@trusty-squire/mcp 1.1.13 → 1.1.14-rc.10

package/dist/bot/broker/custody.d.ts

@@ -0,0 +1,20 @@
+import type { BrowserController } from "../browser.js";
+/** Installed only by the browser-owning broker entrypoint, never by MCP
+ * clients. Lifecycle keeps the existing drain/audit/cleanup transaction. */
+export interface BrokerBrowserCustody {
+    acquire(options: {
+        profileDir?: string;
+        proxyUrl?: string;
+    }): Promise<{
+        browser: BrowserController;
+        profileDir: string;
+    }>;
+    cleanupAdmission(sessionId: string): Promise<boolean>;
+    orphanAdmission(sessionId: string): Promise<void>;
+    orphan(browser: BrowserController): Promise<void>;
+    release(browser: BrowserController): Promise<void>;
+    identity<T>(operation: () => Promise<T>): Promise<T>;
+}
+export declare function installBrokerBrowserCustody(value: BrokerBrowserCustody): void;
+export declare function brokerBrowserCustody(): BrokerBrowserCustody | undefined;
+//# sourceMappingURL=custody.d.ts.map

package/dist/bot/broker/custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custody.d.ts","sourceRoot":"","sources":["../../../src/bot/broker/custody.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;4EAC4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,OAAO,EAAE;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,iBAAiB,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACtD;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAG7E;AACD,wBAAgB,oBAAoB,IAAI,oBAAoB,GAAG,SAAS,CAEvE"}

package/dist/bot/broker/custody.js

@@ -0,0 +1,10 @@
+let custody;
+export function installBrokerBrowserCustody(value) {
+    if (custody !== undefined)
+        throw new Error("Broker browser custody is already installed");
+    custody = value;
+}
+export function brokerBrowserCustody() {
+    return custody;
+}
+//# sourceMappingURL=custody.js.map

package/dist/bot/broker/custody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custody.js","sourceRoot":"","sources":["../../../src/bot/broker/custody.ts"],"names":[],"mappings":"AAeA,IAAI,OAAyC,CAAC;AAC9C,MAAM,UAAU,2BAA2B,CAAC,KAA2B;IACrE,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1F,OAAO,GAAG,KAAK,CAAC;AAClB,CAAC;AACD,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/bot/broker/daemon.d.ts

@@ -0,0 +1,24 @@
+export declare function brokerDrainAllowsMethod(method: string): boolean;
+export declare function brokerStartupAllowsMethod(retainedCustody: boolean, method: string): boolean;
+export declare function brokerShutdownCleanupComplete(inventory: {
+    active: number;
+    quarantined: number;
+    admitting: number;
+}, closeRuntime: () => Promise<boolean>, timeoutMs?: number): Promise<boolean>;
+export declare function brokerIdleTimeoutMs(env?: NodeJS.ProcessEnv): number | undefined;
+export declare function brokerIdleShutdownEligible(input: {
+    closing: boolean;
+    draining: boolean;
+    connectedClients: number;
+    idleTimeout: number | undefined;
+    inventory: {
+        active: number;
+        quarantined: number;
+        admitting: number;
+    };
+    hasReconnectGrace: boolean;
+}): boolean;
+/** Explicit foreground service entrypoint. A supervisor may retain the broker;
+ * ordinary clients cannot stop it while another connection owns sessions. */
+export declare function runBrokerDaemon(): Promise<void>;
+//# sourceMappingURL=daemon.d.ts.map

package/dist/bot/broker/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/bot/broker/daemon.ts"],"names":[],"mappings":"AA8BA,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,yBAAyB,CAAC,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3F;AAED,wBAAsB,6BAA6B,CACjD,SAAS,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACrE,YAAY,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EACpC,SAAS,SAA0C,GAClD,OAAO,CAAC,OAAO,CAAC,CAclB;AAmCD,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAM5F;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAWV;AAED;6EAC6E;AAC7E,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CA8SrD"}

