@tokenfactory/acc-runner 0.47.9 → 0.47.10

package/dist/runtime/refresh-lock.js

@@ -0,0 +1,609 @@
+/**
+ * RUNNER-REFRESH-ROTATION-LOST (ROTATED): coordinate a token refresh across
+ * every process on a host that shares ONE keychain slot.
+ *
+ * The first occurrence (a rotated successor never reaching the keychain) is
+ * handled by keychain.ts's verified save. This file handles the SECOND shape:
+ * two rotators — a `watch` and a `companion`, or two `watch` units — that both
+ * resolve the SAME instance keychain slot. When one rotates the refresh token
+ * the server revokes the predecessor; the OTHER process is still holding that
+ * predecessor in memory and, on its next refresh, re-presents it. The server's
+ * reuse detection then revokes the WHOLE family and both processes die.
+ *
+ * Two primitives fix it, both keyed to the keychain account (= the instance
+ * slot), so coordination is per-slot:
+ *
+ *   1. acquireRefreshLock() — an instance-scoped advisory lock with TWO layers,
+ *      so it serializes rotators both within one process and across processes:
+ *        - an in-process async mutex (keyed by the keychain account) that every
+ *          same-process acquirer queues on FIRST, so at most one rotator in this
+ *          process is ever between taking and releasing the lock; and
+ *        - an O_EXCL lock FILE under the instance-namespaced cache dir that
+ *          serializes rotators in DISTINCT processes (the `watch` and the
+ *          `companion` are separate processes with distinct pids).
+ *      Because the in-process mutex guarantees single-rotator access within the
+ *      process, the file layer never races a LIVE same-pid holder — a lock file
+ *      carrying our own pid is therefore always a stale leftover from THIS
+ *      process (an acquire that could not unlink on release), safe to reclaim.
+ *      A rotator takes the lock before refreshing so two rotators on one slot
+ *      serialize instead of racing. It WAITS for a live cross-process holder
+ *      (polling) and reclaims a dead holder's lock. It fails CLOSED: if the wait
+ *      budget is exhausted while a live holder still owns it, it throws
+ *      `RefreshLockBusyError` rather than proceeding lockless. An earlier build
+ *      failed OPEN here on the theory that the adoption re-read below was a
+ *      sufficient safety net; it is not — the holder may have called
+ *      /api/runner/refresh but not yet SAVED the successor, so a lockless
+ *      rotator re-reads its own (now superseded) token, re-presents it, and
+ *      trips reuse detection. The HTTP refresh therefore only ever runs while
+ *      this lock is HELD.
+ *   2. coordinatedRefresh() — under the lock, RE-READ the slot. If it now holds
+ *      a session whose refresh token differs from the one we loaded, another
+ *      rotator already rotated: ADOPT its successor rather than re-presenting
+ *      our superseded token (which would trip reuse detection). Only when the
+ *      slot still matches our token do we actually call /api/runner/refresh.
+ *      If the lock could not be taken (a live sibling is mid-rotation), it makes
+ *      no HTTP call: it either adopts a successor the sibling has already saved
+ *      (safe — nothing is presented) or refuses, surfacing a transient failure
+ *      the caller retries (by which point the sibling has saved and we adopt).
+ */
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import chalk from "chalk";
+import { cacheDir } from "./cache-dir.js";
+import { isProcessAlive } from "./locks.js";
+import { loadSessionFromAccount } from "../keychain.js";
+import { expiresSoon, refreshAccessToken } from "./auth-lifecycle.js";
+/**
+ * RUNNER-REFRESH-ROTATION-LOST: exit status for a TERMINAL refresh refusal
+ * (reuse / expired) or an unprovable keychain save. EX_CONFIG from sysexits(3):
+ * the config the process was handed is unusable and a restart would only
+ * re-present it, so BOTH the `watch` and `companion` supervisor units carry
+ * `RestartPreventExitStatus=78` and the process exits this code rather than
+ * letting the supervisor loop every minute and burn every token family it can
+ * reach. Defined here (not in watch.ts) so the companion can share it without
+ * importing the whole watch task-loop module. watch.ts re-exports it.
