botmux 3.15.0 → 3.16.0

package/dist/dashboard/standing-link.d.ts

@@ -0,0 +1,76 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type ControlAuditSink } from './control-audit.js';
+import { type ControlRequestHeadersLike } from './control-csrf.js';
+/**
+ * owner 工作台内「自取常驻链接」（`GET /api/workbench/standing-link`）。
+ *
+ * ─── 为什么要有这条端点 ────────────────────────────────────────────────────
+ * botmux 自部署用户就是自己这台实例的 owner，但拿一条能收藏进书签的常驻工作台
+ * 入口，此前只有一条路：SSH 上服务器跑 `botmux dashboard`。飞书卡片那条按钮给的
+ * 是 30 分钟短票（P2-1），到期即死——这是刻意的红线：**长期 token 不得进聊天
+ * 记录**（卡片历史、转发、截图都比首次投递活得久）。这条红线原样保留，这里只是
+ * 把「自取」搬进 owner 已经登录的工作台页面本身：页面是私人上下文，响应
+ * `no-store`，链接既不落盘也不进任何持久化载体。
+ *
+ * ─── 谁能取 ────────────────────────────────────────────────────────────────
+ * 只有**本机完整管理身份**（legacy owner cookie —— `?t=` 种的，或短票兑换出的
+ * 那一枚）。两层门禁，彼此独立、谁都不依赖对方：
+ *
+ *  1. **路由级**：这条路径既不在 `workbenchH5Capability` 的能力表里，也不在
+ *     `PUBLIC_READ_PATHS` 里，所以 `decideWorkbenchH5Auth` / `decideDashboardAuth`
+ *     对 workbench-only（飞书 H5）、平台 owner/teammate/guest、匿名一律 deny401
+ *     —— 请求根本到不了这里。新增路由默认私有，这一层是构造性的。
+ *  2. **处理器级**：本文件再自己判一次 `kind === 'legacy-dashboard'`，不满足直接
+ *     404。平台身份即使角色叫 owner 也在此止步——它证明的是「机器跳板 + 平台角色」，
+ *     不是本机管理权限（与 dashboard.ts 里 `authed = legacyAuthed` 同一口径）。
+ *
+ * ─── 其余约束 ──────────────────────────────────────────────────────────────
+ *  - **同源**：跨站页面拿着 owner 浏览器里的 cookie 打这条 GET 一律 403，判定复用
+ *    control-csrf 的归一化（`Sec-Fetch-Site` / `Origin`，两者都缺席时 `Referer`
+ *    兜底，全无信号 fail closed）。
+ *  - **no-store**：响应体里就是长期凭证，任何中间缓存都不该留。
+ *  - **取用必留痕**：每发一次写一条 `auth.standing_link_issued`（含身份，不含
+ *    token 与链接）。审计写不进去就不发链接——这是唯一一处「审计失败即拒绝」，
+ *    因为这条端点交出去的是常驻凭证，留不下痕就等于凭空多一份无人知晓的副本。
+ *  - **token 只有一个出处**：`activeToken()` 每次现读落盘的活跃 token，所以
+ *    `botmux dashboard rotate` 之后这里自然返回新 token 拼的链接，无需任何同步。
+ */
+/** 端点路径。auth.ts 的能力表 / 公开白名单都**不**包含它（fail closed 的默认）。 */
+export declare const WORKBENCH_STANDING_LINK_PATH = "/api/workbench/standing-link";
+/** 处理器只关心身份的这两个切面（结构上兼容 dashboard.ts 的
+ *  `DashboardRequestIdentity`）。 */
+export interface StandingLinkIdentityLike {
+    kind: string;
+    userId?: string;
+}
+export interface WorkbenchStandingLinkDeps {
+    /** 本请求已解析出的身份（`resolveDashboardIdentity` 的结论），匿名为 null。 */
+    identity: StandingLinkIdentityLike | null;
+    /** 当前活跃的 legacy 管理 token（单一出处：落盘文件）。 */
+    activeToken: () => string | null;
+    /** token → 常驻工作台入口 URL（`<base>/workbench?t=<token>`）。base 的解析复用
+     *  core/dashboard-url.ts 那一份；不可解析时返回 null，调用方据此 503 而不是拼
+     *  出半截链接。 */
+    standingLinkUrl: (token: string) => string | null;
+    /** 审计落点（dashboard.ts 传的是与 takeover / 登录同一个 sink）。 */
+    audit: ControlAuditSink;
+    now?: () => Date;
+}
+/**
+ * 这次请求是否来自本源页面。
+ *
+ * `controlRequestOriginState` 明确判 `foreign` 就是跨站，**不给 Referer 翻案的
+ * 机会**；只有两个来源信号都缺席（`unknown`）时才用 Referer 兜底，把老浏览器上
+ * 的真 owner 救回来（见 {@link refererMatchesHost} 的注释）。全无信号 = 拒绝。
+ */
+export declare function standingLinkSameOrigin(headers: ControlRequestHeadersLike): boolean;
+/**
+ * `GET /api/workbench/standing-link` 处理器。命中返回 true（响应已写完），未命中
+ * 返回 false 交还路由（非 GET / 别的路径一律不自己兜底）。
+ *
+ * 成功：`200 { ok: true, url }`；无权：`404 { ok: false, error: 'not_found' }`；
+ * 跨站：`403 control_origin_forbidden`；没有活跃 token / 链接拼不出 / 审计落不下：
+ * `503 standing_link_unavailable`。失败分支一律不回显 token、不回显链接。
+ */
