crewly 1.20.195 → 1.20.196

package/dist/backend/backend/src/services/core/api-token.service.d.ts

@@ -50,6 +50,34 @@ export declare function generateApiToken(): string;
  * @returns Token plus source and file path
  */
 export declare function resolveApiToken(): ResolvedApiToken;
+/** What {@link mirrorEnvTokenToFile} did. */
+export type EnvTokenMirrorResult = 'not-env' | 'written' | 'updated' | 'unchanged' | 'failed';
+/**
+ * Make `<CREWLY_HOME>/api-token` hold the token the server actually uses
+ * when that token is pinned by `CREWLY_API_TOKEN` (#1010 review).
+ *
+ * The CLI now presents the owner token on its local calls and reads it from
+ * the environment or this file. A server whose token lives only in its
+ * service environment (systemd on steamfun-ops) left the file missing, so
+ * `crewly onboard` / `bundle` / `desktop` from an ordinary shell got 401 on
+ * the owner-only routes. Called once at startup.
+ *
+ * - Token not from the environment: nothing to do (the file is the source).
+ * - File missing: written, mode 0600.
+ * - File holding another value: rewritten — the server only accepts the
+ *   env token, so a stale file can only produce 401s.
+ *
+ * @returns What was done
+ */
+export declare function mirrorEnvTokenToFile(): EnvTokenMirrorResult;
+/**
+ * The token a client on this machine should present, without creating one:
+ * `CREWLY_API_TOKEN`, else the token file, else null. Used by the CLI so a
+ * command run before the first boot does not mint a token as a side effect.
+ *
+ * @returns The token, or null when none exists yet
+ */
+export declare function readExistingApiToken(): string | null;
 /**
  * Convenience accessor for the raw token.
  *

package/dist/backend/backend/src/services/core/api-token.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/api-token.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAcH,kCAAkC;AAClC,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,WAAW,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAyBlD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,CAK5E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAU5E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC"}
+{"version":3,"file":"api-token.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/api-token.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAcH,kCAAkC;AAClC,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,WAAW,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAyBlD;AAED,6CAA6C;AAC7C,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE9F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAY3D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAIpD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,CAK5E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAU5E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC"}

package/dist/backend/backend/src/services/core/api-token.service.js

@@ -101,6 +101,52 @@ export function resolveApiToken() {
     cachedSource = 'generated';
     return { token: generated, source: 'generated', filePath };
 }
+/**
+ * Make `<CREWLY_HOME>/api-token` hold the token the server actually uses
+ * when that token is pinned by `CREWLY_API_TOKEN` (#1010 review).
+ *
+ * The CLI now presents the owner token on its local calls and reads it from
+ * the environment or this file. A server whose token lives only in its
+ * service environment (systemd on steamfun-ops) left the file missing, so
+ * `crewly onboard` / `bundle` / `desktop` from an ordinary shell got 401 on
+ * the owner-only routes. Called once at startup.
+ *
+ * - Token not from the environment: nothing to do (the file is the source).
+ * - File missing: written, mode 0600.
+ * - File holding another value: rewritten — the server only accepts the
+ *   env token, so a stale file can only produce 401s.
+ *
+ * @returns What was done
+ */
+export function mirrorEnvTokenToFile() {
+    const fromEnv = process.env[API_SECURITY_CONSTANTS.ENV.API_TOKEN]?.trim();
+    if (!fromEnv)
+        return 'not-env';
+    const filePath = getApiTokenFilePath();
+    const existing = readTokenFile(filePath);
+    if (existing === fromEnv)
+        return 'unchanged';
+    try {
+        writeTokenFile(filePath, fromEnv);
+        return existing === null ? 'written' : 'updated';
+    }
+    catch {
+        return 'failed';
+    }
+}
+/**
+ * The token a client on this machine should present, without creating one:
+ * `CREWLY_API_TOKEN`, else the token file, else null. Used by the CLI so a
+ * command run before the first boot does not mint a token as a side effect.
+ *
+ * @returns The token, or null when none exists yet
+ */
+export function readExistingApiToken() {
+    const fromEnv = process.env[API_SECURITY_CONSTANTS.ENV.API_TOKEN]?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return readTokenFile(getApiTokenFilePath());
+}
 /**
  * Convenience accessor for the raw token.
  *

