botmux 3.14.0 → 3.16.0

package/dist/dashboard/control-csrf.js

@@ -0,0 +1,392 @@
+/**
+ * P1-11：控制类端点的跨站伪造防线（CSRF / Origin / Fetch-Metadata）。
+ *
+ * 为什么 `SameSite=Lax` 不够：
+ *  - Lax 只拦「跨 **站**」，同站的兄弟子域（`a.example.com` → `b.example.com`）
+ *    与 **同域不同端口** 的 `http://127.0.0.1:<别的端口>` 都算 same-site，
+ *    cookie 照送。中心化平台把每台机器放在 `m-<id>.<host>` 子域下，本地开发机
+ *    上又常年跑着别的 localhost 服务——这两条正是最现实的攻击面。
+ *  - `POST /api/sessions/<id>/control/takeover` 与 preview-interaction 的
+ *    unlock/activity/lock 都是 **无 body** 的，一个 `<form method=post>` 就能
+ *    从任意页面触发（form 提交不受 CORS 限制，也读不到响应——但副作用已经发生：
+ *    抢走终端写租约、把预览从蒙层模式解锁成可交互）。
+ *
+ * 因此控制类请求要同时满足两道：
+ *  1. **同源证明**：`Sec-Fetch-Site: same-origin`，或 `Origin` 与本请求 Host
+ *     同源（两边归一化成 hostname + 有效端口后相等）。两个信号都没有 → fail
+ *     closed（浏览器发起的写请求必然带其中之一；跨站 form 会带一个对不上的
+ *     `Origin`，沙箱/不透明来源会带 `null`）。
+ *  2. **一次性 CSRF 票据**：页面加载时现签、绑定当前认证会话、随认证结束一起
+ *     作废，提交时放在 `X-Botmux-Csrf` 头里。`<form>` 无法设置自定义头，所以
+ *     即使第 1 道被某个浏览器的 Fetch-Metadata 实现绕过，无 body 的表单攻击也
+ *     依然打不进来。
+ *
+ * WebSocket 升级（terminal `/s/*`、debug-terminal）走 {@link managementUpgradeOrigin}：
+ * upgrade 不经 HTTP 门禁，浏览器对 WS 握手 **一定** 带 `Origin`，所以「带了但对
+ * 不上（含 `null`）」一律拒；完全不带 Origin 的是非浏览器客户端（本身就拿不到
+ * 浏览器 cookie，不构成 CSRF），放行以免打断本机 CLI / 探针。
+ * 注意 Preview 自身的 WS 是不透明来源（`Origin: null`），它走 preview 专用路径
+ * 的路径内凭据校验，**不能**用本函数误杀——调用方必须在 preview 分支之后再调。
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { logger } from '../utils/logger.js';
+/** 提交控制类请求时携带 CSRF 票据的头名。`<form>` 设不了自定义头，这是关键。 */
+export const CONTROL_CSRF_HEADER = 'x-botmux-csrf';
+/** 页面注入票据用的 meta 名（SPA 与 preview guard 壳都读它）。 */
+export const CONTROL_CSRF_META_NAME = 'botmux-csrf';
+/** 闲置寿命：每次成功校验都续期（滑动窗口）。工作台常年挂在手机上不刷新，固定
+ *  寿命会让一个用了几天的页面突然操作失败；而真正的安全事件是登出/rotate/解绑，
+ *  那条路径是立即作废，不靠 TTL。TTL 只负责回收没人再用的票据。 */
+const DEFAULT_CSRF_IDLE_TTL_MS = 7 * 24 * 60 * 60_000;
+/** 票据是每次页面加载现签的，给一个封顶避免刷新页面刷爆内存（FIFO 淘汰）。 */
+const DEFAULT_MAX_CSRF_TOKENS = 4096;
+function headerValue(value) {
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+}
+/**
+ * 候选 authority（`Host` / `X-Forwarded-Host` / `BOTMUX_PUBLIC_URL`）拆成
+ * hostname + port。借 `http://` 解析，IPv6 字面量、大小写、尾随点都交给 URL
+ * 规范处理，与 Origin 侧用的是同一套归一化。
+ *
+ * 副作用：显式的 `:80` 会被 URL 当成 http 默认端口抹掉，退化成「无端口」。无端
+ * 口只与跑在协议默认端口上的 Origin 相等（见 {@link authorityMatchesOrigin}），
+ * 所以「同域别的端口」这条要防的路依旧堵着。
+ */
+function normalizeAuthority(value) {
+    const trimmed = value.trim().toLowerCase();
+    if (!trimmed || trimmed.length > 256)
+        return undefined;
+    let url;
+    try {
+        url = new URL(`http://${trimmed}`);
+    }
+    catch {
+        return undefined;
+    }
+    // 只接受纯 authority：带路径/凭据/查询的 Host 头是畸形输入，不是候选。
+    if (!url.hostname || url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+        return undefined;
+    }
+    return { hostname: url.hostname, port: url.port };
+}
+/** Origin 侧：隐含的默认端口显式化（https→443 / http→80），这样两边比的是同一
+ *  种形式——`https://dash.example` 与 `Host: dash.example:443` 是同一个门。 */
+function normalizeOrigin(origin) {
+    if (!origin || origin === 'null')
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(origin);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return undefined;
+    return {
+        hostname: parsed.hostname.toLowerCase(),
+        port: parsed.port || (parsed.protocol === 'https:' ? '443' : '80'),
+        explicitPort: parsed.port !== '',
+    };
+}
+function authorityMatchesOrigin(candidate, origin) {
+    if (candidate.hostname !== origin.hostname)
+        return false;
+    // 候选不带端口（`proxy_set_header Host $host;`、平台隧道）：本进程无从得知反
+    // 代前面是 80 还是 443，只能认「Origin 也跑在协议默认端口上」。通配放行会把
+    // 「同域其它端口」这条攻击面重新打开。对外走非默认端口的部署，靠运维显式声明
+    // 的 `BOTMUX_PUBLIC_URL` 候选覆盖。
+    if (!candidate.port)
+        return !origin.explicitPort;
+    return candidate.port === origin.port;