+export declare function handleWorkbenchStandingLink(req: IncomingMessage, res: ServerResponse, url: URL, deps: WorkbenchStandingLinkDeps): boolean;
+//# sourceMappingURL=standing-link.d.ts.map

package/dist/dashboard/standing-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing-link.d.ts","sourceRoot":"","sources":["../../src/dashboard/standing-link.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,2DAA2D;AAC3D,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;mCACmC;AACnC,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,2DAA2D;IAC3D,QAAQ,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC1C,wCAAwC;IACxC,WAAW,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACjC;;iBAEa;IACb,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAClD,qDAAqD;IACrD,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAKlF;AAYD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CA6CT"}

package/dist/dashboard/standing-link.js

@@ -0,0 +1,111 @@
+import { controlAuditRecord, } from './control-audit.js';
+import { controlRequestOriginState, refererMatchesHost, } from './control-csrf.js';
+/**
+ * owner 工作台内「自取常驻链接」（`GET /api/workbench/standing-link`）。
+ *
+ * ─── 为什么要有这条端点 ────────────────────────────────────────────────────
+ * botmux 自部署用户就是自己这台实例的 owner，但拿一条能收藏进书签的常驻工作台
+ * 入口，此前只有一条路：SSH 上服务器跑 `botmux dashboard`。飞书卡片那条按钮给的
+ * 是 30 分钟短票（P2-1），到期即死——这是刻意的红线：**长期 token 不得进聊天
+ * 记录**（卡片历史、转发、截图都比首次投递活得久）。这条红线原样保留，这里只是
+ * 把「自取」搬进 owner 已经登录的工作台页面本身：页面是私人上下文，响应
+ * `no-store`，链接既不落盘也不进任何持久化载体。
+ *
+ * ─── 谁能取 ────────────────────────────────────────────────────────────────
+ * 只有**本机完整管理身份**（legacy owner cookie —— `?t=` 种的，或短票兑换出的
+ * 那一枚）。两层门禁，彼此独立、谁都不依赖对方：
+ *
+ *  1. **路由级**：这条路径既不在 `workbenchH5Capability` 的能力表里，也不在
+ *     `PUBLIC_READ_PATHS` 里，所以 `decideWorkbenchH5Auth` / `decideDashboardAuth`
+ *     对 workbench-only（飞书 H5）、平台 owner/teammate/guest、匿名一律 deny401
+ *     —— 请求根本到不了这里。新增路由默认私有，这一层是构造性的。
+ *  2. **处理器级**：本文件再自己判一次 `kind === 'legacy-dashboard'`，不满足直接
+ *     404。平台身份即使角色叫 owner 也在此止步——它证明的是「机器跳板 + 平台角色」，
+ *     不是本机管理权限（与 dashboard.ts 里 `authed = legacyAuthed` 同一口径）。
+ *
+ * ─── 其余约束 ──────────────────────────────────────────────────────────────
+ *  - **同源**：跨站页面拿着 owner 浏览器里的 cookie 打这条 GET 一律 403，判定复用
+ *    control-csrf 的归一化（`Sec-Fetch-Site` / `Origin`，两者都缺席时 `Referer`
+ *    兜底，全无信号 fail closed）。
+ *  - **no-store**：响应体里就是长期凭证，任何中间缓存都不该留。
+ *  - **取用必留痕**：每发一次写一条 `auth.standing_link_issued`（含身份，不含
+ *    token 与链接）。审计写不进去就不发链接——这是唯一一处「审计失败即拒绝」，
+ *    因为这条端点交出去的是常驻凭证，留不下痕就等于凭空多一份无人知晓的副本。
+ *  - **token 只有一个出处**：`activeToken()` 每次现读落盘的活跃 token，所以
+ *    `botmux dashboard rotate` 之后这里自然返回新 token 拼的链接，无需任何同步。
+ */
+/** 端点路径。auth.ts 的能力表 / 公开白名单都**不**包含它（fail closed 的默认）。 */
+export const WORKBENCH_STANDING_LINK_PATH = '/api/workbench/standing-link';
+/**
+ * 这次请求是否来自本源页面。
+ *
+ * `controlRequestOriginState` 明确判 `foreign` 就是跨站，**不给 Referer 翻案的
+ * 机会**；只有两个来源信号都缺席（`unknown`）时才用 Referer 兜底，把老浏览器上
+ * 的真 owner 救回来（见 {@link refererMatchesHost} 的注释）。全无信号 = 拒绝。
+ */
+export function standingLinkSameOrigin(headers) {
+    const state = controlRequestOriginState(headers);
+    if (state === 'same-origin')
+        return true;
+    if (state === 'foreign')
+        return false;
+    return refererMatchesHost(headers);
+}
+function json(res, status, body) {
+    res.writeHead(status, {
+        'content-type': 'application/json; charset=utf-8',
+        // 响应体是常驻凭证：不进任何中间缓存，也不把它当 Referer 带去别处。