package/dist/backend/backend/src/services/core/api-token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/api-token.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,4DAA4D;AAC5D,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC,uEAAuE;AACvE,IAAI,YAAY,GAA0B,IAAI,CAAC;AAe/C;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAa;IACrD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,sBAAsB,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3F,wFAAwF;IACxF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,GAAG,OAAO,CAAC;QACtB,YAAY,GAAG,KAAK,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,WAAW,GAAG,QAAQ,CAAC;QACvB,YAAY,GAAG,MAAM,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpC,WAAW,GAAG,SAAS,CAAC;IACxB,YAAY,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,eAAe,EAAE,CAAC,KAAK,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,WAAW,EAAE;IAClE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,sBAAsB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAoC;IACjE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,WAAW,GAAG,IAAI,CAAC;IACnB,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}
+{"version":3,"file":"api-token.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/api-token.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,4DAA4D;AAC5D,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC,uEAAuE;AACvE,IAAI,YAAY,GAA0B,IAAI,CAAC;AAe/C;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAa;IACrD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,sBAAsB,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3F,wFAAwF;IACxF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,GAAG,OAAO,CAAC;QACtB,YAAY,GAAG,KAAK,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,WAAW,GAAG,QAAQ,CAAC;QACvB,YAAY,GAAG,MAAM,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpC,WAAW,GAAG,SAAS,CAAC;IACxB,YAAY,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,CAAC;QACH,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,eAAe,EAAE,CAAC,KAAK,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,WAAW,EAAE;IAClE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,sBAAsB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAoC;IACjE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,WAAW,GAAG,IAAI,CAAC;IACnB,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}

package/dist/backend/backend/src/services/core/dashboard-build.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Which dashboard build this backend serves (#1010 review).
+ *
+ * After an upgrade, a tab that is still open runs the previous bundle. The
+ * new bundle can tell when that happens to it in the future: the backend
+ * stamps every `/api` response with the build it serves (the hashed entry
+ * script of `frontend/dist/index.html`) and sends the same on each
+ * socket.io connection. A tab whose own entry script differs shows "Crewly
+ * was updated — reload". Bundles from before this change ignore both; for
+ * them the owner-auth 401 says "Reload this page" in plain words instead.
+ *
+ * @module services/core/dashboard-build
+ */
+import type { RequestHandler } from 'express';
+/**
+ * The entry script of a built `index.html`.
+ *
+ * @param html - index.html content
+ * @returns e.g. `/assets/index-b91a9801.js`, or null for a dev / unbuilt page
+ */
+export declare function parseDashboardEntry(html: string): string | null;
+/**
+ * Read the entry script of the dashboard this backend serves.
+ *
+ * @param indexHtmlPath - Path of `frontend/dist/index.html`
+ * @returns The entry, or null when there is no built dashboard
+ */
+export declare function loadDashboardEntry(indexHtmlPath: string): string | null;
+/**
+ * Middleware stamping `/api` responses with the served build.
+ *
+ * @param entry - The served entry (null: stamps nothing)
+ * @returns Express middleware
+ */
+export declare function dashboardBuildHeader(entry: string | null): RequestHandler;
+/**
+ * The socket.io message announcing the served build.
+ *
+ * @param entry - The served entry
+ * @returns `{ type, payload: { entry }, timestamp }`, the gateway's message shape
+ */
+export declare function dashboardBuildMessage(entry: string): {
+    type: string;
+    payload: {
+        entry: string;
+    };
+    timestamp: string;
+};
+//# sourceMappingURL=dashboard-build.d.ts.map

package/dist/backend/backend/src/services/core/dashboard-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-build.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/dashboard-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAG/E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMvE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAKzE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAEpH"}