+}
+/**
+ * `Origin` 是否与本请求自己的 authority 同源。两边都归一化成 hostname + 有效端
+ * 口后比较，不比 scheme：中心化平台在 TLS 终止后把明文转给本进程，浏览器发的是
+ * `https://…` 而本地看到的是明文连接，比 scheme 会把正常访问全判成跨站。
+ * hostname + 端口相等已经足以区分兄弟子域与其它端口——那正是本条要防的。
+ *
+ * 端口必须两边对称归一化：`new URL('https://dash.example').host` 会被 URL 规范
+ * 剥成 `dash.example`，而 `Host` 头是原始字符串，反代常写成 `dash.example:443`。
+ * 早先直接比字符串，于是 `proxy_set_header Host $host:$server_port;` 这类广为流
+ * 传的配置会把自己人的控制请求全判成跨站。
+ *
+ * `host` 可以给多个候选：反代/平台隧道下 `Host` 可能已被改写成回环地址，浏览器
+ * 真正看到的域名在 `X-Forwarded-Host` 里。这不削弱防线——浏览器不允许页面设置
+ * `Origin`，而 `X-Forwarded-Host` 是自定义头，跨站 `<form>` 设不了、跨站 fetch
+ * 会先触发预检（本服务不答 CORS，预检直接失败），所以攻击页两个头都伪造不了。
+ */
+export function originMatchesHost(origin, host) {
+    const parsed = normalizeOrigin(origin);
+    if (!parsed)
+        return false;
+    const candidates = Array.isArray(host) ? host : [host];
+    return candidates.some(candidate => {
+        if (typeof candidate !== 'string')
+            return false;
+        const normalized = normalizeAuthority(candidate);
+        return normalized ? authorityMatchesOrigin(normalized, parsed) : false;
+    });
+}
+let publicAuthorityCache;
+/**
+ * 运维显式声明的对外基址（`BOTMUX_PUBLIC_URL`）也算一个候选 authority。
+ * 自建反代下 `Host` 与 `X-Forwarded-Host` 可能双双不可信——被改写成上游回环地
+ * 址，或被 `$host` 剥掉了非默认端口——这条是唯一由本机配置而来、跨站页面无从
+ * 影响的「浏览器实际访问的 authority」，纳入候选不削弱防线。
+ */
+function publicUrlAuthority() {
+    const raw = process.env.BOTMUX_PUBLIC_URL?.trim() ?? '';
+    if (publicAuthorityCache?.raw === raw)
+        return publicAuthorityCache.authority;
+    let authority;
+    if (raw) {
+        try {
+            const url = new URL(raw);
+            if (url.protocol === 'http:' || url.protocol === 'https:')
+                authority = url.host || undefined;
+        }
+        catch {
+            authority = undefined;
+        }
+    }
+    publicAuthorityCache = { raw, authority };
+    return authority;
+}
+/** 本请求可能的自身 authority：直连是 `Host`，反代/平台隧道下还有转发头，外加
+ *  运维显式声明的对外基址。 */
+function requestAuthorities(headers) {
+    const forwarded = headerValue(headers['x-forwarded-host']);
+    return [
+        headerValue(headers.host),
+        // 逗号分隔时第一个才是最初的客户端所见 host。
+        forwarded ? forwarded.split(',')[0] : undefined,
+        publicUrlAuthority(),
+    ];
+}
+/** 日志安全：Origin/Host 都是请求方可控字符串，掐长度并去掉控制字符再落盘。 */
+function logSafeValue(value) {
+    let out = '';
+    for (const ch of value.slice(0, 128)) {
+        const code = ch.codePointAt(0) ?? 0;
+        if (code >= 0x20 && code !== 0x7f)
+            out += ch;
+    }
+    return out;
+}
+/**
+ * 判成跨站时留一行线索。这条 403 是硬失败：前端无降级、doctor 也报不出原因，
+ * 服务端再零日志，运维只能看到「终端连不上、一点接管就 403」。把 Origin 与全部
+ * 候选 authority 打出来，反代配错（Host 被改写 / 端口被剥掉）一眼可辨。
+ */
+function warnForeignOrigin(kind, origin, headers) {
+    const authorities = requestAuthorities(headers)
+        .filter((value) => typeof value === 'string' && value.trim() !== '')
+        .map(logSafeValue);
+    logger.warn(`[dashboard-csrf] ${kind} 判为跨站并拒绝：origin=${logSafeValue(origin)}`
+        + ` 候选 authority=[${authorities.join(', ')}]`
+        + '（反代请原样透传 host:port，或用 BOTMUX_PUBLIC_URL 声明对外基址）');
+}
+/**
+ * 综合 `Sec-Fetch-Site` 与 `Origin` 判定来源。任一信号明确说「不是同源」就是
+ * `foreign`；两个信号都缺席是 `unknown`（非浏览器客户端），由调用方决定 fail
+ * closed 还是放行。
+ */
+export function controlRequestOriginState(headers) {
+    const site = headerValue(headers['sec-fetch-site']);
+    const origin = headerValue(headers.origin);
+    if (origin !== undefined && !originMatchesHost(origin, requestAuthorities(headers))) {
+        warnForeignOrigin('控制类请求', origin, headers);
+        return 'foreign';
+    }
+    if (site !== undefined && site !== 'same-origin')
+        return 'foreign';
+    if (origin === undefined && site === undefined)
+        return 'unknown';
+    return 'same-origin';
+}
+/**
