botmux 3.10.0 → 3.11.0

package/dist/core/managed-origin-capability.d.ts

@@ -1,9 +1,14 @@
 export declare const RELAY_ORIGIN_CAPABILITY_BASENAME = ".botmux-origin-capability.json";
+export declare const MANAGED_ORIGIN_ISOLATION_MARKER_BASENAME = ".botmux-read-isolated-v1";
+export declare const MANAGED_ORIGIN_ISOLATION_SENTINEL_BASENAME = ".botmux-read-isolation-sentinel-v1";
 export interface ManagedOriginCapabilityClaim {
     sessionId: string;
+    channelId?: string;
     capability: string;
     turnId?: string;
     dispatchAttempt?: number;
+    /** Current daemon port, host-written on every capability rotation. */
+    ipcPort?: number;
 }
 /**
  * Per-session path used by macOS read-isolated CLIs to read only their own
@@ -12,7 +17,56 @@ export interface ManagedOriginCapabilityClaim {
  * The parent is denied wholesale by the Seatbelt profile; only this exact file
  * is carved back in for the owning session.
  */
-export declare function managedOriginCapabilityPath(dataDir: string, sessionId: string): string;
+export declare function managedOriginCapabilityPath(dataDir: string, sessionId: string, channelId: string): string;
+/** Host-written, child-read-only proof directory for live daemon attestation. */
+export declare function managedOriginAttestationDirectory(dataDir: string, sessionId: string, channelId: string): string;
+export declare function managedOriginAttestationProofPath(dataDir: string, sessionId: string, channelId: string, nonce: string): string;
+export declare function managedOriginIsolationMarkerPath(dataDir: string, sessionId: string, channelId: string): string;
+export declare function managedOriginIsolationSentinelPath(homeDir: string): string;
+export declare function ensureManagedOriginIsolationSentinel(homeDir: string): string;
+/** Fixed-OS-home locator whose basename is covered by the legacy
+ * `.dashboard-secret(?:\.|$)` read/write deny. New profiles carve only the
+ * exact current-session leaf back in for reads while the final write deny
+ * remains in force. This gives cmdSend a data-root binding independent of
+ * mutable HOME/SESSION_DATA_DIR. */
+export declare function managedOriginRootLocatorPath(osUserHomeDir: string, sessionId: string): string;
+export interface ManagedOriginRootLocator {
+    sessionId: string;
+    dataDir: string;
+}
+/** Probe placed inside the locator-selected data root's legacy-denied
+ * `read-isolation/` namespace, but outside every current exact carve-out. The
+ * exact directory location matters: a forged sibling dataDir must not inherit
+ * a parent-level dashboard-secret deny and masquerade as the real root. */
+export declare function managedOriginDataRootProbePath(dataDir: string, sessionId: string): string;
+export declare function ensureManagedOriginDataRootProbe(dataDir: string, sessionId: string): string;
+export declare function managedOriginDataRootProbeAccess(dataDir: string, sessionId: string): 'host_accessible' | 'sandbox_denied' | 'missing_or_unsafe';
+export declare function ensureManagedOriginRootLocator(osUserHomeDir: string, sessionId: string, dataDir: string): string;
+export declare function readManagedOriginRootLocator(osUserHomeDir: string, sessionId: string): ManagedOriginRootLocator | null;
+/** Kernel-observable macOS isolation classifier. The Seatbelt profile denies
+ * this fixed, host-readable sentinel independent of env/argv/session ids. */
+export declare function managedOriginIsolationSentinelAccess(homeDir: string): 'host_accessible' | 'sandbox_denied' | 'missing_or_unsafe';
+/** Kernel probe backed by an inode that legacy read-isolation profiles already
+ * denied: the dashboard HMAC secret. Only metadata is inspected; secret bytes
+ * are never read or returned. This closes the upgrade race where a stale
+ * pre-sentinel sandbox could replace a newly introduced probe path. */
+export declare function managedOriginLegacyIsolationProbeAccess(osUserHomeDir: string): 'host_accessible' | 'sandbox_denied' | 'missing_or_unsafe';
+/** Strict bounded reader for host-owned authority metadata. It never follows a
+ * leaf symlink and opens FIFOs/devices nonblocking before rejecting them by
+ * inode type, ownership, link count, mode, and size. */
+export declare function readManagedOriginAuthorityFile(filePath: string, maxBytes?: number): string | null;
+/** A durable, host-owned hint that this session was launched read-isolated.