package/dist/bot/broker/daemon.js

@@ -0,0 +1,371 @@
+import { brokerElectionRoot, brokerIsSupervised, publishEndpointOwner } from "./discovery.js";
+import { DispatchJournal } from "./dispatch-journal.js";
+import { lstat, unlink, mkdir } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
+import { createSessionGuard, setServingAccountId } from "../../session-guard.js";
+import { setSelfManagedChromeTerminationSignalExitEnabled } from "../browser.js";
+import { startOwnerProcessReaper } from "../owner-process-reaper.js";
+import { acquireProfileOperationGuard, ProfileBusyError, profilePathIdentity, CHROME_PROFILE_DIR, waitForProfileFree, } from "../profile.js";
+import { installBrokerBrowserCustody } from "./custody.js";
+import { BrokerRuntime } from "./runtime.js";
+import { OperatorBroker } from "./operator.js";
+import { BrokerRefusal } from "./scheduler.js";
+import { BrokerClient, listenBroker } from "./transport.js";
+const MIN_BROKER_IDLE_TIMEOUT_MS = 60_000;
+const DEFAULT_BROKER_IDLE_TIMEOUT_MS = 5 * 60_000;
+const DEFAULT_BROKER_DRAIN_CLEANUP_TIMEOUT_MS = 3_000;
+const SUPERVISOR_ATTACH_TIMEOUT_MS = 10_000;
+const SUPERVISOR_ATTACH_POLL_MS = 100;
+const DRAIN_RECOVERY_METHODS = new Set(["recover", "reclaim", "acknowledge", "confirm_start"]);
+const STARTUP_RECONCILIATION_METHODS = new Set(["recover", "reclaim"]);
+export function brokerDrainAllowsMethod(method) {
+    return DRAIN_RECOVERY_METHODS.has(method);
+}
+export function brokerStartupAllowsMethod(retainedCustody, method) {
+    return !retainedCustody || STARTUP_RECONCILIATION_METHODS.has(method);
+}
+export async function brokerShutdownCleanupComplete(inventory, closeRuntime, timeoutMs = DEFAULT_BROKER_DRAIN_CLEANUP_TIMEOUT_MS) {
+    if (inventory.active !== 0 || inventory.quarantined !== 0 || inventory.admitting !== 0)
+        return false;
+    let timer;
+    try {
+        return await Promise.race([
+            closeRuntime().catch(() => false),
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(false), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+function brokerUnavailable(error) {
+    const code = error.code;
+    return (code === "ENOENT" || code === "ECONNREFUSED" || error.code === "broker_lost");
+}
+async function attachSupervisor(path, token) {
+    let client;
+    try {
+        client = await BrokerClient.connectSupervisor(path, token);
+        await client.call("supervise", {});
+        return true;
+    }
+    catch (error) {
+        if (brokerUnavailable(error))
+            return false;
+        throw error;
+    }
+    finally {
+        await client?.close().catch(() => undefined);
+    }
+}
+async function waitForSupervisorAttachment(path, token) {
+    const deadline = Date.now() + SUPERVISOR_ATTACH_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        if (await attachSupervisor(path, token))
+            return;
+        await new Promise((resolve) => setTimeout(resolve, SUPERVISOR_ATTACH_POLL_MS));
+    }
+    throw new BrokerRefusal("broker_unavailable", "Supervised broker did not become available within 10 seconds");
+}
+export function brokerIdleTimeoutMs(env = process.env) {
+    if (["1", "true"].includes((env.TRUSTY_SQUIRE_BROKER_SUPERVISED ?? "").toLowerCase()))
+        return undefined;
+    const configured = Number(env.TRUSTY_SQUIRE_BROKER_IDLE_TIMEOUT_MS);
+    if (!Number.isFinite(configured) || configured <= 0)
+        return DEFAULT_BROKER_IDLE_TIMEOUT_MS;
+    return Math.max(MIN_BROKER_IDLE_TIMEOUT_MS, configured);
+}
+export function brokerIdleShutdownEligible(input) {
+    return (!input.closing &&
+        !input.draining &&
+        input.connectedClients === 0 &&
+        input.idleTimeout !== undefined &&
+        !input.hasReconnectGrace &&
+        input.inventory.active === 0 &&
+        input.inventory.quarantined === 0 &&
+        input.inventory.admitting === 0);
+}
+/** Explicit foreground service entrypoint. A supervisor may retain the broker;
+ * ordinary clients cannot stop it while another connection owns sessions. */
+export async function runBrokerDaemon() {
+    const path = process.env.TRUSTY_SQUIRE_BROKER_SOCKET;
+    if (path === undefined)
+        throw new Error("TRUSTY_SQUIRE_BROKER_SOCKET must name a private local socket");
+    const parent = await lstat(dirname(path));
+    if (!parent.isDirectory() || (parent.mode & 0o077) !== 0 || parent.uid !== process.getuid?.()) {
+        throw new Error("Broker socket directory must be owned by this user with mode 0700");
+    }
+    const guard = createSessionGuard();
+    const session = await guard.bind();
+    if (session?.account_id === undefined || session.agent_session_token === undefined)
+        throw new Error("Broker requires an enrolled account; run connect first");
+    setServingAccountId(session.account_id);
+    const cellId = createHash("sha256")
+        .update(JSON.stringify([session.account_id, profilePathIdentity(CHROME_PROFILE_DIR)]))
+        .digest("hex");
+    const supervised = brokerIsSupervised();
+    const electionRoot = brokerElectionRoot(CHROME_PROFILE_DIR);
+    await mkdir(electionRoot, { recursive: true, mode: 0o700 });
+    let election;
+    if (supervised) {
+        try {
+            election = acquireProfileOperationGuard(CHROME_PROFILE_DIR, electionRoot);
+        }
+        catch (error) {
+            if (!(error instanceof ProfileBusyError))
+                throw error;
+            await waitForSupervisorAttachment(path, session.agent_session_token);
+            return;
+        }
+    }
+    const runtime = new BrokerRuntime(session.account_id);
+    installBrokerBrowserCustody(runtime);
+    setSelfManagedChromeTerminationSignalExitEnabled(false);
+    startOwnerProcessReaper();
+    // Broker election is anchored beside the canonical profile, independent of
+    // each client's socket path or TMPDIR. Retain it through plain-login maintenance.
