dsh-cliworker-now 0.0.0-stage → 0.7.7

package/lib/types/host/opencode-native.js

@@ -0,0 +1,403 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, rename, rm, writeFile } from 'node:fs/promises';
+import { createHash, randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
+import { dirname, join, resolve, relative, isAbsolute } from 'node:path';
+import { safePiOmpAncestors } from "./pi-omp-native.js";
+import { authenticatedAccountLogins, providerLogin, usableNativeApiKey } from "./account-login.js";
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const text = (value) => typeof value === 'string' && !!value.trim();
+export const OPENCODE_OAUTH_UNSUPPORTED = 'OpenCode OAuth 暂无法安全续期，请使用该 CLI 自身 API 配置';
+/** JSONC comments/trailing commas, without changing quoted model IDs or URLs. */
+function jsonc(raw) {
+    let result = '', quoted = false, escaped = false;
+    for (let i = 0; i < raw.length; i++) {
+        const ch = raw[i];
+        if (quoted) {
+            result += ch;
+            if (escaped)
+                escaped = false;
+            else if (ch === '\\')
+                escaped = true;
+            else if (ch === '"')
+                quoted = false;
+            continue;
+        }
+        if (ch === '"') {
+            quoted = true;
+            result += ch;
+            continue;
+        }
+        if (ch === '/' && raw[i + 1] === '/') {
+            while (i + 1 < raw.length && raw[i + 1] !== '\n')
+                i++;
+            continue;
+        }
+        if (ch === '/' && raw[i + 1] === '*') {
+            const end = raw.indexOf('*/', i + 2);
+            if (end < 0)
+                throw new Error('Invalid native JSONC');
+            i = end + 1;
+            result += ' ';
+            continue;
+        }
+        if (ch === ',') {
+            let next = i + 1;
+            while (next < raw.length) {
+                if (/\s/.test(raw[next])) {
+                    next++;
+                    continue;
+                }
+                if (raw.slice(next, next + 2) === '//') {
+                    const line = raw.indexOf('\n', next + 2);
+                    next = line < 0 ? raw.length : line + 1;
+                    continue;
+                }
+                if (raw.slice(next, next + 2) === '/*') {
+                    const end = raw.indexOf('*/', next + 2);
+                    if (end < 0)
+                        throw new Error('Invalid native JSONC');
+                    next = end + 2;
+                    continue;
+                }
+                break;
+            }
+            if (raw[next] === '}' || raw[next] === ']')
+                continue;
+        }
+        result += ch;
+    }
+    return JSON.parse(result);
+}
+export { jsonc as parseNativeJsonc };
+async function ownEnvironment(roots, options, sourceIds) {
+    const result = {};
+    for (const root of roots) {
+        let handle;
+        try {
+            options.signal?.throwIfAborted();
+            await safePiOmpAncestors(root);
+            handle = await open(join(root, '.env'), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            const info = await handle.stat();
+            if (!info.isFile() || info.nlink !== 1 || info.size > 65536)
+                throw new Error();
+            const bytes = Buffer.alloc(65537);
+            try {
+                const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+                if (bytesRead > 65536)
+                    throw new Error();
+                for (const line of bytes.subarray(0, bytesRead).toString('utf8').split(/\r?\n/)) {
+                    if (!line.trim() || line.trimStart().startsWith('#'))
+                        continue;
+                    const match = /^(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line.trim());
+                    if (!match)
+                        throw new Error();
+                    let value = match[2];
+                    if ((value.startsWith('"') && value.endsWith('"')) ||
+                        (value.startsWith("'") && value.endsWith("'")))
+                        value = value.slice(1, -1);
+                    if (/`|\$\(|\x00/.test(value))
+                        throw new Error();
+                    result[match[1]] = value;
+                    sourceIds.add(resolve(root));
+                }
+            }
+            finally {
+                bytes.fill(0);
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw new Error('OpenCode 自身环境配置无法安全读取');
+        }