+ * It is deliberately separate from the rotating capability so missing,
+ * corrupt, or revoked authority cannot silently downgrade `botmux send` to
+ * the ordinary direct path. The marker is only a fail-closed classification
+ * hint; the live daemon challenge remains the sole send authority. */
+export declare function hasManagedOriginIsolationMarker(dataDir: string, sessionId: string, channelId: string): boolean;
+/** Prepare the proof directory before Seatbelt canonicalizes its read carve. */
+export declare function ensureManagedOriginAttestationDirectory(dataDir: string, sessionId: string, channelId: string): string;
+/** Bounded owner-startup cleanup. Never call this from the unauthenticated
+ * request path: a prefilled legacy directory must not turn every challenge
+ * into an unbounded synchronous daemon scan. */
+export declare function sweepManagedOriginAttestationProofs(dataDir: string, sessionId: string, channelId: string, maxEntries?: number): void;
 /**
  * Atomically replace a capability file without following an attacker-planted
  * destination symlink. The generic atomic writer intentionally follows
@@ -20,18 +74,23 @@ export declare function managedOriginCapabilityPath(dataDir: string, sessionId:
  * contract so an isolated child cannot redirect the worker's next rotation.
  */
 export declare function replaceManagedOriginCapabilityFile(filePath: string, body: string): void;
+/** Prepare a stable capability pathname without ever overwriting a successor
+ * generation's regular file. Unsafe leaf types are removed by directory-entry
+ * unlink (no follow); a regular leaf is left untouched for the daemon-owned
+ * current-worker publication path. */
+export declare function ensureManagedOriginCapabilityLeafSafe(filePath: string): void;
 /**
  * Read the current origin claim from the per-session sandbox relay (Linux) or
  * the exact Seatbelt carve-out (macOS). A file is only transport: the daemon
  * still compares the token with its live worker registry, so stale files and
  * forged tuple fields never confer authority.
  */
-export declare function readManagedOriginCapability(dataDir: string, sessionId: string | undefined, relayDir?: string): ManagedOriginCapabilityClaim | null;
+export declare function readManagedOriginCapability(dataDir: string, sessionId: string | undefined, relayDir?: string, channelId?: string): ManagedOriginCapabilityClaim | null;
 /**
  * Verify that the child-visible capability transport contains the exact token
  * currently authorized by the worker. Existence alone is insufficient: a
  * writable relay can contain a stale token, malformed JSON, or even a directory
  * at the reserved path after a prior sandbox generation.
  */
-export declare function hasMatchingManagedOriginCapability(dataDir: string, sessionId: string | undefined, expectedCapability: string | undefined, relayDir?: string): boolean;
+export declare function hasMatchingManagedOriginCapability(dataDir: string, sessionId: string | undefined, expectedCapability: string | undefined, relayDir?: string, channelId?: string): boolean;
 //# sourceMappingURL=managed-origin-capability.d.ts.map

package/dist/core/managed-origin-capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-origin-capability.d.ts","sourceRoot":"","sources":["../../src/core/managed-origin-capability.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AAEjF,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGtF;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBvF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,CAAC,EAAE,MAAM,GAChB,4BAA4B,GAAG,IAAI,CAwCrC;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAIT"}
+{"version":3,"file":"managed-origin-capability.d.ts","sourceRoot":"","sources":["../../src/core/managed-origin-capability.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AACjF,eAAO,MAAM,wCAAwC,6BAA6B,CAAC;AACnF,eAAO,MAAM,0CAA0C,uCAAuC,CAAC;AAG/F,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAiBD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAGR;AAED,iFAAiF;AACjF,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAGR;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,MAAM,CAGR;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAKR;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAO5E;AAED;;;;oCAIoC;AACpC,wBAAgB,4BAA4B,CAC1C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,CAOR;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;2EAG2E;AAC3E,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAQR;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,iBAAiB,GAAG,gBAAgB,GAAG,mBAAmB,CAmC5D;AAED,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,MAAM,CAwBR;AAED,wBAAgB,4BAA4B,CAC1C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,wBAAwB,GAAG,IAAI,CAkBjC;AAED;6EAC6E;AAC7E,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,GACd,iBAAiB,GAAG,gBAAgB,GAAG,mBAAmB,CAqC5D;AAED;;;uEAGuE;AACvE,wBAAgB,uCAAuC,CACrD,aAAa,EAAE,MAAM,GACpB,iBAAiB,GAAG,gBAAgB,GAAG,mBAAmB,CAuB5D;AAED;;wDAEwD;AACxD,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAAW,GAClB,MAAM,GAAG,IAAI,CA2Bf;AAED;;;;sEAIsE;AACtE,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAkBT;AAED,gFAAgF;AAChF,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CA0CR;AAED;;gDAEgD;AAChD,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,SAAM,GACf,IAAI,CA4BN;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBvF;AAED;;;sCAGsC;AACtC,wBAAgB,qCAAqC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAa5E;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,4BAA4B,GAAG,IAAI,CAqDrC;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAIT"}

package/dist/core/managed-origin-capability.js

@@ -1,7 +1,23 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { chmodSync, closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, openSync, opendirSync, readSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
 export const RELAY_ORIGIN_CAPABILITY_BASENAME = '.botmux-origin-capability.json';
+export const MANAGED_ORIGIN_ISOLATION_MARKER_BASENAME = '.botmux-read-isolated-v1';
+export const MANAGED_ORIGIN_ISOLATION_SENTINEL_BASENAME = '.botmux-read-isolation-sentinel-v1';
+const MANAGED_ORIGIN_STALE_PROOF_MS = 60_000;
+function assertManagedOriginChannelId(channelId) {
+    if (!/^[a-f0-9]{64}$/.test(channelId)) {
+        throw new Error('invalid managed origin channel id');
+    }
+    return channelId;
+}
+function managedOriginChannelDigest(sessionId, channelId) {
+    return createHash('sha256')
+        .update(sessionId)
+        .update('\0')
+        .update(assertManagedOriginChannelId(channelId))
+        .digest('hex');
+}
 /**
  * Per-session path used by macOS read-isolated CLIs to read only their own
  * rotating daemon-IPC capability. Hashing keeps an untrusted session id out of
@@ -9,10 +25,369 @@ export const RELAY_ORIGIN_CAPABILITY_BASENAME = '.botmux-origin-capability.json'
  * The parent is denied wholesale by the Seatbelt profile; only this exact file
  * is carved back in for the owning session.