+    const profileElection = election ?? acquireProfileOperationGuard(CHROME_PROFILE_DIR, electionRoot);
+    runtime.claimProfile();
+    const journal = new DispatchJournal(join(profilePathIdentity(CHROME_PROFILE_DIR), "trusty-squire-broker-dispatch.jsonl"));
+    await journal.expirePendingStartDeliveries();
+    const retainedXataPreDispatchAuthorization = await journal.retainedXataPreDispatchAuthorization();
+    // A retained `entered` record must not launch/adopt a browser, but the
+    // broker endpoint has to exist so an explicit durable recovery can repair
+    // it. Parsing states here still fails startup on a malformed journal.
+    let startupReconciliation = retainedXataPreDispatchAuthorization !== undefined &&
+        (await journal.hasOnlyAuthorizedPreDispatchFailure(retainedXataPreDispatchAuthorization));
+    if (!startupReconciliation)
+        await journal.assertReconciled();
+    const operator = new OperatorBroker({
+        accountId: session.account_id,
+        agentSessionToken: session.agent_session_token,
+        apiBaseUrl: session.api_base_url,
+        registryBaseUrl: process.env.ADAPTER_REGISTRY_URL ?? "https://registry.trustysquire.ai",
+    }, cellId, journal, retainedXataPreDispatchAuthorization);
+    const connected = new Set();
+    let closing = false;
+    let draining = false;
+    let listenerClosed = false;
+    let cleanupRunning = false;
+    let maintenanceOwner;
+    let maintenanceReady = false;
+    let idleTimer;
+    let runtimeClose;
+    let idleTimeout = brokerIdleTimeoutMs();
+    const closeRuntime = () => {
+        if (runtimeClose === undefined) {
+            runtimeClose = runtime.close().finally(() => {
+                runtimeClose = undefined;
+            });
+        }
+        return runtimeClose;
+    };
+    const restoreMaintenance = async () => {
+        const refreshed = await guard.bind();
+        if (refreshed === null)
+            throw new Error("Enrolled account session is missing");
+        operator.refreshCredentials(refreshed);
+        runtime.resume();
+        runtime.claimProfile();
+        operator.authority.rotateEpoch();
+        maintenanceOwner = undefined;
+        maintenanceReady = false;
+    };
+    const listener = await listenBroker(path, {
+        authenticate: async (token, agentId, lineageCredential, supervisor) => await operator.authenticate(token, agentId, lineageCredential, supervisor),
+        connected: async (principal) => {
+            await operator.connected(principal);
+            connected.add(principal.clientId);
+            if (idleTimer !== undefined)
+                clearTimeout(idleTimer);
+        },
+        call: async (principal, method, params, id) => {
+            connected.add(principal.clientId);
+            if (idleTimer !== undefined)
+                clearTimeout(idleTimer);
+            if (closing || (draining && !brokerDrainAllowsMethod(method)))
+                throw new BrokerRefusal("broker_draining", "Broker is draining; only durable recovery is available");
+            if (principal.supervisor && method !== "supervise")
+                throw new BrokerRefusal("unauthorized", "Supervisor connections may only supervise");
+            const report = await guard.inspect();
+            if (report.problem !== null)
+                throw new Error(report.problem.message);
+            if (runtime.browserLost() && method === "reclaim")
+                throw new BrokerRefusal("browser_lost", "Browser transport is lost; the pending start cannot be recovered");
+            if (method === "supervise") {
+                if (!principal.supervisor)
+                    throw new BrokerRefusal("unauthorized", "Supervisor identity is required");
+                idleTimeout = undefined;
+                return { state: "supervised" };
+            }
+            if (method === "recover") {
+                const result = await operator.recover(principal, params);
+                if (startupReconciliation && retainedXataPreDispatchAuthorization !== undefined)
+                    startupReconciliation = await journal.hasOnlyAuthorizedPreDispatchFailure(retainedXataPreDispatchAuthorization);
+                return result;
+            }
+            if (!brokerStartupAllowsMethod(startupReconciliation, method))
+                throw new BrokerRefusal("outcome_unknown", "Prior broker lost mutation custody; only explicit reconciliation is available");
+            if (method === "reclaim")
+                return await operator.reclaim(principal);
+            if (method === "acknowledge") {
+                if (typeof params.requestId !== "string")
+                    throw new Error("A broker acknowledgement requires its request ID");
+                await operator.acknowledge(principal, params.requestId);
+                return {};
+            }
+            if (method === "confirm_start") {
+                await operator.confirmStartDelivery(principal, params);
+                return {};
+            }
+            if ((await journal.hasOutstanding(undefined, principal.forwarderId)) &&
+                !(method === "tool" && (await operator.canContinuePaymentStatus(principal, params))))
+                throw new BrokerRefusal("outcome_unknown", "Prior mutation outcome awaits reconciliation; reconnect without replaying it");
+            if (method === "maintenance") {
+                if (maintenanceOwner !== undefined && maintenanceOwner !== principal.clientId)
+                    throw new Error("Identity maintenance is already owned");
+                maintenanceOwner = principal.clientId;
+                const inventory = operator.authority.inventory();
+                const ready = inventory.active === 0 &&
+                    inventory.quarantined === 0 &&
