botmux 3.3.0 → 3.4.0

package/dist/platform/binding.js

@@ -1,25 +1,32 @@
 // 平台绑定状态：存在 ~/.botmux/platform.json，记录这台机器绑到了哪个平台。
-import { readFileSync, existsSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { atomicWriteFileSync } from '../utils/atomic-write.js';
+import { readSecureHostFileSync, unlinkSecureHostFileSync, UnsafeHostAuthorityFileError, writeSecureHostFileSync, } from './secure-host-file.js';
 export const PLATFORM_BINDING_PATH = join(homedir(), '.botmux', 'platform.json');
 export function readPlatformBinding() {
     try {
-        if (!existsSync(PLATFORM_BINDING_PATH))
+        const raw = readSecureHostFileSync(PLATFORM_BINDING_PATH);
+        if (raw === null)
             return null;
-        const obj = JSON.parse(readFileSync(PLATFORM_BINDING_PATH, 'utf8'));
+        const obj = JSON.parse(raw);
         if (obj && typeof obj.platformUrl === 'string' && typeof obj.machineToken === 'string' && typeof obj.machineId === 'string') {
             return obj;
         }
     }
-    catch {
-        /* ignore */
+    catch (error) {
+        // File-missing / parse failures still mean "unbound". Permission/symlink
+        // failures are different: treat as unbound for callers, but log a clear
+        // recovery hint so a hand-copied platform.json does not look like a silent
+        // drop-binding mystery.
+        if (error instanceof UnsafeHostAuthorityFileError) {
+            console.error(`[platform-binding] 拒绝读取 ${PLATFORM_BINDING_PATH}: ${error.message}`
+                + '（请确保文件权限为 0600、路径不是符号链接，且 ~/.botmux 不可被组/其他用户写入；例: chmod 600 ~/.botmux/platform.json）');
+        }
     }
     return null;
 }
 export function writePlatformBinding(b) {
-    atomicWriteFileSync(PLATFORM_BINDING_PATH, JSON.stringify(b, null, 2), { mode: 0o600 });
+    writeSecureHostFileSync(PLATFORM_BINDING_PATH, `${JSON.stringify(b, null, 2)}\n`);
 }
 /**
  * 解绑：删除本地平台绑定文件（~/.botmux/platform.json）。
@@ -28,8 +35,7 @@ export function writePlatformBinding(b) {
  */
 export function clearPlatformBinding() {
     try {
-        if (existsSync(PLATFORM_BINDING_PATH))
-            rmSync(PLATFORM_BINDING_PATH);
+        unlinkSecureHostFileSync(PLATFORM_BINDING_PATH);
     }
     catch {
         /* ignore */

package/dist/platform/binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/platform/binding.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAwB/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAEjF,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5H,OAAO,GAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAkB;IACrD,mBAAmB,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,qBAAqB,CAAC;YAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;IAChB,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/platform/binding.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAwB/B,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAEjF,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;QAC1D,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5H,OAAO,GAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,wBAAwB;QACxB,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,OAAO,CAAC,KAAK,CACX,2BAA2B,qBAAqB,KAAK,KAAK,CAAC,OAAO,EAAE;kBAClE,uFAAuF,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAkB;IACrD,uBAAuB,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC;QACH,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;IAChB,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/platform/device-command.d.ts

@@ -0,0 +1,35 @@
+import { type PlatformBinding } from './binding.js';
+import { type DeviceCredentialPathOptions, type DevicePublicStatus } from './device.js';
+import { type DeviceEnrollmentApi } from './device-enroll.js';
+export type { DeviceEnrollmentApi } from './device-enroll.js';
+export interface DeviceCommandDependencies extends DeviceCredentialPathOptions {
+    env?: NodeJS.ProcessEnv;
+    dataDir?: string;
+    startPid?: number;
+    stdout?: (line: string) => void;
+    stderr?: (line: string) => void;
+    readBinding?: () => PlatformBinding | null;
+    createClient?: (issuer: string) => DeviceEnrollmentApi;
+    hostName?: () => string;
+    isAgentContext?: () => boolean;
+    now?: () => Date;
+    isolationSupported?: () => boolean;
+    ensureIsolationMarker?: () => {
+        created: boolean;
+        path: string;
+    };
+    activateIsolation?: () => Promise<{
+        activated: boolean;
+        daemonCount: number;
+    }>;
+}
+/**
+ * UX guard for accidental invocation from a managed AI CLI. The mandatory OS
+ * credential mask is the actual security boundary; this early check only
+ * provides a clearer error. Never trust child-controlled SESSION_DATA_DIR/HOME
+ * when consulting the daemon breadcrumb and PID markers.
