openmeld 0.3.231 → 0.3.233

package/dist/{windows-user-task-BR-WB7hr.js.map → windows-user-task-CTsMnmD4.js.map}

@@ -1 +1 @@
-{"version":3,"file":"windows-user-task-BR-WB7hr.js","names":[],"sources":["../src/local-service/lifecycle/windows-service-binary.ts","../src/local-service/lifecycle/windows-task-host.ts","../src/local-service/lifecycle/windows-user-task.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport {\n  copyFile,\n  mkdir,\n  mkdtemp,\n  open,\n  rename,\n  rm,\n  stat,\n} from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { pruneWindowsBinaryBundle } from \"@openmeld/adapter-core/windows-system\";\nimport { WINDOWS_PROCESS_HELPER_FILENAME } from \"@openmeld/schemas\";\nimport { daemonRuntimeBundlesPath } from \"../../config/daemon-state\";\nimport type { OpenMeldPathResolutionInput } from \"../../config/paths\";\nimport type { CliBinaryReleaseInfo } from \"../../config/version-state\";\nimport type { DaemonActiveBundleState } from \"./daemon-service-bundle\";\n\nconst FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/u;\n\nexport function windowsMaintenanceBinaryPath(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): string {\n  if (\n    !(\n      bundle.sourceDistFingerprint &&\n      FINGERPRINT_PATTERN.test(bundle.sourceDistFingerprint)\n    )\n  ) {\n    throw new Error(\n      \"OpenMeld maintenance needs a verified Windows Service bundle.\"\n    );\n  }\n  return join(\n    daemonRuntimeBundlesPath(pathInput),\n    `maintenance-${bundle.sourceDistFingerprint}`,\n    \"openmeld.exe\"\n  );\n}\n\nexport async function prepareWindowsMaintenanceBinary(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): Promise<string> {\n  const target = windowsMaintenanceBinaryPath(bundle, pathInput);\n  const expected = bundle.sourceDistFingerprint;\n  if (\n    (await hashBinaryServiceBundle(target, true).catch(() => null)) === expected\n  ) {\n    return target;\n  }\n  if (\n    (await hashBinaryServiceBundle(bundle.sourceEntryScriptPath, true)) !==\n    expected\n  ) {\n    throw new Error(\n      \"The Windows maintenance source no longer matches its verified bundle.\"\n    );\n  }\n  const directory = dirname(target);\n  if (\n    await stat(directory).catch((error: NodeJS.ErrnoException) => {\n      if (error.code === \"ENOENT\") {\n        return null;\n      }\n      throw error;\n    })\n  ) {\n    const result = await pruneWindowsBinaryBundle(directory);\n    if (result !== \"removed\" && result !== \"absent\") {\n      throw new Error(\n        \"The existing Windows maintenance copy is still in use or contains unrecognized files.\"\n      );\n    }\n  }\n  await mkdir(daemonRuntimeBundlesPath(pathInput), { recursive: true });\n  const temporary = await mkdtemp(\n    join(daemonRuntimeBundlesPath(pathInput), \".maintenance-\")\n  );\n  try {\n    for (const name of [\"openmeld.exe\", WINDOWS_PROCESS_HELPER_FILENAME]) {\n      await copyFile(\n        name === \"openmeld.exe\"\n          ? bundle.sourceEntryScriptPath\n          : join(dirname(bundle.sourceEntryScriptPath), name),\n        join(temporary, name)\n      );\n    }\n    if (\n      (await hashBinaryServiceBundle(join(temporary, \"openmeld.exe\"), true)) !==\n      expected\n    ) {\n      throw new Error(\n        \"The prepared Windows maintenance copy failed verification.