+                    inventory.admitting === 0 &&
+                    (await runtime.close());
+                maintenanceReady = ready;
+                return { state: ready ? "ready" : "draining", ...inventory };
+            }
+            if (method === "resume") {
+                if (maintenanceOwner !== principal.clientId)
+                    throw new Error("Identity maintenance is not owned by this client");
+                if (!(await waitForProfileFree(CHROME_PROFILE_DIR, { deadlineMs: 0 })))
+                    throw new Error("Plain login browser is still open");
+                await restoreMaintenance();
+                return { state: "resumed" };
+            }
+            if (maintenanceOwner !== undefined &&
+                (params.name === "operate_start" ||
+                    (params.name === "operate_recipe_run" &&
+                        params.args?.session_id === undefined)))
+                throw new Error("Identity maintenance is draining; retry after connect completes");
+            if (runtime.browserLost()) {
+                operator.authority.fenceRuntime();
+                await operator.reap();
+                const inventory = operator.authority.inventory();
+                if (inventory.active === 0 && inventory.quarantined === 0 && inventory.admitting === 0) {
+                    await journal.assertReconciled();
+                    if (!(await runtime.close()))
+                        throw new Error("Old browser cleanup is not proven");
+                    runtime.resume();
+                    runtime.claimProfile();
+                    operator.authority.rotateEpoch();
+                }
+                else
+                    throw new Error("browser_lost: old session outcomes remain in custody; do not replay mutations");
+            }
+            return await operator.call(principal, method, params, id);
+        },
+        disconnect: async (principal, explicit) => {
+            await operator.disconnect(principal, explicit);
+            connected.delete(principal.clientId);
+            if (maintenanceOwner === principal.clientId && !maintenanceReady)
+                maintenanceOwner = undefined;
+            if (maintenanceOwner === principal.clientId &&
+                (await waitForProfileFree(CHROME_PROFILE_DIR, { deadlineMs: 0 })))
+                await restoreMaintenance();
+            scheduleShutdownIfIdle();
+        },
+    });
+    await publishEndpointOwner(path);
+    function scheduleShutdownIfIdle() {
+        if (idleTimer !== undefined)
+            clearTimeout(idleTimer);
+        idleTimer = undefined;
+        if (!brokerIdleShutdownEligible({
+            closing,
+            draining,
+            connectedClients: connected.size,
+            idleTimeout,
+            inventory: operator.authority.inventory(),
+            hasReconnectGrace: operator.authority.hasReconnectGrace(),
+        }))
+            return;
+        idleTimer = setTimeout(() => {
+            idleTimer = undefined;
+            void shutdown();
+        }, idleTimeout);
+        idleTimer.unref();
+    }
+    const shutdown = async (explicitDrain = false) => {
+        if (closing ||
+            (!explicitDrain &&
+                !brokerIdleShutdownEligible({
+                    closing,
+                    draining,
+                    connectedClients: connected.size,
+                    idleTimeout,
+                    inventory: operator.authority.inventory(),
+                    hasReconnectGrace: operator.authority.hasReconnectGrace(),
+                })))
+            return;
+        draining = true;
+        if (idleTimer !== undefined)
+            clearTimeout(idleTimer);
+        if (!(await brokerShutdownCleanupComplete(operator.authority.inventory(), closeRuntime))) {
+            process.stderr.write("[browser-broker] cleanup unproven; retaining physical custody\n");
+            return;
+        }
+        closing = true;
+        if (!listenerClosed) {
+            listenerClosed = true;
+            await listener.close();
+        }
+        await unlink(`${path}.owner.json`).catch(() => undefined);
+        profileElection.release();
+        process.exit(0);
+    };
+    const requestDrain = async () => {
+        draining = true;
+        if (idleTimer !== undefined)
+            clearTimeout(idleTimer);
+        await operator.reap(Number.POSITIVE_INFINITY);
+        await shutdown(true);
+    };
+    const reap = setInterval(() => {
+        if (cleanupRunning)
+            return;
+        cleanupRunning = true;
+        void operator
+            .reap()
+            .then(async () => {
+            if (maintenanceOwner !== undefined &&
+                !connected.has(maintenanceOwner) &&
+                maintenanceReady &&
+                (await waitForProfileFree(CHROME_PROFILE_DIR, { deadlineMs: 0 }))) {
+                await restoreMaintenance();
+            }
+            if (draining)
+                await shutdown(true);
+            else if (connected.size === 0 && idleTimeout !== undefined && idleTimer === undefined)
+                scheduleShutdownIfIdle();
+        })
+            .catch((error) => {
+            process.stderr.write(`[browser-broker] cleanup retained: ${error instanceof Error ? error.message : String(error)}\n`);
+        })
+            .finally(() => {
+            cleanupRunning = false;
+        });
+    }, 5000);
+    // This timer keeps quarantined payment/outcome custody alive after sockets close.
+    process.once("SIGINT", () => {
+        void requestDrain();
+    });
+    process.once("SIGTERM", () => {
+        void requestDrain();
+    });
+    process.once("exit", () => clearInterval(reap));
+    process.stderr.write(`[browser-broker] listening cell=${cellId} pid=${process.pid}\n`);
+}
+//# sourceMappingURL=daemon.js.map