+ * `Referer` 兜底的同源判定：请求既没带 `Origin` 也没带 `Sec-Fetch-Site` 时，用
+ * Referer 的 origin 与本请求的候选 authority 比一次（复用上面那套归一化，不另写
+ * 一份比较逻辑）。
+ *
+ * 为什么需要它：同源 **GET** 在浏览器里通常两个信号都没有——`Origin` 只在跨源和
+ * 非 GET 请求上发，`Sec-Fetch-*` 是较新的浏览器才有（Safari 16.4 之前没有）。对
+ * 「有副作用的 POST」两信号缺席一律 fail closed 是对的（那条路径没有需要放行的非
+ * 浏览器调用方），但一条**发放凭证的 GET** 若照搬那条规则，会把老浏览器上的真
+ * owner 一起挡在门外。Referer 在默认的 `strict-origin-when-cross-origin` 策略下
+ * 对同源请求带完整 URL，正好补上这一格。
+ *
+ * 这不放宽防线：Referer 同样是浏览器写、页面改不了的头，而**明确判为跨站**
+ * （`controlRequestOriginState` 已经返回 `foreign`）的请求绝不会走到这里——调用方
+ * 只在 `unknown` 时才用它兜底。
+ */
+export function refererMatchesHost(headers) {
+    const referer = headerValue(headers.referer);
+    if (!referer)
+        return false;
+    let origin;
+    try {
+        const parsed = new URL(referer);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+            return false;
+        origin = parsed.origin;
+    }
+    catch {
+        return false;
+    }
+    return originMatchesHost(origin, requestAuthorities(headers));
+}
+/**
+ * 管理类 WebSocket 升级的 Origin 判定（terminal / debug-terminal）。
+ * 带 Origin 就必须同源（`null` 也算带了，直接拒）；不带 Origin 视为非浏览器客
+ * 户端放行。Preview 自身的 WS 不走这里，见文件头注释。
+ */
+export function managementUpgradeOrigin(headers) {
+    const origin = headerValue(headers.origin);
+    if (origin === undefined)
+        return { ok: true };
+    if (originMatchesHost(origin, requestAuthorities(headers)))
+        return { ok: true };
+    // WS 握手被拒最难查：浏览器拿不到 403 的状态码与响应体，页面只会显示「连不
+    // 上」，workbench-doctor 的探测同样说不出原因。日志是唯一的线索。
+    warnForeignOrigin('WebSocket 升级', origin, headers);
+    return { ok: false, error: 'upgrade_origin_forbidden' };
+}
+function csrfTokenHash(token) {
+    return createHash('sha256').update('botmux-dashboard-control-csrf-v1\0').update(token).digest('base64url');
+}
+/**
+ * 一次性签发、绑定认证会话的 CSRF 票据表。
+ *
+ * - **一次性签发**：每次页面加载现签一枚随机票据，不是从长期密钥推导的稳定值，
+ *   页面刷新即换新票，旧票随 TTL / 认证结束消失。
+ * - **绑定认证会话**：校验时必须与当前请求解析出的 authSessionId 一致，所以一
+ *   枚票据换不到别人的身份，登出后也立刻作废（`revokeAuthSession`）。
+ * - 只存 SHA-256 摘要，明文票据只在注入页面和请求头里存在。
+ *
+ * 不做「用一次即焚」：工作台一次交互会连打多条控制请求（unlock 之后每 20s 一条
+ * activity），单次即焚会退化成每个操作都要先取票，多一次往返还会在弱网下把解锁
+ * 变成必然失败。这里的安全性来自「跨站拿不到票 + 同源证明」，不来自使用次数。
+ */
+export class ControlCsrfTokens {
+    byHash = new Map();
+    hashesByAuthSession = new Map();
+    ttlMs;
+    maxTokens;
+    now;
+    randomToken;
+    constructor(opts = {}) {
+        this.ttlMs = opts.ttlMs ?? DEFAULT_CSRF_IDLE_TTL_MS;
+        this.maxTokens = opts.maxTokens ?? DEFAULT_MAX_CSRF_TOKENS;
+        this.now = opts.now ?? Date.now;
+        this.randomToken = opts.randomToken ?? (() => randomBytes(24).toString('base64url'));
+    }
+    mint(authSessionId) {
+        if (!authSessionId)
+            throw new Error('csrf token requires an auth session');
+        const token = this.randomToken();
+        const hash = csrfTokenHash(token);
+        this.sweep();
+        // Map 保序，超额时从最老的一枚开始淘汰。
+        while (this.byHash.size >= this.maxTokens) {
+            const oldest = this.byHash.keys().next();
+            if (oldest.done)
+                break;
+            this.forget(oldest.value);
+        }
+        this.byHash.set(hash, { authSessionId, expiresAt: this.now() + this.ttlMs });
+        let hashes = this.hashesByAuthSession.get(authSessionId);
+        if (!hashes) {
+            hashes = new Set();
+            this.hashesByAuthSession.set(authSessionId, hashes);
+        }
+        hashes.add(hash);
+        return token;
+    }
+    verify(token, authSessionId) {
+        if (!token || token.length > 512 || !/^[A-Za-z0-9_-]+$/.test(token))
+            return false;
+        const hash = csrfTokenHash(token);
+        const stored = this.byHash.get(hash);
+        if (!stored)
+            return false;
+        if (this.now() >= stored.expiresAt) {
