botmux 3.2.1 → 3.4.0

package/dist/platform/device.d.ts

@@ -0,0 +1,77 @@
+export declare const DEVICE_CREDENTIAL_SCHEMA_VERSION: 1;
+export interface DeviceCredentials {
+    schemaVersion: typeof DEVICE_CREDENTIAL_SCHEMA_VERSION;
+    /** HTTPS origin pinned when enrollment starts. */
+    issuer: string;
+    /** Short-lived signed bearer. Never expose outside the host process. */
+    accessToken: string;
+    /** Absolute access-token expiry supplied by the server, Unix epoch ms. */
+    accessExpiresAt: number;
+    /** Rotating opaque secret. Never expose outside the host process. */
+    refreshToken: string;
+    /** Absolute server-issued device expiry, represented as Unix epoch ms. */
+    deviceExp: number;
+    /** Local metadata only; ISO timestamp of the last atomic credential write. */
+    savedAt: string;
+    /**
+     * Durable idempotency key for an in-flight refresh rotation. A failed or
+     * interrupted request keeps this value so the next host process can replay
+     * the same server operation instead of reusing the old refresh as a new one.
+     */
+    pendingRefreshRequestId?: string;
+    /** Unix epoch ms when the current replay window began. */
+    pendingRefreshStartedAt?: number;
+    /** Ambiguous/unsafe refresh state: never send the stored refresh again. */
+    refreshRecoveryRequired?: true;
+}
+export type DeviceCredentialWriteInput = Pick<DeviceCredentials, 'issuer' | 'accessToken' | 'accessExpiresAt' | 'refreshToken' | 'deviceExp'> & {
+    pendingRefreshRequestId?: string;
+    pendingRefreshStartedAt?: number;
+    refreshRecoveryRequired?: true;
+};
+export type DevicePublicStatus = {
+    schemaVersion: typeof DEVICE_CREDENTIAL_SCHEMA_VERSION;
+    enrolled: false;
+} | {
+    schemaVersion: typeof DEVICE_CREDENTIAL_SCHEMA_VERSION;
+    enrolled: true;
+    issuer: string;
+    deviceExp: number;
+    savedAt: string;
+};
+export interface DeviceCredentialPathOptions {
+    /** Test/embedding seam. Defaults to os.homedir(). */
+    homeDir?: string;
+    /** Exact file override. Takes precedence over homeDir. */
+    filePath?: string;
+}
+export interface WriteDeviceCredentialsOptions extends DeviceCredentialPathOptions {
+    /** Test seam; defaults to the current wall clock. */
+    now?: () => Date;
+}
+export declare class DeviceCredentialError extends Error {
+    readonly code: 'invalid_issuer' | 'issuer_mismatch' | 'unsafe_file' | 'invalid_file';
+    constructor(message: string, code: 'invalid_issuer' | 'issuer_mismatch' | 'unsafe_file' | 'invalid_file');
+}
+export declare function deviceCredentialsPath(options?: DeviceCredentialPathOptions): string;
+/**
+ * Normalize and validate the credential issuer.
+ *
+ * Production enrollment is HTTPS-only. Loopback HTTP is accepted solely for
+ * local development/self-tests; credentials are never sent over cleartext to
+ * a non-loopback host. Paths, query strings, fragments and userinfo are
+ * rejected so every request stays pinned to one unambiguous origin.
+ */
+export declare function normalizeDeviceIssuer(raw: string): string;
+export declare function readDeviceCredentials(options?: DeviceCredentialPathOptions): DeviceCredentials | null;
+/**
+ * Atomically replace the device credential pair with exact 0600 permissions.
+ * If a credential already exists, its issuer is immutable until explicit
+ * logout. This prevents a changed env/platform binding from exfiltrating the
+ * rotating refresh token to another origin.
+ */
+export declare function writeDeviceCredentials(input: DeviceCredentialWriteInput, options?: WriteDeviceCredentialsOptions): DeviceCredentials;
+/** Delete only the local credential file. Server-side revocation is separate. */
+export declare function clearDeviceCredentials(options?: DeviceCredentialPathOptions): boolean;
+export declare function readDevicePublicStatus(options?: DeviceCredentialPathOptions): DevicePublicStatus;
+//# sourceMappingURL=device.d.ts.map

