botmux 3.3.0 → 3.4.1

package/dist/core/device-isolation-daemon.js

@@ -0,0 +1,591 @@
+/**
+ * Daemon half of the one-way device-credential isolation transaction.
+ *
+ * The host coordinator writes the marker, but only the daemon can prove that
+ * every CLI it owns has stopped.  A short spawn freeze closes the inventory
+ * race; private worker IPC supplies process identities that the CLI cannot
+ * forge; backend-native teardown handles detached multiplexer sessions.
+ */
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { deviceCredentialIsolationMarkerPath } from '../adapters/cli/read-isolation.js';
+import { config } from '../config.js';
+import { readSecureHostFileSync } from '../platform/secure-host-file.js';
+import { logger } from '../utils/logger.js';
+import { acquireDeviceIsolationFreeze, bindDeviceIsolationFreezeInventoryGeneration, DEVICE_ISOLATION_ACTIVATION_VERSION, releaseDeviceIsolationFreeze, requireDeviceIsolationFreeze, } from './device-isolation-activation.js';
+import { killPersistentSession, persistentSessionName, probePersistentSession, } from './persistent-backend.js';
+import { readProcessStartIdentity } from './session-marker.js';
+import { killWorker, listActiveSessions } from './worker-pool.js';
+export const DEVICE_ISOLATION_PREPARE_PATH = '/api/device-isolation/activation/prepare';
+export const DEVICE_ISOLATION_COMMIT_PATH = '/api/device-isolation/activation/commit';
+export const DEVICE_ISOLATION_RELEASE_PATH = '/api/device-isolation/activation/release';
+let daemonIdentity = null;
+let transaction = null;
+function isPersistentBackend(value) {
+    return value === 'tmux' || value === 'herdr' || value === 'zellij';
+}
+function isLocalBackend(value) {
+    return value === 'pty' || isPersistentBackend(value);
+}
+function safeProcessExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+}
+function defaultRuntimeSessions() {
+    return listActiveSessions().map((ds) => {
+        const workerPresent = !!ds.worker && !ds.worker.killed;
+        const workerPid = workerPresent ? ds.worker?.pid : undefined;
+        const workerStart = workerPid ? readProcessStartIdentity(workerPid) : undefined;
+        const attestation = ds.localProcessAttestation;
+        const cli = attestation?.cliPid && attestation.cliProcStart
+            ? { pid: attestation.cliPid, procStart: attestation.cliProcStart }
+            : undefined;
+        return {
+            sessionId: ds.session.sessionId,
+            adopted: !!(ds.adoptedFrom || ds.initConfig?.adoptMode || ds.session.adoptedFrom),
+            frozenBackend: ds.initConfig?.backendType ?? ds.session.backendType,
+            workerPresent,
+            ...(ds.workerGeneration !== undefined ? { workerGeneration: ds.workerGeneration } : {}),
+            ...(workerPid && workerStart ? { worker: { pid: workerPid, procStart: workerStart } } : {}),
+            ...(attestation ? {
+                attestation: {
+                    backendType: attestation.backendType,
+                    credentialIsolated: attestation.credentialIsolated,
+                    ...(cli ? { cli } : {}),
+                    ...(attestation.workerGeneration !== undefined
+                        ? { workerGeneration: attestation.workerGeneration }
+                        : {}),
+                },
+            } : {}),
+            source: ds,
+        };
+    });
+}
+const defaultDependencies = {
+    now: () => Date.now(),
+    listSessions: defaultRuntimeSessions,
+    processStart: readProcessStartIdentity,
+    processExists: safeProcessExists,
+    signalProcess: (pid, signal) => { process.kill(pid, signal); },
+    probePersistent: probePersistentSession,
+    killPersistent: killPersistentSession,
+    closeWorker: (session) => {
+        if (!session.source)
+            throw new Error('missing daemon session handle');
+        killWorker(session.source);
+    },
+    readMarker: () => readSecureHostFileSync(deviceCredentialIsolationMarkerPath(homedir()), 4 * 1024),
+    sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+    dataDir: () => config.session.dataDir,
+};
+let dependencies = defaultDependencies;
+function resolvedBackend(session) {
+    return session.frozenBackend ?? session.attestation?.backendType ?? 'unknown';
+}
+function blockerEntry(session, backendType, blocker) {
+    return {
+        sessionId: session.sessionId,
+        backendType,