package/dist/backend/backend/src/services/core/dashboard-build.js

@@ -0,0 +1,68 @@
+/**
+ * Which dashboard build this backend serves (#1010 review).
+ *
+ * After an upgrade, a tab that is still open runs the previous bundle. The
+ * new bundle can tell when that happens to it in the future: the backend
+ * stamps every `/api` response with the build it serves (the hashed entry
+ * script of `frontend/dist/index.html`) and sends the same on each
+ * socket.io connection. A tab whose own entry script differs shows "Crewly
+ * was updated — reload". Bundles from before this change ignore both; for
+ * them the owner-auth 401 says "Reload this page" in plain words instead.
+ *
+ * @module services/core/dashboard-build
+ */
+import * as fs from 'fs';
+import { OWNER_AUTH_CONSTANTS } from '../../constants.js';
+/**
+ * The entry script of a built `index.html`.
+ *
+ * @param html - index.html content
+ * @returns e.g. `/assets/index-b91a9801.js`, or null for a dev / unbuilt page
+ */
+export function parseDashboardEntry(html) {
+    for (const tag of html.match(/<script\b[^>]*>/gi) ?? []) {
+        if (!/\btype=["']module["']/i.test(tag))
+            continue;
+        const src = /\bsrc=["']([^"']+)["']/i.exec(tag)?.[1];
+        if (src && src.includes('/assets/'))
+            return src;
+    }
+    return null;
+}
+/**
+ * Read the entry script of the dashboard this backend serves.
+ *
+ * @param indexHtmlPath - Path of `frontend/dist/index.html`
+ * @returns The entry, or null when there is no built dashboard
+ */
+export function loadDashboardEntry(indexHtmlPath) {
+    try {
+        return parseDashboardEntry(fs.readFileSync(indexHtmlPath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Middleware stamping `/api` responses with the served build.
+ *
+ * @param entry - The served entry (null: stamps nothing)
+ * @returns Express middleware
+ */
+export function dashboardBuildHeader(entry) {
+    return (_req, res, next) => {
+        if (entry)
+            res.setHeader(OWNER_AUTH_CONSTANTS.BUILD_HEADER, entry);
+        next();
+    };
+}
+/**
+ * The socket.io message announcing the served build.
+ *
+ * @param entry - The served entry
+ * @returns `{ type, payload: { entry }, timestamp }`, the gateway's message shape
+ */
+export function dashboardBuildMessage(entry) {
+    return { type: OWNER_AUTH_CONSTANTS.BUILD_EVENT, payload: { entry }, timestamp: new Date().toISOString() };
+}
+//# sourceMappingURL=dashboard-build.js.map

package/dist/backend/backend/src/services/core/dashboard-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-build.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/dashboard-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,GAAG,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAChE,IAAI,KAAK;YAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7G,CAAC"}