  */
-export function managedOriginCapabilityPath(dataDir, sessionId) {
-    const digest = createHash('sha256').update(sessionId).digest('hex');
+export function managedOriginCapabilityPath(dataDir, sessionId, channelId) {
+    const digest = managedOriginChannelDigest(sessionId, channelId);
     return join(dataDir, 'read-isolation', `origin-${digest}.json`);
 }
+/** Host-written, child-read-only proof directory for live daemon attestation. */
+export function managedOriginAttestationDirectory(dataDir, sessionId, channelId) {
+    const digest = managedOriginChannelDigest(sessionId, channelId);
+    return join(dataDir, 'read-isolation', `attest-${digest}`);
+}
+export function managedOriginAttestationProofPath(dataDir, sessionId, channelId, nonce) {
+    if (!/^[a-f0-9]{64}$/.test(nonce))
+        throw new Error('invalid managed origin attestation nonce');
+    return join(managedOriginAttestationDirectory(dataDir, sessionId, channelId), `${nonce}.json`);
+}
+export function managedOriginIsolationMarkerPath(dataDir, sessionId, channelId) {
+    return join(managedOriginAttestationDirectory(dataDir, sessionId, channelId), MANAGED_ORIGIN_ISOLATION_MARKER_BASENAME);
+}
+export function managedOriginIsolationSentinelPath(homeDir) {
+    return join(homeDir, MANAGED_ORIGIN_ISOLATION_SENTINEL_BASENAME);
+}
+export function ensureManagedOriginIsolationSentinel(homeDir) {
+    const path = managedOriginIsolationSentinelPath(homeDir);
+    replaceManagedOriginCapabilityFile(path, JSON.stringify({
+        domain: 'botmux.read-isolation-sentinel.v1',
+    }));
+    chmodSync(path, 0o600);
+    return path;
+}
+/** Fixed-OS-home locator whose basename is covered by the legacy
+ * `.dashboard-secret(?:\.|$)` read/write deny. New profiles carve only the
+ * exact current-session leaf back in for reads while the final write deny
+ * remains in force. This gives cmdSend a data-root binding independent of
+ * mutable HOME/SESSION_DATA_DIR. */
+export function managedOriginRootLocatorPath(osUserHomeDir, sessionId) {
+    const digest = createHash('sha256').update(sessionId).digest('hex');
+    return join(osUserHomeDir, '.botmux', `.dashboard-secret.origin-root-${digest}.json`);
+}
+/** Probe placed inside the locator-selected data root's legacy-denied
+ * `read-isolation/` namespace, but outside every current exact carve-out. The
+ * exact directory location matters: a forged sibling dataDir must not inherit
+ * a parent-level dashboard-secret deny and masquerade as the real root. */
+export function managedOriginDataRootProbePath(dataDir, sessionId) {
+    if (!dataDir.startsWith('/'))
+        throw new Error('managed origin data root must be absolute');
+    const digest = createHash('sha256')
+        .update(sessionId)
+        .update('\0')
+        .update(dataDir)
+        .digest('hex');
+    return join(dataDir, 'read-isolation', `.origin-root-probe-${digest}.json`);
+}
+export function ensureManagedOriginDataRootProbe(dataDir, sessionId) {
+    const canonicalDataDir = realpathSync(dataDir);
+    const path = managedOriginDataRootProbePath(canonicalDataDir, sessionId);
+    replaceManagedOriginCapabilityFile(path, JSON.stringify({
+        domain: 'botmux.managed-origin-root-probe.v1',
+        sessionId,
+        dataDir: canonicalDataDir,
+    }));
+    chmodSync(path, 0o600);
+    return path;
+}
+export function managedOriginDataRootProbeAccess(dataDir, sessionId) {
+    const path = managedOriginDataRootProbePath(dataDir, sessionId);
+    let fd;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | fsConstants.O_NONBLOCK);
+        const stat = fstatSync(fd);
+        const expectedUid = process.getuid?.();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size <= 0 || stat.size > 8 * 1024
+            || (stat.mode & 0o777) !== 0o600
+            || (expectedUid !== undefined && stat.uid !== expectedUid))
+            return 'missing_or_unsafe';
+        const body = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < body.length) {
+            const read = readSync(fd, body, offset, body.length - offset, null);
+            if (read <= 0)
+                return 'missing_or_unsafe';
+            offset += read;
+        }
+        const parsed = JSON.parse(body.toString('utf8'));
+        return parsed.domain === 'botmux.managed-origin-root-probe.v1'
+            && parsed.sessionId === sessionId
+            && parsed.dataDir === dataDir
+            ? 'host_accessible'
+            : 'missing_or_unsafe';
+    }
+    catch (err) {
+        // macOS Seatbelt returns EPERM for the profile deny. Do not accept EACCES:
+        // a confined child can manufacture that with chmod(000) in a forged root.