+ */
+export declare function isManagedAgentDeviceCommandContext(options?: Pick<DeviceCommandDependencies, 'env' | 'dataDir' | 'startPid'>): boolean;
+export declare function serializeDevicePublicStatus(status: DevicePublicStatus): string;
+export declare function runDeviceCommand(args: string[], dependencies?: DeviceCommandDependencies): Promise<number>;
+//# sourceMappingURL=device-command.d.ts.map

package/dist/platform/device-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-command.d.ts","sourceRoot":"","sources":["../../src/platform/device-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAYzE,OAAO,EAIL,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,WAAW,yBAA0B,SAAQ,2BAA2B;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IAC3C,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,mBAAmB,CAAC;IACvD,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChF;AASD;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,IAAI,CAAC,yBAAyB,EAAE,KAAK,GAAG,SAAS,GAAG,UAAU,CAAM,GAC5E,OAAO,CAET;AA8CD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAE9E;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EAAE,EACd,YAAY,GAAE,yBAA8B,GAC3C,OAAO,CAAC,MAAM,CAAC,CA6HjB"}

package/dist/platform/device-command.js

@@ -0,0 +1,187 @@
+/** Host-only `botmux device ...` command surface. */
+import { hostname } from 'node:os';
+import { readPlatformBinding } from './binding.js';
+import { isManagedAgentHostCommandContext, } from './host-command-context.js';
+import { deviceCredentialIsolationSupported, ensureDeviceCredentialIsolationMarker, } from './device-isolation.js';
+import { activateDeviceCredentialIsolation, DeviceIsolationDaemonActivationError, } from './device-isolation-activation-client.js';
+import { DeviceCredentialError, readDeviceCredentials, readDevicePublicStatus, } from './device.js';
+import { clearStoredDeviceCredentials, DeviceEnrollmentClient, DeviceProtocolError, enrollStoredDeviceCredentials, } from './device-enroll.js';
+const DEVICE_USAGE = `用法:
+  botmux device enroll [--name <设备名>]
+  botmux device status [--json]
+  botmux device logout
+
+这些命令只能从宿主终端运行，botmux 管理的 AI CLI 会话内一律拒绝。`;
+/**
+ * UX guard for accidental invocation from a managed AI CLI. The mandatory OS
+ * credential mask is the actual security boundary; this early check only
+ * provides a clearer error. Never trust child-controlled SESSION_DATA_DIR/HOME
+ * when consulting the daemon breadcrumb and PID markers.
+ */
+export function isManagedAgentDeviceCommandContext(options = {}) {
+    return isManagedAgentHostCommandContext(options);
+}
+function parseEnrollName(args) {
+    let name;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--name') {
+            const value = args[++i];
+            if (!value || value.startsWith('-'))
+                return { ok: false };
+            name = value;
+            continue;
+        }
+        if (arg.startsWith('--name=')) {
+            name = arg.slice('--name='.length);
+            if (!name)
+                return { ok: false };
+            continue;
+        }
+        return { ok: false };
+    }
+    return { ok: true, ...(name !== undefined ? { name } : {}) };
+}
+function validDeviceName(raw) {
+    const name = raw.trim();
+    if (!name || name.length > 80 || /[\u0000-\u001f\u007f]/.test(name))
+        return null;
+    return name;
+}
+function formatDeviceExpiry(deviceExp) {
+    const date = new Date(deviceExp);
+    return Number.isNaN(date.getTime()) ? String(deviceExp) : date.toISOString();
+}
+function safeErrorMessage(error) {
+    if (error instanceof DeviceCredentialError
+        || error instanceof DeviceProtocolError
+        || error instanceof DeviceIsolationDaemonActivationError) {
+        return error.message;
+    }
+    // Do not reflect arbitrary transport/parser errors: third-party code may
+    // accidentally include a bearer or response body in Error.message.