package/dist/backend/backend/src/services/core/owner-auth.service.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Owner-auth credentials (#999, specs/2026-10-03-owner-auth.md).
+ *
+ * Mints and verifies the credentials that tell the owner apart from agents:
+ * - **agent badge** — per-session, injected into each agent's environment at
+ *   launch (`CREWLY_AGENT_BADGE`) and sent by the skills as `X-Agent-Badge`;
+ * - **owner session** — the dashboard's HttpOnly cookie, plus a CSRF token
+ *   derived from it;
+ * - **internal credential** — what the in-process relay / Cloud forwarders
+ *   present when they call this backend over loopback.
+ *
+ * Everything is an HMAC under one secret that lives only in this process's
+ * memory. It is never written to disk and never put in an environment, so an
+ * agent (same OS user) cannot read it from a file the way it can read
+ * `~/.crewly/api-token`. A restart rotates it: dashboards re-bootstrap their
+ * session and the restarted agents get new badges.
+ *
+ * @module services/core/owner-auth.service
+ */
+/** Purposes an internal credential can carry. */
+export type InternalCredentialPurpose = 'relay' | 'cloud';
+/** A verified owner session. */
+export interface OwnerSession {
+    /** Random session id (base64url) */
+    id: string;
+    /** Issue time, epoch seconds */
+    issuedAt: number;
+}
+/** A freshly minted owner session. */
+export interface MintedOwnerSession extends OwnerSession {
+    /** Cookie value */
+    value: string;
+    /** CSRF token for this session */
+    csrfToken: string;
+}
+/**
+ * Mint the agent badge for a session. Deterministic for the process
+ * lifetime, so minting twice for the same session gives the same badge.
+ *
+ * @param session - Agent session name
+ * @returns `cab1.<base64url session>.<mac>`
+ *
+ * @example
+ * ```ts
+ * env[OWNER_AUTH_CONSTANTS.AGENT_BADGE_ENV] = mintAgentBadge('crewly-orc');
+ * ```
+ */
+export declare function mintAgentBadge(session: string): string;
+/**
+ * Verify an agent badge.
+ *
+ * @param badge - Presented badge (may be missing)
+ * @returns The session it was minted for, or null when invalid
+ */
+export declare function verifyAgentBadge(badge: string | null | undefined): string | null;
+/**
+ * Headers for a backend-internal call made on an agent's behalf (the
+ * WorkItem dispatcher, TL auto-verify, the ticket assignee waker …).
+ *
+ * @param session - The agent session the call acts as
+ * @returns `X-Agent-Session` plus that session's badge
+ */
+export declare function internalAgentHeaders(session: string): Record<string, string>;
+/**
+ * The CSRF token for a session id.
+ *
+ * @param sessionId - Owner session id
+ * @returns base64url MAC
+ */
+export declare function csrfTokenFor(sessionId: string): string;
+/**
+ * Mint a new owner session.
+ *
+ * @param nowMs - Clock (tests)
+ * @returns Cookie value, id, issue time and CSRF token
+ */
+export declare function mintOwnerSession(nowMs?: number): MintedOwnerSession;
+/**
+ * Verify an owner session cookie value.
+ *
+ * @param value - Cookie value (may be missing)
+ * @param nowMs - Clock (tests)
+ * @returns The session, or null when invalid or older than OWNER_SESSION_MAX_AGE_S
+ */
+export declare function verifyOwnerSession(value: string | null | undefined, nowMs?: number): OwnerSession | null;
+/**
+ * Whether a CSRF token matches a session.
+ *
+ * @param sessionId - Owner session id
+ * @param token - Presented CSRF token (may be missing)
+ * @returns True when valid
+ */
+export declare function verifyCsrfToken(sessionId: string, token: string | null | undefined): boolean;
+/**
+ * The credential an in-process forwarder presents on its loopback calls.
+ *
+ * @param purpose - `relay` (phone / portal REST) or `cloud` (Cloud-forwarded Slack envelopes)
+ * @returns Header value
+ */
+export declare function mintInternalCredential(purpose: InternalCredentialPurpose): string;
+/**
+ * Verify an internal credential.
+ *
+ * @param value - Presented value (may be missing)
+ * @returns Its purpose, or null when invalid
+ */
+export declare function verifyInternalCredential(value: string | null | undefined): InternalCredentialPurpose | null;
+/**
+ * Headers an in-process relay forwarder adds to its loopback call.
+ *
+ * @param purpose - Credential purpose
+ * @returns `{ 'x-crewly-internal': … }`
+ */
+export declare function internalCredentialHeaders(purpose: InternalCredentialPurpose): Record<string, string>;
+/**
+ * Name of the owner session cookie for a listening port.
+ *
+ * @param port - The backend's local port
+ * @returns e.g. `crewly_owner_8787`
+ */
+export declare function ownerSessionCookieName(port: number | string | undefined): string;
+/**
+ * Forget the signing secret (tests): every badge, session and internal
+ * credential minted before stops verifying.
+ */
+export declare function resetOwnerAuthSecretForTesting(): void;
+//# sourceMappingURL=owner-auth.service.d.ts.map

package/dist/backend/backend/src/services/core/owner-auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-auth.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/owner-auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,iDAAiD;AACjD,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1D,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sCAAsC;AACtC,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAmB,GAAG,kBAAkB,CAK/E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,GAAE,MAAmB,GAAG,YAAY,GAAG,IAAI,CAWpH;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,yBAAyB,GAAG,IAAI,CAO3G;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEpG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAEhF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}