package/dist/bot/broker/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../../src/bot/broker/daemon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,gDAAgD,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAElB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE5D,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,8BAA8B,GAAG,CAAC,GAAG,MAAM,CAAC;AAClD,MAAM,uCAAuC,GAAG,KAAK,CAAC;AACtD,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAC5C,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;AAC/F,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,eAAwB,EAAE,MAAc;IAChF,OAAO,CAAC,eAAe,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAqE,EACrE,YAAoC,EACpC,SAAS,GAAG,uCAAuC;IAEnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,WAAW,KAAK,CAAC,IAAI,SAAS,CAAC,SAAS,KAAK,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACjC,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,EAAE;gBAC7B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;YACtD,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;IACnD,OAAO,CACL,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAK,KAAuB,CAAC,IAAI,KAAK,aAAa,CAChG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACzD,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,IAAY,EAAE,KAAa;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,4BAA4B,CAAC;IAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO;QAChD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,8DAA8D,CAC/D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAC3F,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAO1C;IACC,OAAO,CACL,CAAC,KAAK,CAAC,OAAO;QACd,CAAC,KAAK,CAAC,QAAQ;QACf,KAAK,CAAC,gBAAgB,KAAK,CAAC;QAC5B,KAAK,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,KAAK,CAAC,iBAAiB;QACxB,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,CAAC;QACjC,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS;QACpB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,OAAO,EAAE,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS;QAChF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;SACrF,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,IAAI,QAA2C,CAAC;IAChD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,QAAQ,GAAG,4BAA4B,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,gBAAgB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACtD,MAAM,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrC,gDAAgD,CAAC,KAAK,CAAC,CAAC;IACxD,uBAAuB,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,kFAAkF;IAClF,MAAM,eAAe,GACnB,QAAQ,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC7E,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,eAAe,CACjC,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,qCAAqC,CAAC,CACrF,CAAC;IACF,MAAM,OAAO,CAAC,4BAA4B,EAAE,CAAC;IAC7C,MAAM,oCAAoC,GAAG,MAAM,OAAO,CAAC,oCAAoC,EAAE,CAAC;IAClG,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,qBAAqB,GACvB,oCAAoC,KAAK,SAAS;QAClD,CAAC,MAAM,OAAO,CAAC,mCAAmC,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,qBAAqB;QAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC;QACE,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,iBAAiB,EAAE,OAAO,CAAC,mBAAmB;QAC9C,UAAU,EAAE,OAAO,CAAC,YAAY;QAChC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,kCAAkC;KACxF,EACD,MAAM,EACN,OAAO,EACP,oCAAoC,CACrC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,gBAAoC,CAAC;IACzC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,SAAqC,CAAC;IAC1C,IAAI,YAA0C,CAAC;IAC/C,IAAI,WAAW,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,GAAqB,EAAE;QAC1C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1C,YAAY,GAAG,SAAS,CAAC;YAC3B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,kBAAkB,GAAG,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,SAAS,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC/E,QAAQ,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,YAAY,EAAE,CAAC;QACvB,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACjC,gBAAgB,GAAG,SAAS,CAAC;QAC7B,gBAAgB,GAAG,KAAK,CAAC;IAC3B,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE;QACxC,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,CACpE,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,CAAC;QAC5E,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC7B,MAAM,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACpC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,SAAS,KAAK,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;YAC5C,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,SAAS,KAAK,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBAC3D,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;YACJ,IAAI,SAAS,CAAC,UAAU,IAAI,MAAM,KAAK,WAAW;gBAChD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2CAA2C,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrE,IAAI,OAAO,CAAC,WAAW,EAAE,IAAI,MAAM,KAAK,SAAS;gBAC/C,MAAM,IAAI,aAAa,CACrB,cAAc,EACd,kEAAkE,CACnE,CAAC;YACJ,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,IAAI,CAAC,SAAS,CAAC,UAAU;oBACvB,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;gBAC7E,WAAW,GAAG,SAAS,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;YACjC,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACzD,IAAI,qBAAqB,IAAI,oCAAoC,KAAK,SAAS;oBAC7E,qBAAqB,GAAG,MAAM,OAAO,CAAC,mCAAmC,CACvE,oCAAoC,CACrC,