+        return err?.code === 'EPERM' ? 'sandbox_denied' : 'missing_or_unsafe';
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+export function ensureManagedOriginRootLocator(osUserHomeDir, sessionId, dataDir) {
+    if (!dataDir.startsWith('/'))
+        throw new Error('managed origin data root must be absolute');
+    const canonicalDataDir = realpathSync(dataDir);
+    const lexicalPath = managedOriginRootLocatorPath(osUserHomeDir, sessionId);
+    const lexicalParent = dirname(lexicalPath);
+    mkdirSync(lexicalParent, { recursive: true, mode: 0o700 });
+    // Existing installations may symlink ~/.botmux. Resolve the trusted host
+    // parent once, validate the target directory, and write the leaf there; the
+    // CLI's lexical fixed-home path resolves to the same inode under Seatbelt.
+    const parent = realpathSync(lexicalParent);
+    const path = join(parent, basename(lexicalPath));
+    const stat = lstatSync(parent);
+    const expectedUid = process.getuid?.();
+    if (!stat.isDirectory()
+        || (expectedUid !== undefined && stat.uid !== expectedUid)) {
+        throw new Error(`managed origin locator parent is unsafe: ${parent}`);
+    }
+    replaceManagedOriginCapabilityFile(path, JSON.stringify({
+        domain: 'botmux.managed-origin-root.v1',
+        sessionId,
+        dataDir: canonicalDataDir,
+    }));
+    chmodSync(path, 0o600);
+    return path;
+}
+export function readManagedOriginRootLocator(osUserHomeDir, sessionId) {
+    const body = readManagedOriginAuthorityFile(managedOriginRootLocatorPath(osUserHomeDir, sessionId), 8 * 1024);
+    if (!body)
+        return null;
+    try {
+        const parsed = JSON.parse(body);
+        if (parsed.domain !== 'botmux.managed-origin-root.v1'
+            || parsed.sessionId !== sessionId
+            || typeof parsed.dataDir !== 'string'
+            || !parsed.dataDir.startsWith('/')
+            || parsed.dataDir.length > 4096
+            || parsed.dataDir.includes('\0'))
+            return null;
+        return { sessionId, dataDir: parsed.dataDir };
+    }
+    catch {
+        return null;
+    }
+}
+/** Kernel-observable macOS isolation classifier. The Seatbelt profile denies
+ * this fixed, host-readable sentinel independent of env/argv/session ids. */
+export function managedOriginIsolationSentinelAccess(homeDir) {
+    const path = managedOriginIsolationSentinelPath(homeDir);
+    let fd;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | fsConstants.O_NONBLOCK);
+        const stat = fstatSync(fd);
+        const expectedUid = process.getuid?.();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size <= 0 || stat.size > 1024
+            || (stat.mode & 0o777) !== 0o600
+            || (expectedUid !== undefined && stat.uid !== expectedUid))
+            return 'missing_or_unsafe';
+        const body = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < body.length) {
+            const read = readSync(fd, body, offset, body.length - offset, null);
+            if (read <= 0)
+                return 'missing_or_unsafe';
+            offset += read;
+        }
+        try {
+            const value = JSON.parse(body.toString('utf8'));
+            return value.domain === 'botmux.read-isolation-sentinel.v1'
+                ? 'host_accessible'
+                : 'missing_or_unsafe';
+        }
+        catch {
+            return 'missing_or_unsafe';
+        }
+    }
+    catch (err) {
+        return err?.code === 'EACCES' || err?.code === 'EPERM'
+            ? 'sandbox_denied'
+            : 'missing_or_unsafe';
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+/** Kernel probe backed by an inode that legacy read-isolation profiles already
+ * denied: the dashboard HMAC secret. Only metadata is inspected; secret bytes
+ * are never read or returned. This closes the upgrade race where a stale
+ * pre-sentinel sandbox could replace a newly introduced probe path. */
+export function managedOriginLegacyIsolationProbeAccess(osUserHomeDir) {
+    const path = join(osUserHomeDir, '.botmux', '.dashboard-secret');
+    let fd;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | fsConstants.O_NONBLOCK);
+        const stat = fstatSync(fd);
+        const expectedUid = process.getuid?.();
+        return stat.isFile() && stat.nlink === 1
+            && (expectedUid === undefined || stat.uid === expectedUid)
+            ? 'host_accessible'
+            : 'missing_or_unsafe';
+    }
+    catch (err) {
+        return err?.code === 'EACCES' || err?.code === 'EPERM'
+            ? 'sandbox_denied'
+            : 'missing_or_unsafe';