+        disposition: 'blocked',
+        ...(session.worker ? { worker: session.worker } : {}),
+        ...(session.attestation?.cli ? { cli: session.attestation.cli } : {}),
+        ...(session.workerGeneration !== undefined
+            ? { workerGeneration: session.workerGeneration }
+            : {}),
+        blocker,
+    };
+}
+function classifySession(session) {
+    const backendType = resolvedBackend(session);
+    if (session.adopted)
+        return blockerEntry(session, backendType, 'adopted_session');
+    if (backendType === 'unknown')
+        return blockerEntry(session, backendType, 'unknown_backend');
+    if (session.frozenBackend
+        && session.attestation
+        && session.frozenBackend !== session.attestation.backendType) {
+        return blockerEntry(session, backendType, 'backend_inconsistent');
+    }
+    if (backendType === 'riff') {
+        return {
+            sessionId: session.sessionId,
+            backendType,
+            disposition: 'safe_remote',
+            ...(session.workerGeneration !== undefined
+                ? { workerGeneration: session.workerGeneration }
+                : {}),
+        };
+    }
+    const persistent = isPersistentBackend(backendType)
+        ? {
+            backendType,
+            name: persistentSessionName(backendType, session.sessionId),
+            probe: dependencies.probePersistent(backendType, persistentSessionName(backendType, session.sessionId)),
+        }
+        : undefined;
+    if (!session.workerPresent) {
+        if (!persistent || persistent.probe === 'missing') {
+            return {
+                sessionId: session.sessionId,
+                backendType,
+                disposition: 'quiescent',
+                ...(persistent ? { persistent } : {}),
+            };
+        }
+        if (persistent.probe === 'unknown') {
+            return { ...blockerEntry(session, backendType, 'backend_probe_unknown'), persistent };
+        }
+        // A detached pane may still be executing a legacy unconfined CLI, but the
+        // daemon no longer has a private-IPC attestation for its exact process.
+        return { ...blockerEntry(session, backendType, 'unattested_worker'), persistent };
+    }
+    if (!session.attestation) {
+        return {
+            ...blockerEntry(session, backendType, 'unattested_worker'),
+            ...(persistent ? { persistent } : {}),
+        };
+    }
+    if (!session.worker || !session.attestation.cli) {
+        return {
+            ...blockerEntry(session, backendType, 'process_identity_unavailable'),
+            ...(persistent ? { persistent } : {}),
+        };
+    }
+    if (session.workerGeneration === undefined
+        || session.attestation.workerGeneration !== session.workerGeneration) {
+        return {
+            ...blockerEntry(session, backendType, 'stale_attestation'),
+            ...(persistent ? { persistent } : {}),
+        };
+    }
+    if (dependencies.processStart(session.worker.pid) !== session.worker.procStart
+        || dependencies.processStart(session.attestation.cli.pid) !== session.attestation.cli.procStart) {
+        return {
+            ...blockerEntry(session, backendType, 'stale_attestation'),
+            ...(persistent ? { persistent } : {}),
+        };
+    }
+    if (persistent?.probe === 'unknown') {
+        return { ...blockerEntry(session, backendType, 'backend_probe_unknown'), persistent };
+    }
+    if (persistent?.probe === 'missing') {
+        return { ...blockerEntry(session, backendType, 'backend_inconsistent'), persistent };
+    }
+    return {
+        sessionId: session.sessionId,
+        backendType,
+        disposition: 'owned_local',
+        credentialIsolated: session.attestation.credentialIsolated,
+        worker: session.worker,
+        cli: session.attestation.cli,
+        workerGeneration: session.workerGeneration,
+        ...(persistent ? { persistent } : {}),
+    };
+}
+function generationFor(entries) {
+    return createHash('sha256').update(JSON.stringify(entries), 'utf8').digest('hex');
+}
+export function buildDeviceIsolationInventory() {
+    const entries = dependencies.listSessions()
+        .map(classifySession)
+        .sort((a, b) => a.sessionId.localeCompare(b.sessionId));
+    return {
+        generation: generationFor(entries),
+        entries,
+        blockers: entries.flatMap(entry => entry.blocker