package/dist/platform/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../src/platform/device.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,OAAO,gCAAgC,CAAC;IACvD,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,0DAA0D;IAC1D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,iBAAiB,EACjB,QAAQ,GAAG,aAAa,GAAG,iBAAiB,GAAG,cAAc,GAAG,WAAW,CAC5E,GAAG;IACF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,IAAI,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,aAAa,EAAE,OAAO,gCAAgC,CAAC;IACvD,QAAQ,EAAE,KAAK,CAAC;CACjB,GACD;IACE,aAAa,EAAE,OAAO,gCAAgC,CAAC;IACvD,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,WAAW,2BAA2B;IAC1C,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA8B,SAAQ,2BAA2B;IAChF,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,QAAQ,CAAC,IAAI,EACT,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,GACb,cAAc;gBALlB,OAAO,EAAE,MAAM,EACN,IAAI,EACT,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,GACb,cAAc;CAKrB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,2BAAgC,GAAG,MAAM,CAGvF;AAOD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBzD;AA2ED,wBAAgB,qBAAqB,CACnC,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,GAAG,IAAI,CAQ1B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE,6BAAkC,GAC1C,iBAAiB,CA6DnB;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAOzF;AAED,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,2BAAgC,GACxC,kBAAkB,CAYpB"}

package/dist/platform/device.js

@@ -0,0 +1,212 @@
+/**
+ * Host-only desktop device credential storage.
+ *
+ * Device credentials are deliberately kept separate from platform.json: the
+ * machine bearer identifies the daemon, while this file identifies a person on
+ * a desktop device.  Callers must never serialize this object to stdout or a
+ * renderer process; use {@link readDevicePublicStatus} for display purposes.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { readSecureHostFileSync, unlinkSecureHostFileSync, UnsafeHostAuthorityFileError, writeSecureHostFileSync, } from './secure-host-file.js';
+import { deviceCredentialFile } from './device-paths.js';
+export const DEVICE_CREDENTIAL_SCHEMA_VERSION = 1;
+export class DeviceCredentialError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'DeviceCredentialError';
+    }
+}
+export function deviceCredentialsPath(options = {}) {
+    return options.filePath
+        ?? deviceCredentialFile(join(options.homeDir ?? homedir(), '.botmux'));
+}
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
+}
+/**
+ * Normalize and validate the credential issuer.
+ *
+ * Production enrollment is HTTPS-only. Loopback HTTP is accepted solely for
+ * local development/self-tests; credentials are never sent over cleartext to
+ * a non-loopback host. Paths, query strings, fragments and userinfo are
+ * rejected so every request stays pinned to one unambiguous origin.
+ */
+export function normalizeDeviceIssuer(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new DeviceCredentialError('设备平台地址无效', 'invalid_issuer');
+    }
+    if (url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+        throw new DeviceCredentialError('设备平台地址必须是纯 origin，不能包含路径、查询、片段或用户信息', 'invalid_issuer');
+    }
+    const secure = url.protocol === 'https:';
+    const localDevelopment = url.protocol === 'http:' && isLoopbackHostname(url.hostname);
+    if (!secure && !localDevelopment) {
+        throw new DeviceCredentialError('设备注册只允许 HTTPS（本机 loopback 开发除外）', 'invalid_issuer');
+    }
+    return url.origin;
+}
+function asCredentialFileError(error) {
+    if (error instanceof UnsafeHostAuthorityFileError) {
+        throw new DeviceCredentialError(error.message, 'unsafe_file');
+    }
+    throw error;
+}
+function parseDeviceCredentials(raw) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new DeviceCredentialError('device.json 已损坏或不是有效 JSON', 'invalid_file');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new DeviceCredentialError('device.json 结构无效', 'invalid_file');
+    }
+    const record = value;
+    if (record.schemaVersion !== DEVICE_CREDENTIAL_SCHEMA_VERSION
+        || typeof record.issuer !== 'string'
+        || typeof record.accessToken !== 'string'
+        || !record.accessToken
+        || typeof record.accessExpiresAt !== 'number'
+        || !Number.isSafeInteger(record.accessExpiresAt)
+        || record.accessExpiresAt <= 0
+        || typeof record.refreshToken !== 'string'
+        || !record.refreshToken
+        || typeof record.deviceExp !== 'number'
+        || !Number.isSafeInteger(record.deviceExp)
+        || record.deviceExp <= 0
+        || record.accessExpiresAt > record.deviceExp
+        || typeof record.savedAt !== 'string'
+        || !record.savedAt
+        || !Number.isFinite(Date.parse(record.savedAt))
+        || new Date(record.savedAt).toISOString() !== record.savedAt
+        || (record.pendingRefreshRequestId !== undefined && (typeof record.pendingRefreshRequestId !== 'string'
+            || !/^[a-zA-Z0-9._:-]{16,128}$/.test(record.pendingRefreshRequestId)))
+        || (record.pendingRefreshStartedAt !== undefined && (typeof record.pendingRefreshStartedAt !== 'number'
+            || !Number.isSafeInteger(record.pendingRefreshStartedAt)
+            || record.pendingRefreshStartedAt <= 0))