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,EAAE,MAAM,CAAC;gBAC3D,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,+EAA+E,CAChF,CAAC;YACJ,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;gBAC7B,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;oBACtC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,MAAM,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBACxD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;gBAC/B,MAAM,QAAQ,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACvD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IACE,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;gBAChE,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;gBAEpF,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,8EAA8E,CAC/E,CAAC;YACJ,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;gBAC7B,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,CAAC,QAAQ;oBAC3E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC;gBACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;gBACjD,MAAM,KAAK,GACT,SAAS,CAAC,MAAM,KAAK,CAAC;oBACtB,SAAS,CAAC,WAAW,KAAK,CAAC;oBAC3B,SAAS,CAAC,SAAS,KAAK,CAAC;oBACzB,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1B,gBAAgB,GAAG,KAAK,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;YAC/D,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,gBAAgB,KAAK,SAAS,CAAC,QAAQ;oBACzC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;oBACpE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvD,MAAM,kBAAkB,EAAE,CAAC;gBAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,IACE,gBAAgB,KAAK,SAAS;gBAC9B,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe;oBAC9B,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB;wBAClC,MAAM,CAAC,IAA4C,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC;gBAEpF,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACrF,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;gBAClC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;gBACjD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,WAAW,KAAK,CAAC,IAAI,SAAS,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;oBACvF,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBACjC,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;oBACnF,OAAO,CAAC,MAAM,EAAE,CAAC;oBACjB,OAAO,CAAC,YAAY,EAAE,CAAC;oBACvB,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;gBACnC,CAAC;;oBACC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;YACN,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC/C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,gBAAgB,KAAK,SAAS,CAAC,QAAQ,IAAI,CAAC,gBAAgB;gBAC9D,gBAAgB,GAAG,SAAS,CAAC;YAC/B,IACE,gBAAgB,KAAK,SAAS,CAAC,QAAQ;gBACvC,CAAC,MAAM,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;gBAEjE,MAAM,kBAAkB,EAAE,CAAC;YAC7B,sBAAsB,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;IACH,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjC,SAAS,sBAAsB;QAC7B,IAAI,SAAS,KAAK,SAAS;YAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QACrD,SAAS,GAAG,SAAS,CAAC;QACtB,IACE,CAAC,0BAA0B,CAAC;YAC1B,OAAO;YACP,QAAQ;YACR,gBAAgB,EAAE,SAAS,CAAC,IAAI;YAChC,WAAW;YACX,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE;YACzC,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE;SAC1D,CAAC;YAEF,OAAO;QACT,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,SAAS,GAAG,SAAS,CAAC;YACtB,KAAK,QAAQ,EAAE,CAAC;QAClB,CAAC,EAAE,WAAW,CAAC,CAAC;QAChB,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,EAAE,aAAa,GAAG,KAAK,EAAE,EAAE;QAC/C,IACE,OAAO;YACP,CAAC,CAAC,aAAa;gBACb,CAAC,0BAA0B,CAAC;oBAC1B,OAAO;oBACP,QAAQ;oBACR,gBAAgB,EAAE,SAAS,CAAC,IAAI;oBAChC,WAAW;oBACX,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE;oBACzC,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE;iBAC1D,CAAC,CAAC;YAEL,OAAO;QACT,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,SAAS,KAAK,SAAS;YAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,MAAM,6BAA6B,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,IAAI,CAAC;YACtB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1D,eAAe,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;QAC9B,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,SAAS,KAAK,SAAS;YAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC9C,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5B,IAAI,cAAc;YAAE,OAAO;QAC3B,cAAc,GAAG,IAAI,CAAC;QACtB,KAAK,QAAQ;aACV,IAAI,EAAE;aACN,IAAI,CAAC,KAAK,IAAI,EAAE;YACf,IACE,gBAAgB,KAAK,SAAS;gBAC9B,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAChC,gBAAgB;gBAChB,CAAC,MAAM,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,EACjE,CAAC;gBACD,MAAM,kBAAkB,EAAE,CAAC;YAC7B,CAAC;YACD,IAAI,QAAQ;gBAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;iBAC9B,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,WAAW,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;gBACnF,sBAAsB,EAAE,CAAC;QAC7B,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACjG,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,KAAK,CAAC;QACzB,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,IAAI,CAAC,CAAC;IACT,kFAAkF;IAClF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC1B,KAAK,YAAY,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;QAC3B,KAAK,YAAY,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,MAAM,QAAQ,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACzF,CAAC"}