\"\n      );\n    }\n    await rename(temporary, directory);\n  } finally {\n    await rm(temporary, { recursive: true, force: true });\n  }\n  return target;\n}\n\n// Windows binary_v1 bundles contain two indivisible, independently signed files.\n// Keep one bundle fingerprint for inventory, update jobs, and maintenance copies.\nexport function expectedBinaryServiceFingerprint(\n  release: CliBinaryReleaseInfo\n): string {\n  if (!release.platform.startsWith(\"windows-\")) {\n    return release.sha256.toLowerCase();\n  }\n  if (!release.windows) {\n    throw new Error(\n      \"The selected Windows Service has no native helper metadata.\"\n    );\n  }\n  return fingerprint(release.sha256, release.windows.processHelper.sha256);\n}\n\nexport async function hashBinaryServiceBundle(\n  executablePath: string,\n  windows: boolean = process.platform === \"win32\"\n): Promise<string> {\n  const executableHash = await hashFile(executablePath);\n  return windows\n    ? fingerprint(\n        executableHash,\n        await hashFile(\n          join(dirname(executablePath), WINDOWS_PROCESS_HELPER_FILENAME)\n        )\n      )\n    : executableHash;\n}\n\nfunction fingerprint(executableHash: string, helperHash: string): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify([executableHash.toLowerCase(), helperHash.toLowerCase()])\n    )\n    .digest(\"hex\");\n}\n\nasync function hashFile(file: string): Promise<string> {\n  const hash = createHash(\"sha256\");\n  for await (const chunk of createReadStream(file)) {\n    hash.update(chunk);\n  }\n  return hash.digest(\"hex\");\n}\n\n/** A valid signature does not establish the required console-free PE subsystem. */\nexport async function verifyWindowsServiceSubsystem(\n  file: string\n): Promise<void> {\n  const handle = await open(file, \"r\");\n  try {\n    const dos = Buffer.alloc(64);\n    const first = await handle.read(dos, 0, dos.length, 0);\n    if (\n      first.bytesRead !== dos.length ||\n      dos.toString(\"ascii\", 0, 2) !== \"MZ\"\n    ) {\n      throw new Error(\"The Windows Service artifact is not a PE executable.\");\n    }\n    const header = Buffer.alloc(94);\n    const second = await handle.read(\n      header,\n      0,\n      header.length,\n      dos.readUInt32LE(0x3c)\n    );\n    if (\n      second.bytesRead !== header.length ||\n      header.toString(\"ascii\", 0, 4) !== \"PE\\0\\0\" ||\n      header.readUInt16LE(4) !== 0x86_64 ||\n      header.readUInt16LE(24 + 68) !== 2\n    ) {\n      throw new Error(\n        \"The selected Windows Service must be a console-free x64 executable.\"\n      );\n    }\n  } finally {\n    await handle.close();\n  }\n}\n","// Task Scheduler must start a Windows-subsystem executable, not a console\n// executable that hides its window after startup. Keep the existing encoded\n// PowerShell action as the command/environment/logging owner.\n// Windows PowerShell 5.1 compiles this fixed source during guarded installation;\n// no SDK, downloaded executable, WSH/VBScript, or administrator access is needed.