+ */
+export const EX_CONFIG = 78;
+/**
+ * RUNNER-REFRESH-ROTATION-LOST (ROTATED): print the operator-actionable banner
+ * for a TERMINAL refresh refusal and emit the runner-lane `auth.refresh_refused`
+ * board breadcrumb — AC3, carrying the `process` field so the board sees WHICH
+ * rotator (watch or companion) died on the shared slot. Shared verbatim by both
+ * rotators so the payload shape can never drift between them. Does NOT exit; the
+ * caller decides (both exit EX_CONFIG). The breadcrumb is emitted only while a
+ * usable bearer remains and is strictly best-effort — it never throws and never
+ * blocks the exit.
+ */
+export async function emitRefreshRefused(opts) {
+    const write = opts.write ?? ((s) => void process.stderr.write(s));
+    const { session, instance, account, error } = opts;
+    write(chalk.red.bold(`\n[acc-runner] CRITICAL: refresh refused (${error.code}).\n`));
+    write(chalk.red(`${error.message}\n`));
+    if (error.code === "refresh_reuse_detected") {
+        write(chalk.red("If this machine is the legitimate owner, an attacker may have rotated your tokens.\n" +
+            "Rotate any other credentials that were on this box.\n"));
+    }
+    write(chalk.red(`Clear the stale keychain slot "${account}" and re-login: ` +
+        `acc-runner login${instance ? ` --instance ${instance}` : ""}\n` +
+        `The unit stays failed (exit ${EX_CONFIG}); it will NOT restart-loop.\n`));
+    // Emit the board breadcrumb ONLY while the current access token is still
+    // usable — a refusal reached after the bearer itself expired has no authority
+    // to call log_activity, and must not block the exit waiting on a 401.
+    if (!expiresSoon(session, 0)) {
+        try {
+            const client = opts.makeClient();
+            const call = Promise.resolve(client.rpc("log_activity", {
+                p_verb: "auth.refresh_refused",
+                p_target_id: session.runner_id,
+                p_target_type: "runner",
+                p_payload: {
+                    runner_id: session.runner_id,
+                    instance,
+                    process: opts.process,
+                    error: error.code,
+                    keychain_account: account,
+                },
+            }));
+            await (opts.withDeadline ? opts.withDeadline(call, 5_000) : call);
+        }
+        catch {
+            /* best-effort breadcrumb — never let it hold up the terminal exit */
+        }
+    }
+}
+/**
+ * Thrown by acquireRefreshLock when the instance-scoped lock could not be taken
+ * within the wait budget because a LIVE sibling still holds it. It is NOT a
+ * terminal auth error — the caller must treat it as transient (refuse to rotate
+ * lockless, then retry), never exit on it.
+ */
+/**
+ * The keychain slot could not be re-read under the held lock, so the cached
+ * refresh token cannot be proven current. No HTTP refresh is made; the caller
+ * treats this like a transient refresh failure and retries.
+ */
+export class RefreshSlotUnreadableError extends Error {
+    account;
+    constructor(account, cause) {
+        super(`refresh skipped: keychain slot ${JSON.stringify(account)} could not be re-read ` +
+            `(${cause instanceof Error ? cause.message : String(cause)}); not presenting the cached token`);
+        this.name = "RefreshSlotUnreadableError";
+        this.account = account;
+    }
+}
+export class RefreshLockBusyError extends Error {
+    account;
+    code = "refresh_lock_busy";
+    constructor(account) {
+        super(`refresh lock for "${account}" is held by a live sibling and was not released ` +
+            `within the wait budget; refusing to rotate without it`);
+        this.account = account;
+        this.name = "RefreshLockBusyError";
+    }
+}
+/**
+ * `<cache>/refresh.<hash>.lock`. The hash is the keychain account (the instance
+ * slot), so every process resolving the same slot contends on one file while
+ * two distinct instances (distinct slots) never do.