package/dist/backend/backend/src/services/core/owner-auth.service.js

@@ -0,0 +1,205 @@
+/**
+ * Owner-auth credentials (#999, specs/2026-10-03-owner-auth.md).
+ *
+ * Mints and verifies the credentials that tell the owner apart from agents:
+ * - **agent badge** — per-session, injected into each agent's environment at
+ *   launch (`CREWLY_AGENT_BADGE`) and sent by the skills as `X-Agent-Badge`;
+ * - **owner session** — the dashboard's HttpOnly cookie, plus a CSRF token
+ *   derived from it;
+ * - **internal credential** — what the in-process relay / Cloud forwarders
+ *   present when they call this backend over loopback.
+ *
+ * Everything is an HMAC under one secret that lives only in this process's
+ * memory. It is never written to disk and never put in an environment, so an
+ * agent (same OS user) cannot read it from a file the way it can read
+ * `~/.crewly/api-token`. A restart rotates it: dashboards re-bootstrap their
+ * session and the restarted agents get new badges.
+ *
+ * @module services/core/owner-auth.service
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'crypto';
+import { OWNER_AUTH_CONSTANTS } from '../../constants.js';
+let secret = null;
+/**
+ * The process-lifetime signing secret (lazily generated).
+ *
+ * @returns 32 random bytes
+ */
+function signingSecret() {
+    if (!secret)
+        secret = randomBytes(32);
+    return secret;
+}
+/**
+ * HMAC-SHA256 of `purpose:payload`, base64url.
+ *
+ * @param purpose - Domain separator (badge / session / csrf / internal)
+ * @param payload - Signed content
+ * @returns MAC
+ */
+function mac(purpose, payload) {
+    return createHmac('sha256', signingSecret()).update(`${purpose}:${payload}`).digest('base64url');
+}
+/**
+ * Constant-time string comparison.
+ *
+ * @param a - First value
+ * @param b - Second value
+ * @returns True when equal
+ */
+function safeEqual(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+/**
+ * Mint the agent badge for a session. Deterministic for the process
+ * lifetime, so minting twice for the same session gives the same badge.
+ *
+ * @param session - Agent session name
+ * @returns `cab1.<base64url session>.<mac>`
+ *
+ * @example
+ * ```ts
+ * env[OWNER_AUTH_CONSTANTS.AGENT_BADGE_ENV] = mintAgentBadge('crewly-orc');
+ * ```
+ */
+export function mintAgentBadge(session) {
+    const encoded = Buffer.from(session, 'utf8').toString('base64url');
+    return `${OWNER_AUTH_CONSTANTS.AGENT_BADGE_PREFIX}.${encoded}.${mac('badge', encoded)}`;
+}
+/**
+ * Verify an agent badge.
+ *
+ * @param badge - Presented badge (may be missing)
+ * @returns The session it was minted for, or null when invalid
+ */
+export function verifyAgentBadge(badge) {
+    if (typeof badge !== 'string')
+        return null;
+    const parts = badge.trim().split('.');
+    if (parts.length !== 3 || parts[0] !== OWNER_AUTH_CONSTANTS.AGENT_BADGE_PREFIX)
+        return null;
+    const [, encoded, presented] = parts;
+    if (!encoded || !presented || !safeEqual(presented, mac('badge', encoded)))
+        return null;
+    const session = Buffer.from(encoded, 'base64url').toString('utf8');
+    return session.length > 0 ? session : null;
+}
+/**
+ * Headers for a backend-internal call made on an agent's behalf (the
+ * WorkItem dispatcher, TL auto-verify, the ticket assignee waker …).
+ *
+ * @param session - The agent session the call acts as
+ * @returns `X-Agent-Session` plus that session's badge
+ */
+export function internalAgentHeaders(session) {
+    return { 'X-Agent-Session': session, 'X-Agent-Badge': mintAgentBadge(session) };
+}
+/**
+ * The CSRF token for a session id.
+ *
+ * @param sessionId - Owner session id
+ * @returns base64url MAC
+ */
+export function csrfTokenFor(sessionId) {
+    return mac('csrf', sessionId);
+}
+/**
+ * Mint a new owner session.
+ *
+ * @param nowMs - Clock (tests)
+ * @returns Cookie value, id, issue time and CSRF token
+ */
+export function mintOwnerSession(nowMs = Date.now()) {
+    const id = randomBytes(18).toString('base64url');
+    const issuedAt = Math.floor(nowMs / 1000);
+    const body = `${OWNER_AUTH_CONSTANTS.OWNER_SESSION_PREFIX}.${id}.${issuedAt}`;
+    return { id, issuedAt, value: `${body}.${mac('session', body)}`, csrfToken: csrfTokenFor(id) };
+}
+/**
+ * Verify an owner session cookie value.
+ *