\nexport const WINDOWS_TASK_HOST_SOURCE = String.raw`\nusing System;\nusing System.Diagnostics;\nusing System.IO;\nusing System.Reflection;\nusing System.Text;\nusing System.Text.RegularExpressions;\n\npublic static class OpenMeldTaskHostV1 {\n  public static int Main(string[] args) {\n    string logPath = Assembly.GetExecutingAssembly().Location + \".log\";\n    try {\n      // Accept only the existing OpenMeld action, never an arbitrary executable\n      // or a shell-interpolated command line. Base64 contains no quoting syntax.\n      if (args.Length != 7 || args[0] != \"-NoLogo\" || args[1] != \"-NoProfile\" ||\n          args[2] != \"-NonInteractive\" || args[3] != \"-WindowStyle\" ||\n          args[4] != \"Hidden\" || args[5] != \"-EncodedCommand\" ||\n          !Regex.IsMatch(args[6], @\"\\A[A-Za-z0-9+/]+={0,2}\\z\"))\n        throw new ArgumentException(\"Invalid OpenMeld task arguments.\");\n      Convert.FromBase64String(args[6]);\n      var start = new ProcessStartInfo();\n      start.FileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System),\n        @\"WindowsPowerShell\\v1.0\\powershell.exe\");\n      start.Arguments = String.Join(\" \", args);\n      start.UseShellExecute = false;\n      start.CreateNoWindow = true;\n      start.RedirectStandardInput = true;\n      start.RedirectStandardOutput = true;\n      start.RedirectStandardError = true;\n      using (var log = Stream.Synchronized(new FileStream(logPath, FileMode.Append,\n          FileAccess.Write, FileShare.ReadWrite)))\n      using (var child = new Process()) {\n        child.StartInfo = start;\n        child.Start();\n        child.StandardInput.Close();\n        var stdout = child.StandardOutput.BaseStream.CopyToAsync(log);\n        var stderr = child.StandardError.BaseStream.CopyToAsync(log);\n        // Do not detach or break away from Task Scheduler's process ownership.\n        // The task remains running until the action completes, and restart-on-\n        // failure still receives the action's real exit code.\n        child.WaitForExit();\n        stdout.GetAwaiter().GetResult();\n        stderr.GetAwaiter().GetResult();\n        return child.ExitCode;\n      }\n    } catch (Exception error) {\n      try { File.AppendAllText(logPath, DateTime.UtcNow.ToString(\"o\") + \" \" +\n        error.GetType().Name + \": \" + error.Message + Environment.NewLine, Encoding.UTF8); }\n      catch { /* Task Scheduler still receives a nonzero result if logging fails. */ }\n      return 1;\n    }\n  }\n}\n`;\n\n// Per-task, lane-owned path: updating the maintenance host cannot replace the\n// executable of a running main Service, or vice versa. Keep v1 stable; a future\n// host format must explicitly support migration from this path.\nexport const WINDOWS_TASK_HOST_SUFFIX = \".task-host-v1.exe\";\n\n// The caller has already verified identity and acquired the lifecycle grant.\n// Build beside the target and replace atomically, never overwrite a running\n// host or fall back to a flashing console when compilation is unavailable.\nexport const WINDOWS_TASK_HOST_INSTALL_SCRIPT = `\n$hostDirectory = [IO.Path]::GetDirectoryName($hostPath)\n$null = [IO.Directory]::CreateDirectory($hostDirectory)\n$temporaryHost = Join-Path $hostDirectory ([Guid]::NewGuid().ToString('N') + '.exe')\ntry {\n  Add-Type -TypeDefinition @'\n${WINDOWS_TASK_HOST_SOURCE}\n'@ -OutputAssembly $temporaryHost -OutputType WindowsApplication -ErrorAction Stop\n  if ($task -and $task.State -eq 4) { throw 'OpenMeld cannot replace a background task while it is running.' }\n  if ([IO.File]::Exists($hostPath)) {\n    # PowerShell coerces bare $null to an empty string for this .NET parameter.