+        finally {
+            await handle?.close();
+        }
+    }
+    return result;
+}
+async function resolveReferences(value, options, scope, depth = 0) {
+    if (depth > 48)
+        throw new Error('OpenCode 原生配置过深');
+    if (Array.isArray(value))
+        return Promise.all(value.map((entry) => resolveReferences(entry, options, scope, depth + 1)));
+    if (object(value))
+        return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, entry]) => [
+            key,
+            await resolveReferences(entry, options, scope, depth + 1),
+        ])));
+    if (typeof value !== 'string')
+        return value;
+    let result = value.replace(/\{env:([^}]+)\}/g, (_, name) => scope.env[name] ?? '');
+    for (const match of [...result.matchAll(/\{file:([^}]+)\}/g)]) {
+        const path = match[1].startsWith('~/')
+            ? join(options.nativeHome ?? homedir(), match[1].slice(2))
+            : match[1];
+        if (!isAbsolute(path) ||
+            !scope.roots.some((root) => {
+                const rel = relative(resolve(root), resolve(path));
+                return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
+            }))
+            throw new Error('OpenCode 只允许引用自身账号目录中的凭据文件');
+        await safePiOmpAncestors(dirname(path));
+        let file;
+        const bytes = Buffer.alloc(65537);
+        try {
+            options.signal?.throwIfAborted();
+            const parent = await lstat(dirname(path));
+            if (!parent.isDirectory() || parent.isSymbolicLink())
+                throw new Error('Unsafe credential reference');
+            file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            const info = await file.stat();
+            if (!info.isFile() || info.nlink !== 1 || info.size > 65536)
+                throw new Error('Unsafe credential reference');
+            const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+            if (bytesRead > 65536)
+                throw new Error('Oversized credential reference');
+            result = result.replace(match[0], bytes.subarray(0, bytesRead).toString('utf8').trim());
+        }
+        catch {
+            throw new Error('OpenCode 原生凭据引用无法安全读取');
+        }
+        finally {
+            bytes.fill(0);
+            await file?.close();
+        }
+    }
+    return result;
+}
+function merge(base, next) {
+    return Object.fromEntries([...new Set([...Object.keys(base), ...Object.keys(next)])].map((key) => [
+        key,
+        object(base[key]) && object(next[key])
+            ? merge(base[key], next[key])
+            : next[key] === undefined
+                ? base[key]
+                : next[key],
+    ]));
+}
+async function readDocument(path, optional, options, comments = false, limit = 4 * 1024 * 1024) {
+    let file;
+    const bytes = Buffer.alloc(limit + 1);
+    try {
+        options.signal?.throwIfAborted();
+        const parent = await lstat(dirname(path));
+        if (!parent.isDirectory() || parent.isSymbolicLink())
+            throw new Error('Unsafe native account directory');
+        file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const before = await file.stat();
+        if (!before.isFile() || before.nlink !== 1 || before.size >= bytes.length)
+            throw new Error('Unsafe native account file');
+        let length = 0;
+        while (length < bytes.length) {
+            options.signal?.throwIfAborted();
+            const part = await file.read(bytes, length, bytes.length - length, null);
+            if (!part.bytesRead)
+                break;
+            length += part.bytesRead;
+        }
+        const after = await file.stat();
+        if (length >= bytes.length || before.size !== after.size || before.mtimeMs !== after.mtimeMs)
+            throw new Error('Native account changed during read');
+        const value = comments
+            ? jsonc(bytes.subarray(0, length).toString('utf8'))
+            : JSON.parse(bytes.subarray(0, length).toString('utf8'));
+        if (!object(value))
+            throw new Error('Invalid native account data');
+        return value;
+    }
+    catch (error) {
+        options.signal?.throwIfAborted();
+        if (optional && error.code === 'ENOENT')
+            return undefined;
+        throw new Error('OpenCode 原生账号或模型配置无法安全读取，请检查配置');
+    }
+    finally {
+        bytes.fill(0);
+        await file?.close();
+    }
+}
+export const activeOpenCodeCredential = (value) => object(value) &&
+    (value.type === 'api'
+        ? text(value.key)