+        || ((record.pendingRefreshRequestId === undefined) !== (record.pendingRefreshStartedAt === undefined))
+        || (record.refreshRecoveryRequired !== undefined && record.refreshRecoveryRequired !== true)
+        || (record.refreshRecoveryRequired === true && record.pendingRefreshRequestId !== undefined)) {
+        throw new DeviceCredentialError('device.json 缺少必要字段或字段类型无效', 'invalid_file');
+    }
+    const issuer = normalizeDeviceIssuer(record.issuer);
+    if (issuer !== record.issuer) {
+        throw new DeviceCredentialError('device.json 中的 issuer 不是规范化 origin', 'invalid_file');
+    }
+    return {
+        schemaVersion: DEVICE_CREDENTIAL_SCHEMA_VERSION,
+        issuer,
+        accessToken: record.accessToken,
+        accessExpiresAt: record.accessExpiresAt,
+        refreshToken: record.refreshToken,
+        deviceExp: record.deviceExp,
+        savedAt: record.savedAt,
+        ...(typeof record.pendingRefreshRequestId === 'string'
+            ? { pendingRefreshRequestId: record.pendingRefreshRequestId }
+            : {}),
+        ...(typeof record.pendingRefreshStartedAt === 'number'
+            ? { pendingRefreshStartedAt: record.pendingRefreshStartedAt }
+            : {}),
+        ...(record.refreshRecoveryRequired === true ? { refreshRecoveryRequired: true } : {}),
+    };
+}
+export function readDeviceCredentials(options = {}) {
+    const filePath = deviceCredentialsPath(options);
+    try {
+        const raw = readSecureHostFileSync(filePath);
+        return raw === null ? null : parseDeviceCredentials(raw);
+    }
+    catch (error) {
+        asCredentialFileError(error);
+    }
+}
+/**
+ * Atomically replace the device credential pair with exact 0600 permissions.
+ * If a credential already exists, its issuer is immutable until explicit
+ * logout. This prevents a changed env/platform binding from exfiltrating the
+ * rotating refresh token to another origin.
+ */
+export function writeDeviceCredentials(input, options = {}) {
+    const issuer = normalizeDeviceIssuer(input.issuer);
+    if (!input.accessToken
+        || !Number.isSafeInteger(input.accessExpiresAt)
+        || input.accessExpiresAt <= 0
+        || !input.refreshToken
+        || !Number.isSafeInteger(input.deviceExp)
+        || input.deviceExp <= 0
+        || input.accessExpiresAt > input.deviceExp) {
+        throw new DeviceCredentialError('平台返回的设备凭证字段无效', 'invalid_file');
+    }
+    if (input.pendingRefreshRequestId !== undefined
+        && !/^[a-zA-Z0-9._:-]{16,128}$/.test(input.pendingRefreshRequestId)) {
+        throw new DeviceCredentialError('设备续期 request ID 无效', 'invalid_file');
+    }
+    if ((input.pendingRefreshRequestId === undefined) !== (input.pendingRefreshStartedAt === undefined)
+        || (input.pendingRefreshStartedAt !== undefined && (!Number.isSafeInteger(input.pendingRefreshStartedAt)
+            || input.pendingRefreshStartedAt <= 0))
+        || (input.refreshRecoveryRequired !== undefined && input.refreshRecoveryRequired !== true)
+        || (input.refreshRecoveryRequired === true && input.pendingRefreshRequestId !== undefined)) {
+        throw new DeviceCredentialError('设备续期恢复状态无效', 'invalid_file');
+    }
+    const filePath = deviceCredentialsPath(options);
+    const current = readDeviceCredentials(options);
+    if (current && current.issuer !== issuer) {
+        throw new DeviceCredentialError('已有设备凭证已固定到另一个平台；请先执行 botmux device logout，再重新注册', 'issuer_mismatch');
+    }
+    const credential = {
+        schemaVersion: DEVICE_CREDENTIAL_SCHEMA_VERSION,
+        issuer,
+        accessToken: input.accessToken,
+        accessExpiresAt: input.accessExpiresAt,
+        refreshToken: input.refreshToken,
+        deviceExp: input.deviceExp,
+        savedAt: (options.now ?? (() => new Date()))().toISOString(),
+        ...(input.pendingRefreshRequestId
+            ? { pendingRefreshRequestId: input.pendingRefreshRequestId }
+            : {}),
+        ...(input.pendingRefreshStartedAt !== undefined
+            ? { pendingRefreshStartedAt: input.pendingRefreshStartedAt }
+            : {}),
+        ...(input.refreshRecoveryRequired === true ? { refreshRecoveryRequired: true } : {}),
+    };
+    try {
+        writeSecureHostFileSync(filePath, `${JSON.stringify(credential, null, 2)}\n`);
+    }
+    catch (error) {
+        asCredentialFileError(error);
+    }
+    return credential;
+}
+/** Delete only the local credential file. Server-side revocation is separate. */
+export function clearDeviceCredentials(options = {}) {
+    const filePath = deviceCredentialsPath(options);
+    try {
+        return unlinkSecureHostFileSync(filePath);
+    }
+    catch (error) {
+        asCredentialFileError(error);
+    }
+}
+export function readDevicePublicStatus(options = {}) {
+    const credential = readDeviceCredentials(options);
+    if (!credential) {
+        return { schemaVersion: DEVICE_CREDENTIAL_SCHEMA_VERSION, enrolled: false };
+    }
+    return {
+        schemaVersion: DEVICE_CREDENTIAL_SCHEMA_VERSION,
+        enrolled: true,
+        issuer: credential.issuer,
+        deviceExp: credential.deviceExp,
+        savedAt: credential.savedAt,
+    };
+}
+//# sourceMappingURL=device.js.map