+            ? [{ sessionId: entry.sessionId, blocker: entry.blocker }]
+            : []),
+    };
+}
+function sha256(raw) {
+    return createHash('sha256').update(raw, 'utf8').digest('hex');
+}
+function validNonce(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_-]{32,128}$/.test(value);
+}
+function validLeaseId(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9-]{8,128}$/.test(value);
+}
+function validDigest(value) {
+    return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+}
+function validVersion(value) {
+    return value === DEVICE_ISOLATION_ACTIVATION_VERSION;
+}
+function stableError(status, error) {
+    return { status, body: { ok: false, error } };
+}
+function baseResponse(lease, inventoryGeneration) {
+    if (!daemonIdentity)
+        return stableError(503, 'daemon_identity_unavailable');
+    const procStart = dependencies.processStart(process.pid);
+    const dataDir = dependencies.dataDir();
+    if (!procStart || !dataDir)
+        return stableError(503, 'daemon_identity_unavailable');
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            activationVersion: DEVICE_ISOLATION_ACTIVATION_VERSION,
+            nonce: lease.nonce,
+            leaseId: lease.leaseId,
+            daemon: {
+                larkAppId: daemonIdentity.larkAppId,
+                bootInstanceId: daemonIdentity.bootInstanceId,
+                pid: process.pid,
+                procStart,
+                dataDir,
+            },
+            inventoryGeneration,
+            expiresAt: lease.expiresAt,
+        },
+    };
+}
+function markerState(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== 1 || typeof parsed.enabledAt !== 'string')
+            return 'invalid';
+        if (new Date(parsed.enabledAt).toISOString() !== parsed.enabledAt)
+            return 'invalid';
+        // Legacy v1 markers without state are deliberately pending: they enforce
+        // isolation for new workers but cannot prove the daemon transaction ended.
+        if (parsed.state === undefined || parsed.state === 'pending')
+            return 'pending';
+        if (parsed.state === 'active'
+            && typeof parsed.activatedAt === 'string'
+            && new Date(parsed.activatedAt).toISOString() === parsed.activatedAt)
+            return 'active';
+        return 'invalid';
+    }
+    catch {
+        return 'invalid';
+    }
+}
+function readAndMatchMarker(expectedSha256, expectedState) {
+    try {
+        const raw = dependencies.readMarker();
+        if (raw === null || sha256(raw) !== expectedSha256 || markerState(raw) !== expectedState) {
+            return stableError(409, 'marker_mismatch');
+        }
+        return { raw };
+    }
+    catch {
+        return stableError(503, 'marker_unavailable');
+    }
+}
+function currentTransaction(input) {
+    const lease = requireDeviceIsolationFreeze({
+        nonce: input.nonce,
+        leaseId: input.leaseId,
+        now: dependencies.now(),
+    });
+    if (!lease
+        || !transaction
+        || transaction.lease.nonce !== input.nonce
+        || transaction.lease.leaseId !== input.leaseId)
+        return null;
+    transaction.lease = lease;
+    return transaction;
+}
+function processIdentityGone(identity) {
+    const current = dependencies.processStart(identity.pid);
+    if (current !== undefined)
+        return current === identity.procStart ? 'alive' : 'gone';
+    return dependencies.processExists(identity.pid) ? 'unknown' : 'gone';
+}
+function signalExact(identity, signal) {
+    if (processIdentityGone(identity) !== 'alive')
+        return;
+    try {
+        dependencies.signalProcess(identity.pid, signal);
+    }
+    catch { /* verified below */ }
+}
+async function quiesceOwnedSessions(prepared, lease) {
+    const sessions = new Map(dependencies.listSessions().map(session => [session.sessionId, session]));
+    const targets = prepared.entries.filter(entry => entry.disposition === 'owned_local');
+    try {
+        for (const target of targets) {
+            const session = sessions.get(target.sessionId);
+            if (!session)
+                return 'teardown_failed';
+            dependencies.closeWorker(session);
+            if (target.persistent) {
+                dependencies.killPersistent(target.persistent.backendType, target.persistent.name);
+            }
+        }
+    }
+    catch {
+        return 'teardown_failed';