+    return '设备操作失败；请检查平台连接和本地凭证文件后重试';
+}
+export function serializeDevicePublicStatus(status) {
+    return JSON.stringify(status);
+}
+export async function runDeviceCommand(args, dependencies = {}) {
+    const stdout = dependencies.stdout ?? console.log;
+    const stderr = dependencies.stderr ?? console.error;
+    const subcommand = (args[0] ?? 'status').toLowerCase();
+    const rest = args.slice(1);
+    if (subcommand === 'help' || subcommand === '--help' || subcommand === '-h') {
+        stdout(DEVICE_USAGE);
+        return 0;
+    }
+    if (!['enroll', 'status', 'logout'].includes(subcommand)) {
+        stderr(DEVICE_USAGE);
+        return 2;
+    }
+    const inAgent = dependencies.isAgentContext
+        ? dependencies.isAgentContext()
+        : isManagedAgentDeviceCommandContext(dependencies);
+    if (inAgent) {
+        stderr('❌ botmux device 命令只能在宿主终端执行；AI CLI 会话不能读取或修改设备凭证。');
+        return 2;
+    }
+    const pathOptions = {
+        ...(dependencies.homeDir !== undefined ? { homeDir: dependencies.homeDir } : {}),
+        ...(dependencies.filePath !== undefined ? { filePath: dependencies.filePath } : {}),
+    };
+    try {
+        if (subcommand === 'status') {
+            if (rest.some(arg => arg !== '--json')) {
+                stderr(DEVICE_USAGE);
+                return 2;
+            }
+            const status = readDevicePublicStatus(pathOptions);
+            if (rest.includes('--json')) {
+                stdout(serializeDevicePublicStatus(status));
+            }
+            else if (!status.enrolled) {
+                stdout('未注册 desktop device。运行 `botmux device enroll` 开始注册。');
+            }
+            else {
+                stdout('✓ Desktop device 已注册');
+                stdout(`  平台: ${status.issuer}`);
+                stdout(`  绝对到期: ${formatDeviceExpiry(status.deviceExp)}`);
+                stdout(`  本地凭证更新时间: ${status.savedAt}`);
+            }
+            return 0;
+        }
+        if (subcommand === 'logout') {
+            if (rest.length > 0) {
+                stderr(DEVICE_USAGE);
+                return 2;
+            }
+            if (readDeviceCredentials(pathOptions)) {
+                (dependencies.ensureIsolationMarker ?? (() => ensureDeviceCredentialIsolationMarker({
+                    ...(dependencies.homeDir !== undefined ? { homeDir: dependencies.homeDir } : {}),
+                    ...(dependencies.now ? { now: dependencies.now } : {}),
+                })))();
+            }
+            const removed = await clearStoredDeviceCredentials(pathOptions);
+            if (removed) {
+                stdout('✓ 已删除本机 desktop device 凭证。');
+                stdout('  这不会替代服务端吊销；若凭证可能泄露，请同时在平台设备管理页吊销该设备。');
+            }
+            else {
+                stdout('本机没有 desktop device 凭证，无需退出。');
+            }
+            return 0;
+        }
+        const parsed = parseEnrollName(rest);
+        if (!parsed.ok) {
+            stderr(DEVICE_USAGE);
+            return 2;
+        }
+        const deviceName = validDeviceName(parsed.name ?? (dependencies.hostName ?? hostname)());
+        if (!deviceName) {
+            stderr('设备名不能为空、不能包含控制字符，且最长 80 个字符。');
+            return 2;
+        }
+        const isolationSupported = (dependencies.isolationSupported
+            ?? deviceCredentialIsolationSupported)();
+        if (!isolationSupported) {
+            stderr('本机无法建立 mandatory device credential isolation；Windows 本期不支持，macOS 需要 sandbox-exec，Linux 需要 bubblewrap。拒绝注册。');
+            return 1;
+        }
+        if (readDeviceCredentials(pathOptions)) {
+            stderr('本机已有 desktop device 凭证；如需换平台或重新注册，请先执行 `botmux device logout`。');
+            return 1;
+        }
+        const binding = (dependencies.readBinding ?? readPlatformBinding)();
+        if (!binding) {
+            stderr('本机尚未绑定平台。请先从平台网页复制并执行 `botmux bind <凭证>`。');
+            return 1;
+        }
+        const activation = await (dependencies.activateIsolation ?? (() => activateDeviceCredentialIsolation({
+            ...(dependencies.homeDir !== undefined ? { homeDir: dependencies.homeDir } : {}),
+            ...(dependencies.now ? { now: dependencies.now } : {}),
+        })))();
+        if (activation.activated) {
+            stdout(`✓ 已冻结并清退 ${activation.daemonCount} 个 daemon 的旧本地 CLI，会话后续将在凭证隔离下冷启动。`);
+        }
+        const client = (dependencies.createClient ?? ((issuer) => new DeviceEnrollmentClient(issuer)))(binding.platformUrl);
+        const stored = await enrollStoredDeviceCredentials({