package/dist/bot/broker/discovery.d.ts

@@ -0,0 +1,9 @@
+import { BrokerClient } from "./transport.js";
+export declare function brokerElectionRoot(profileDir?: string): string;
+export declare function brokerLaunchRoot(profileDir?: string): string;
+export declare function brokerEnvironment(env: NodeJS.ProcessEnv, path: string): NodeJS.ProcessEnv;
+export declare function brokerIsSupervised(env?: NodeJS.ProcessEnv): boolean;
+export declare function publishEndpointOwner(path: string): Promise<void>;
+export declare function reclaimDeadBrokerEndpoint(path: string): Promise<void>;
+export declare function connectOrLaunchBroker(path: string, token: string, lineageCredential?: string): Promise<BrokerClient>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/bot/broker/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/bot/broker/discovery.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAc9C,wBAAgB,kBAAkB,CAAC,UAAU,SAAqB,GAAG,MAAM,CAE1E;AAED,wBAAgB,gBAAgB,CAAC,UAAU,SAAqB,GAAG,MAAM,CAExE;AAgDD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAIzF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEhF;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBtE;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC3E;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,YAAY,CAAC,CA6DvB"}

package/dist/bot/broker/discovery.js

@@ -0,0 +1,167 @@
+import { spawn } from "node:child_process";
+import { lstat, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { acquireProfileOperationGuard, ProfileBusyError, processBirthIdentity, processBirthIdentityState, profilePathIdentity, CHROME_PROFILE_DIR, waitForProfileFree, } from "../profile.js";
+import { BrokerClient } from "./transport.js";
+import { BrokerRefusal } from "./scheduler.js";
+const BROKER_CONNECT_TIMEOUT_MS = 10_000;
+const BROKER_CONNECT_POLL_MS = 100;
+export function brokerElectionRoot(profileDir = CHROME_PROFILE_DIR) {
+    return join(dirname(profilePathIdentity(profileDir)), ".trusty-squire-broker-leases");
+}
+export function brokerLaunchRoot(profileDir = CHROME_PROFILE_DIR) {
+    return join(brokerElectionRoot(profileDir), "launch");
+}
+async function prepareBrokerElectionRoot(profileDir) {
+    const root = brokerElectionRoot(profileDir);
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    return root;
+}
+async function brokerElectionIsHeld(profileDir) {
+    const root = await prepareBrokerElectionRoot(profileDir);
+    try {
+        const lease = acquireProfileOperationGuard(profileDir, root);
+        lease.release();
+        return false;
+    }
+    catch (error) {
+        if (error instanceof ProfileBusyError)
+            return true;
+        throw error;
+    }
+}
+function isUnavailable(error) {
+    const code = error.code;
+    return code === "ENOENT" || code === "ECONNREFUSED";
+}
+async function waitForBroker(path, token, lineageCredential, failure) {
+    const deadline = Date.now() + BROKER_CONNECT_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        const launchFailure = failure?.();
+        if (launchFailure !== undefined)
+            throw launchFailure;
+        try {
+            return await BrokerClient.connect(path, token, lineageCredential);
+        }
+        catch (error) {
+            if (!isUnavailable(error))
+                throw error;
+        }
+        await new Promise((resolve) => setTimeout(resolve, BROKER_CONNECT_POLL_MS));
+    }
+    throw new BrokerRefusal("broker_unavailable", "Broker did not become available within 10 seconds; no operator command was dispatched");
+}
+export function brokerEnvironment(env, path) {
+    const brokerEnv = { ...env };
+    delete brokerEnv.TRUSTY_SQUIRE_FORWARDER_CREDENTIAL;
+    return { ...brokerEnv, TRUSTY_SQUIRE_BROKER_SOCKET: path };
+}
+export function brokerIsSupervised(env = process.env) {
+    return ["1", "true"].includes((env.TRUSTY_SQUIRE_BROKER_SUPERVISED ?? "").toLowerCase());
+}
+export async function publishEndpointOwner(path) {
+    const identity = processBirthIdentity(process.pid);
+    if (identity === null)
+        throw new BrokerRefusal("ownership_unknown", "Cannot establish broker process birth identity");
+    const socket = await lstat(path);