package/dist/platform/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../src/platform/device.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC;AA8D3D,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAGnC;IAFX,YACE,OAAe,EACN,IAIS;QAElB,KAAK,CAAC,OAAO,CAAC,CAAC;QANN,SAAI,GAAJ,IAAI,CAIK;QAGlB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAuC,EAAE;IAC7E,OAAO,OAAO,CAAC,QAAQ;WAClB,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACnF,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,EAAE,gBAAgB,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACzC,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACjC,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,EAAE,gBAAgB,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,aAAa,KAAK,gCAAgC;WACtD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;WACjC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;WACtC,CAAC,MAAM,CAAC,WAAW;WACnB,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;WAC1C,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;WAC7C,MAAM,CAAC,eAAe,IAAI,CAAC;WAC3B,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;WACvC,CAAC,MAAM,CAAC,YAAY;WACpB,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;WACpC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;WACvC,MAAM,CAAC,SAAS,IAAI,CAAC;WACrB,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,SAAS;WACzC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;WAClC,CAAC,MAAM,CAAC,OAAO;WACf,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;WAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,OAAO;WACzD,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,IAAI,CAClD,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ;eAC/C,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CACrE,CAAC;WACC,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,IAAI,CAClD,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ;eAC/C,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,uBAAuB,CAAC;eACrD,MAAM,CAAC,uBAAuB,IAAI,CAAC,CACvC,CAAC;WACC,CAAC,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC;WACnG,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,IAAI,MAAM,CAAC,uBAAuB,KAAK,IAAI,CAAC;WACzF,CAAC,MAAM,CAAC,uBAAuB,KAAK,IAAI,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS,CAAC,EAC5F,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,EAAE,cAAc,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,aAAa,EAAE,gCAAgC;QAC/C,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ;YACpD,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ;YACpD,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,UAAuC,EAAE;IAEzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAiC,EACjC,UAAyC,EAAE;IAE3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,IACE,CAAC,KAAK,CAAC,WAAW;WACf,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC;WAC5C,KAAK,CAAC,eAAe,IAAI,CAAC;WAC1B,CAAC,KAAK,CAAC,YAAY;WACnB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;WACtC,KAAK,CAAC,SAAS,IAAI,CAAC;WACpB,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,SAAS,EAC1C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACnE,CAAC;IACD,IACE,KAAK,CAAC,uBAAuB,KAAK,SAAS;WACxC,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,EACnE,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IACD,IACE,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAC;WAC5F,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS,IAAI,CACjD,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,uBAAuB,CAAC;eACjD,KAAK,CAAC,uBAAuB,IAAI,CAAC,CACtC,CAAC;WACC,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC;WACvF,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAC,EAC1F,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,qBAAqB,CAC7B,iDAAiD,EACjD,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAsB;QACpC,aAAa,EAAE,gCAAgC;QAC/C,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;QAC5D,GAAG,CAAC,KAAK,CAAC,uBAAuB;YAC/B,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC;IACF,IAAI,CAAC;QACH,uBAAuB,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,UAAuC,EAAE;IAC9E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,UAAuC,EAAE;IAEzC,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,aAAa,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO;QACL,aAAa,EAAE,gCAAgC;QAC/C,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC"}