+            client,
+            machineToken: binding.machineToken,
+            deviceName,
+            ...pathOptions,
+            ...(dependencies.now ? { now: dependencies.now } : {}),
+            onGrantReady: () => {
+                stdout('已向机器 owner 发送飞书确认，请在 5 分钟内确认本次 desktop device 注册…');
+            },
+        });
+        stdout('✓ Desktop device 注册完成，凭证已安全写入本机（0600）。');
+        stdout(`  平台: ${stored.issuer}`);
+        stdout(`  绝对到期: ${formatDeviceExpiry(stored.deviceExp)}`);
+        return 0;
+    }
+    catch (error) {
+        stderr(`❌ ${safeErrorMessage(error)}`);
+        return 1;
+    }
+}
+//# sourceMappingURL=device-command.js.map

package/dist/platform/device-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-command.js","sourceRoot":"","sources":["../../src/platform/device-command.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAwB,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,gCAAgC,GACjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iCAAiC,EACjC,oCAAoC,GACrC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GAGvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,GAE9B,MAAM,oBAAoB,CAAC;AAmB5B,MAAM,YAAY,GAAG;;;;;yCAKoB,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,UAA2E,EAAE;IAE7E,OAAO,gCAAgC,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACrC,IAAI,IAAwB,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAC1D,IAAI,GAAG,KAAK,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IACE,KAAK,YAAY,qBAAqB;WACnC,KAAK,YAAY,mBAAmB;WACpC,KAAK,YAAY,oCAAoC,EACxD,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,yEAAyE;IACzE,mEAAmE;IACnE,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA0B;IACpE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAc,EACd,eAA0C,EAAE;IAE5C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACpD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc;QACzC,CAAC,CAAC,YAAY,CAAC,cAAc,EAAE;QAC/B,CAAC,CAAC,kCAAkC,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAgC;QAC/C,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,YAAY,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACrB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,oDAAoD,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBAC/B,MAAM,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjC,MAAM,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC1D,MAAM,CAAC,eAAe,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,YAAY,CAAC,CAAC;gBACrB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvC,CAAC,YAAY,CAAC,qBAAqB,IAAI,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC;oBAClF,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC,CAAC,EAAE,CAAC;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,WAAW,CAAC,CAAC;YAChE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,4BAA4B,CAAC,CAAC;gBACrC,MAAM,CAAC,wCAAwC,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,YAAY,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,kBAAkB,GAAG,CAAC,YAAY,CAAC,kBAAkB;eACtD,kCAAkC,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,CAAC,4GAA4G,CAAC,CAAC;YACrH,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,gEAAgE,CAAC,CAAC;YACzE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,WAAW,IAAI,mBAAmB,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,2CAA2C,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAChE,iCAAiC,CAAC;YAChC,GAAG,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,UAAU,CAAC,WAAW,oCAAoC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,YAAY,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CACpG,OAAO,CAAC,WAAW,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;YACjD,MAAM;YACN,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU;YACV,GAAG,WAAW;YACd,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,YAAY,EAAE,GAAG,EAAE;gBACjB,MAAM,CAAC,mDAAmD,CAAC,CAAC;YAC9D,CAAC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACjD,MAAM,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/platform/device-enroll.d.ts

@@ -0,0 +1,156 @@
+import { type DeviceCredentialPathOptions, type DeviceCredentials } from './device.js';
+export declare const DEVICE_ENROLL_ENDPOINTS: Readonly<{
+    begin: "/api/devices/enroll";
+    poll: "/api/devices/enroll/poll";
+    refresh: "/api/devices/refresh";
+}>;
+export interface DeviceEnrollEndpoints {
+    begin: string;
+    poll: string;
+    refresh: string;
+}
+/**
+ * Wire contract consumed by the open client. The closed-source server owns
+ * implementation details but must return these fields before the CLI is
+ * enabled end-to-end.