+ */
+export function refreshLockPath(account) {
+    const hash = crypto.createHash("sha1").update(account).digest("hex").slice(0, 12);
+    return path.join(cacheDir(), `refresh.${hash}.lock`);
+}
+/**
+ * How long an UNPARSEABLE lock file is presumed to be a live holder's before it
+ * may be reclaimed. The lock file is created atomically with its full payload
+ * (temp file + hard link, below), so an unreadable or partial file is never a
+ * holder mid-write on this build; it is either a crashed older build's leftover
+ * or filesystem damage. It is still never reclaimed while fresh: a reader that
+ * cannot name the holder's pid has no proof the holder is dead, and unlinking a
+ * live holder's lock is exactly the race this lock exists to prevent.
+ */
+export const UNPARSEABLE_LOCK_STALE_MS = 30_000;
+function readRefreshLock(file, now) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { kind: "absent" };
+        throw err;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.pid === "number" && Number.isFinite(parsed.pid)) {
+            return {
+                kind: "holder",
+                info: {
+                    pid: parsed.pid,
+                    account: typeof parsed.account === "string" ? parsed.account : "<unknown>",
+                    acquiredAt: typeof parsed.acquiredAt === "string" ? parsed.acquiredAt : "<unknown>",
+                },
+            };
+        }
+    }
+    catch {
+        /* fall through: unparseable */
+    }
+    // Corrupt / partial / empty lock file. NOT reclaimable while fresh — see
+    // UNPARSEABLE_LOCK_STALE_MS. Its age comes from the file's mtime; an mtime
+    // that cannot be read counts as fresh (the conservative direction).
+    let ageMs = 0;
+    try {
+        ageMs = Math.max(0, now() - fs.statSync(file).mtimeMs);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { kind: "absent" };
+    }
+    return { kind: "unparseable", ageMs };
+}
+function readRefreshLockInfo(file) {
+    const read = readRefreshLock(file, Date.now);
+    return read.kind === "holder" ? read.info : null;
+}
+/**
+ * In-process serialization gate, keyed by keychain account. The O_EXCL lock FILE
+ * below serializes rotators ACROSS processes (distinct pids); this async mutex
+ * serializes rotators WITHIN one process. Without it, two same-process acquirers
+ * would each find their OWN pid on the lock file and — on the stale-reclaim path
+ * — the second could delete the first's LIVE lock and proceed in parallel
+ * instead of waiting, breaking single-rotator serialization. With it, a
+ * same-process acquirer queues here first, so only one is ever between
+ * file-create and release; a same-pid lock file the file layer encounters is
+ * then provably a stale leftover from THIS process, never a live concurrent
+ * holder, and is safe to reclaim.
+ *
+ * Implemented as a per-account promise chain: each acquirer awaits the previous
+ * tail, and its release resolves the gate for the next in line. The map entry is
+ * dropped once its queue has fully drained so it cannot grow unbounded.
+ */
+const inProcessGates = new Map();
+function acquireInProcessGate(account) {
+    const prev = inProcessGates.get(account) ?? Promise.resolve();
+    let release;
+    const held = new Promise((r) => {
+        release = r;
+    });
+    const tail = prev.then(() => held);
+    inProcessGates.set(account, tail);
+    // Hand control to the caller only after every earlier holder has released.
+    return prev.then(() => () => {
+        release();
+        // Drop the entry once we are the tail (queue drained) so long-lived
+        // processes rotating many accounts do not accumulate resolved promises.