\n    # Pass a real null backup path; an empty path breaks repeat setup/repair.\n    [IO.File]::Replace($temporaryHost, $hostPath, [NullString]::Value)\n  } else {\n    [IO.File]::Move($temporaryHost, $hostPath)\n  }\n} finally {\n  if ([IO.File]::Exists($temporaryHost)) { [IO.File]::Delete($temporaryHost) }\n}\n`;\n","import { type ExecFileException, execFile } from \"node:child_process\";\nimport { normalizeCommandEnvironment } from \"@openmeld/adapter-core/process-environment\";\nimport {\n  powerShellEncodedArguments,\n  resolveWindowsPowerShellPath,\n} from \"@openmeld/adapter-core/windows-system\";\nimport {\n  type WindowsUserTaskAction,\n  type WindowsUserTaskRequest,\n  windowsUserTaskActionSchema,\n  windowsUserTaskRequestSchema,\n  windowsUserTaskStatusSchema,\n  windowsUserTaskStoredActionSchema,\n} from \"@openmeld/schemas\";\nimport { currentDaemonServiceLifecycleLock } from \"../../config/daemon-state\";\nimport {\n  attachLockProcess,\n  type OpenMeldLock,\n  releaseLock,\n} from \"../../config/lock\";\nimport { verifyWindowsServiceSubsystem } from \"./windows-service-binary\";\nimport { readWindowsDirectTaskAction } from \"./windows-task-command\";\nimport {\n  WINDOWS_TASK_HOST_INSTALL_SCRIPT,\n  WINDOWS_TASK_HOST_SUFFIX,\n} from \"./windows-task-host\";\n\n// Task Scheduler runs in the signed-in user's session, with that user's tokens\n// and ordinary permissions. No password, elevation, or third-party service host.\n// Native COM contracts: learn.microsoft.com/windows/win32/taskschd/\nconst TASK_CONTROL = String.raw`\n$ErrorActionPreference = 'Stop'\n$ProgressPreference = 'SilentlyContinue'\n[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)\n$r = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:OPENMELD_TASK_REQUEST)))\nif ($env:OPENMELD_TASK_GRANT_REQUIRED -eq '1' -and [Console]::In.ReadLine() -ne 'execute') { exit 125 }\n$env:OPENMELD_TASK_GRANT_REQUIRED = $null\n$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value\nif ($sid -in @('S-1-5-18','S-1-5-19','S-1-5-20')) { throw 'Run OpenMeld setup from your own Windows account, not a system account.' }\n$scheduler = New-Object -ComObject 'Schedule.Service'\n$scheduler.Connect()\n$folder = $scheduler.GetFolder('\\')\n$name = $r.name + '-' + $sid\n$hostPath = $r.legacyScript + '${WINDOWS_TASK_HOST_SUFFIX}'\n$runtimeRoot = [IO.Path]::GetDirectoryName($r.legacyScript)\nfunction Read-OwnedDirectAction($path, $arguments) {\n  if ($arguments -notmatch '(?:^| )--openmeld-windows-task ([A-Za-z0-9+/=]+)$') { return $null }\n  $c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Matches[1])))\n  $bundles = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'bundles')) + '\\'\n  $fullPath = [IO.Path]::GetFullPath($path)\n  if ($c.executable -ne $path -or !$fullPath.StartsWith($bundles, [StringComparison]::OrdinalIgnoreCase) -or [IO.Path]::GetFileName($path) -ne 'openmeld.exe' -or !$c.env.OPENMELD_HOME -or [IO.Path]::GetFullPath((Join-Path $c.env.OPENMELD_HOME 'runtime\\daemon')) -ne [IO.Path]::GetFullPath($runtimeRoot)) {\n    throw 'The Windows task does not belong to this OpenMeld installation.'