package/dist/platform/host-command-context.d.ts

@@ -0,0 +1,15 @@
+export interface ManagedAgentHostCommandContextOptions {
+    env?: NodeJS.ProcessEnv;
+    dataDir?: string;
+    startPid?: number;
+}
+/**
+ * Detect commands launched from a botmux-managed AI CLI rather than a trusted
+ * host terminal. Environment hints cover detached/workflow launches; the
+ * daemon-owned PID marker covers shells which scrub those hints. Child-provided
+ * HOME/SESSION_DATA_DIR are deliberately ignored when resolving the authority
+ * store. This is an early UX/consumption guard; OS credential isolation remains
+ * the actual secret boundary.
+ */
+export declare function isManagedAgentHostCommandContext(options?: ManagedAgentHostCommandContextOptions): boolean;
+//# sourceMappingURL=host-command-context.d.ts.map

package/dist/platform/host-command-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-command-context.d.ts","sourceRoot":"","sources":["../../src/platform/host-command-context.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qCAAqC;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,qCAA0C,GAClD,OAAO,CAWT"}

package/dist/platform/host-command-context.js

@@ -0,0 +1,26 @@
+import { homedir } from 'node:os';
+import { resolveBotmuxDataDir } from '../core/data-dir.js';
+import { resolveSessionContext } from '../core/session-marker.js';
+/**
+ * Detect commands launched from a botmux-managed AI CLI rather than a trusted
+ * host terminal. Environment hints cover detached/workflow launches; the
+ * daemon-owned PID marker covers shells which scrub those hints. Child-provided
+ * HOME/SESSION_DATA_DIR are deliberately ignored when resolving the authority
+ * store. This is an early UX/consumption guard; OS credential isolation remains
+ * the actual secret boundary.
+ */
+export function isManagedAgentHostCommandContext(options = {}) {
+    const env = options.env ?? process.env;
+    if (env.BOTMUX_WORKFLOW === '1' || !!env.BOTMUX_SESSION_ID?.trim())
+        return true;
+    try {
+        const dataDir = options.dataDir
+            ?? resolveBotmuxDataDir({ env: {}, homeDir: homedir() });
+        return resolveSessionContext(dataDir, undefined, options.startPid ?? process.ppid) !== null;
+    }
+    catch {
+        // If the authority boundary cannot be evaluated, fail closed.
+        return true;
+    }
+}
+//# sourceMappingURL=host-command-context.js.map

package/dist/platform/host-command-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-command-context.js","sourceRoot":"","sources":["../../src/platform/host-command-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQlE;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAC9C,UAAiD,EAAE;IAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,GAAG,CAAC,eAAe,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;eAC1B,oBAAoB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,qBAAqB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/platform/secure-host-file.d.ts