+            this.forget(hash);
+            return false;
+        }
+        if (stored.authSessionId !== authSessionId)
+            return false;
+        // 滑动续期：还在用的页面不会因为开得久而突然操作失败。
+        stored.expiresAt = this.now() + this.ttlMs;
+        return true;
+    }
+    /** 认证结束（logout / 到期 / rotate / 解绑）时作废该会话的全部票据。 */
+    revokeAuthSession(authSessionId) {
+        const hashes = this.hashesByAuthSession.get(authSessionId);
+        if (!hashes)
+            return 0;
+        let removed = 0;
+        for (const hash of [...hashes]) {
+            if (this.byHash.delete(hash))
+                removed++;
+        }
+        this.hashesByAuthSession.delete(authSessionId);
+        return removed;
+    }
+    size() {
+        return this.byHash.size;
+    }
+    forget(hash) {
+        const stored = this.byHash.get(hash);
+        this.byHash.delete(hash);
+        if (!stored)
+            return;
+        const hashes = this.hashesByAuthSession.get(stored.authSessionId);
+        if (!hashes)
+            return;
+        hashes.delete(hash);
+        if (hashes.size === 0)
+            this.hashesByAuthSession.delete(stored.authSessionId);
+    }
+    sweep() {
+        const now = this.now();
+        for (const [hash, stored] of this.byHash) {
+            if (now >= stored.expiresAt)
+                this.forget(hash);
+        }
+    }
+}
+/**
+ * 把本次页面加载现签的票据注入 HTML 壳（SPA index.html / preview guard 壳）。
+ * 票据只进 `<meta>`：跨站页面读不到本源 DOM，`<form>` 也设不了自定义头，所以
+ * 「无 body 表单触发接管/解锁」这条路就此断掉。注入后的壳必须 `no-store`，
+ * 否则浏览器会把已作废的票据缓存下来复用。
+ */
+export function injectControlCsrfMeta(html, token) {
+    const safe = token.replace(/[^A-Za-z0-9_-]/g, '');
+    if (!safe)
+        return html;
+    const tag = `<meta name="${CONTROL_CSRF_META_NAME}" content="${safe}">`;
+    return html.includes('</head>') ? html.replace('</head>', `  ${tag}\n</head>`) : `${tag}\n${html}`;
+}
+/**
+ * 控制类请求（takeover/release、preview-interaction unlock/activity/lock、
+ * locate 等有副作用且可被无 body 表单触发的 POST）的统一门禁。
+ * 调用点必须已经解析出身份——匿名请求在路由层就该 401，这里只管跨站伪造。
+ */
+export function guardControlRequest(input) {
+    // 两个来源信号都缺席时 fail closed：浏览器对带副作用的 POST 必然带 Origin，
+    // 缺席只可能是刻意剥掉的请求，而这条路径上没有需要放行的非浏览器调用方。
+    if (controlRequestOriginState(input.headers) !== 'same-origin') {
+        return { ok: false, status: 403, error: 'control_origin_forbidden' };
+    }
+    const token = headerValue(input.headers[CONTROL_CSRF_HEADER]);
+    if (!input.tokens.verify(token, input.authSessionId)) {
+        return { ok: false, status: 403, error: 'control_csrf_invalid' };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=control-csrf.js.map

package/dist/dashboard/control-csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-csrf.js","sourceRoot":"","sources":["../../src/dashboard/control-csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AACnD,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAEpD;;yCAEyC;AACzC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACtD,6CAA6C;AAC7C,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAWrC,SAAS,WAAW,CAAC,KAAoC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACvE,8CAA8C;IAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACpG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;oEACoE;AACpE,SAAS,eAAe,CAAC,MAA0B;IACjD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;QACvC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA8B,EAC9B,MAAuD;IAEvD,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzD,uDAAuD;IACvD,+CAA+C;IAC/C,wCAAwC;IACxC,8BAA8B;IAC9B,IAAI,CAAC,SAAS,CAAC,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;IACjD,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,IAA4D;IAE5D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAA0B,CAAC,CAAC;IAC7E,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACjC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,oBAAgF,CAAC;AAErF;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,oBAAoB,EAAE,GAAG,KAAK,GAAG;QAAE,OAAO,oBAAoB,CAAC,SAAS,CAAC;IAC7E,IAAI,SAA6B,CAAC;IAClC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS,GAAG,SAAS,CAAC;QAAC,CAAC;IACpC,CAAC;IACD,oBAAoB,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC1C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;mBACmB;AACnB,SAAS,kBAAkB,CAAC,OAAkC;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,2BAA2B;QAC3B,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/C,kBAAkB,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,GAAG,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,OAAkC;IACzF,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC;SAC5C,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;SACpF,GAAG,CAAC,YAAY,CAAC,CAAC;IACrB,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,YAAY,CAAC,MAAM,CAAC,EAAE;UACzE,kBAAkB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;UAC3C,iDAAiD,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAkC;IAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpF,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9E,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkC;IAExE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAChF,2CAA2C;IAC3C,2CAA2C;IAC3C,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7G,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAiB;IACX,MAAM,GAAG,IAAI,GAAG,EAAwD,CAAC;IACzE,mBAAmB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,CAAS;IACd,SAAS,CAAS;IAClB,GAAG,CAAe;IAClB,WAAW,CAAe;IAE3C,YAAY,OAAiC,EAAE;QAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,wBAAwB,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC3D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,aAAqB;QACxB,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,wBAAwB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAyB,EAAE,aAAqB;QACrD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC;QACzD,6BAA6B;QAC7B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kDAAkD;IAClD,iBAAiB,CAAC,aAAqB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/E,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAa;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,eAAe,sBAAsB,cAAc,IAAI,IAAI,CAAC;IACxE,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC;AACrG,CAAC;AAMD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,oDAAoD;IACpD,sCAAsC;IACtC,IAAI,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,aAAa,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/dashboard/daemon-reconcile.d.ts

@@ -0,0 +1,26 @@
+import type { DaemonInfo } from './registry.js';
+import type { Aggregator } from './aggregator.js';
+export type DaemonSnapshot = {
+    sessions: any[];
+    schedules: any[];
+};
+export type SnapshotFetcher = (port: number, signal: AbortSignal) => Promise<DaemonSnapshot>;
+/**
+ * Install one daemon's authoritative snapshot into the aggregator. Runs as
+ * the subscribeDaemon barrier — BEFORE any SSE frame is read — on both
+ * initial attach and reconnect, so the snapshot can never clobber fresher
+ * SSE-delivered state.
+ *
+ * Epoch arbitration: `signal` is the subscription's abort signal. If this
+ * subscription was aborted (daemon offline, superseded by a newer
+ * generation) while the fetches were in flight, the result is discarded
+ * entirely — applying it would reverse-clobber the newer generation's
+ * state. The aggregator's hydrate paths have no version arbitration, so the
+ * subscription generation (this signal) is the arbitration: abort ⟺ this
+ * generation is no longer authoritative for the daemon. The check-then-
+ * mutate sequence below has no await in between, so no abort can interleave.
+ *
+ * Best-effort: on failure the live SSE stream remains the source of truth.