+    }
+    const startedAt = dependencies.now();
+    let escalatedTerm = false;
+    let escalatedKill = false;
+    while (dependencies.now() - startedAt <= 4_000) {
+        if (!requireDeviceIsolationFreeze({ nonce: lease.nonce, leaseId: lease.leaseId, now: dependencies.now() })) {
+            return 'lease_expired';
+        }
+        let clean = true;
+        let unknown = false;
+        for (const target of targets) {
+            for (const identity of [target.cli, target.worker]) {
+                if (!identity)
+                    continue;
+                const state = processIdentityGone(identity);
+                if (state === 'alive')
+                    clean = false;
+                if (state === 'unknown')
+                    unknown = true;
+            }
+            if (target.persistent) {
+                const probe = dependencies.probePersistent(target.persistent.backendType, target.persistent.name);
+                if (probe === 'unknown')
+                    unknown = true;
+                if (probe === 'exists') {
+                    clean = false;
+                    try {
+                        dependencies.killPersistent(target.persistent.backendType, target.persistent.name);
+                    }
+                    catch { /* verified by the next probe */ }
+                }
+            }
+        }
+        if (clean && !unknown)
+            return 'ok';
+        const elapsed = dependencies.now() - startedAt;
+        if (!escalatedTerm && elapsed >= 250) {
+            escalatedTerm = true;
+            for (const target of targets) {
+                if (target.cli)
+                    signalExact(target.cli, 'SIGTERM');
+                if (target.worker)
+                    signalExact(target.worker, 'SIGTERM');
+            }
+        }
+        if (!escalatedKill && elapsed >= 1_250) {
+            escalatedKill = true;
+            for (const target of targets) {
+                if (target.cli)
+                    signalExact(target.cli, 'SIGKILL');
+                if (target.worker)
+                    signalExact(target.worker, 'SIGKILL');
+            }
+        }
+        await dependencies.sleep(50);
+    }
+    return 'teardown_failed';
+}
+export function setDeviceIsolationDaemonIdentity(identity) {
+    daemonIdentity = identity && identity.larkAppId && identity.bootInstanceId
+        ? { ...identity }
+        : null;
+}
+export function prepareDeviceIsolationActivation(body) {
+    const input = body;
+    if (!input || !validVersion(input.activationVersion) || !validNonce(input.nonce)) {
+        return stableError(409, 'invalid_request');
+    }
+    if (!daemonIdentity || !dependencies.processStart(process.pid) || !dependencies.dataDir()) {
+        return stableError(503, 'daemon_identity_unavailable');
+    }
+    const acquired = acquireDeviceIsolationFreeze({
+        nonce: input.nonce,
+        inventoryGeneration: 'pending',
+        now: dependencies.now(),
+    });
+    if (!acquired.ok)
+        return stableError(423, 'activation_busy');
+    if (acquired.reused
+        && transaction
+        && transaction.lease.leaseId === acquired.lease.leaseId
+        && transaction.lease.nonce === input.nonce) {
+        const response = baseResponse(acquired.lease, transaction.inventory.generation);
+        if (response.status === 200) {
+            response.body.phase = transaction.phase;
+            response.body.inventory = transaction.inventory.entries;
+        }
+        return response;
+    }
+    let inventory;
+    try {
+        inventory = buildDeviceIsolationInventory();
+    }
+    catch {
+        releaseDeviceIsolationFreeze({
+            nonce: input.nonce,
+            leaseId: acquired.lease.leaseId,
+            now: dependencies.now(),
+        });
+        return stableError(503, 'inventory_unavailable');
+    }
+    if (inventory.blockers.length > 0) {
+        releaseDeviceIsolationFreeze({
+            nonce: input.nonce,
+            leaseId: acquired.lease.leaseId,
+            now: dependencies.now(),
+        });
+        transaction = null;
+        return {
+            status: 409,
+            body: { ok: false, error: 'activation_blocked', blockers: inventory.blockers },
+        };
+    }
+    const bound = bindDeviceIsolationFreezeInventoryGeneration({
+        nonce: input.nonce,
+        leaseId: acquired.lease.leaseId,