+        : value.type === 'oauth' &&
+            text(value.access) &&
+            typeof value.expires === 'number' &&
+            value.expires > Date.now() + 30000);
+/** A native account terminal may load remote well-known config before provider filters. */
+export async function assertOpenCodeManagedAuth(authDirectory, signal) {
+    await safePiOmpAncestors(join(authDirectory, 'opencode'));
+    const auth = (await readDocument(join(authDirectory, 'opencode/auth.json'), true, { signal })) ?? {};
+    if (Object.values(auth).some((entry) => !object(entry) || !['api', 'oauth'].includes(entry.type)))
+        throw new Error('OpenCode 原生账号包含不支持的远程认证配置');
+}
+/** The same native+plugin sources supply metadata queries and worker execution. */
+export async function readOpenCodeProfile(authDirectory, options = {}) {
+    const home = options.nativeHome ?? homedir();
+    const data = options.nativeHome
+        ? join(home, '.local/share')
+        : process.env.XDG_DATA_HOME || join(home, '.local/share');
+    const config = options.nativeHome
+        ? join(home, '.config')
+        : process.env.XDG_CONFIG_HOME || join(home, '.config');
+    const ownRoots = [
+        join(config, 'opencode'),
+        join(data, 'opencode'),
+        join(dirname(authDirectory), 'config', 'opencode'),
+        join(authDirectory, 'opencode'),
+    ];
+    const sourceIds = new Set();
+    const ownEnv = await ownEnvironment(ownRoots, options, sourceIds);
+    const globalAuth = (await readDocument(join(data, 'opencode/auth.json'), true, options)) ?? {};
+    const localAuth = (await readDocument(join(authDirectory, 'opencode/auth.json'), true, options)) ?? {};
+    if (Object.keys(globalAuth).length)
+        sourceIds.add(resolve(data, 'opencode'));
+    if (Object.keys(localAuth).length)
+        sourceIds.add(resolve(authDirectory, 'opencode'));
+    let settings = {};
+    const paths = [
+        ...['config.json', 'opencode.json', 'opencode.jsonc'].map((name) => join(config, 'opencode', name)),
+        ...['opencode.json', 'opencode.jsonc'].map((name) => join(dirname(authDirectory), 'config', 'opencode', name)),
+    ];
+    for (const path of new Set(paths)) {
+        const document = (await readDocument(path, true, options, true)) ?? {};
+        settings = merge(settings, document);
+        if (Object.keys(document.provider ?? {}).length)
+            sourceIds.add(resolve(dirname(path)));
+    }
+    const providers = await resolveReferences(settings.provider ?? {}, options, {
+        roots: ownRoots,
+        env: ownEnv,
+    });
+    if (!object(providers))
+        throw new Error('OpenCode 原生提供商配置无效');
+    const auth = { ...globalAuth, ...localAuth };
+    for (const [id, provider] of Object.entries(providers)) {
+        if (!object(provider))
+            throw new Error('OpenCode 原生提供商配置无效');
+        const key = provider.options?.apiKey;
+        if (typeof key === 'string' && key.trim()) {
+            if (key.trimStart().startsWith('!'))
+                throw new Error('OpenCode 不执行凭据命令');
+            // Keep the explicit API source identical in metadata and the private runtime auth store.
+            auth[id] = { type: 'api', key };
+        }
+    }
+    const disabled = settings.disabled_providers ?? [], enabled = settings.enabled_providers;
+    if (!Array.isArray(disabled) ||
+        !disabled.every(text) ||
+        (enabled !== undefined && (!Array.isArray(enabled) || !enabled.every(text))))
+        throw new Error('OpenCode 原生提供商开关配置无效');
+    const cache = options.modelsPath ??
+        (options.nativeHome
+            ? join(home, '.cache/opencode/models.json')
+            : process.env.OPENCODE_MODELS_PATH || join(home, '.cache/opencode/models.json'));
+    return {
+        sourceIds: [...sourceIds].sort(),
+        auth,
+        providers,
+        disabled,
+        enabled,
+        modelsPath: cache,
+        // The installed public multi-provider cache is 4.4 MB; scoped CLI output
+        // remains capped at 4 MB. This larger cap does not apply to credential files.
+        catalog: (await readDocument(cache, true, options, false, 8 * 1024 * 1024)) ?? {},
+    };
+}
+/** Rebuild a private copy from current own sources; never restore an old worker account. */
+export async function snapshotOpenCodeAuth(authDirectory, auth, providers, signal) {
+    // Native Auth.set has no cross-process CAS. Copying OAuth loses rotated tokens;
+    // writing directly can resurrect a concurrent logout. Neither mode is safe.