+ */
+export declare function reconcileDaemonSnapshot(d: DaemonInfo, agg: Aggregator, signal: AbortSignal, fetchSnapshot?: SnapshotFetcher): Promise<DaemonSnapshot | undefined>;
+//# sourceMappingURL=daemon-reconcile.d.ts.map

package/dist/dashboard/daemon-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-reconcile.d.ts","sourceRoot":"","sources":["../../src/dashboard/daemon-reconcile.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAIlD,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAAC,SAAS,EAAE,GAAG,EAAE,CAAA;CAAE,CAAC;AACnE,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAY7F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAC3C,CAAC,EAAE,UAAU,EACb,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,WAAW,EACnB,aAAa,GAAE,eAAsC,GACpD,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAkBrC"}

package/dist/dashboard/daemon-reconcile.js

@@ -0,0 +1,46 @@
+import { fetchDaemonIpc } from '../core/daemon-ipc-auth.js';
+import { logger } from '../utils/logger.js';
+const defaultFetchSnapshot = async (port, signal) => {
+    const [sRes, schRes] = await Promise.all([
+        fetchDaemonIpc(port, '/api/sessions', { signal }),
+        fetchDaemonIpc(port, '/api/schedules', { signal }),
+    ]);
+    const s = await sRes.json();
+    const sch = await schRes.json();
+    return { sessions: s.sessions ?? [], schedules: sch.schedules ?? [] };
+};
+/**
+ * Install one daemon's authoritative snapshot into the aggregator. Runs as
+ * the subscribeDaemon barrier — BEFORE any SSE frame is read — on both
+ * initial attach and reconnect, so the snapshot can never clobber fresher
+ * SSE-delivered state.
+ *
+ * Epoch arbitration: `signal` is the subscription's abort signal. If this
+ * subscription was aborted (daemon offline, superseded by a newer
+ * generation) while the fetches were in flight, the result is discarded
+ * entirely — applying it would reverse-clobber the newer generation's
+ * state. The aggregator's hydrate paths have no version arbitration, so the
+ * subscription generation (this signal) is the arbitration: abort ⟺ this
+ * generation is no longer authoritative for the daemon. The check-then-
+ * mutate sequence below has no await in between, so no abort can interleave.
+ *
+ * Best-effort: on failure the live SSE stream remains the source of truth.
+ */
+export async function reconcileDaemonSnapshot(d, agg, signal, fetchSnapshot = defaultFetchSnapshot) {
+    try {
+        const snapshot = await fetchSnapshot(d.ipcPort, AbortSignal.any([signal, AbortSignal.timeout(10_000)]));
+        if (signal.aborted)
+            return undefined;
+        const rows = snapshot.sessions.map((row) => (d.botAvatarUrl ? { ...row, botAvatarUrl: d.botAvatarUrl } : row));
+        agg.hydrateSessions(d.larkAppId, rows);
+        agg.hydrateSchedules(d.larkAppId, snapshot.schedules);
+        return snapshot;
+    }
+    catch (e) {
+        if (signal.aborted)
+            return undefined;
+        logger.warn(`[dashboard] reconcile ${d.larkAppId}: ${e?.message ?? e}`);
+        return undefined;
+    }
+}
+//# sourceMappingURL=daemon-reconcile.js.map

package/dist/dashboard/daemon-reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-reconcile.js","sourceRoot":"","sources":["../../src/dashboard/daemon-reconcile.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,MAAM,oBAAoB,GAAoB,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IACnE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvC,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC;QACjD,cAAc,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAyB,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAA0B,CAAC;IACxD,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,CAAa,EACb,GAAe,EACf,MAAmB,EACnB,gBAAiC,oBAAoB;IAErD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,CAAC,CAAC,OAAO,EACT,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,CAC/C,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAChE,CAAC,CAAC;QACH,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,SAAS,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/dashboard/debug-terminal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"debug-terminal.d.ts","sourceRoot":"","sources":["../../src/dashboard/debug-terminal.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgC1C,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,UAAU,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;IAC7E,kDAAkD;IAClD,aAAa,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/E,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACpC,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;CACrC;AAuBD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iBAAiB,GAAG,oBAAoB,CAuLxF"}
+{"version":3,"file":"debug-terminal.d.ts","sourceRoot":"","sources":["../../src/dashboard/debug-terminal.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiC1C,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,UAAU,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;IAC7E,kDAAkD;IAClD,aAAa,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/E,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACpC,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;CACrC;AA8BD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iBAAiB,GAAG,oBAAoB,CA4LxF"}

package/dist/dashboard/debug-terminal.js

@@ -20,6 +20,7 @@ import { randomBytes } from 'node:crypto';
 import * as pty from 'node-pty';
 import { WebSocketServer, WebSocket } from 'ws';
 import { logger } from '../utils/logger.js';
+import { redactChildEnv } from '../utils/child-env.js';
 import { parseCookie } from './auth.js';
 /** 单个 dashboard 最多同时存在的调试终端数——挡住失控泄漏 PTY。 */
 const MAX_TERMINALS = 8;
@@ -38,12 +39,19 @@ function pickDefaultCwd(deps) {
     }
     return homedir();
 }
-/** bash 的运行环境：继承 dashboard 进程 env，并把 ~/.botmux/bin 前置进 PATH，
- *  这样 `botmux`、被 wrapper 的 CLI 等复现命令里的 bin 都能直接找到（与 worker
- *  childEnv.PATH 处理保持一致）。 */
+/** bash 的运行环境：继承 dashboard 进程 env（**先脱敏**），并把 ~/.botmux/bin
+ *  前置进 PATH，这样 `botmux`、被 wrapper 的 CLI 等复现命令里的 bin 都能直接找到
+ *  （与 worker childEnv.PATH 处理保持一致）。
+ *
+ *  脱敏走 redactChildEnv——与 worker 给会话 CLI 子进程用的是同一条边界：这个 shell
+ *  跑在 dashboard 进程里，而 dashboard 是全机唯一合法持有飞书 H5 登录凭据
+ *  （BOTMUX_DASHBOARD_FEISHU_H5_*，含 APP_SECRET）的进程。不脱敏的话，owner 在
+ *  调试终端里一条 `env` 就能读到它，任何在此 shell 里起的进程（含它自己 spawn 的
+ *  CLI）也一并继承。顺带把 IM app 凭据 / GitHub token / Claude 会话标记一起摘掉，
+ *  让这里复现出来的环境和真实会话 CLI 子进程保持一致。 */
 function debugShellEnv() {
     const base = {};
-    for (const [k, v] of Object.entries(process.env))
+    for (const [k, v] of Object.entries(redactChildEnv(process.env)))
         if (typeof v === 'string')
             base[k] = v;
     base.PATH = `${join(homedir(), '.botmux', 'bin')}:${base.PATH ?? ''}`;
@@ -132,6 +140,12 @@ export function createDebugTerminalManager(deps) {
         const active = deps.getActiveToken();
         if (!active)
             return false;
+        // P0 定向加固：`Origin: null` 只可能来自 opaque origin 文档——沙箱化的网页预览
+        // 就是这么一个来源，而调试终端页面永远带自己的真实 origin。这条 WS 是「拿宿主
+        // 裸 bash」的最后一跳，所以即便 opaque origin 已经带不出 SameSite=Lax cookie，
+        // 也在这里显式拒死，不依赖单一层防线。
+        if (req.headers.origin === 'null')
+            return false;
         // Same credential as the management dashboard: cookie set by the `?t=` gate.
         const cookieTok = parseCookie(req.headers.cookie);
         return !!cookieTok && cookieTok === active;

package/dist/dashboard/debug-terminal.js.map

@@ -1 +1 @@
-{"version":3,"file":"debug-terminal.js","sourceRoot":"","sources":["../../src/dashboard/debug-terminal.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,wDAAwD;AACxD,qDAAqD;AACrD,sCAAsC;AACtC,EAAE;AACF,yCAAyC;AACzC,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AACnD,uEAAuE;AACvE,EAAE;AACF,sDAAsD;AACtD,2DAA2D;AAC3D,0DAA0D;AAI1D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,6CAA6C;AAC7C,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,sCAAsC;AACtC,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AACjC,wCAAwC;AACxC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;AAexC,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,IAAI;AAkBjC,SAAS,cAAc,CAAC,IAAuB;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;6BAE6B;AAC7B,SAAS,aAAa;IACpB,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACtE,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC;IACjC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAuB;IAChE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,SAAS,OAAO,CAAC,IAAmB,EAAE,MAAc;QAClD,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,EAAE,KAAK,MAAM,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,YAAY,CAAC,IAAmB;QACvC,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC,EAAE,aAAa,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS,MAAM,CAAC,GAAW;QACzB,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa;YAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE;gBACpC,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,EAAE;gBACR,IAAI,EAAE,EAAE;gBACR,GAAG;gBACH,GAAG,EAAE,aAAa,EAA+B;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,iBAAiB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAkB;YAC1B,EAAE;YACF,IAAI;YACJ,GAAG;YACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,eAAe,CAAC;YAC/E,MAAM,EAAE,KAAK;SACd,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE;YACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBAC5C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;YACrE,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;oBAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxB,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,OAAO,GAAG,WAAW,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,QAAQ,CAAC,GAAoB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,6EAA6E;QAC7E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,MAAM,CAAC;IAC7C,CAAC;IAED,6EAA6E;IAC7E,MAAM,UAAU,GAAuC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;QAEvB,8CAA8C;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,qBAAqB,EAAE,CAAC;YACzD,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,IAAI,GAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;wBAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;oBACpD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBAAC,IAAI,GAAG,EAAE,CAAC;gBAAC,CAAC;gBACtB,IAAI,GAAG,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;oBACrE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;oBACxB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACzB,+BAA+B;gBAC/B,IAAI,CAAC;oBACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;wBAAE,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC;oBAAC,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;oBACjB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBACpG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBACvD,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9F,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8BAA8B;QAC9B,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,+EAA+E;IAC/E,6DAA6D;IAC7D,sBAAsB;IACtB,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,GAA0C,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,wCAAwC;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC3F,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAa,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YAAC,CAAC;YAC5E,8BAA8B;YAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpC,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;oBAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvD,CAAC;YACD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBACpC,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC5B,CAAC;yBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;wBACjE,IAAI,CAAC;4BAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;oBACxE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAqC,GAAG,EAAE;QACtD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,yDAAyD;AACzD,SAAS,iBAAiB,CAAC,EAAU,EAAE,GAAW;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAY,CAAA,CAAC,CAAC;IACxH,OAAO;;;;;gBAKO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;6BAmBD,OAAO,KAAK,OAAO;;;;;;;;;;;;;;;;;;4EAkB4B,EAAE;;;;;;;;;;;;;;;;;;QAkBtE,CAAC;AACT,CAAC"}