+        inventoryGeneration: inventory.generation,
+        now: dependencies.now(),
+    });
+    if (!bound)
+        return stableError(409, 'lease_expired');
+    transaction = { lease: bound, inventory, phase: 'prepared' };
+    const response = baseResponse(bound, inventory.generation);
+    if (response.status === 200) {
+        response.body.phase = 'prepared';
+        response.body.inventory = inventory.entries;
+    }
+    return response;
+}
+export async function commitDeviceIsolationActivation(body) {
+    const input = body;
+    if (!input
+        || !validVersion(input.activationVersion)
+        || !validNonce(input.nonce)
+        || !validLeaseId(input.leaseId)
+        || !validDigest(input.markerSha256))
+        return stableError(409, 'invalid_request');
+    const active = currentTransaction({ nonce: input.nonce, leaseId: input.leaseId });
+    if (!active)
+        return stableError(409, 'lease_mismatch');
+    if (active.phase === 'committed') {
+        if (active.pendingMarkerSha256 !== input.markerSha256) {
+            return stableError(409, 'marker_mismatch');
+        }
+        const response = baseResponse(active.lease, active.inventory.generation);
+        if (response.status === 200)
+            response.body.phase = 'committed';
+        return response;
+    }
+    const marker = readAndMatchMarker(input.markerSha256, 'pending');
+    if ('status' in marker)
+        return marker;
+    let current;
+    try {
+        current = buildDeviceIsolationInventory();
+    }
+    catch {
+        return stableError(503, 'inventory_unavailable');
+    }
+    if (current.generation !== active.inventory.generation) {
+        return stableError(409, 'inventory_changed');
+    }
+    const quiesced = await quiesceOwnedSessions(active.inventory, active.lease);
+    if (quiesced === 'lease_expired')
+        return stableError(409, 'lease_expired');
+    if (quiesced !== 'ok')
+        return stableError(503, 'teardown_unverified');
+    let after;
+    try {
+        after = buildDeviceIsolationInventory();
+    }
+    catch {
+        return stableError(503, 'inventory_unavailable');
+    }
+    if (after.blockers.length > 0
+        || after.entries.some(entry => entry.disposition === 'owned_local'))
+        return stableError(409, 'unsafe_local_process');
+    active.phase = 'committed';
+    active.pendingMarkerSha256 = input.markerSha256;
+    active.inventory = after;
+    const rebound = bindDeviceIsolationFreezeInventoryGeneration({
+        nonce: input.nonce,
+        leaseId: input.leaseId,
+        inventoryGeneration: after.generation,
+        now: dependencies.now(),
+    });
+    if (!rebound)
+        return stableError(409, 'lease_expired');
+    active.lease = rebound;
+    const response = baseResponse(rebound, after.generation);
+    if (response.status === 200)
+        response.body.phase = 'committed';
+    return response;
+}
+export function releaseDeviceIsolationActivation(body) {
+    const input = body;
+    if (!input
+        || !validVersion(input.activationVersion)
+        || !validNonce(input.nonce)
+        || !validLeaseId(input.leaseId))
+        return stableError(409, 'invalid_request');
+    const active = currentTransaction({ nonce: input.nonce, leaseId: input.leaseId });
+    if (!active)
+        return stableError(409, 'lease_mismatch');
+    if (input.abort === true) {
+        if (active.phase === 'committed')
+            return stableError(409, 'activation_committed');
+        if (!releaseDeviceIsolationFreeze({
+            nonce: input.nonce,
+            leaseId: input.leaseId,
+            now: dependencies.now(),
+        })) {
+            return stableError(409, 'lease_mismatch');
+        }
+        transaction = null;
+        const response = baseResponse(active.lease, active.inventory.generation);
+        if (response.status === 200)
+            response.body.aborted = true;
+        return response;
+    }
+    if (active.phase !== 'committed')
+        return stableError(409, 'activation_not_committed');
+    if (!validDigest(input.markerSha256))
+        return stableError(409, 'invalid_request');
+    // Commit binds the PENDING marker. The host switches it to ACTIVE only after
+    // every daemon committed, so release intentionally accepts a different hash
+    // while requiring the exact bytes supplied here to parse as ACTIVE.