+ * @param value - Cookie value (may be missing)
+ * @param nowMs - Clock (tests)
+ * @returns The session, or null when invalid or older than OWNER_SESSION_MAX_AGE_S
+ */
+export function verifyOwnerSession(value, nowMs = Date.now()) {
+    if (typeof value !== 'string')
+        return null;
+    const parts = value.split('.');
+    if (parts.length !== 4 || parts[0] !== OWNER_AUTH_CONSTANTS.OWNER_SESSION_PREFIX)
+        return null;
+    const [prefix, id, iat, presented] = parts;
+    if (!id || !/^\d+$/.test(iat ?? '') || !presented)
+        return null;
+    if (!safeEqual(presented, mac('session', `${prefix}.${id}.${iat}`)))
+        return null;
+    const issuedAt = Number(iat);
+    const age = Math.floor(nowMs / 1000) - issuedAt;
+    if (age < -60 || age > OWNER_AUTH_CONSTANTS.OWNER_SESSION_MAX_AGE_S)
+        return null;
+    return { id, issuedAt };
+}
+/**
+ * Whether a CSRF token matches a session.
+ *
+ * @param sessionId - Owner session id
+ * @param token - Presented CSRF token (may be missing)
+ * @returns True when valid
+ */
+export function verifyCsrfToken(sessionId, token) {
+    return typeof token === 'string' && token.length > 0 && safeEqual(token, csrfTokenFor(sessionId));
+}
+/**
+ * The credential an in-process forwarder presents on its loopback calls.
+ *
+ * @param purpose - `relay` (phone / portal REST) or `cloud` (Cloud-forwarded Slack envelopes)
+ * @returns Header value
+ */
+export function mintInternalCredential(purpose) {
+    return `${purpose}.${mac('internal', purpose)}`;
+}
+/**
+ * Verify an internal credential.
+ *
+ * @param value - Presented value (may be missing)
+ * @returns Its purpose, or null when invalid
+ */
+export function verifyInternalCredential(value) {
+    if (typeof value !== 'string')
+        return null;
+    const dot = value.indexOf('.');
+    if (dot <= 0)
+        return null;
+    const purpose = value.slice(0, dot);
+    if (purpose !== 'relay' && purpose !== 'cloud')
+        return null;
+    return safeEqual(value, mintInternalCredential(purpose)) ? purpose : null;
+}
+/**
+ * Headers an in-process relay forwarder adds to its loopback call.
+ *
+ * @param purpose - Credential purpose
+ * @returns `{ 'x-crewly-internal': … }`
+ */
+export function internalCredentialHeaders(purpose) {
+    return { [OWNER_AUTH_CONSTANTS.INTERNAL_HEADER]: mintInternalCredential(purpose) };
+}
+/**
+ * Name of the owner session cookie for a listening port.
+ *
+ * @param port - The backend's local port
+ * @returns e.g. `crewly_owner_8787`
+ */
+export function ownerSessionCookieName(port) {
+    return `${OWNER_AUTH_CONSTANTS.OWNER_SESSION_COOKIE_PREFIX}${port ?? 'default'}`;
+}
+/**
+ * Forget the signing secret (tests): every badge, session and internal
+ * credential minted before stops verifying.
+ */
+export function resetOwnerAuthSecretForTesting() {
+    secret = null;
+}
+//# sourceMappingURL=owner-auth.service.js.map

package/dist/backend/backend/src/services/core/owner-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-auth.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/owner-auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAqB1D,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC;;;;GAIG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,GAAG,CAAC,OAAe,EAAE,OAAe;IAC3C,OAAO,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,OAAO,GAAG,oBAAoB,CAAC,kBAAkB,IAAI,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgC;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IACzD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,oBAAoB,CAAC,oBAAoB,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgC,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IAC7F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAC9F,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC3C,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC;IAChD,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,oBAAoB,CAAC,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,KAAgC;IACjF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAkC;IACvE,OAAO,GAAG,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,SAAS,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAkC;IAC1E,OAAO,EAAE,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiC;IACtE,OAAO,GAAG,oBAAoB,CAAC,2BAA2B,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}