+        if (inProcessGates.get(account) === tail)
+            inProcessGates.delete(account);
+    });
+}
+/**
+ * Acquire the instance-scoped advisory refresh lock for `account`. Two layers:
+ * an in-process mutex (same-process rotators queue) and an O_EXCL lock file
+ * (cross-process rotators contend). Blocks (polling) while a LIVE process holds
+ * the file and reclaims a DEAD holder's lock. If the wait budget is exhausted
+ * while a live holder still owns it, it fails CLOSED — throwing
+ * `RefreshLockBusyError` — because an HTTP refresh must never run without the
+ * lock held (a lockless rotator can re-present a superseded token mid-rotation
+ * and trip reuse detection). The caller treats the throw as transient and
+ * retries. The in-process gate is always released, including on a throw, so a
+ * failed acquire never wedges later same-process rotators.
+ */
+export async function acquireRefreshLock(account, opts = {}) {
+    const releaseGate = await acquireInProcessGate(account);
+    try {
+        return await acquireFileLock(account, opts, releaseGate);
+    }
+    catch (err) {
+        releaseGate();
+        throw err;
+    }
+}
+/**
+ * The cross-process half: the O_EXCL lock file. Only ever entered while the
+ * in-process gate is held, so a same-pid lock file here is a stale leftover from
+ * this process (safe to reclaim), never a live concurrent same-process holder.
+ */
+async function acquireFileLock(account, opts, releaseGate) {
+    const file = refreshLockPath(account);
+    const pid = opts.pid ?? process.pid;
+    const waitMs = opts.waitMs ?? 10_000;
+    const pollMs = opts.pollMs ?? 100;
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    // Synchronous on the uncontended happy path (no await) so taking the lock
+    // adds no extra microtask/IO turn to the refresh — it only awaits when it
+    // genuinely has to WAIT for a live holder.
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const payload = `${JSON.stringify({
+        pid,
+        account,
+        acquiredAt: new Date().toISOString(),
+    })}\n`;
+    const deadline = now() + waitMs;
+    // The lock file appears with its FULL payload or not at all: the payload is
+    // written to a private temp file first and then hard-linked to the lock path.
+    // link(2) fails with EEXIST when the lock exists, giving O_EXCL semantics,
+    // and a sibling that reads the lock can never observe it empty or partial
+    // (an `openSync("wx")` + `writeSync` pair had exactly that window, and a
+    // sibling reading the empty file in it treated the live lock as corrupt and
+    // reclaimed it — the race the reviewer found on 84c75503).
+    const tmp = `${file}.${pid}.${crypto.randomBytes(4).toString("hex")}.tmp`;
+    for (;;) {
+        fs.writeFileSync(tmp, payload, { flag: "w" });
+        try {
+            fs.linkSync(tmp, file);
+            return makeRefreshLock(file, pid, releaseGate);
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            const read = readRefreshLock(file, now);
+            const reclaimable = read.kind === "absent" ||
+                (read.kind === "holder" && (read.info.pid === pid || !isProcessAlive(read.info.pid))) ||
+                (read.kind === "unparseable" && read.ageMs >= UNPARSEABLE_LOCK_STALE_MS);
+            if (reclaimable) {
+                // Reclaimable: a dead cross-process holder, OUR OWN pid, an already
+                // vanished file, or an unparseable file that has sat untouched for
+                // UNPARSEABLE_LOCK_STALE_MS. Our own pid can only be a stale leftover —
+                // the in-process gate above guarantees no other same-process rotator is
+                // holding the lock right now — so reclaiming it unwedges this process
+                // rather than stomping a live sibling. A live cross-process sibling
+                // carries a DIFFERENT pid, and a FRESH unparseable file is treated as a
+                // live holder too; both fall through to the wait below.
+                try {
+                    fs.unlinkSync(file);
+                }
+                catch (unlinkErr) {
+                    if (unlinkErr.code !== "ENOENT")
+                        throw unlinkErr;
+                }
+                continue;
+            }
+            if (now() >= deadline)
+                throw new RefreshLockBusyError(account);
+            await sleep(pollMs);
+        }
+        finally {
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch {
+                /* already gone */
+            }
+        }
+    }
+}
+function makeRefreshLock(file, pid, releaseGate) {
+    let released = false;
+    return {
+        held: true,
+        async release() {
+            // Idempotent: callers may release more than once; the gate is freed once.