+    if (providers.some((id) => auth[id]?.type === 'oauth'))
+        throw new Error(OPENCODE_OAUTH_UNSUPPORTED);
+    const chosen = Object.fromEntries(providers
+        .filter((id) => auth[id]?.type === 'api' && activeOpenCodeCredential(auth[id]))
+        .map((id) => [id, auth[id]]));
+    const digest = createHash('sha256').update(JSON.stringify(chosen)).digest('hex');
+    const root = join(authDirectory, 'cliworker-snapshots', 'own-v2-' + digest);
+    for (const path of [
+        authDirectory,
+        join(authDirectory, 'cliworker-snapshots'),
+        root,
+        join(root, 'opencode'),
+    ]) {
+        signal?.throwIfAborted();
+        await safePiOmpAncestors(path);
+        await mkdir(path, { recursive: true, mode: 0o700 });
+        const info = await lstat(path);
+        if (!info.isDirectory() || info.isSymbolicLink() || (process.platform !== 'win32' && (info.mode & 0o077)))
+            throw new Error('OpenCode 私有账号快照目录不安全');
+    }
+    const path = join(root, 'opencode/auth.json');
+    try {
+        const info = await lstat(path);
+        if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || (process.platform !== 'win32' && (info.mode & 0o077)))
+            throw new Error('OpenCode 私有账号快照文件不安全');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const temporary = join(root, 'opencode', `.auth-${randomUUID()}.tmp`);
+    try {
+        signal?.throwIfAborted();
+        await writeFile(temporary, JSON.stringify(chosen), { mode: 0o600, flag: 'wx' });
+        signal?.throwIfAborted();
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+    signal?.throwIfAborted();
+    return root;
+}
+export async function inspectOpenCodeProfile(authDirectory, options = {}) {
+    try {
+        const profile = await readOpenCodeProfile(authDirectory, options);
+        const logins = [];
+        let expired = false;
+        for (const [id, auth] of Object.entries(profile.auth)) {
+            if (!object(auth))
+                continue;
+            const api = auth.type === 'api' && usableNativeApiKey(auth.key);
+            const oauthShape = auth.type === 'oauth' &&
+                usableNativeApiKey(auth.access) &&
+                typeof auth.expires === 'number' &&
+                Number.isFinite(auth.expires) &&
+                (auth.refresh === undefined || typeof auth.refresh === 'string');
+            const oauth = oauthShape && (auth.expires > Date.now() || usableNativeApiKey(auth.refresh));
+            if (oauthShape && !oauth)
+                expired = true;
+            if (api || oauth) {
+                const config = profile.providers[id];
+                logins.push(providerLogin(id, api ? 'api' : 'oauth', {
+                    baseUrl: config?.options?.baseURL,
+                    name: config?.name,
+                }));
+            }
+        }
+        if (logins.length)
+            return authenticatedAccountLogins(logins);
+        if (expired)
+            return {
+                state: 'unauthenticated',
+                verification: 'local',
+                summary: '登录已过期，请重新登录',
+            };
+        if (Object.values(profile.auth).some((auth) => object(auth) && auth.type === 'api') ||
+            (!Object.keys(profile.auth).length && Object.keys(profile.providers).length))
+            return { state: 'configured', verification: 'local', summary: '尚未配置有效凭据' };
+        return Object.keys(profile.auth).length
+            ? { state: 'unknown', verification: 'local', summary: '账号配置格式未知' }
+            : { state: 'unconfigured', verification: 'local', summary: '尚未配置 OpenCode 账号' };
+    }
+    catch {
+        options.signal?.throwIfAborted();
+        return {
+            state: 'unavailable',
+            verification: 'local',
+            summary: '账号配置读取失败，请检查配置',
+        };
+    }
+}
+//# sourceMappingURL=opencode-native.js.map

package/lib/types/host/opencode-native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-native.js","sourceRoot":"","sources":["../../../src/host/opencode-native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAGlG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAgC,EAAE,CAC9D,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC/D,MAAM,IAAI,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;AAC7F,MAAM,CAAC,MAAM,0BAA0B,GAAG,2CAA2C,CAAA;AAerF,iFAAiF;AACjF,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,MAAM,GAAG,EAAE,EACb,MAAM,GAAG,KAAK,EACd,OAAO,GAAG,KAAK,CAAA;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAE,CAAA;QAClB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,EAAE,CAAA;YACZ,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAA;iBACvB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAA;iBAC/B,IAAI,EAAE,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAA;YACnC,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,IAAI,CAAA;YACb,MAAM,IAAI,EAAE,CAAA;YACZ,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAA;YACrD,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACpC,IAAI,GAAG,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YACpD,CAAC,GAAG,GAAG,GAAG,CAAC,CAAA;YACX,MAAM,IAAI,GAAG,CAAA;YACb,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAChB,OAAO,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,EAAE,CAAC;oBAC1B,IAAI,EAAE,CAAA;oBACN,SAAQ;gBACV,CAAC;gBACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAA;oBACxC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;oBACvC,SAAQ;gBACV,CAAC;gBACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACvC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAA;oBACvC,IAAI,GAAG,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;oBACpD,IAAI,GAAG,GAAG,GAAG,CAAC,CAAA;oBACd,SAAQ;gBACV,CAAC;gBACD,MAAK;YACP,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG;gBAAE,SAAQ;QACtD,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC3B,CAAC;AACD,OAAO,EAAE,KAAK,IAAI,gBAAgB,EAAE,CAAA;AAKpC,KAAK,UAAU,cAAc,CAAC,KAAe,EAAE,OAA8B,EAAE,SAAsB;IACnG,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,CAAA;QACV,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;YAChC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAA;YAC9B,MAAM,GAAG,MAAM,IAAI,CACjB,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAClB,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAA;YACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;YAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,CAAC;gBACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;gBAClE,IAAI,SAAS,GAAG,KAAK;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;gBACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,SAAQ;oBAC9D,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;oBAC9E,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;oBAC7B,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;oBACrB,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;wBAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;wBAE9C,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;oBAC5B,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;oBAChD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAA;oBACzB,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAA;QACvB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AACD,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,OAA8B,EAC9B,KAAqB,EACrB,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/F,IAAI,MAAM,CAAC,KAAK,CAAC;QACf,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAChD,GAAG;YACH,MAAM,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;SAC1D,CAAC,CACH,CACF,CAAA;IACH,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAClF,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QACb,IACE,CAAC,UAAU,CAAC,IAAI,CAAC;YACjB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;gBAClD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAChE,CAAC,CAAC;YAEF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAC/C,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACvC,IAAI,IAAkD,CAAA;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;YACzC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACpG,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YACzF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;gBACzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;YAChD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YAChE,IAAI,SAAS,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YACxE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC1C,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACb,MAAM,IAAI,EAAE,KAAK,EAAE,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AACD,SAAS,KAAK,CAAC,IAAyB,EAAE,IAAyB;IACjE,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACtE,GAAG;QACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;gBACvB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAChB,CAAC,CACH,CAAA;AACH,CAAC;AACD,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,QAAiB,EACjB,OAA8B,EAC9B,QAAQ,GAAG,KAAK,EAChB,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;IAEvB,IAAI,IAAkD,CAAA;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACxG,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM;YACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAC/C,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAA;YACxE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAK;YAC1B,MAAM,IAAI,IAAI,CAAC,SAAS,CAAA;QAC1B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAC1F,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,MAAM,KAAK,GAAY,QAAQ;YAC7B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAChC,IAAI,QAAQ,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACpF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,MAAM,IAAI,EAAE,KAAK,EAAE,CAAA;IACrB,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAc,EAAgC,EAAE,CACvF,MAAM,CAAC,KAAK,CAAC;IACb,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK;QACnB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAClB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAA;AACzC,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,aAAqB,EAAE,MAAoB;IACzF,MAAM,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACpG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;AAChD,CAAC;AACD,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,UAAiC,EAAE;IAEnC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,EAAE,CAAA;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU;QAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAC5B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU;QAC/B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QACvB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACxD,MAAM,QAAQ,GAAG;QACf,