+        'cache-control': 'no-store',
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(JSON.stringify(body));
+}
+/**
+ * `GET /api/workbench/standing-link` 处理器。命中返回 true（响应已写完），未命中
+ * 返回 false 交还路由（非 GET / 别的路径一律不自己兜底）。
+ *
+ * 成功：`200 { ok: true, url }`；无权：`404 { ok: false, error: 'not_found' }`；
+ * 跨站：`403 control_origin_forbidden`；没有活跃 token / 链接拼不出 / 审计落不下：
+ * `503 standing_link_unavailable`。失败分支一律不回显 token、不回显链接。
+ */
+export function handleWorkbenchStandingLink(req, res, url, deps) {
+    if ((req.method ?? 'GET').toUpperCase() !== 'GET')
+        return false;
+    if (url.pathname !== WORKBENCH_STANDING_LINK_PATH)
+        return false;
+    // 身份门在同源门之前：无权身份不论从哪个源来，看到的都是同一个 404，端点对它
+    // 而言就是不存在。
+    const identity = deps.identity;
+    if (!identity || identity.kind !== 'legacy-dashboard') {
+        json(res, 404, { ok: false, error: 'not_found' });
+        return true;
+    }
+    if (!standingLinkSameOrigin(req.headers)) {
+        json(res, 403, { ok: false, error: 'control_origin_forbidden' });
+        return true;
+    }
+    let link = null;
+    try {
+        const token = deps.activeToken();
+        link = token ? deps.standingLinkUrl(token) : null;
+    }
+    catch {
+        link = null;
+    }
+    if (!link) {
+        json(res, 503, { ok: false, error: 'standing_link_unavailable' });
+        return true;
+    }
+    try {
+        deps.audit.append(controlAuditRecord(identity.userId ?? 'legacy-owner', 'dashboard', 'auth.standing_link_issued', { now: deps.now?.() }));
+    }
+    catch {
+        // 留不下痕就不发：这条端点交出去的是常驻凭证，宁可让 owner 重试，也不留一份
+        // 无人知晓的副本。
+        json(res, 503, { ok: false, error: 'standing_link_unavailable' });
+        return true;
+    }
+    json(res, 200, { ok: true, url: link });
+    return true;
+}
+//# sourceMappingURL=standing-link.js.map

package/dist/dashboard/standing-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing-link.js","sourceRoot":"","sources":["../../src/dashboard/standing-link.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAuB3E;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAkC;IACvE,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,wCAAwC;QACxC,eAAe,EAAE,UAAU;QAC3B,iBAAiB,EAAE,aAAa;KACjC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAA+B;IAE/B,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,KAAK,4BAA4B;QAAE,OAAO,KAAK,CAAC;IAEhE,0CAA0C;IAC1C,WAAW;IACX,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACtD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAClC,QAAQ,CAAC,MAAM,IAAI,cAAc,EACjC,WAAW,EACX,2BAA2B,EAC3B,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CACtB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;QAC3C,WAAW;QACX,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/dashboard/terminal-control.d.ts

@@ -0,0 +1,105 @@
+import { type TerminalControlGrantClaims } from '../core/terminal-control-grant.js';
+import { type ControlAuditSink } from './control-audit.js';
+export declare const DEFAULT_TERMINAL_CONTROL_TTL_MS: number;
+export interface TerminalDashboardActor {
+    userId: string;
+    authSessionId: string;
+    expiresAt: number;
+    /**
+     * `controlled` is the Workbench lease model. A trusted central-platform
+     * owner retains its historical always-write role; teammate/guest identities
+     * are permanently read-only and cannot promote themselves via takeover.