+            if (released)
+                return;
+            released = true;
+            try {
+                const holder = readRefreshLockInfo(file);
+                if (holder && holder.pid === pid)
+                    await fsp.unlink(file);
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    throw err;
+            }
+            finally {
+                // Always hand the in-process gate to the next same-process rotator, even
+                // if unlinking the file failed, so a stuck unlink cannot wedge the queue.
+                releaseGate();
+            }
+        },
+    };
+}
+/**
+ * RUNNER-REFRESH-ROTATION-LOST (ROTATED): refresh the session the rotation-safe way.
+ *
+ * - Env-token providers have no shared keychain slot (boundAccount() === null)
+ *   so they just refresh in place — there is no sibling to race.
+ * - Keychain providers take the instance-scoped lock, then RE-READ the slot. A
+ *   refresh token in the slot that differs from ours means a sibling rotator
+ *   already rotated while we held our (now superseded) token — adopt its
+ *   successor instead of re-presenting ours. Only when the slot still matches
+ *   do we call /api/runner/refresh ourselves and save the successor.
+ */
+export async function coordinatedRefresh(deps) {
+    const refresh = deps.refresh ?? refreshAccessToken;
+    const account = deps.provider.boundAccount();
+    if (account === null) {
+        const updated = await refresh(deps.cfg, deps.session);
+        await deps.provider.save(updated);
+        return { session: updated, adopted: false, refreshed: true };
+    }
+    const acquire = deps.acquireLock ?? acquireRefreshLock;
+    const load = deps.loadFromAccount ?? loadSessionFromAccount;
+    let lock;
+    try {
+        lock = await acquire(account);
+    }
+    catch (err) {
+        if (!(err instanceof RefreshLockBusyError))
+            throw err;
+        // We could NOT take the instance-scoped lock within the wait budget — a live
+        // sibling is mid-rotation. Rotating ourselves now (presenting our token, or
+        // even refreshing from a near-expired sibling successor) without the lock
+        // can re-trip reuse detection, so make NO HTTP call. The one safe move is to
+        // re-read the slot and ADOPT a successor the sibling has already saved
+        // (nothing is presented). Otherwise re-throw: the caller surfaces this as a
+        // transient refresh failure and retries, by which point the holder has saved
+        // and we adopt on the next pass.
+        const current = await load(account).catch(() => null);
+        if (current?.refresh_token &&
+            current.refresh_token !== deps.session.refresh_token &&
+            !expiresSoon(current)) {
+            return { session: current, adopted: true, refreshed: false };
+        }
+        throw err;
+    }
+    try {
+        // The slot re-read is the proof that our cached token is still the slot's
+        // current one. If the keychain cannot be read, that proof is missing, and
+        // presenting the cached token anyway is exactly the superseded-token
+        // re-presentation this function exists to prevent — so NO HTTP call: fail
+        // this attempt (the caller treats it as transient and retries).
+        let current;
+        try {
+            current = await load(account);
+        }
+        catch (err) {
+            throw new RefreshSlotUnreadableError(account, err);
+        }
+        if (current && current.refresh_token && current.refresh_token !== deps.session.refresh_token) {
+            // A sibling rotator already rotated the slot. Its successor is the only
+            // credential the server will still accept; ours was revoked when it
+            // rotated. Adopt it if it is still a usable bearer; otherwise refresh
+            // FROM it (the freshest refresh token), never from our superseded one.
+            // Both branches run under the held lock.