+ */
+export interface DeviceEnrollmentGrant {
+    grantId: string;
+    pollSecret: string;
+    /** Absolute grant expiry as Unix epoch ms. */
+    expiresAt: number;
+    /** Server-requested minimum polling delay. Optional; Retry-After also works. */
+    pollIntervalMs?: number;
+}
+export interface DeviceTokenPair {
+    accessToken: string;
+    /** Absolute access-token expiry as Unix epoch ms; used for proactive lease renewal. */
+    accessExpiresAt: number;
+    refreshToken: string;
+    /** Absolute device expiry as Unix epoch ms. */
+    deviceExp: number;
+}
+export type DeviceEnrollmentPoll = {
+    kind: 'pending';
+    retryAfterMs: number;
+} | {
+    kind: 'issued';
+    credentials: DeviceTokenPair;
+} | {
+    kind: 'denied';
+} | {
+    kind: 'expired';
+};
+export interface DeviceEnrollmentApi {
+    readonly issuer: string;
+    beginEnrollment(input: BeginDeviceEnrollmentInput): Promise<DeviceEnrollmentGrant>;
+    waitForEnrollment(grant: DeviceEnrollmentGrant, options?: WaitForDeviceEnrollmentOptions): Promise<DeviceTokenPair>;
+}
+export interface BeginDeviceEnrollmentInput {
+    machineToken: string;
+    deviceName: string;
+    deviceKind?: 'desktop-ide';
+    signal?: AbortSignal;
+}
+export interface WaitForDeviceEnrollmentOptions {
+    /** Local upper bound; server grant expiry can shorten it. Defaults to 5min. */
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    onPending?: () => void;
+}
+export interface RefreshDeviceOptions {
+    /** Durable idempotency key; required by the safe stored-refresh path. */
+    requestId: string;
+    signal?: AbortSignal;
+}
+export interface StoredDeviceRefreshOptions extends DeviceCredentialPathOptions {
+    signal?: AbortSignal;
+    now?: () => Date;
+    requestIdFactory?: () => string;
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    createClient?: (issuer: string) => Pick<DeviceEnrollmentClient, 'issuer' | 'refresh'>;
+}
+export interface StoredDeviceMutationOptions extends DeviceCredentialPathOptions {
+    now?: () => Date;
+}
+export interface DeviceHttpRequest {
+    url: string;
+    method: 'POST';
+    headers: Readonly<Record<string, string>>;
+    body: unknown;
+    timeoutMs: number;
+    signal?: AbortSignal;
+}
+export interface DeviceHttpResponse {
+    status: number;
+    body: unknown;
+    /** Header names must be lowercase. */
+    headers?: Readonly<Record<string, string | undefined>>;
+}
+export type DeviceHttpTransport = (request: DeviceHttpRequest) => Promise<DeviceHttpResponse>;
+export interface DeviceEnrollmentClientOptions {
+    transport?: DeviceHttpTransport;
+    endpoints?: Partial<DeviceEnrollEndpoints>;
+    timeoutMs?: number;
+    now?: () => number;
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+}
+export declare class DeviceProtocolError extends Error {
+    readonly code: 'network_error' | 'invalid_response' | 'request_rejected' | 'enrollment_timeout' | 'enrollment_denied' | 'enrollment_expired' | 'aborted';
+    readonly status?: number | undefined;
+    readonly serverCode?: DeviceProtocolServerCode | undefined;
+    /** Parsed and bounded Retry-After delay for a transient HTTP response. */
+    readonly retryAfterMs?: number | undefined;
+    constructor(message: string, code: 'network_error' | 'invalid_response' | 'request_rejected' | 'enrollment_timeout' | 'enrollment_denied' | 'enrollment_expired' | 'aborted', status?: number | undefined, serverCode?: DeviceProtocolServerCode | undefined, 
+    /** Parsed and bounded Retry-After delay for a transient HTTP response. */
+    retryAfterMs?: number | undefined);
+}
+export type DeviceProtocolServerCode = 'bad_request' | 'invalid_refresh' | 'device_gone' | 'device_revoked' | 'device_expired' | 'recovery_required' | 'refresh_in_progress' | 'store_unavailable';
+/**
+ * Small JSON transport with a bounded response and no redirect following.
+ * Redirects are surfaced as a rejection so a bearer can never cross origins.