+     */
+    terminalCapability?: 'controlled' | 'owner' | 'readonly';
+}
+export interface TerminalControlSocket {
+    readonly destroyed?: boolean;
+    destroy(): void;
+}
+export type TerminalControlTakeoverResult = {
+    ok: true;
+    mode: 'controlled';
+    expiresAt: number;
+    reused: boolean;
+} | {
+    ok: false;
+    error: 'authentication_expired' | 'control_busy' | 'terminal_operation_forbidden';
+};
+export type TerminalControlReleaseResult = {
+    ok: true;
+    mode: 'readonly';
+    released: boolean;
+} | {
+    ok: false;
+    error: 'control_owned_by_another_session' | 'terminal_operation_forbidden';
+};
+/** Internal central-proxy material. The browser receives neither the signed
+ * token nor the lease marker; both stay on the loopback hop. */
+export interface TerminalProxyGrant {
+    token: string;
+    scope: 'read' | 'write';
+    leaseMarker?: string;
+}
+export interface TerminalControlManagerOptions {
+    secret: string;
+    audit: ControlAuditSink;
+    ttlMs?: number;
+    now?: () => number;
+    setTimer?: typeof setTimeout;
+    clearTimer?: typeof clearTimeout;
+    grantId?: () => string;
+}
+/**
+ * Server-authoritative single-controller lease per terminal session. The
+ * browser sees only mode/expiry. The signed write grant remains in this
+ * process and is injected on the dashboard -> worker loopback hop.
+ */
+export declare class TerminalControlManager {
+    private readonly leases;
+    /** P1-5 revocation index: read-only bridged sockets per auth session, so a
+     * logout/expiry can close every read stream that authentication opened. */
+    private readonly readSocketsByAuthSession;
+    private readonly secret;
+    private readonly audit;
+    private readonly ttlMs;
+    private readonly now;
+    private readonly schedule;
+    private readonly cancel;
+    private readonly nextGrantId?;
+    constructor(opts: TerminalControlManagerOptions);
+    takeover(actor: TerminalDashboardActor, sessionId: string): TerminalControlTakeoverResult;
+    release(actor: TerminalDashboardActor, sessionId: string): TerminalControlReleaseResult;
+    state(actor: TerminalDashboardActor, sessionId: string): {
+        mode: 'readonly' | 'controlled';
+        owned: boolean;
+        expiresAt?: number;
+        fixed?: boolean;
+    };
+    /** Internal-only grant selection for the central terminal proxy. The marker
+     * lets the proxy prove that a write lease is still the exact same lease after
+     * the asynchronous worker WebSocket handshake completes. */
+    grantForProxy(actor: TerminalDashboardActor, sessionId: string): TerminalProxyGrant;
+    /** Backward-compatible narrow accessor used by direct manager tests. */
+    grantFor(actor: TerminalDashboardActor, sessionId: string): string;
+    registerWritableSocket(actor: TerminalDashboardActor, sessionId: string, socket: TerminalControlSocket, expectedLeaseMarker?: string): {
+        registered: boolean;
+        leaseMarker?: string;
+    };
+    disconnect(actor: TerminalDashboardActor, sessionId: string, leaseMarker: string | undefined): boolean;
+    /**
+     * Index a read-only bridged socket under the auth session that opened it.
+     * `releaseByAuthSession` (fired on logout/session expiry) then closes it
+     * immediately instead of waiting for the worker-side grant expiry timer.
+     * Returns a deregistration closure for the socket's own natural close.