+{"version":3,"file":"debug-terminal.js","sourceRoot":"","sources":["../../src/dashboard/debug-terminal.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,wDAAwD;AACxD,qDAAqD;AACrD,sCAAsC;AACtC,EAAE;AACF,yCAAyC;AACzC,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AACnD,uEAAuE;AACvE,EAAE;AACF,sDAAsD;AACtD,2DAA2D;AAC3D,0DAA0D;AAI1D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,6CAA6C;AAC7C,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,sCAAsC;AACtC,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AACjC,wCAAwC;AACxC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;AAexC,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,IAAI;AAkBjC,SAAS,cAAc,CAAC,IAAuB;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;;mCASmC;AACnC,SAAS,aAAa;IACpB,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACtE,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC;IACjC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAuB;IAChE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,SAAS,OAAO,CAAC,IAAmB,EAAE,MAAc;QAClD,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,EAAE,KAAK,MAAM,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,YAAY,CAAC,IAAmB;QACvC,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC,EAAE,aAAa,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS,MAAM,CAAC,GAAW;QACzB,IAAI,SAAS,CAAC,IAAI,IAAI,aAAa;YAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE;gBACpC,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,EAAE;gBACR,IAAI,EAAE,EAAE;gBACR,GAAG;gBACH,GAAG,EAAE,aAAa,EAA+B;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,iBAAiB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAkB;YAC1B,EAAE;YACF,IAAI;YACJ,GAAG;YACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,eAAe,CAAC;YAC/E,MAAM,EAAE,KAAK;SACd,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE;YACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBAC5C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;YACrE,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;oBAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxB,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,OAAO,GAAG,WAAW,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,QAAQ,CAAC,GAAoB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,0DAA0D;QAC1D,8CAA8C;QAC9C,6DAA6D;QAC7D,qBAAqB;QACrB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAChD,6EAA6E;QAC7E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,MAAM,CAAC;IAC7C,CAAC;IAED,6EAA6E;IAC7E,MAAM,UAAU,GAAuC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;QAEvB,8CAA8C;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,qBAAqB,EAAE,CAAC;YACzD,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,IAAI,GAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;wBAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;oBACpD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBAAC,IAAI,GAAG,EAAE,CAAC;gBAAC,CAAC;gBACtB,IAAI,GAAG,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;oBACrE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;oBACxB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACzB,+BAA+B;gBAC/B,IAAI,CAAC;oBACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;wBAAE,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC;oBAAC,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;oBACjB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBACpG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBACvD,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9F,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8BAA8B;QAC9B,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,+EAA+E;IAC/E,6DAA6D;IAC7D,sBAAsB;IACtB,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,GAA0C,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,wCAAwC;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC3F,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAa,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YAAC,CAAC;YAC5E,8BAA8B;YAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpC,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;oBAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvD,CAAC;YACD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBACpC,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC5B,CAAC;yBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;wBACjE,IAAI,CAAC;4BAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;oBACxE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAqC,GAAG,EAAE;QACtD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAClF,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,yDAAyD;AACzD,SAAS,iBAAiB,CAAC,EAAU,EAAE,GAAW;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAY,CAAA,CAAC,CAAC;IACxH,OAAO;;;;;gBAKO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;6BAmBD,OAAO,KAAK,OAAO;;;;;;;;;;;;;;;;;;4EAkB4B,EAAE;;;;;;;;;;;;;;;;;;QAkBtE,CAAC;AACT,CAAC"}