+            if (!expiresSoon(current)) {
+                return { session: current, adopted: true, refreshed: false };
+            }
+            const updated = await refresh(deps.cfg, current);
+            await deps.provider.save(updated);
+            return { session: updated, adopted: false, refreshed: true };
+        }
+        const updated = await refresh(deps.cfg, deps.session);
+        await deps.provider.save(updated);
+        return { session: updated, adopted: false, refreshed: true };
+    }
+    finally {
+        await lock.release();
+    }
+}
+/** Map an instance name (or null for the unnamed default) to its keychain slot. */
+export function rotatorSlot(instance) {
+    return instance ? `instance:${instance}` : "default";
+}
+/**
+ * pgrep-style scan for other `acc-runner watch` / `acc-runner companion`
+ * processes, extracting the `--instance <name>` each was launched with. Offline
+ * of any lock file and best-effort (returns [] on any failure). It reads only
+ * the command LINE (`ps -axo args`), never a process's environment — reading
+ * /proc/<pid>/environ is banned (it would leak secrets per CLAUDE.md).
+ *
+ * The process scan only sees RUNNING rotators, and only the slot that appears as
+ * `--instance` in argv — a stopped/failed unit, or one that carries its slot in
+ * `ACC_RUNNER_INSTANCE` rather than argv, is invisible here. `listRefreshRotatorUnits`
+ * below covers both gaps from the read-only systemd unit config.
+ */
+export async function listRefreshRotators(selfPid = process.pid) {
+    try {
+        const { execa } = await import("execa");
+        const { stdout } = await execa("ps", ["-axo", "pid=,args="]);
+        const rotators = [];
+        for (const line of stdout.split(/\r?\n/)) {
+            const m = line.trim().match(/^(\d+)\s+(.*)$/);
+            if (!m)
+                continue;
+            const pid = Number.parseInt(m[1], 10);
+            const args = m[2];
+            if (pid === selfPid)
+                continue;
+            if (!/acc-runner\b/.test(args) && !/\bacc-runner-(watch|companion)\b/.test(args))
+                continue;
+            const kind = /\bwatch\b/.test(args)
+                ? "watch"
+                : /\bcompanion\b/.test(args)
+                    ? "companion"
+                    : null;
+            if (!kind)
+                continue;
+            const instMatch = args.match(/--instance[=\s]+([a-z0-9][a-z0-9-]{0,31})/);
+            rotators.push({ pid, kind, instance: instMatch ? instMatch[1] : null });
+        }
+        return rotators;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Instance name carried in a unit basename: `acc-runner-<name>.service` or the
+ * template form `acc-runner@<name>.service` (the impl1–4 lanes). Null for any
+ * other name — a companion unit's name (`acc-staging-companion.service`) says
+ * nothing about its slot; its environment does.
+ */
+export function instanceFromUnitName(unit) {
+    const m = unit.match(/^acc-runner[-@]([a-z0-9][a-z0-9-]{0,31})\.service$/);
+    return m ? m[1] : null;
+}
+/**
+ * Classify one systemd unit as a rotator from what it RUNS and what its
+ * environment says, never from its name alone. A unit is a rotator when its
+ * ExecStart runs the runner binary (`acc-runner` / `acc`) as `watch` or
+ * `companion`, or when its environment carries `ACC_RUNNER_INSTANCE` (a unit
+ * that pins a slot refreshes it). Anything else — `acc-keyring.service`, a
+ * backup timer, an unrelated service that merely has "acc" in its name — is
+ * null. This is the rule the reviewer asked for on 91c768ad: the earlier
+ * name filter (`/acc-runner/`) skipped `acc-staging-companion.service`, the
+ * very unit that burnt the staging-smoke family (ledger 66).
+ */
+export function classifyRotatorUnit(unit, props) {
+    const exec = props.ExecStart ?? "";
+    const env = props.Environment ?? "";
+    const runsRunner = /(^|[\s/=])(acc-runner|acc)(\s|$)/.test(exec);
+    const kind = runsRunner && /\bcompanion\b/.test(exec)
+        ? "companion"
+        : runsRunner && /\bwatch\b/.test(exec)
+            ? "watch"
+            : runsRunner
+                ? "unknown"
+                : null;
+    const envMatch = env.match(/\bACC_RUNNER_INSTANCE=([a-z0-9][a-z0-9-]{0,31})/);
+    if (kind === null && !envMatch)
+        return null;
+    // Slot precedence: the unit's ACC_RUNNER_INSTANCE env (authoritative, what
+    // instance.ts resolves), then an argv --instance, then the unit basename.