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC;QAClD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC;KAChC,CAAA;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;IACjE,MAAM,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9F,MAAM,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACtG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM;QAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;IAC5E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;QAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;IACpF,IAAI,QAAQ,GAAwB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACnG,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CACzD;KACF,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;QACtE,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACpC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM;YAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE;QAC1E,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,MAAM;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAA;IAC5C,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACxE,yFAAyF;YACzF,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QACjC,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAChD,OAAO,GAAG,QAAQ,CAAC,iBAAiB,CAAA;IACtC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACrB,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAE5E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,MAAM,KAAK,GACT,OAAO,CAAC,UAAU;QAClB,CAAC,OAAO,CAAC,UAAU;YACjB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC;YAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAA;IACpF,OAAO;QACL,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE;QAChC,IAAI;QACJ,SAAS;QACT,QAAQ;QACR,OAAO;QACP,UAAU,EAAE,KAAK;QACjB,yEAAyE;QACzE,8EAA8E;QAC9E,OAAO,EAAE,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE;KAClF,CAAA;AACH,CAAC;AACD,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,IAAyB,EACzB,SAAmB,EACnB,MAAoB;IAEpB,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,SAAS;SACN,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,KAAK,KAAK,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAC/B,CAAA;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,qBAAqB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;IAC3E,KAAK,MAAM,IAAI,IAAI;QACjB,aAAa;QACb,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC;QAC1C,IAAI;QACJ,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;KACvB,EAAE,CAAC;QACF,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YACvG,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YACtH,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,UAAU,EAAE,MAAM,CAAC,CAAA;IACrE,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/E,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC/B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,OAAO,IAAI,CAAA;AACb,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,UAAiC,EAAE;IAEnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACjE,MAAM,MAAM,GAAmB,EAAE,CAAA;QACjC,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC/D,MAAM,UAAU,GACd,IAAI,CAAC,IAAI,KAAK,OAAO;gBACrB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC7B,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;YAC3F,IAAI,UAAU,IAAI,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAA;YACxC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBACpC,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE;oBACvC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;oBACjC,IAAI,EAAE,MAAM,EAAE,IAAI;iBACnB,CAAC,CACH,CAAA;YACH,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAA;QAC5D,IAAI,OAAO;YACT,OAAO;gBACL,KAAK,EAAE,iBAAiB;gBACxB,YAAY,EAAE,OAAO;gBACrB,OAAO,EAAE,aAAa;aACvB,CAAA;QACH,IACE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;YAC/E,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;YAE5E,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;QAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM;YACrC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE;YAClE,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAChC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,OAAO;YACrB,OAAO,EAAE,gBAAgB;SAC1B,CAAA;IACH,CAAC;AACH,CAAC"}

package/lib/types/host/own-account-lease.d.mts

@@ -0,0 +1,5 @@
+export const OWN_ACCOUNT_BUSY: string
+export function assertOwnAccountLeaseIdle(root: string): Promise<void>
+export function acquireOwnAccountLease(root: string, nonce: string): Promise<void>
+export function ownsOwnAccountLease(root: string, nonce: string): Promise<boolean>
+export function releaseOwnAccountLease(root: string, nonce: string): Promise<void>

package/lib/types/host/own-account-lease.mjs

@@ -0,0 +1,105 @@
+import { constants } from 'node:fs'
+import { lstat, mkdir, open, realpath, rename, rm, writeFile } from 'node:fs/promises'
+import { join, resolve } from 'node:path'
+
+export const OWN_ACCOUNT_BUSY = '账号正被使用，请稍后刷新'
+const nonceValid = (value) => typeof value === 'string' && /^[a-f0-9-]{36}$/.test(value)
+async function privateRoot(root) {
+  const info = await lstat(root)
+  if (
+    !info.isDirectory() ||
+    info.isSymbolicLink() ||
+    (process.platform !== 'win32' && (info.mode & 0o077)) ||
+    (await realpath(root)) !== resolve(root)
+  )
+    throw new Error('账号运行目录无法安全使用')
+}
+/** A lease is not stolen after PID death: its descendants may still be alive.