+    const marker = readAndMatchMarker(input.markerSha256, 'active');
+    if ('status' in marker)
+        return marker;
+    let current;
+    try {
+        current = buildDeviceIsolationInventory();
+    }
+    catch {
+        return stableError(503, 'inventory_unavailable');
+    }
+    if (current.blockers.length > 0
+        || current.entries.some(entry => entry.disposition === 'owned_local'))
+        return stableError(409, 'unsafe_local_process');
+    if (!releaseDeviceIsolationFreeze({
+        nonce: input.nonce,
+        leaseId: input.leaseId,
+        now: dependencies.now(),
+    })) {
+        return stableError(409, 'lease_mismatch');
+    }
+    transaction = null;
+    const response = baseResponse(active.lease, current.generation);
+    if (response.status === 200)
+        response.body.released = true;
+    return response;
+}
+/** Test seams keep process and backend destruction out of unit tests. */
+export function setDeviceIsolationDaemonDependenciesForTest(overrides) {
+    dependencies = overrides ? { ...defaultDependencies, ...overrides } : defaultDependencies;
+}
+export function resetDeviceIsolationDaemonForTest() {
+    transaction = null;
+    daemonIdentity = null;
+    dependencies = defaultDependencies;
+}
+export function logDeviceIsolationActivationError(error) {
+    logger.warn('[device-isolation] activation handler failed closed', error);
+}
+//# sourceMappingURL=device-isolation-daemon.js.map

package/dist/core/device-isolation-daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-isolation-daemon.js","sourceRoot":"","sources":["../../src/core/device-isolation-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,4BAA4B,EAC5B,4CAA4C,EAC5C,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,GAE7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,CAAC,MAAM,6BAA6B,GAAG,0CAA0C,CAAC;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,yCAAyC,CAAC;AACtF,MAAM,CAAC,MAAM,6BAA6B,GAAG,0CAA0C,CAAC;AAsFxF,IAAI,cAAc,GAAyC,IAAI,CAAC;AAChE,IAAI,WAAW,GAAiC,IAAI,CAAC;AAErD,SAAS,mBAAmB,CAAC,KAAuB;IAClD,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AACrE,CAAC;AAED,SAAS,cAAc,CAAC,KAAuB;IAC7C,OAAO,KAAK,KAAK,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACvD,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,WAAW,GAAG,EAAE,CAAC,uBAAuB,CAAC;QAC/C,MAAM,GAAG,GAAG,WAAW,EAAE,MAAM,IAAI,WAAW,CAAC,YAAY;YACzD,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS;YAC/B,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;YACjF,aAAa,EAAE,EAAE,CAAC,UAAU,EAAE,WAAW,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW;YACnE,aAAa;YACb,GAAG,CAAC,EAAE,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;gBAChB,WAAW,EAAE;oBACX,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;oBAClD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvB,GAAG,CAAC,WAAW,CAAC,gBAAgB,KAAK,SAAS;wBAC5C,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,EAAE;wBACpD,CAAC,CAAC,EAAE,CAAC;iBACR;aACF,CAAC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,mBAAmB,GAAsC;IAC7D,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,YAAY,EAAE,sBAAsB;IACpC,YAAY,EAAE,wBAAwB;IACtC,aAAa,EAAE,iBAAiB;IAChC,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,eAAe,EAAE,sBAAsB;IACvC,cAAc,EAAE,qBAAqB;IACrC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACtE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,UAAU,EAAE,GAAG,EAAE,CAAC,sBAAsB,CACtC,mCAAmC,CAAC,OAAO,EAAE,CAAC,EAC9C,CAAC,GAAG,IAAI,CACT;IACD,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;CACtC,CAAC;AAEF,IAAI,YAAY,GAAsC,mBAAmB,CAAC;AAE1E,SAAS,eAAe,CAAC,OAAsC;IAC7D,OAAO,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,WAAW,EAAE,WAAW,IAAI,SAAS,CAAC;AAChF,CAAC;AAED,SAAS,YAAY,CACnB,OAAsC,EACtC,WAA6B,EAC7B,OAA+B;IAE/B,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW;QACX,WAAW,EAAE,SAAS;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAsC;IAC7D,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAClF,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAC5F,IACE,OAAO,CAAC,aAAa;WAClB,OAAO,CAAC,WAAW;WACnB,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,WAAW,EAC5D,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW;YACX,WAAW,EAAE,aAAa;YAC1B,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,WAAW,CAAC;QACjD,CAAC,CAAC;YACA,WAAW;YACX,IAAI,EAAE,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC;YAC3D,KAAK,EAAE,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;SACxG;QACD,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW;gBACX,WAAW,EAAE,WAAW;gBACxB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,uBAAuB,CAAC,EAAE,UAAU,EAAE,CAAC;QACxF,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,mBAAmB,CAAC;YAC1D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QAChD,OAAO;YACL,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,8BAA8B,CAAC;YACrE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,gBAAgB,KAAK,SAAS;WACnC,OAAO,CAAC,WAAW,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,EACpE,CAAC;QACD,OAAO;YACL,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,mBAAmB,CAAC;YAC1D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC;IACD,IACE,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,SAAS;WACvE,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAC/F,CAAC;QACD,OAAO;YACL,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,mBAAmB,CAAC;YAC1D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,uBAAuB,CAAC,EAAE,UAAU,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,UAAU,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC;IACvF,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW;QACX,WAAW,EAAE,aAAa;QAC1B,kBAAkB,EAAE,OAAO,CAAC,WAAW,CAAC,kBAAkB;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG;QAC5B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAiD;IACtE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE;SACxC,GAAG,CAAC,eAAe,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC;QAClC,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO;YAC9C,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,mCAAmC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,MAAuB,EAAE,KAAa;IACzD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CACnB,KAAiC,EACjC,mBAA2B;IAE3B,IAAI,CAAC,cAAc;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACnF,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI;YACR,iBAAiB,EAAE,mCAAmC;YACtD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE;gBACN,SAAS,EAAE,cAAc,CAAC,SAAS;gBACnC,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,SAAS;gBACT,OAAO;aACR;YACD,mBAAmB;YACnB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnF,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACpF,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC/E,IACE,MAAM,CAAC,KAAK,KAAK,QAAQ;eACtB,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;eACtC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW;YACpE,OAAO,QAAQ,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,cAAsB,EACtB,aAAmC;IAEnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,cAAc,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,aAAa,EAAE,CAAC;YACzF,OAAO,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAG3B;IACC,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;KACxB,CAAC,CAAC;IACH,IACE,CAAC,KAAK;WACH,CAAC,WAAW;WACZ,WAAW,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WACvC,WAAW,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9C,OAAO,IAAI,CAAC;IACd,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;IAC1B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAyB;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,QAAyB,EAAE,MAAsB;IACpE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,OAAO;QAAE,OAAO;IACtD,IAAI,CAAC;QAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAkC,EAClC,KAAiC;IAEjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO;gBAAE,OAAO,iBAAiB,CAAC;YACvC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;IACrC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;QAC/C,IAAI,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;YAC3G,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,KAAK,KAAK,OAAO;oBAAE,KAAK,GAAG,KAAK,CAAC;gBACrC,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,GAAG,IAAI,CAAC;YAC1C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CACxC,MAAM,CAAC,UAAU,CAAC,WAAW,EAC7B,MAAM,CAAC,UAAU,CAAC,IAAI,CACvB,CAAC;gBACF,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,GAAG,IAAI,CAAC;gBACxC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvB,KAAK,GAAG,KAAK,CAAC;oBACd,IAAI,CAAC;wBACH,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACrF,CAAC;oBAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC/C,IAAI,CAAC,aAAa,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACrC,aAAa,GAAG,IAAI,CAAC;YACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,GAAG;oBAAE,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACnD,IAAI,MAAM,CAAC,MAAM;oBAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;YACvC,aAAa,GAAG,IAAI,CAAC;YACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,GAAG;oBAAE,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACnD,IAAI,MAAM,CAAC,MAAM;oBAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,QAA8C;IAE9C,cAAc,GAAG,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,cAAc;QACxE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE;QACjB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,IAAa;IAC5D,MAAM,KAAK,GAAG,IAAsC,CAAC;IACrD,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1F,OAAO,WAAW,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,mBAAmB,EAAE,SAAS;QAC9B,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAE7D,IACE,QAAQ,CAAC,MAAM;WACZ,WAAW;WACX,