@@ -0,0 +1,12 @@
+export declare class UnsafeHostAuthorityFileError extends Error {
+    constructor(message: string);
+}
+/** Create/resolve the parent without ever resolving the final path component. */
+export declare function secureHostFilePath(filePath: string): string;
+/** Return null only for a genuinely absent leaf; unsafe shapes fail closed. */
+export declare function readSecureHostFileSync(filePath: string, maxBytes?: number): string | null;
+/** Strict, durable atomic replace that never follows a leaf symlink. */
+export declare function writeSecureHostFileSync(filePath: string, data: string): void;
+/** Strict durable unlink. Returns false only if the leaf is absent. */
+export declare function unlinkSecureHostFileSync(filePath: string): boolean;
+//# sourceMappingURL=secure-host-file.d.ts.map

package/dist/platform/secure-host-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-host-file.d.ts","sourceRoot":"","sources":["../../src/platform/secure-host-file.ts"],"names":[],"mappings":"AAwBA,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAyDD,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAc3D;AAeD,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,MAAM,GAAG,IAAI,CA2C5F;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAmB5E;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CASlE"}

package/dist/platform/secure-host-file.js

@@ -0,0 +1,182 @@
+/**
+ * Strict host-authority file primitives.
+ *
+ * Unlike general dotfiles, machine/device credentials must never follow a
+ * leaf symlink. Reads pin one inode with O_NOFOLLOW, writes canonicalize only
+ * the parent and atomically replace the leaf, and the containing directory
+ * must not be writable by group/other users.
+ */
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, statSync, unlinkSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { atomicWriteFileSync } from '../utils/atomic-write.js';
+export class UnsafeHostAuthorityFileError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'UnsafeHostAuthorityFileError';
+    }
+}
+function sameInode(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function assertOwnedByCurrentUser(stats, label) {
+    if (process.platform === 'win32' || !process.getuid)
+        return;
+    if (stats.uid !== process.getuid()) {
+        throw new UnsafeHostAuthorityFileError(`${label} 不属于当前用户`);
+    }
+}
+/**
+ * A 0700 credential directory is still replaceable when one of its ancestors
+ * is writable by another user. Walk the canonical chain so later path-based
+ * open/rename operations cannot be redirected by renaming the whole directory.
+ *
+ * POSIX sticky directories (notably /tmp) are the one safe writable exception:
+ * when both the directory owner and child owner are trusted, unrelated users
+ * cannot rename that child despite the directory's 01777 mode.
+ */
+function assertAncestorChainCannotReplace(canonicalParent) {
+    if (process.platform === 'win32' || !process.getuid)
+        return;
+    const uid = process.getuid();
+    const trustedOwner = (owner) => owner === uid || owner === 0;
+    let childPath = canonicalParent;
+    let childStats = statSync(childPath);
+    while (true) {
+        const ancestorPath = dirname(childPath);
+        if (ancestorPath === childPath)
+            return;
+        const ancestorStats = statSync(ancestorPath);
+        if (!ancestorStats.isDirectory()) {
+            throw new UnsafeHostAuthorityFileError('宿主凭证祖先路径不是目录');
+        }
+        const untrustedOwnerCanWrite = !trustedOwner(ancestorStats.uid)
+            && (ancestorStats.mode & 0o200) !== 0;
+        const groupOrOtherCanWrite = (ancestorStats.mode & 0o022) !== 0;
+        if (untrustedOwnerCanWrite || groupOrOtherCanWrite) {
+            const stickyProtectsChild = (ancestorStats.mode & 0o1000) !== 0
+                && trustedOwner(ancestorStats.uid)
+                && trustedOwner(childStats.uid);
+            if (!stickyProtectsChild) {
+                throw new UnsafeHostAuthorityFileError('宿主凭证目录可被不可信祖先目录替换');
+            }
+        }
+        childPath = ancestorPath;
+        childStats = ancestorStats;
+    }
+}
+/** Create/resolve the parent without ever resolving the final path component. */
+export function secureHostFilePath(filePath) {
+    const parent = dirname(filePath);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const canonicalParent = realpathSync(parent);
+    const parentStats = statSync(canonicalParent);
+    if (!parentStats.isDirectory()) {
+        throw new UnsafeHostAuthorityFileError('宿主凭证目录不是普通目录');
+    }
+    assertOwnedByCurrentUser(parentStats, '宿主凭证目录');
+    if (process.platform !== 'win32' && (parentStats.mode & 0o022) !== 0) {
+        throw new UnsafeHostAuthorityFileError('宿主凭证目录可被组内或其它用户写入');
+    }
+    assertAncestorChainCannotReplace(canonicalParent);
+    return join(canonicalParent, basename(filePath));
+}
+function assertSecureFileStats(stats, maxBytes) {
+    if (!stats.isFile()) {
+        throw new UnsafeHostAuthorityFileError('宿主凭证必须是普通文件');
+    }
+    assertOwnedByCurrentUser(stats, '宿主凭证文件');
+    if (process.platform !== 'win32' && (stats.mode & 0o777) !== 0o600) {
+        throw new UnsafeHostAuthorityFileError('宿主凭证文件权限必须严格为 0600');
+    }
+    if (stats.size < 0 || stats.size > maxBytes) {
+        throw new UnsafeHostAuthorityFileError('宿主凭证文件大小异常');
+    }
+}
+/** Return null only for a genuinely absent leaf; unsafe shapes fail closed. */
+export function readSecureHostFileSync(filePath, maxBytes = 64 * 1024) {
+    try {
+        lstatSync(dirname(filePath));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    const resolved = secureHostFilePath(filePath);
+    let fd;
+    try {
+        const flags = process.platform === 'win32'
+            ? constants.O_RDONLY
+            : constants.O_RDONLY | constants.O_NOFOLLOW;
+        fd = openSync(resolved, flags);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        if (error.code === 'ELOOP') {
+            throw new UnsafeHostAuthorityFileError('宿主凭证拒绝符号链接');
+        }
+        throw error;
+    }
+    try {
+        const before = fstatSync(fd);
+        assertSecureFileStats(before, maxBytes);
+        const pathStats = lstatSync(resolved);
+        if (pathStats.isSymbolicLink() || !sameInode(before, pathStats)) {
+            throw new UnsafeHostAuthorityFileError('宿主凭证路径在读取时发生变化');
+        }
+        const raw = readFileSync(fd, 'utf8');
+        const after = fstatSync(fd);
+        if (!sameInode(before, after)
+            || before.size !== after.size
+            || before.mtimeMs !== after.mtimeMs
+            || before.ctimeMs !== after.ctimeMs) {
+            throw new UnsafeHostAuthorityFileError('宿主凭证在读取时发生变化');
+        }
+        return raw;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Strict, durable atomic replace that never follows a leaf symlink. */
+export function writeSecureHostFileSync(filePath, data) {
+    const resolved = secureHostFilePath(filePath);
+    let leafExists = false;
+    try {
+        lstatSync(resolved);
+        leafExists = true;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (leafExists) {
+        // Pin and validate the existing leaf before replacement. The final rename
+        // never follows a leaf symlink, so a later swap cannot redirect the write.
+        readSecureHostFileSync(resolved);
+    }
+    atomicWriteFileSync(resolved, data, {
+        mode: 0o600,
+        durable: true,
+        followTargetSymlink: false,
+    });
+}
+/** Strict durable unlink. Returns false only if the leaf is absent. */
+export function unlinkSecureHostFileSync(filePath) {
+    const resolved = secureHostFilePath(filePath);
+    if (readSecureHostFileSync(resolved) === null)
+        return false;
+    unlinkSync(resolved);
+    if (process.platform !== 'win32') {
+        const fd = openSync(dirname(resolved), constants.O_RDONLY);
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=secure-host-file.js.map