+ */
+export declare const nodeDeviceHttpTransport: DeviceHttpTransport;
+export declare class DeviceEnrollmentClient {
+    readonly issuer: string;
+    private readonly transport;
+    private readonly endpoints;
+    private readonly timeoutMs;
+    private readonly now;
+    private readonly sleep;
+    constructor(issuer: string, options?: DeviceEnrollmentClientOptions);
+    private normalizeEndpoint;
+    private post;
+    beginEnrollment(input: BeginDeviceEnrollmentInput): Promise<DeviceEnrollmentGrant>;
+    pollEnrollment(grant: Pick<DeviceEnrollmentGrant, 'grantId' | 'pollSecret'>, signal?: AbortSignal): Promise<DeviceEnrollmentPoll>;
+    waitForEnrollment(grant: DeviceEnrollmentGrant, options?: WaitForDeviceEnrollmentOptions): Promise<DeviceTokenPair>;
+    /**
+     * Send one refresh attempt. The stored-credential coordinator performs
+     * bounded same-key retries for ambiguous failures inside the replay window;
+     * keeping retry policy outside this wire primitive also keeps direct callers
+     * from accidentally retrying with a new key.
+     */
+    refresh(refreshToken: string, options: RefreshDeviceOptions): Promise<DeviceTokenPair>;
+}
+export { DEVICE_ENROLLMENT_JOURNAL_FILE } from './device-paths.js';
+export interface StoredDeviceEnrollmentOptions extends StoredDeviceMutationOptions {
+    client: DeviceEnrollmentApi;
+    machineToken: string;
+    deviceName: string;
+    signal?: AbortSignal;
+    onPending?: () => void;
+    onGrantReady?: () => void;
+}
+export declare function deviceEnrollmentJournalPath(options?: DeviceCredentialPathOptions): string;
+/**
+ * Crash-safe F1 enrollment coordinator.
+ *
+ * The grant/poll secret is durably journaled before polling. A later host
+ * process resumes the same grant, and an issued response is installed together
+ * with journal cleanup under the same device lock.
+ */
+export declare function enrollStoredDeviceCredentials(options: StoredDeviceEnrollmentOptions): Promise<DeviceCredentials>;
+/** Serialize logout with refresh/install so a completed refresh cannot revive it. */
+export declare function clearStoredDeviceCredentials(options?: DeviceCredentialPathOptions): Promise<boolean>;
+export declare function refreshStoredDeviceCredentials(options?: StoredDeviceRefreshOptions, foreignJournalDepth?: number): Promise<DeviceCredentials>;
+//# sourceMappingURL=device-enroll.d.ts.map

package/dist/platform/device-enroll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-enroll.d.ts","sourceRoot":"","sources":["../../src/platform/device-enroll.ts"],"names":[],"mappings":"AAcA,OAAO,EAOL,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAOrB,eAAO,MAAM,uBAAuB;;;;EAIlC,CAAC;AAEH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,eAAe,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAExB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnF,iBAAiB,CACf,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B;IAC7C,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,0BAA2B,SAAQ,2BAA2B;IAC7E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;CACvF;AAED,MAAM,WAAW,2BAA4B,SAAQ,2BAA2B;IAC9E,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAQD,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,sCAAsC;IACtC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAE9F,MAAM,WAAW,6BAA6B;IAC5C,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,oBAAoB,GACpB,SAAS;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,wBAAwB;IAC9C,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM;gBAZ9B,OAAO,EAAE,MAAM,EACN,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,oBAAoB,GACpB,SAAS,EACJ,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,UAAU,CAAC,EAAE,wBAAwB,YAAA;IAC9C,0EAA0E;IACjE,YAAY,CAAC,EAAE,MAAM,YAAA;CAKjC;AAED,MAAM,MAAM,wBAAwB,GAChC,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,mBAAmB,CAAC;AA2JxB;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAoDrC,CAAC;AAEF,qBAAa,sBAAsB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsD;gBAEhE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,6BAAkC;IAcvE,OAAO,CAAC,iBAAiB;YA4BX,IAAI;IAkCZ,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAiBlF,cAAc,CAClB,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,GAAG,YAAY,CAAC,EAC5D,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC;IA0B1B,iBAAiB,CACrB,KAAK,EAAE,qBAAqB,EAC5B,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,eAAe,CAAC;IAsB3B;;;;;OAKG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;CAwB7F;AAED,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAenE,MAAM,WAAW,6BAA8B,SAAQ,2BAA2B;IAChF,MAAM,EAAE,mBAAmB,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,2BAAgC,GACxC,MAAM,CAER;AA+ED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,iBAAiB,CAAC,CAmH5B;AA2GD,qFAAqF;AACrF,wBAAsB,4BAA4B,CAChD,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC,CAYlB;AAeD,wBAAsB,8BAA8B,CAClD,OAAO,GAAE,0BAA+B,EACxC,mBAAmB,SAAI,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAoJ5B"}