+     */
+    registerReadSocket(authSessionId: string, socket: TerminalControlSocket): () => void;
+    releaseByAuthSession(authSessionId: string): number;
+    expireDue(): number;
+    private expireSessionIfDue;
+    private invalidate;
+}
+/** Parse a bounded operator-tunable lease TTL while preserving a short cap. */
+export declare function terminalControlTtlFromEnv(env?: NodeJS.ProcessEnv): number;
+/** Type-only assertion used by downstream callers without exporting leases. */
+export type TerminalControlGrant = TerminalControlGrantClaims;
+//# sourceMappingURL=terminal-control.d.ts.map

package/dist/dashboard/terminal-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-control.d.ts","sourceRoot":"","sources":["../../src/dashboard/terminal-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAG5B,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAS1D,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,YAAY,GAAG,OAAO,GAAG,UAAU,CAAC;CAC1D;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,OAAO,IAAI,IAAI,CAAC;CACjB;AAcD,MAAM,MAAM,6BAA6B,GACrC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,wBAAwB,GAAG,cAAc,GAAG,8BAA8B,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,kCAAkC,GAAG,8BAA8B,CAAA;CAAE,CAAC;AAE9F;gEACgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,UAAU,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,YAAY,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;CACxB;AAMD;;;;GAIG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE;+EAC2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAiD;IAC1F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAe;gBAEhC,IAAI,EAAE,6BAA6B;IAY/C,QAAQ,CAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,6BAA6B;IA2DzF,OAAO,CAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,4BAA4B;IAevF,KAAK,CAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG;QACvD,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;QAChC,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;IAgBD;;gEAE4D;IAC5D,aAAa,CAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,kBAAkB;IAoCnF,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAIlE,sBAAsB,CACpB,KAAK,EAAE,sBAAsB,EAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,qBAAqB,EAC7B,mBAAmB,CAAC,EAAE,MAAM,GAC3B;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAchD,UAAU,CAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAUtG;;;;;OAKG;IACH,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,MAAM,IAAI;IAepF,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM;IAoBnD,SAAS,IAAI,MAAM;IASnB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,UAAU;CAyBnB;AAED,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGtF;AAED,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG,0BAA0B,CAAC"}

package/dist/dashboard/terminal-control.js

@@ -0,0 +1,296 @@
+import { issueTerminalControlGrant, } from '../core/terminal-control-grant.js';
+import { controlAuditRecord, } from './control-audit.js';
+import { TERMINAL_VIEW_CAPABILITY_TTL_MS } from './terminal-view-capability.js';
+export const DEFAULT_TERMINAL_CONTROL_TTL_MS = 5 * 60_000;
+// One shared bound for every read capability (per-request proxy grants AND the
+// view-link URL capability). The worker closes read sockets at this signed
+// boundary (P1-5), so the value doubles as the periodic reconnect cadence for
+// long-watching read viewers — 60s would have made every read terminal blink
+// once a minute, while logout/expiry still closes sockets immediately through
+// the proxy-side index below.
+const READ_GRANT_TTL_MS = TERMINAL_VIEW_CAPABILITY_TTL_MS;
+function validControlTtl(value) {
+    return Number.isSafeInteger(value) && value >= 10_000 && value <= 15 * 60_000;
+}
+/**
+ * Server-authoritative single-controller lease per terminal session. The
+ * browser sees only mode/expiry. The signed write grant remains in this
+ * process and is injected on the dashboard -> worker loopback hop.
+ */
+export class TerminalControlManager {
+    leases = new Map();
+    /** P1-5 revocation index: read-only bridged sockets per auth session, so a
+     * logout/expiry can close every read stream that authentication opened. */
+    readSocketsByAuthSession = new Map();
+    secret;
+    audit;
+    ttlMs;
+    now;
+    schedule;
+    cancel;
+    nextGrantId;
+    constructor(opts) {
+        if (!opts.secret)
+            throw new Error('terminal control secret is required');
+        this.secret = opts.secret;
+        this.audit = opts.audit;
+        this.ttlMs = opts.ttlMs ?? DEFAULT_TERMINAL_CONTROL_TTL_MS;
+        if (!validControlTtl(this.ttlMs))
+            throw new RangeError('terminal control TTL must be between 10 seconds and 15 minutes');
+        this.now = opts.now ?? Date.now;
+        this.schedule = opts.setTimer ?? setTimeout;
+        this.cancel = opts.clearTimer ?? clearTimeout;
+        this.nextGrantId = opts.grantId;
+    }
+    takeover(actor, sessionId) {
+        const now = this.now();
+        if (actor.terminalCapability === 'readonly') {
+            return { ok: false, error: 'terminal_operation_forbidden' };
+        }
+        if (actor.terminalCapability === 'owner') {
+            return {
+                ok: true,
+                mode: 'controlled',
+                expiresAt: Math.min(actor.expiresAt, now + READ_GRANT_TTL_MS),
+                reused: true,
+            };
+        }
+        this.expireSessionIfDue(sessionId, now);
+        if (!Number.isSafeInteger(actor.expiresAt) || actor.expiresAt <= now) {
+            return { ok: false, error: 'authentication_expired' };
+        }
+        const current = this.leases.get(sessionId);
+        if (current) {
+            if (current.authSessionId !== actor.authSessionId || current.userId !== actor.userId) {
+                return { ok: false, error: 'control_busy' };
+            }
+            this.audit.append(controlAuditRecord(actor.userId, sessionId, 'terminal.takeover_reused', { now: new Date(now) }));
+            return { ok: true, mode: 'controlled', expiresAt: current.expiresAt, reused: true };
+        }
+        const expiresAt = Math.min(now + this.ttlMs, actor.expiresAt);
+        if (expiresAt <= now)
+            return { ok: false, error: 'authentication_expired' };
+        const grantId = this.nextGrantId?.();
+        const grant = issueTerminalControlGrant(this.secret, {
+            scope: 'write',
+            sessionId,
+            userId: actor.userId,
+            authSessionId: actor.authSessionId,
+            issuedAt: now,
+            expiresAt,
+            ...(grantId ? { grantId } : {}),
+        });
+        // Fail closed if the durable audit sink cannot account for takeover.