package/dist/platform/secure-host-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-host-file.js","sourceRoot":"","sources":["../../src/platform/secure-host-file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,SAAS,CAChB,IAAkD,EAClD,KAAmD;IAEnD,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,SAAS,wBAAwB,CAAC,KAA8B,EAAE,KAAa;IAC7E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAC5D,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gCAAgC,CAAC,eAAuB;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC;IACrE,IAAI,SAAS,GAAG,eAAe,CAAC;IAChC,IAAI,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAErC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO;QACvC,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,4BAA4B,CAAC,cAAc,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,sBAAsB,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC;eAC1D,CAAC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,oBAAoB,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,sBAAsB,IAAI,oBAAoB,EAAE,CAAC;YACnD,MAAM,mBAAmB,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;mBAC1D,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC;mBAC/B,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,SAAS,GAAG,YAAY,CAAC;QACzB,UAAU,GAAG,aAAa,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,4BAA4B,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,wBAAwB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,gCAAgC,CAAC,eAAe,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA8B,EAAE,QAAgB;IAC7E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,4BAA4B,CAAC,aAAa,CAAC,CAAC;IACxD,CAAC;IACD,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,4BAA4B,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,QAAQ,GAAG,EAAE,GAAG,IAAI;IAC3E,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;YACxC,CAAC,CAAC,SAAS,CAAC,QAAQ;YACpB,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC;QAC9C,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,IAAI,4BAA4B,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,IACE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;eACtB,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;eAC1B,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eAChC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EACnC,CAAC;YACD,MAAM,IAAI,4BAA4B,CAAC,cAAc,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,IAAY;IACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpB,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,0EAA0E;QAC1E,2EAA2E;QAC3E,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE;QAClC,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,IAAI;QACb,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,sBAAsB,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/schedule-store.d.ts