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+/** Strict bounded reader for host-owned authority metadata. It never follows a
+ * leaf symlink and opens FIFOs/devices nonblocking before rejecting them by
+ * inode type, ownership, link count, mode, and size. */
+export function readManagedOriginAuthorityFile(filePath, maxBytes = 8 * 1024) {
+    let fd;
+    try {
+        fd = openSync(filePath, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | fsConstants.O_NONBLOCK);
+        const stat = fstatSync(fd);
+        const expectedUid = process.getuid?.();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size <= 0 || stat.size > maxBytes
+            || (stat.mode & 0o777) !== 0o600
+            || (expectedUid !== undefined && stat.uid !== expectedUid))
+            return null;
+        const body = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < body.length) {
+            const read = readSync(fd, body, offset, body.length - offset, null);
+            if (read <= 0)
+                return null;
+            offset += read;
+        }
+        return body.toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+/** A durable, host-owned hint that this session was launched read-isolated.
+ * It is deliberately separate from the rotating capability so missing,
+ * corrupt, or revoked authority cannot silently downgrade `botmux send` to
+ * the ordinary direct path. The marker is only a fail-closed classification
+ * hint; the live daemon challenge remains the sole send authority. */
+export function hasManagedOriginIsolationMarker(dataDir, sessionId, channelId) {
+    const body = readManagedOriginAuthorityFile(managedOriginIsolationMarkerPath(dataDir, sessionId, channelId), 1024);
+    if (!body)
+        return false;
+    try {
+        const parsed = JSON.parse(body);
+        return parsed.domain === 'botmux.read-isolation-origin.v1'
+            && parsed.sessionId === sessionId
+            && parsed.channelId === channelId;
+    }
+    catch {
+        return false;
+    }
+}
+/** Prepare the proof directory before Seatbelt canonicalizes its read carve. */
+export function ensureManagedOriginAttestationDirectory(dataDir, sessionId, channelId) {
+    const proofDir = managedOriginAttestationDirectory(dataDir, sessionId, channelId);
+    const parent = dirname(proofDir);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const expectedUid = process.getuid?.();
+    const parentStat = lstatSync(parent);
+    if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) {
+        throw new Error(`managed origin attestation parent is not a real directory: ${parent}`);
+    }
+    if (expectedUid !== undefined && parentStat.uid !== expectedUid) {
+        throw new Error(`managed origin attestation parent has the wrong owner: ${parent}`);
+    }
+    chmodSync(parent, 0o700);
+    try {
+        const existing = lstatSync(proofDir);
+        if (existing.isSymbolicLink() || !existing.isDirectory()) {
+            rmSync(proofDir, { recursive: true, force: true });
+        }
+        else if (expectedUid !== undefined && existing.uid !== expectedUid) {
+            throw new Error(`managed origin attestation directory has the wrong owner: ${proofDir}`);
+        }
+    }
+    catch (err) {
+        if (err?.code !== 'ENOENT')
+            throw err;
+    }
+    mkdirSync(proofDir, { recursive: true, mode: 0o700 });
+    chmodSync(proofDir, 0o700);
+    const finalStat = lstatSync(proofDir);
+    if (!finalStat.isDirectory() || finalStat.isSymbolicLink()
+        || (expectedUid !== undefined && finalStat.uid !== expectedUid)
+        || (finalStat.mode & 0o777) !== 0o700) {
+        throw new Error(`managed origin attestation directory is unsafe: ${proofDir}`);
+    }
+    const markerPath = managedOriginIsolationMarkerPath(dataDir, sessionId, channelId);
+    const markerBody = JSON.stringify({
+        domain: 'botmux.read-isolation-origin.v1',
+        sessionId,
+        channelId,
+    });
+    if (!hasManagedOriginIsolationMarker(dataDir, sessionId, channelId)) {
+        replaceManagedOriginCapabilityFile(markerPath, markerBody);
+        chmodSync(markerPath, 0o600);
+    }
+    return proofDir;
+}
+/** Bounded owner-startup cleanup. Never call this from the unauthenticated
+ * request path: a prefilled legacy directory must not turn every challenge
+ * into an unbounded synchronous daemon scan. */
+export function sweepManagedOriginAttestationProofs(dataDir, sessionId, channelId, maxEntries = 512) {
+    const proofDir = ensureManagedOriginAttestationDirectory(dataDir, sessionId, channelId);
+    const expectedUid = process.getuid?.();