+        this.audit.append(controlAuditRecord(actor.userId, sessionId, 'terminal.takeover', { now: new Date(now) }));
+        const verifiedGrantId = grant.split('.')[1];
+        const lease = {
+            sessionId,
+            userId: actor.userId,
+            authSessionId: actor.authSessionId,
+            grant,
+            // Internal equality marker; never serialized or logged. Using the signed
+            // payload avoids retaining an additional secret value.
+            grantId: verifiedGrantId,
+            issuedAt: now,
+            expiresAt,
+            sockets: new Set(),
+        };
+        lease.timer = this.schedule(() => this.invalidate(sessionId, lease, 'expired'), expiresAt - now);
+        lease.timer.unref?.();
+        this.leases.set(sessionId, lease);
+        return { ok: true, mode: 'controlled', expiresAt, reused: false };
+    }
+    release(actor, sessionId) {
+        if (actor.terminalCapability === 'readonly' || actor.terminalCapability === 'owner') {
+            return { ok: false, error: 'terminal_operation_forbidden' };
+        }
+        const now = this.now();
+        this.expireSessionIfDue(sessionId, now);
+        const lease = this.leases.get(sessionId);
+        if (!lease)
+            return { ok: true, mode: 'readonly', released: false };
+        if (lease.authSessionId !== actor.authSessionId || lease.userId !== actor.userId) {
+            return { ok: false, error: 'control_owned_by_another_session' };
+        }
+        this.invalidate(sessionId, lease, 'release', now);
+        return { ok: true, mode: 'readonly', released: true };
+    }
+    state(actor, sessionId) {
+        const now = this.now();
+        if (actor.terminalCapability === 'readonly')
+            return { mode: 'readonly', owned: false };
+        if (actor.terminalCapability === 'owner') {
+            return { mode: 'controlled', owned: true, fixed: true };
+        }
+        this.expireSessionIfDue(sessionId, now);
+        const lease = this.leases.get(sessionId);
+        if (!lease)
+            return { mode: 'readonly', owned: false };
+        return {
+            mode: 'controlled',
+            owned: lease.authSessionId === actor.authSessionId && lease.userId === actor.userId,
+            expiresAt: lease.expiresAt,
+        };
+    }
+    /** Internal-only grant selection for the central terminal proxy. The marker
+     * lets the proxy prove that a write lease is still the exact same lease after
+     * the asynchronous worker WebSocket handshake completes. */
+    grantForProxy(actor, sessionId) {
+        const now = this.now();
+        if (actor.terminalCapability === 'owner') {
+            const expiresAt = Math.min(actor.expiresAt, now + READ_GRANT_TTL_MS);
+            return {
+                token: issueTerminalControlGrant(this.secret, {
+                    scope: 'write',
+                    sessionId,
+                    userId: actor.userId,
+                    authSessionId: actor.authSessionId,
+                    issuedAt: now,
+                    expiresAt,
+                }),
+                scope: 'write',
+            };
+        }
+        this.expireSessionIfDue(sessionId, now);
+        const lease = actor.terminalCapability === 'readonly' ? undefined : this.leases.get(sessionId);
+        if (lease && lease.authSessionId === actor.authSessionId && lease.userId === actor.userId) {
+            return { token: lease.grant, scope: 'write', leaseMarker: lease.grantId };
+        }
+        const expiresAt = Math.min(actor.expiresAt, now + READ_GRANT_TTL_MS);
+        if (expiresAt <= now)
+            return { token: '', scope: 'read' };
+        return {
+            token: issueTerminalControlGrant(this.secret, {
+                scope: 'read',
+                sessionId,
+                userId: actor.userId,
+                authSessionId: actor.authSessionId,
+                issuedAt: now,
+                expiresAt,
+            }),
+            scope: 'read',
+        };
+    }
+    /** Backward-compatible narrow accessor used by direct manager tests. */
+    grantFor(actor, sessionId) {
+        return this.grantForProxy(actor, sessionId).token;
+    }
+    registerWritableSocket(actor, sessionId, socket, expectedLeaseMarker) {
+        const now = this.now();
+        this.expireSessionIfDue(sessionId, now);
+        const lease = this.leases.get(sessionId);
+        if (!lease || lease.authSessionId !== actor.authSessionId || lease.userId !== actor.userId) {
+            return { registered: false };
+        }
+        if (socket.destroyed || (expectedLeaseMarker !== undefined && lease.grantId !== expectedLeaseMarker)) {
+            return { registered: false };
+        }
+        lease.sockets.add(socket);
+        return { registered: true, leaseMarker: lease.grantId };
+    }
+    disconnect(actor, sessionId, leaseMarker) {
+        const lease = this.leases.get(sessionId);
+        if (!lease || !leaseMarker || lease.grantId !== leaseMarker
+            || lease.authSessionId !== actor.authSessionId || lease.userId !== actor.userId) {
+            return false;
+        }
+        this.invalidate(sessionId, lease, 'disconnect');
+        return true;
+    }
+    /**
+     * Index a read-only bridged socket under the auth session that opened it.