+    const argvMatch = exec.match(/--instance[=\s]+([a-z0-9][a-z0-9-]{0,31})/);
+    const instance = envMatch ? envMatch[1] : argvMatch ? argvMatch[1] : instanceFromUnitName(unit);
+    const mainPidRaw = Number.parseInt(props.MainPID ?? "0", 10);
+    return {
+        unit,
+        kind: kind ?? (/companion/.test(unit) ? "companion" : "unknown"),
+        instance,
+        state: props.ActiveState ?? "unknown",
+        mainPid: Number.isFinite(mainPidRaw) && mainPidRaw > 0 ? mainPidRaw : null,
+    };
+}
+/** Parse `Key=Value` lines from `systemctl show` into a flat map. */
+function parseSystemctlShow(stdout) {
+    const out = {};
+    for (const line of stdout.split(/\r?\n/)) {
+        const eq = line.indexOf("=");
+        if (eq <= 0)
+            continue;
+        out[line.slice(0, eq)] = line.slice(eq + 1);
+    }
+    return out;
+}
+/**
+ * RUNNER-REFRESH-ROTATION-LOST (ROTATED, AC4): enumerate acc-runner rotator
+ * units from systemd --user CONFIG, INCLUDING stopped/failed ones, and resolve
+ * the keychain slot each targets from its READ-ONLY unit environment rather than
+ * a running process's argv. This closes the two gaps in the process scan:
+ *
+ *   - A stopped or failed unit never appears in `ps`, yet it shares the slot it
+ *     will rotate the instant it (re)starts — so doctor must still count it.
+ *   - A unit that carries its slot in `Environment=ACC_RUNNER_INSTANCE=<name>`
+ *     (not in argv) would be misread as the default slot by the argv-only scan.
+ *     We read it from `systemctl show --property=Environment`, extracting ONLY
+ *     `ACC_RUNNER_INSTANCE` and discarding the rest of the string, so no other
+ *     (possibly secret-bearing) unit variable is ever surfaced. This reads the
+ *     static unit config — NOT a live process's /proc/<pid>/environ, which stays
+ *     banned per CLAUDE.md.
+ *
+ * Best-effort: returns [] on any failure (e.g. no systemd, non-Linux).
+ */
+export async function listRefreshRotatorUnits() {
+    try {
+        const { execa } = await import("execa");
+        // `list-units --all` includes loaded units in every state — active, failed,
+        // and inactive — so a stopped/failed rotator is enumerated, not skipped.
+        const { stdout: list } = await execa("systemctl", [
+            "--user",
+            "list-units",
+            "--all",
+            "--no-legend",
+            "--plain",
+            "--type=service",
+        ]);
+        // Candidate units: every service whose name mentions acc at all (watch
+        // units, template lanes, companions, keyring, …). Which of them are rotators
+        // is decided by classifyRotatorUnit from ExecStart/Environment, not here.