\n  }\n  return $c\n}\n$existingDirect = $null\n$task = $null\ntry { $task = $folder.GetTask($name) } catch {\n  if ($_.Exception.GetBaseException().HResult -ne -2147024894) { throw }\n}\nif ($task) {\n  $principal = $task.Definition.Principal\n  $taskSid = $principal.UserId\n  if ($taskSid -notmatch '^S-\\d-') { $taskSid = ([Security.Principal.NTAccount]$taskSid).Translate([Security.Principal.SecurityIdentifier]).Value }\n  $actionPath = $task.Definition.Actions.Item(1).Path\n  $existingDirect = Read-OwnedDirectAction $actionPath $task.Definition.Actions.Item(1).Arguments\n  if ($taskSid -ne $sid -or $principal.LogonType -ne 3 -or $principal.RunLevel -ne 0 -or $task.Definition.Actions.Count -ne 1 -or (!$existingDirect -and $actionPath -ne (Join-Path $PSHOME 'powershell.exe') -and $actionPath -ne $hostPath)) {\n    throw 'An existing OpenMeld task uses a different user or launch configuration. Resolve that installation before continuing.'\n  }\n}\n# Migration only owns the exact legacy script in this lane. Never stop another\n# user's or an administrator-customized service merely because its name matches.\n$legacy = Get-CimInstance Win32_Service -Filter (\"Name='\" + $r.name.Replace(\"'\",\"''\") + \"'\")\nif ($legacy -and $legacy.PathName.Trim('\"') -ne $r.legacyScript) {\n  throw 'An existing Windows service uses a different installation. Resolve that installation before continuing.'\n}\nswitch ($r.operation) {\n  'install' {\n    if ($legacy -and $legacy.State -ne 'Stopped') { throw 'The previous OpenMeld Service must finish stopping before migration.' }\n    $nextDirect = Read-OwnedDirectAction $r.executable $r.arguments\n    # A running maintenance invocation keeps its immutable copy and lease. Only\n    # subsequent invocations select the new copy. Main Service replacement still\n    # requires the existing drain and stopped-state proof.\n    $maintenanceUpdate = $r.periodic -and $existingDirect -and $nextDirect -and $existingDirect.args.Count -eq 2 -and $nextDirect.args.Count -eq 2 -and $existingDirect.args[0] -eq 'service' -and $existingDirect.args[1] -eq 'update-worker' -and $nextDirect.args[0] -eq 'service' -and $nextDirect.args[1] -eq 'update-worker'\n    if ($task -and $task.State -eq 4 -and !$maintenanceUpdate) { throw 'OpenMeld cannot replace a background task while it is running.' }\n    if (!$nextDirect) {\n      if ($r.executable -ne (Join-Path $PSHOME 'powershell.exe')) { throw 'OpenMeld tasks require a verified background executable.' }\n      ${WINDOWS_TASK_HOST_INSTALL_SCRIPT}\n    }\n    $definition = $scheduler.NewTask(0)\n    $definition.RegistrationInfo.Description = 'OpenMeld background process for the signed-in user.'\n    $definition.Principal.UserId = $sid\n    $definition.Principal.LogonType = 3\n    $definition.Principal.RunLevel = 0\n    $definition.Settings.Enabled = ($null -eq $legacy)\n    $definition.Settings.Hidden = $true\n    $definition.Settings.AllowDemandStart = $true\n    $definition.Settings.DisallowStartIfOnBatteries = $false\n    $definition.Settings.StopIfGoingOnBatteries = $false\n    $definition.Settings.RunOnlyIfNetworkAvailable = $false\n    $definition.Settings.StartWhenAvailable = $true\n    $definition.Settings.ExecutionTimeLimit = 'PT0S'\n    $definition.Settings.MultipleInstances = 2\n    $definition.Settings.RestartInterval = 'PT1M'\n    $definition.Settings.RestartCount = 999\n    $trigger = $definition.Triggers.Create(9)\n    $trigger.UserId = $sid\n    if ($r.periodic) {\n      $timer = $definition.Triggers.Create(1)\n      $timer.StartBoundary = (Get-Date).AddMinutes(1).ToString('yyyy-MM-ddTHH:mm:ss')\n      $timer.Repetition.Interval = 'PT1H'\n    }\n    $action = $definition.Actions.Create(0)\n    $action.Path = $(if ($nextDirect) { $r.executable } else { $hostPath })\n    $action.Arguments = $r.arguments\n    $action.WorkingDirectory = $r.workingDirectory\n    $task = $folder.RegisterTaskDefinition($name, $definition, 6, $sid, $null, 3, $null)\n    if ($legacy) {\n      try {\n        $deleted = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n        if ($deleted.ReturnValue -ne 0) { throw ('Cannot remove the old Windows Service (code ' + $deleted.ReturnValue + '). An administrator must remove the old registration before setup can continue.') }\n      } catch {\n        $folder.DeleteTask($name,0)\n        throw\n      }\n      $task.Enabled = $true\n    }\n    $legacy = $null\n  }\n  'start' { if (!$task) { throw 'OpenMeld background task is not installed. Run setup to repair it.' }; $null = $task.Run($null) }\n  'enable' { if ($task) { $task.Enabled = $true } }\n  'disable' { if ($task) { $task.Enabled = $false }; if ($legacy) { $result = Invoke-CimMethod -InputObject $legacy -MethodName ChangeStartMode -Arguments @{StartMode='Manual'}; if ($result.ReturnValue -ne 0) { throw 'Cannot disable the old Windows Service. Administrator assistance is required.' } } }\n  'stop' {\n    if ($task) { $task.Stop(0) }\n    if ($legacy -and $legacy.State -ne 'Stopped') {\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName StopService\n      if ($result.ReturnValue -notin @(0,6)) { throw 'Cannot stop the old Windows Service. Administrator assistance is required.' }\n    }\n  }\n  'uninstall' {\n    if ($task) { $task.Stop(0); $folder.DeleteTask($name,0); $task = $null }\n    if ($legacy) {\n      if ($legacy.State -ne 'Stopped') { throw 'The old OpenMeld Service is still running.' }\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n      if ($result.ReturnValue -ne 0) { throw 'Cannot remove the old Windows Service. Administrator assistance is required.' }\n      $legacy = $null\n    }\n  }\n  'status' { }\n  default { throw 'Unknown OpenMeld task operation.' }\n}\n@{ installed=($null -ne $task -or $null -ne $legacy); running=($(if ($task) { $task.State -eq 4 } else { $legacy -and $legacy.State -ne 'Stopped' })); enabled=($(if ($task) { [bool]$task.Enabled } else { $legacy -and $legacy.StartMode -eq 'Auto' })); legacy=($null -ne $legacy); actionArguments=($(if ($task) { $task.Definition.Actions.Item(1).Arguments } else { $null })) } | ConvertTo-Json -Compress\n`;\n\nexport function windowsPowerShellPath(): string {\n  return resolveWindowsPowerShellPath();\n}\n\nexport function windowsTaskActionArguments(\n  input: WindowsUserTaskAction\n): string {\n  // TypeScript's structural type does not strip fields from a spread spec.\n  // Project and validate the actual wire value before encoding it.