+     * `releaseByAuthSession` (fired on logout/session expiry) then closes it
+     * immediately instead of waiting for the worker-side grant expiry timer.
+     * Returns a deregistration closure for the socket's own natural close.
+     */
+    registerReadSocket(authSessionId, socket) {
+        let sockets = this.readSocketsByAuthSession.get(authSessionId);
+        if (!sockets) {
+            sockets = new Set();
+            this.readSocketsByAuthSession.set(authSessionId, sockets);
+        }
+        sockets.add(socket);
+        return () => {
+            const current = this.readSocketsByAuthSession.get(authSessionId);
+            if (!current)
+                return;
+            current.delete(socket);
+            if (current.size === 0)
+                this.readSocketsByAuthSession.delete(authSessionId);
+        };
+    }
+    releaseByAuthSession(authSessionId) {
+        let released = 0;
+        for (const [sessionId, lease] of [...this.leases]) {
+            if (lease.authSessionId !== authSessionId)
+                continue;
+            this.invalidate(sessionId, lease, 'disconnect');
+            released++;
+        }
+        // Read streams are not leases but must die with the authentication that
+        // opened them (P1-5). Only THIS auth session's sockets close — a different
+        // viewer's read stream on the same terminal is untouched.
+        const readSockets = this.readSocketsByAuthSession.get(authSessionId);
+        if (readSockets) {
+            this.readSocketsByAuthSession.delete(authSessionId);
+            for (const socket of readSockets) {
+                try {
+                    if (!socket.destroyed)
+                        socket.destroy();
+                }
+                catch { /* already closed */ }
+            }
+        }
+        return released;
+    }
+    expireDue() {
+        const now = this.now();
+        let expired = 0;
+        for (const sessionId of [...this.leases.keys()]) {
+            if (this.expireSessionIfDue(sessionId, now))
+                expired++;
+        }
+        return expired;
+    }
+    expireSessionIfDue(sessionId, now) {
+        const lease = this.leases.get(sessionId);
+        if (!lease || now < lease.expiresAt)
+            return false;
+        this.invalidate(sessionId, lease, 'expired', now);
+        return true;
+    }
+    invalidate(sessionId, lease, reason, now = this.now()) {
+        if (this.leases.get(sessionId) !== lease)
+            return;
+        this.leases.delete(sessionId);
+        if (lease.timer)
+            this.cancel(lease.timer);
+        const action = reason === 'release' ? 'terminal.release'
+            : reason === 'expired' ? 'terminal.expired'
+                : 'terminal.disconnected';
+        try {
+            this.audit.append(controlAuditRecord(lease.userId, sessionId, action, { now: new Date(now) }));
+        }
+        catch {
+            // Revocation is the security boundary. A teardown audit failure must not
+            // resurrect the lease, skip later leases in a logout sweep, or crash an
+            // expiry/disconnect timer. New takeovers still fail closed on audit above.