+    const now = Date.now();
+    const dir = opendirSync(proofDir);
+    let seen = 0;
+    try {
+        for (;;) {
+            const entry = dir.readSync();
+            if (!entry)
+                break;
+            if (++seen > maxEntries) {
+                throw new Error(`managed origin attestation directory exceeds ${maxEntries} entries`);
+            }
+            if (!/^[a-f0-9]{64}\.json$/.test(entry.name))
+                continue;
+            const candidate = join(proofDir, entry.name);
+            try {
+                const stat = lstatSync(candidate);
+                if (stat.isDirectory())
+                    continue;
+                if (stat.isSymbolicLink() || !stat.isFile()
+                    || (expectedUid !== undefined && stat.uid !== expectedUid)
+                    || now - stat.mtimeMs > MANAGED_ORIGIN_STALE_PROOF_MS) {
+                    unlinkSync(candidate);
+                }
+            }
+            catch { /* raced cleanup or inaccessible leaf: fail closed per nonce */ }
+        }
+    }
+    finally {
+        try {
+            dir.closeSync();
+        }
+        catch { /* best effort */ }
+    }
+}
 /**
  * Atomically replace a capability file without following an attacker-planted
  * destination symlink. The generic atomic writer intentionally follows
@@ -41,23 +416,51 @@ export function replaceManagedOriginCapabilityFile(filePath, body) {
         throw error;
     }
 }
+/** Prepare a stable capability pathname without ever overwriting a successor
+ * generation's regular file. Unsafe leaf types are removed by directory-entry
+ * unlink (no follow); a regular leaf is left untouched for the daemon-owned
+ * current-worker publication path. */
+export function ensureManagedOriginCapabilityLeafSafe(filePath) {
+    const parent = dirname(filePath);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const parentStat = lstatSync(parent);
+    if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) {
+        throw new Error(`managed origin capability parent is not a real directory: ${parent}`);
+    }
+    try {
+        const leaf = lstatSync(filePath);
+        if (leaf.isSymbolicLink() || !leaf.isFile())
+            unlinkSync(filePath);
+    }
+    catch (err) {
+        if (err?.code !== 'ENOENT')
+            throw err;
+    }
+}
 /**
  * Read the current origin claim from the per-session sandbox relay (Linux) or
  * the exact Seatbelt carve-out (macOS). A file is only transport: the daemon
  * still compares the token with its live worker registry, so stale files and
  * forged tuple fields never confer authority.
  */
-export function readManagedOriginCapability(dataDir, sessionId, relayDir) {
+export function readManagedOriginCapability(dataDir, sessionId, relayDir, channelId) {
     if (!sessionId)
         return null;
     const relay = !!relayDir;
+    if (!relay && !channelId)
+        return null;
     const path = relay
         ? join(relayDir, RELAY_ORIGIN_CAPABILITY_BASENAME)
-        : managedOriginCapabilityPath(dataDir, sessionId);
+        : managedOriginCapabilityPath(dataDir, sessionId, channelId);
     try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        const body = readManagedOriginAuthorityFile(path, 8 * 1024);
+        if (!body)
+            return null;
+        const parsed = JSON.parse(body);
         if (!relay && parsed.sessionId !== sessionId)
             return null;
+        if (!relay && parsed.channelId !== channelId)
+            return null;
         const capability = typeof parsed.capability === 'string'
             ? parsed.capability
             : parsed.token;
@@ -74,11 +477,18 @@ export function readManagedOriginCapability(dataDir, sessionId, relayDir) {
             && parsed.dispatchAttempt > 0
             ? parsed.dispatchAttempt
             : undefined;
+        const ipcPort = typeof parsed.ipcPort === 'number'
+            && Number.isSafeInteger(parsed.ipcPort)
+            && parsed.ipcPort > 0 && parsed.ipcPort <= 65_535
+            ? parsed.ipcPort
+            : undefined;
         return {
             sessionId,
+            ...(!relay && channelId ? { channelId } : {}),
             capability,
             ...(turnId ? { turnId } : {}),
             ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
+            ...(ipcPort !== undefined ? { ipcPort } : {}),
         };
     }
     catch {
@@ -91,10 +501,10 @@ export function readManagedOriginCapability(dataDir, sessionId, relayDir) {
  * writable relay can contain a stale token, malformed JSON, or even a directory
  * at the reserved path after a prior sandbox generation.