\n  const action = windowsUserTaskActionSchema.parse({\n    executable: input.executable,\n    args: input.args,\n    env: input.env,\n    logPath: input.logPath,\n  });\n  const data = Buffer.from(JSON.stringify(action)).toString(\"base64\");\n  const script = String.raw`\n$ErrorActionPreference = 'Stop'\n$c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${data}')))\nfunction Quote-ProcessArgument([string]$value) {\n  '\"' + [regex]::Replace([regex]::Replace($value, '(\\\\*)\"', '$1$1\\\"'), '(\\\\+)$', '$1$1') + '\"'\n}\n$start = New-Object Diagnostics.ProcessStartInfo\n$start.FileName = $c.executable\n$start.Arguments = (@($c.args | ForEach-Object { Quote-ProcessArgument $_ }) -join ' ')\n$start.UseShellExecute = $false\n$start.CreateNoWindow = $true\n$start.RedirectStandardOutput = $true\n$start.RedirectStandardError = $true\nforeach ($property in $c.env.PSObject.Properties) { $start.EnvironmentVariables[$property.Name] = [string]$property.Value }\n$log = [IO.Stream]::Synchronized([IO.File]::Open($c.logPath, [IO.FileMode]::Append, [IO.FileAccess]::Write, [IO.FileShare]::ReadWrite))\n$process = New-Object Diagnostics.Process\n$process.StartInfo = $start\ntry {\n  $null = $process.Start()\n  $stdout = $process.StandardOutput.BaseStream.CopyToAsync($log)\n  $stderr = $process.StandardError.BaseStream.CopyToAsync($log)\n  $process.WaitForExit()\n  $stdout.GetAwaiter().GetResult()\n  $stderr.GetAwaiter().GetResult()\n  $exitCode = $process.ExitCode\n} finally {\n  $log.Dispose()\n  $process.Dispose()\n}\nexit $exitCode\n`;\n  return `-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(script, \"utf16le\").toString(\"base64\")}`;\n}\n\nconst ENCODED_ACTION_PATTERN = /-EncodedCommand ([A-Za-z0-9+/=]+)$/u;\nconst ACTION_DATA_PATTERN = /FromBase64String\\('([A-Za-z0-9+/=]+)'\\)/u;\n\nexport function readWindowsTaskAction(argumentsText: string) {\n  const direct = readWindowsDirectTaskAction(argumentsText);\n  if (direct) {\n    return direct;\n  }\n  const encoded = argumentsText.match(ENCODED_ACTION_PATTERN)?.[1];\n  const data =\n    encoded &&\n    Buffer.from(encoded, \"base64\")\n      .toString(\"utf16le\")\n      .match(ACTION_DATA_PATTERN)?.[1];\n  if (!data) {\n    throw new Error(\n      \"Windows task does not contain an OpenMeld launch command.\"\n    );\n  }\n  const action = windowsUserTaskStoredActionSchema.safeParse(\n    JSON.parse(Buffer.from(data, \"base64\").toString(\"utf8\"))\n  );\n  if (!action.success) {\n    throw new Error(\n      \"Windows task contains an invalid OpenMeld launch command.\"\n    );\n  }\n  return action.data;\n}\n\nexport async function runWindowsUserTask(\n  request: WindowsUserTaskRequest\n): Promise<{\n  installed: boolean;\n  running: boolean;\n  enabled: boolean;\n  legacy: boolean;\n  actionArguments: string | null;\n}> {\n  const lock = currentDaemonServiceLifecycleLock();\n  if (request.operation === \"install\" && request.arguments) {\n    const direct = readWindowsDirectTaskAction(request.arguments);\n    if (direct) {\n      if (request.executable !== direct.executable) {\n        throw new Error(\n          \"The Windows task executable does not match its launch envelope.