+        }
+        finally {
+            for (const socket of lease.sockets) {
+                try {
+                    if (!socket.destroyed)
+                        socket.destroy();
+                }
+                catch { /* already closed */ }
+            }
+            lease.sockets.clear();
+        }
+    }
+}
+/** Parse a bounded operator-tunable lease TTL while preserving a short cap. */
+export function terminalControlTtlFromEnv(env = process.env) {
+    const candidate = Number(env.BOTMUX_DASHBOARD_TERMINAL_CONTROL_TTL_MS);
+    return validControlTtl(candidate) ? candidate : DEFAULT_TERMINAL_CONTROL_TTL_MS;
+}
+//# sourceMappingURL=terminal-control.js.map

package/dist/dashboard/terminal-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-control.js","sourceRoot":"","sources":["../../src/dashboard/terminal-control.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,GAAG,MAAM,CAAC;AAC1D,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,8BAA8B;AAC9B,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAyD1D,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAChB,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IAClE;+EAC2E;IAC1D,wBAAwB,GAAG,IAAI,GAAG,EAAsC,CAAC;IACzE,MAAM,CAAS;IACf,KAAK,CAAmB;IACxB,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,QAAQ,CAAoB;IAC5B,MAAM,CAAsB;IAC5B,WAAW,CAAgB;IAE5C,YAAY,IAAmC;QAC7C,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,+BAA+B,CAAC;QAC3D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,gEAAgE,CAAC,CAAC;QACzH,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,QAAQ,CAAC,KAA6B,EAAE,SAAiB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,OAAO,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,GAAG,iBAAiB,CAAC;gBAC7D,MAAM,EAAE,IAAI;aACb,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACnH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,SAAS,IAAI,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE;YACnD,KAAK,EAAE,OAAO;YACd,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,QAAQ,EAAE,GAAG;YACb,SAAS;YACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,qEAAqE;QACrE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAyB;YAClC,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,KAAK;YACL,yEAAyE;YACzE,uDAAuD;YACvD,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,GAAG;YACb,SAAS;YACT,OAAO,EAAE,IAAI,GAAG,EAAE;SACnB,CAAC;QACF,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;QACjG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,KAA6B,EAAE,SAAiB;QACtD,IAAI,KAAK,CAAC,kBAAkB,KAAK,UAAU,IAAI,KAAK,CAAC,kBAAkB,KAAK,OAAO,EAAE,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnE,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,KAA6B,EAAE,SAAiB;QAMpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,kBAAkB,KAAK,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACvF,IAAI,KAAK,CAAC,kBAAkB,KAAK,OAAO,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YACnF,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IAED;;gEAE4D;IAC5D,aAAa,CAAC,KAA6B,EAAE,SAAiB;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,kBAAkB,KAAK,OAAO,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,GAAG,iBAAiB,CAAC,CAAC;YACrE,OAAO;gBACL,KAAK,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE;oBAC5C,KAAK,EAAE,OAAO;oBACd,SAAS;oBACT,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,QAAQ,EAAE,GAAG;oBACb,SAAS;iBACV,CAAC;gBACF,KAAK,EAAE,OAAO;aACf,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/F,IAAI,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1F,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,GAAG,iBAAiB,CAAC,CAAC;QACrE,IAAI,SAAS,IAAI,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC1D,OAAO;YACL,KAAK,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC5C,KAAK,EAAE,MAAM;gBACb,SAAS;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,QAAQ,EAAE,GAAG;gBACb,SAAS;aACV,CAAC;YACF,KAAK,EAAE,MAAM;SACd,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,QAAQ,CAAC,KAA6B,EAAE,SAAiB;QACvD,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;IACpD,CAAC;IAED,sBAAsB,CACpB,KAA6B,EAC7B,SAAiB,EACjB,MAA6B,EAC7B,mBAA4B;QAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3F,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,mBAAmB,CAAC,EAAE,CAAC;YACrG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,UAAU,CAAC,KAA6B,EAAE,SAAiB,EAAE,WAA+B;QAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW;eACtD,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,aAAqB,EAAE,MAA6B;QACrE,IAAI,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,EAAE;YACV,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,CAAC,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,aAAqB;QACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa;gBAAE,SAAS;YACpD,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YAChD,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACrE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;gBACjC,IAAI,CAAC;oBAAC,IAAI,CAAC,MAAM,CAAC,SAAS;wBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,kBAAkB,CAAC,SAAiB,EAAE,GAAW;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAChB,SAAiB,EACjB,KAA2B,EAC3B,MAA4C,EAC5C,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAEhB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK;YAAE,OAAO;QACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB;YACtD,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB;gBAC3C,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,wEAAwE;YACxE,2EAA2E;QAC7E,CAAC;gBAAS,CAAC;YACT,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,CAAC;oBAAC,IAAI,CAAC,MAAM,CAAC,SAAS;wBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACjF,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACvE,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC;AAClF,CAAC"}