+    await writeFile(`${path}.owner.json`, JSON.stringify({
+        version: 1,
+        ...identity,
+        profileDir: profilePathIdentity(CHROME_PROFILE_DIR),
+        inode: socket.ino,
+        device: socket.dev,
+    }), { mode: 0o600, flag: "wx" });
+}
+export async function reclaimDeadBrokerEndpoint(path) {
+    let owner;
+    try {
+        owner = JSON.parse(await readFile(`${path}.owner.json`, "utf8"));
+    }
+    catch {
+        throw new BrokerRefusal("broker_unavailable", "Endpoint ownership is unknown; refusing to remove it");
+    }
+    const profileDir = profilePathIdentity(CHROME_PROFILE_DIR);
+    if (owner.version !== 1 ||
+        !Number.isSafeInteger(owner.pid) ||
+        typeof owner.start_time !== "string" ||
+        owner.profileDir !== profileDir ||
+        processBirthIdentityState(owner) !== "stale") {
+        throw new BrokerRefusal("broker_unavailable", "Endpoint belongs to a live or unproven broker");
+    }
+    const lease = acquireProfileOperationGuard(profileDir, await prepareBrokerElectionRoot(profileDir));
+    try {
+        if (!(await waitForProfileFree(profileDir, { deadlineMs: 0 })))
+            throw new BrokerRefusal("profile_busy", "Old browser is still being reaped");
+        const socket = await lstat(path).catch(() => null);
+        const latest = await readFile(`${path}.owner.json`, "utf8");
+        if (JSON.stringify(JSON.parse(latest)) !== JSON.stringify(owner))
+            throw new BrokerRefusal("broker_unavailable", "Endpoint ownership changed");
+        if (socket !== null && (socket.ino !== owner.inode || socket.dev !== owner.device))
+            throw new BrokerRefusal("broker_unavailable", "Endpoint was replaced");
+        if (socket !== null)
+            await unlink(path);
+        await unlink(`${path}.owner.json`);
+    }
+    finally {
+        lease.release();
+    }
+}
+export async function connectOrLaunchBroker(path, token, lineageCredential) {
+    try {
+        return await BrokerClient.connect(path, token, lineageCredential);
+    }
+    catch (error) {
+        const code = error.code;
+        if (!isUnavailable(error))
+            throw error;
+        if (brokerIsSupervised())
+            throw new BrokerRefusal("broker_unavailable", "Supervised broker is unavailable; refusing to create a competing browser owner");
+        if (code === "ECONNREFUSED")
+            await reclaimDeadBrokerEndpoint(path);
+        // A cleanly stopped broker removes its socket but may have left its owner
+        // record if interrupted during final unlink. Reclaim only with birth proof.
+        else if (await lstat(`${path}.owner.json`).then(() => true, () => false))
+            await reclaimDeadBrokerEndpoint(path);
+    }
+    const profileDir = profilePathIdentity(CHROME_PROFILE_DIR);
+    if (await brokerElectionIsHeld(profileDir))
+        return await waitForBroker(path, token, lineageCredential);
+    let launchLease;
+    try {
+        const launchRoot = brokerLaunchRoot(profileDir);
+        await mkdir(launchRoot, { recursive: true, mode: 0o700 });
+        launchLease = acquireProfileOperationGuard(profileDir, launchRoot);
+    }
+    catch (error) {
+        if (error instanceof ProfileBusyError)
+            return await waitForBroker(path, token, lineageCredential);
+        throw error;
+    }
+    try {
+        try {
+            return await BrokerClient.connect(path, token, lineageCredential);
+        }
+        catch (error) {
+            if (!isUnavailable(error))
+                throw error;
+        }
+        if (await brokerElectionIsHeld(profileDir))
+            return await waitForBroker(path, token, lineageCredential);
+        const child = spawn(process.execPath, [fileURLToPath(new URL("../../bin.js", import.meta.url)), "broker"], {
+            detached: true,
+            stdio: "ignore",
+            env: brokerEnvironment(process.env, path),
+        });
+        let failure;
+        child.once("error", (error) => {
+            failure = error;
+        });
+        child.unref();
+        return await waitForBroker(path, token, lineageCredential, () => failure);
+    }
+    finally {
+        launchLease.release();
+    }
+}
+//# sourceMappingURL=discovery.js.map