@@ -1,4 +1,4 @@
-import type { ScheduledTask, ParsedSchedule } from '../types.js';
+import type { ScheduledTask, ParsedSchedule, ScheduleExecutionPosition } from '../types.js';
 /**
  * Raised by `createTask` when an `id` is supplied but a task already exists
  * with that id AND its canonical input differs from the incoming params.
@@ -46,6 +46,8 @@ export declare function canonicalScheduleInput(t: {
     chatType?: 'group' | 'p2p' | 'topic_group';
     rootMessageId?: string;
     scope?: 'thread' | 'chat';
+    executionPosition?: ScheduleExecutionPosition;
+    topicTitle?: string;
     larkAppId?: string;
     repeat?: {
         times: number | null;
@@ -82,6 +84,8 @@ export declare function createTask(params: {
     chatId: string;
     rootMessageId?: string;
     scope?: 'thread' | 'chat';
+    executionPosition?: ScheduleExecutionPosition;
+    topicTitle?: string;
     chatType?: 'group' | 'p2p' | 'topic_group';
     larkAppId?: string;
     creatorChatId?: string;
@@ -97,7 +101,7 @@ export declare function createTask(params: {
 }): ScheduledTask;
 export declare function getTask(id: string): ScheduledTask | undefined;
 export declare function removeTask(id: string): boolean;
-export declare function updateTask(id: string, updates: Partial<Pick<ScheduledTask, 'enabled' | 'lastRunAt' | 'nextRunAt' | 'lastStatus' | 'lastError' | 'lastDeliveryError' | 'repeat' | 'rootMessageId' | 'chatType' | 'deliver' | 'name' | 'prompt' | 'schedule' | 'parsed' | 'silent' | 'workingDir'>>): void;
+export declare function updateTask(id: string, updates: Partial<Pick<ScheduledTask, 'enabled' | 'lastRunAt' | 'nextRunAt' | 'lastStatus' | 'lastError' | 'lastDeliveryError' | 'repeat' | 'rootMessageId' | 'scope' | 'executionPosition' | 'topicTitle' | 'chatType' | 'deliver' | 'name' | 'prompt' | 'schedule' | 'parsed' | 'silent' | 'workingDir'>>): void;
 /**
  * Record a run outcome and auto-manage repeat counter.  If the task has a
  * finite repeat count and we've hit it, the task is removed.

package/dist/services/schedule-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schedule-store.d.ts","sourceRoot":"","sources":["../../src/services/schedule-store.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIjE;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;gBACvB,MAAM,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;CAUF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,aAAa,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAgCV;AAcD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AA4GD,wBAAgB,sCAAsC,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI,CAK9E;AAsHD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,aAAa,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,aAAa,CAqDhB;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAG7D;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAO9C;AAED,wBAAgB,UAAU,CACxB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EACjC,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,mBAAmB,GAAG,QAAQ,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CACrN,CAAC,GACD,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CA+BlG;AAED,wBAAgB,SAAS,IAAI,aAAa,EAAE,CAG3C;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAOvE;AAcD,wBAAgB,yBAAyB,IAAI,IAAI,CAsDhD"}
+{"version":3,"file":"schedule-store.d.ts","sourceRoot":"","sources":["../../src/services/schedule-store.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAI5F;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;gBACvB,MAAM,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;CAUF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,aAAa,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAkCV;AAcD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAuHD,wBAAgB,sCAAsC,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI,CAK9E;AAsHD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,aAAa,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,aAAa,CAyDhB;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAG7D;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAO9C;AAED,wBAAgB,UAAU,CACxB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EACjC,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,mBAAmB,GAAG,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,mBAAmB,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CACpQ,CAAC,GACD,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CA+BlG;AAED,wBAAgB,SAAS,IAAI,aAAa,EAAE,CAG3C;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAOvE;AAcD,wBAAgB,yBAAyB,IAAI,IAAI,CAsDhD"}