+        const units = list
+            .split(/\r?\n/)
+            .map((l) => l.trim().split(/\s+/)[0] ?? "")
+            .filter((u) => /\.service$/.test(u) && /acc/i.test(u));
+        const out = [];
+        for (const unit of units) {
+            const { stdout } = await execa("systemctl", [
+                "--user",
+                "show",
+                unit,
+                "--property=Environment",
+                "--property=ExecStart",
+                "--property=ActiveState",
+                "--property=MainPID",
+            ]);
+            const props = parseSystemctlShow(stdout);
+            const classified = classifyRotatorUnit(unit, props);
+            if (classified)
+                out.push(classified);
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=refresh-lock.js.map

package/dist/runtime/refresh-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-lock.js","sourceRoot":"","sources":["../../src/runtime/refresh-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAMtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAgC5B;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA4B;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACnD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;IACrF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;QAC5C,KAAK,CACH,KAAK,CAAC,GAAG,CACP,sFAAsF;YACpF,uDAAuD,CAC1D,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CACH,KAAK,CAAC,GAAG,CACP,kCAAkC,OAAO,kBAAkB;QACzD,mBAAmB,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI;QAChE,+BAA+B,SAAS,gCAAgC,CAC3E,CACF,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAC1B,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE;gBACzB,MAAM,EAAE,sBAAsB;gBAC9B,WAAW,EAAE,OAAO,CAAC,SAAS;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE;oBACT,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ;oBACR,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,gBAAgB,EAAE,OAAO;iBAC1B;aACF,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,OAAO,CAAS;IACzB,YAAY,OAAe,EAAE,KAAc;QACzC,KAAK,CACH,kCAAkC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wBAAwB;YAC/E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CACjG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAExB;IADZ,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,OAAe;QAClC,KAAK,CACH,qBAAqB,OAAO,mDAAmD;YAC7E,uDAAuD,CAC1D,CAAC;QAJiB,YAAO,GAAP,OAAO,CAAQ;QAKlC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAQD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,WAAW,IAAI,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAQhD,SAAS,eAAe,CAAC,IAAY,EAAE,GAAiB;IACtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QAC3D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE;oBACJ,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;oBAC1E,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;iBACpF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAYD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;AAExD,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9D,IAAI,OAAoB,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE;QACnC,OAAO,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACnC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,2EAA2E;IAC3E,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE;QAC1B,OAAO,EAAE,CAAC;QACV,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,OAAkC,EAAE;IAEpC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,EAAE,CAAC;QACd,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,IAA+B,EAC/B,WAAuB;IAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,0EAA0E;IAC1E,0EAA0E;IAC1E,2CAA2C;IAC3C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,GAAG;QACH,OAAO;QACP,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACX,CAAC,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC;IAChC,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC1E,SAAS,CAAC;QACR,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvB,OAAO,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAChE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,WAAW,GACf,IAAI,CAAC,IAAI,KAAK,QAAQ;gBACtB,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrF,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;YAC3E,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,mEAAmE;gBACnE,wEAAwE;gBACxE,wEAAwE;gBACxE,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,wDAAwD;gBACxD,IAAI,CAAC;oBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,IAAK,SAAmC,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,SAAS,CAAC;gBAC9E,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,GAAW,EAAE,WAAuB;IACzE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,CAAC,OAAO;YACX,0EAA0E;YAC1E,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;oBAAE,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,yEAAyE;gBACzE,0EAA0E;gBAC1E,WAAW,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAuBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAC;IAE5D,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC;YAAE,MAAM,GAAG,CAAC;QACtD,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,uEAAuE;QACvE,4EAA4E;QAC5E,6EAA6E;QAC7E,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtD,IACE,OAAO,EAAE,aAAa;YACtB,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa;YACpD,CAAC,WAAW,CAAC,OAAO,CAAC,EACrB,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7F,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,uEAAuE;YACvE,yCAAyC;YACzC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC/D,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAoBD,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAuB;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,OAAO,CAAC,GAAG;IAE7B,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,GAAG,KAAK,OAAO;gBAAE,SAAS;YAC9B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3F,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBACjC,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC1B,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAuB;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,IAAI,GAAkB,UAAU,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAClE,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC;IACb,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9E,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS;QACrC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;KAC3E,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAChD,QAAQ;YACR,YAAY;YACZ,OAAO;YACP,aAAa;YACb,SAAS;YACT,gBAAgB;SACjB,CAAC,CAAC;QACH,uEAAuE;QACvE,6EAA6E;QAC7E,0EAA0E;QAC1E,MAAM,KAAK,GAAG,IAAI;aACf,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAyB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBAC1C,QAAQ;gBACR,MAAM;gBACN,IAAI;gBACJ,wBAAwB;gBACxB,sBAAsB;gBACtB,wBAAwB;gBACxB,oBAAoB;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,UAAU;gBAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}