WAAW,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO;WACpD,WAAW,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAC1C,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,SAAmC,CAAC;IACxC,IAAI,CAAC;QACH,SAAS,GAAG,6BAA6B,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B,CAAC;YAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC/B,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,4BAA4B,CAAC;YAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC/B,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,WAAW,GAAG,IAAI,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;SAC/E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,4CAA4C,CAAC;QACzD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;QAC/B,mBAAmB,EAAE,SAAS,CAAC,UAAU;QACzC,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACrD,WAAW,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,IAAa;IACjE,MAAM,KAAK,GAAG,IAAsC,CAAC;IACrD,IACE,CAAC,KAAK;WACH,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC;WACtC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;WACxB,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;WAC5B,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC;QACnC,OAAO,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,mBAAmB,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAEtC,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QAAC,OAAO,GAAG,6BAA6B,EAAE,CAAC;IAAC,CAAC;IAClD,MAAM,CAAC;QAAC,OAAO,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,WAAW,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC3E,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAEtE,IAAI,KAA+B,CAAC;IACpC,IAAI,CAAC;QAAC,KAAK,GAAG,6BAA6B,EAAE,CAAC;IAAC,CAAC;IAChD,MAAM,CAAC;QAAC,OAAO,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAAC,CAAC;IAC3D,IACE,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;WACtB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,aAAa,CAAC;QACnE,OAAO,WAAW,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAElD,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;IAC3B,MAAM,CAAC,mBAAmB,GAAG,KAAK,CAAC,YAAY,CAAC;IAChD,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,4CAA4C,CAAC;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,mBAAmB,EAAE,KAAK,CAAC,UAAU;QACrC,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;IACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,IAAa;IAC5D,MAAM,KAAK,GAAG,IAAsC,CAAC;IACrD,IACE,CAAC,KAAK;WACH,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC;WACtC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;WACxB,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,OAAO,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAEvD,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAClF,IAAI,CAAC,4BAA4B,CAAC;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,EAAE,CAAC;YACH,OAAO,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACtF,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACjF,6EAA6E;IAC7E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAEtC,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QAAC,OAAO,GAAG,6BAA6B,EAAE,CAAC;IAAC,CAAC;IAClD,MAAM,CAAC;QAAC,OAAO,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAAC,CAAC;IAC3D,IACE,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;WACxB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,aAAa,CAAC;QACrE,OAAO,WAAW,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAClD,IAAI,CAAC,4BAA4B,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;KACxB,CAAC,EAAE,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC5C,CAAC;IACD,WAAW,GAAG,IAAI,CAAC;IACnB,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC3D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,2CAA2C,CACzD,SAA4D;IAE5D,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,mBAAmB,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,iCAAiC;IAC/C,WAAW,GAAG,IAAI,CAAC;IACnB,cAAc,GAAG,IAAI,CAAC;IACtB,YAAY,GAAG,mBAAmB,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC"}

package/dist/core/types.d.ts

@@ -29,6 +29,15 @@ export interface DaemonSession {
     /** Independent read-only xterm capability. Optional for hydrated/legacy
      * sessions; live workers publish it with their ready event. */
     workerViewToken?: string | null;
+    /** Latest process identity reported over the trusted worker IPC channel.
+     * Used to quiesce legacy unconfined CLIs before device credentials exist. */
+    localProcessAttestation?: {
+        backendType: import('../adapters/backend/types.js').BackendType;
+        credentialIsolated: boolean;
+        cliPid?: number;
+        cliProcStart?: string;
+        workerGeneration?: number;
+    };
     /** Monotonic within one daemon boot. Captured by durable delivery receipts
      *  so a terminal/exit from a replaced worker cannot settle a newer attempt. */
     workerGeneration?: number;