,CAAC,QAAQ,CAAmC;IAEnD,YACY,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAO,EACnD;IAEJ,SAAS,CAAC,IAAI,EAAE,MAAM,WAErB;IAED,KAAK,CAAC,IAAI,EAAE,MAAM,iBAiCjB;IAEK,IAAI,CAAC,IAAI,EAAE,MAAM,0BAetB;IAED,MAAM,CAAC,IAAI,EAAE,MAAM,6BAElB;IAED,GAAG,IAAI,aAAa,EAAE,CAErB;IAEK,OAAO,kBAEZ;CACJ"}