+ * Only Host cleanup after confirmed process-range exit may release it. */
+export async function assertOwnAccountLeaseIdle(root) {
+  await privateRoot(root)
+  try {
+    await lstat(join(root, '.lease'))
+  } catch (error) {
+    if (error?.code === 'ENOENT') return
+    throw error
+  }
+  throw new Error(OWN_ACCOUNT_BUSY)
+}
+export async function acquireOwnAccountLease(root, nonce) {
+  if (!nonceValid(nonce)) throw new Error('Invalid account lease')
+  await privateRoot(root)
+  const lock = join(root, '.lease')
+  const pending = join(root, `.lease-${nonce}.pending`)
+  await assertOwnAccountLeaseIdle(root)
+  await mkdir(pending, { mode: 0o700 })
+  try {
+    await writeFile(join(pending, 'owner.json'), JSON.stringify({ nonce, pid: process.pid }), {
+      flag: 'wx',
+      mode: 0o600,
+    })
+    // Publish a complete, nonempty owner directory in one filesystem operation.
+    // A killed initializer leaves only its nonce-specific pending directory.
+    await rename(pending, lock)
+  } catch (error) {
+    await rm(pending, { recursive: true, force: true })
+    if (error?.code === 'EEXIST' || error?.code === 'ENOTEMPTY') throw new Error(OWN_ACCOUNT_BUSY)
+    throw error
+  }
+}
+export async function ownsOwnAccountLease(root, nonce) {
+  if (!nonceValid(nonce)) throw new Error('Invalid account lease')
+  await privateRoot(root)
+  let handle
+  try {
+    const lock = await lstat(join(root, '.lease'))
+    if (!lock.isDirectory() || lock.isSymbolicLink() || (process.platform !== 'win32' && (lock.mode & 0o077)))
+      throw new Error('账号使用状态无法确认')
+    handle = await open(
+      join(root, '.lease/owner.json'),
+      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK,
+    )
+    const info = await handle.stat()
+    if (!info.isFile() || info.nlink !== 1 || (process.platform !== 'win32' && (info.mode & 0o077)) || info.size > 1024)
+      throw new Error('账号使用状态无法确认')
+    return JSON.parse(await handle.readFile('utf8')).nonce === nonce
+  } catch (error) {
+    if (error?.code === 'ENOENT') return false
+    throw error
+  } finally {
+    await handle?.close()
+  }
+}
+export async function releaseOwnAccountLease(root, nonce) {
+  if (!nonceValid(nonce)) throw new Error('Invalid account lease')
+  await privateRoot(root)
+  // Safe only at this API's contract boundary: Host confirmed this nonce's whole
+  // process range exited, including an initializer killed before publication.
+  await rm(join(root, `.lease-${nonce}.pending`), { recursive: true, force: true })
+  const lock = join(root, '.lease')
+  let handle
+  try {
+    const directory = await lstat(lock)
+    if (!directory.isDirectory() || directory.isSymbolicLink() || (process.platform !== 'win32' && (directory.mode & 0o077)))
+      throw new Error('账号使用状态无法安全清理')
+    handle = await open(
+      join(lock, 'owner.json'),
+      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK,
+    )
+    const info = await handle.stat()
+    if (!info.isFile() || info.nlink !== 1 || (process.platform !== 'win32' && (info.mode & 0o077)) || info.size > 1024)
+      throw new Error('账号使用状态无法安全清理')
+    const owner = JSON.parse(await handle.readFile('utf8'))
+    if (owner.nonce !== nonce) return
+    const current = await lstat(lock)
+    if (current.dev !== directory.dev || current.ino !== directory.ino || current.isSymbolicLink())
+      throw new Error('账号使用状态在清理前改变')
+    await handle.close()
+    handle = undefined
+    await rm(lock, { recursive: true })
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error
+  } finally {
+    await handle?.close()
+  }
+}

package/lib/types/host/pi-installation.d.mts

@@ -0,0 +1,7 @@
+export interface PiInstallation {
+  root: string
+  dist: string
+  version: '1.0.2' | '1.0.4' | '1.1.0'
+  executable: string
+}
+export function inspectPiInstallation(entry: string): PiInstallation

package/lib/types/host/pi-installation.mjs

@@ -0,0 +1,87 @@
+// One verified Pi package for the Host, account UI, native catalog and RPC entry.
+// Resolve installation metadata only; never execute an arbitrary shell launcher.