  */
-export function hasMatchingManagedOriginCapability(dataDir, sessionId, expectedCapability, relayDir) {
+export function hasMatchingManagedOriginCapability(dataDir, sessionId, expectedCapability, relayDir, channelId) {
     if (!expectedCapability)
         return false;
-    return readManagedOriginCapability(dataDir, sessionId, relayDir)?.capability
+    return readManagedOriginCapability(dataDir, sessionId, relayDir, channelId)?.capability
         === expectedCapability;
 }
 //# sourceMappingURL=managed-origin-capability.js.map

package/dist/core/managed-origin-capability.js.map

@@ -1 +1 @@
-{"version":3,"file":"managed-origin-capability.js","sourceRoot":"","sources":["../../src/core/managed-origin-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,GAC1E,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AASjF;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,MAAM,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAAgB,EAAE,IAAY;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAA6B,EAC7B,QAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,IAAI,CAAC,QAAS,EAAE,gCAAgC,CAAC;QACnD,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAMnD,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACtD,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACjB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;eAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;eACxB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;YAC9B,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;eAC7D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;eAC5C,MAAM,CAAC,eAAe,GAAG,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,SAAS;YACT,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAAe,EACf,SAA6B,EAC7B,kBAAsC,EACtC,QAAiB;IAEjB,IAAI,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,2BAA2B,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU;YACtE,kBAAkB,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"managed-origin-capability.js","sourceRoot":"","sources":["../../src/core/managed-origin-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAC/E,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAC7E,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AACjF,MAAM,CAAC,MAAM,wCAAwC,GAAG,0BAA0B,CAAC;AACnF,MAAM,CAAC,MAAM,0CAA0C,GAAG,oCAAoC,CAAC;AAC/F,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAY7C,SAAS,4BAA4B,CAAC,SAAiB;IACrD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAiB,EAAE,SAAiB;IACtE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC;SAC/C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAAiB,EACjB,SAAiB;IAEjB,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,MAAM,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iCAAiC,CAC/C,OAAe,EACf,SAAiB,EACjB,SAAiB;IAEjB,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAAe,EACf,SAAiB,EACjB,SAAiB,EACjB,KAAa;IAEb,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC,iCAAiC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAe,EACf,SAAiB,EACjB,SAAiB;IAEjB,OAAO,IAAI,CACT,iCAAiC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAChE,wCAAwC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,OAAe;IAChE,OAAO,IAAI,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,OAAe;IAClE,MAAM,IAAI,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IACzD,kCAAkC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;QACtD,MAAM,EAAE,mCAAmC;KAC5C,CAAC,CAAC,CAAC;IACJ,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;oCAIoC;AACpC,MAAM,UAAU,4BAA4B,CAC1C,aAAqB,EACrB,SAAiB;IAEjB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,IAAI,CACT,aAAa,EACb,SAAS,EACT,iCAAiC,MAAM,OAAO,CAC/C,CAAC;AACJ,CAAC;AAOD;;;2EAG2E;AAC3E,MAAM,UAAU,8BAA8B,CAC5C,OAAe,EACf,SAAiB;IAEjB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,MAAM,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAe,EACf,SAAiB;IAEjB,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,8BAA8B,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACzE,kCAAkC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;QACtD,MAAM,EAAE,qCAAqC;QAC7C,SAAS;QACT,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC,CAAC;IACJ,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAe,EACf,SAAiB;IAEjB,MAAM,IAAI,GAAG,8BAA8B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,CAC9E,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI;eAC3E,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;YAAE,OAAO,mBAAmB,CAAC;QACzF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,IAAI,IAAI,CAAC;gBAAE,OAAO,mBAAmB,CAAC;YAC1C,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;QAC5E,OAAO,MAAM,CAAC,MAAM,KAAK,qCAAqC;eACzD,MAAM,CAAC,SAAS,KAAK,SAAS;eAC9B,MAAM,CAAC,OAAO,KAAK,OAAO;YAC7B,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,mBAAmB,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,aAAqB,EACrB,SAAiB,EACjB,OAAe;IAEf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,4BAA4B,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;WAClB,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,kCAAkC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;QACtD,MAAM,EAAE,+BAA+B;QACvC,SAAS;QACT,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC,CAAC;IACJ,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,aAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,8BAA8B,CACzC,4BAA4B,CAAC,aAAa,EAAE,SAAS,CAAC,EACtD,CAAC,GAAG,IAAI,CACT,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,+BAA+B;eAChD,MAAM,CAAC,SAAS,KAAK,SAAS;eAC9B,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;eAClC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;eAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI;eAC5B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,oCAAoC,CAClD,OAAe;IAEf,MAAM,IAAI,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,CAC9E,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI;eACvE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