+import { readFileSync, realpathSync, statSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
+import { resolveNativeEntry } from './native-launch.mjs'
+
+const versions = new Set(['1.0.2', '1.0.4', '1.1.0'])
+const failure = () =>
+  Object.assign(
+    new Error('Pi 安装身份或原生接口不匹配；需要 Pi Coding Agent 1.0.2、1.0.4 或 1.1.0，不能使用 OMP 入口'),
+    { code: 'CLI_IDENTITY_MISMATCH' },
+  )
+function metadata(path) {
+  const info = statSync(path)
+  if (!info.isFile() || info.size > 128 * 1024) throw failure()
+  return readFileSync(path, 'utf8')
+}
+// Exact official Windows managed launcher inspected from Pi 1.1.0. It is read as
+// installation metadata, never evaluated. Unknown bootstrap code fails closed.
+const managedWindowsLauncherSHA256 = '3d8b27bb3f5c07543303b0ee774ce215e4d6ae2b0ae43311c4acf51f517ffd13'
+function windowsManagedEntry(launcher) {
+  const source = metadata(launcher).trim().replace(/\r\n/g, '\n')
+  if (createHash('sha256').update(source).digest('hex') !== managedWindowsLauncherSHA256) throw failure()
+  const install = join(dirname(dirname(launcher)), 'install')
+  const version = metadata(join(install, 'current-version')).trim()
+  if (!versions.has(version)) throw failure()
+  const directory = resolve(install, 'releases', version, 'node_modules/@earendil-works/pi-coding-agent')
+  // A version pointer/package symlink must not select code outside this release.
+  if (realpathSync(directory) !== directory) throw failure()
+  const manifest = JSON.parse(metadata(join(directory, 'package.json')))
+  const bin = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin?.pi
+  if (manifest.name !== '@earendil-works/pi-coding-agent' || manifest.version !== version ||
+    !['dist/cli.js', 'dist/bundle/cli.js'].includes(bin)) throw failure()
+  const entry = realpathSync(resolve(directory, bin))
+  const inside = relative(directory, entry)
+  if (!inside || inside === '..' || inside.startsWith('..' + sep) || isAbsolute(inside)) throw failure()
+  return entry
+}
+
+export function inspectPiInstallation(entry) {
+  try {
+    let executable = realpathSync(entry)
+    if (
+      ['pi', 'pi.cmd', 'pi.bat'].includes(basename(executable).toLowerCase()) &&
+      basename(dirname(executable)) === 'bin'
+    ) {
+      const launcher = metadata(executable)
+      if (launcher.includes('PI_MANAGED_INSTALL_ROOT=') && launcher.includes('install/current-version')) {
+        const install = join(dirname(dirname(executable)), 'install')
+        const version = metadata(join(install, 'current-version')).trim()
+        if (!versions.has(version)) throw failure()
+        executable = realpathSync(
+          join(install, 'releases', version, 'node_modules/@earendil-works/pi-coding-agent/dist/cli.js'),
+        )
+      }
+    }
+    executable = realpathSync(resolveNativeEntry(executable))
+    if (basename(executable).toLowerCase() === 'pi-launcher.js' && basename(dirname(executable)) === 'bin')
+      executable = windowsManagedEntry(executable)
+    let directory = dirname(executable)
+    for (let depth = 0; depth < 5; depth++, directory = dirname(directory)) {
+      let manifest
+      try {
+        manifest = JSON.parse(metadata(join(directory, 'package.json')))
+      } catch {
+        continue
+      }
+      if (manifest.name !== '@earendil-works/pi-coding-agent' || !versions.has(manifest.version))
+        throw failure()
+      const dist = join(directory, 'dist')
+      if (![join(dist, 'cli.js'), join(dist, 'bundle/cli.js')].includes(executable)) throw failure()
+      for (const relative of ['cli.js', 'index.js', 'core/model-runtime.js', 'core/auth-storage.js']) {
+        if (!statSync(join(dist, relative)).isFile()) throw failure()
+      }
+      return {
+        root: directory,
+        dist,
+        version: manifest.version,
+        executable: realpathSync(join(dist, 'cli.js')),
+      }
+    }
+  } catch {
+    throw failure()
+  }
+  throw failure()
+}