;YAAE,OAAO,mBAAmB,CAAC;QACzF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,IAAI,IAAI,CAAC;gBAAE,OAAO,mBAAmB,CAAC;YAC1C,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAyB,CAAC;YACxE,OAAO,KAAK,CAAC,MAAM,KAAK,mCAAmC;gBACzD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,mBAAmB,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,mBAAmB,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,EAAE,IAAI,KAAK,OAAO;YACpD,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,mBAAmB,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;uEAGuE;AACvE,MAAM,UAAU,uCAAuC,CACrD,aAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,CAC9E,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;eACnC,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;YAC1D,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,mBAAmB,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,EAAE,IAAI,KAAK,OAAO;YACpD,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,mBAAmB,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;wDAEwD;AACxD,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,QAAQ,GAAG,CAAC,GAAG,IAAI;IAEnB,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CACX,QAAQ,EACR,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,UAAU,CAC9E,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ;eAC3E,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;eAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,IAAI,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;sEAIsE;AACtE,MAAM,UAAU,+BAA+B,CAC7C,OAAe,EACf,SAAiB,EACjB,SAAiB;IAEjB,MAAM,IAAI,GAAG,8BAA8B,CACzC,gCAAgC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAC/D,IAAI,CACL,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI7B,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,KAAK,iCAAiC;eACrD,MAAM,CAAC,SAAS,KAAK,SAAS;eAC9B,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uCAAuC,CACrD,OAAe,EACf,SAAiB,EACjB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,iCAAiC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,8DAA8D,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0DAA0D,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACzD,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,6DAA6D,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IACxC,CAAC;IACD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE;WACrD,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,WAAW,CAAC;WAC5D,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,UAAU,GAAG,gCAAgC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,MAAM,EAAE,iCAAiC;QACzC,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,+BAA+B,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACpE,kCAAkC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC3D,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;gDAEgD;AAChD,MAAM,UAAU,mCAAmC,CACjD,OAAe,EACf,SAAiB,EACjB,SAAiB,EACjB,UAAU,GAAG,GAAG;IAEhB,MAAM,QAAQ,GAAG,uCAAuC,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,IAAI,EAAE,IAAI,GAAG,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,UAAU,UAAU,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACvD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,IAAI,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACjC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;uBACtC,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;uBACvD,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,6BAA6B,EAAE,CAAC;oBACxD,UAAU,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,+DAA+D,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAAgB,EAAE,IAAY;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;sCAGsC;AACtC,MAAM,UAAU,qCAAqC,CAAC,QAAgB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAA6B,EAC7B,QAAiB,EACjB,SAAkB;IAElB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,IAAI,CAAC,QAAS,EAAE,gCAAgC,CAAC;QACnD,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,SAAS,EAAE,SAAU,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAQ7B,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACtD,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACjB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;eAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;eACxB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;YAC9B,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;eAC7D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;eAC5C,MAAM,CAAC,eAAe,GAAG,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;eAC7C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;eACpC,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM;YACjD,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,SAAS;YACT,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAAe,EACf,SAA6B,EAC7B,kBAAsC,EACtC,QAAiB,EACjB,SAAkB;IAElB,IAAI,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,2BAA2B,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,UAAU;YACjF,kBAAkB,CAAC;AAC3B,CAAC"}

package/dist/core/pending-repo-journal.d.ts

@@ -0,0 +1,6 @@
+import type { DaemonSession } from './types.js';
+import type { PendingRepoSetup } from '../types.js';
+export declare function stagePendingRepoSetup(ds: DaemonSession, args: Pick<PendingRepoSetup, 'mode'> & Partial<Pick<PendingRepoSetup, 'baseDir' | 'turnId'>>): void;
+export declare function persistPendingRepoCardMessageId(ds: DaemonSession, messageId: string): void;
+export declare function restorePendingRepoRuntime(ds: DaemonSession): boolean;
+//# sourceMappingURL=pending-repo-journal.d.ts.map

package/dist/core/pending-repo-journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-repo-journal.d.ts","sourceRoot":"","sources":["../../src/core/pending-repo-journal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,QAAQ,CAAC,CAAC,GAC3F,IAAI,CA+CN;AAED,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAW1F;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAkBpE"}