\"\n        );\n      }\n      await verifyWindowsServiceSubsystem(direct.executable);\n    }\n  }\n  const payload = Buffer.from(\n    JSON.stringify(windowsUserTaskRequestSchema.parse(request))\n  ).toString(\"base64\");\n  let finish!: (value: {\n    error: ExecFileException | null;\n    stdout: string;\n  }) => void;\n  const completed = new Promise<{\n    error: ExecFileException | null;\n    stdout: string;\n  }>((resolve) => {\n    finish = resolve;\n  });\n  const child = execFile(\n    windowsPowerShellPath(),\n    powerShellEncodedArguments(TASK_CONTROL),\n    {\n      encoding: \"utf8\",\n      windowsHide: true,\n      timeout: 30_000,\n      maxBuffer: 1024 * 1024,\n      env: {\n        ...normalizeCommandEnvironment(process.env),\n        OPENMELD_TASK_REQUEST: payload,\n        OPENMELD_TASK_GRANT_REQUIRED: lock ? \"1\" : \"0\",\n      },\n    },\n    (error, stdout) => finish({ error, stdout })\n  );\n  // EOF before the grant prevents the COM operation. Once granted, this exact\n  // PowerShell instance retains the existing lifecycle fence if its CLI dies.\n  // This is not a Wake Job: the independently scheduled Service must survive it.\n  child.stdin?.on(\"error\", () => undefined);\n  let participant: OpenMeldLock | undefined;\n  try {\n    if (lock) {\n      if (!child.pid) {\n        throw new Error(\"Windows task control did not establish a process.\");\n      }\n      participant = await attachLockProcess(lock, child.pid);\n    }\n    child.stdin?.end(lock ? \"execute\\n\" : undefined);\n    const result = await completed;\n    if (result.error) {\n      throw result.error;\n    }\n    const status = windowsUserTaskStatusSchema.safeParse(\n      JSON.parse(result.stdout.trim())\n    );\n    if (!status.success) {\n      throw new Error(\"Windows returned an invalid OpenMeld task status.\");\n    }\n    return status.data;\n  } finally {\n    child.stdin?.destroy();\n    if (child.exitCode === null && child.signalCode === null) {\n      child.kill();\n    }\n    await completed;\n    if (participant) {\n      await releaseLock(participant);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAM,sBAAsB;AAE5B,SAAgB,6BACd,QACA,YAAyC,CAAC,GAClC;CACR,IACE,EACE,OAAO,yBACP,oBAAoB,KAAK,OAAO,qBAAqB,IAGvD,MAAM,IAAI,MACR,+DACF;CAEF,OAAO,KACL,yBAAyB,SAAS,GAClC,eAAe,OAAO,yBACtB,cACF;AACF;AAEA,eAAsB,gCACpB,QACA,YAAyC,CAAC,GACzB;CACjB,MAAM,SAAS,6BAA6B,QAAQ,SAAS;CAC7D,MAAM,WAAW,OAAO;CACxB,IACG,MAAM,wBAAwB,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,MAAO,UAEpE,OAAO;CAET,IACG,MAAM,wBAAwB,OAAO,uBAAuB,IAAI,MACjE,UAEA,MAAM,IAAI,MACR,uEACF;CAEF,MAAM,YAAY,QAAQ,MAAM;CAChC,IACE,MAAM,KAAK,SAAS,CAAC,CAAC,OAAO,UAAiC;EAC5D,IAAI,MAAM,SAAS,UACjB,OAAO;EAET,MAAM;CACR,CAAC,GACD;EACA,MAAM,SAAS,MAAM,yBAAyB,SAAS;EACvD,IAAI,WAAW,aAAa,WAAW,UACrC,MAAM,IAAI,MACR,uFACF;CAEJ;CACA,MAAM,MAAM,yBAAyB,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;CACpE,MAAM,YAAY,MAAM,QACtB,KAAK,yBAAyB,SAAS,GAAG,eAAe,CAC3D;CACA,IAAI;EACF,KAAK,MAAM,QAAQ,CAAC,gBAAgB,+BAA+B,GACjE,MAAM,SACJ,SAAS,iBACL,OAAO,wBACP,KAAK,QAAQ,OAAO,qBAAqB,GAAG,IAAI,GACpD,KAAK,WAAW,IAAI,CACtB;EAEF,IACG,MAAM,wBAAwB,KAAK,WAAW,cAAc,GAAG,IAAI,MACpE,UAEA,MAAM,IAAI,MACR,4DACF;EAEF,MAAM,OAAO,WAAW,SAAS;CACnC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;CACA,OAAO;AACT;AAIA,SAAgB,iCACd,SACQ;CACR,IAAI,CAAC,QAAQ,SAAS,WAAW,UAAU,GACzC,OAAO,QAAQ,OAAO,YAAY;CAEpC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,cAAc,MAAM;AACzE;AAEA,eAAsB,wBACpB,gBACA,UAAmB,QAAQ,aAAa,SACvB;CACjB,MAAM,iBAAiB,MAAM,SAAS,cAAc;CACpD,OAAO,UACH,YACE,gBACA,MAAM,SACJ,KAAK,QAAQ,cAAc,GAAG,+BAA+B,CAC/D,CACF,IACA;AACN;AAEA,SAAS,YAAY,gBAAwB,YAA4B;CACvE,OAAO,WAAW,QAAQ,CAAC,CACxB,OACC,KAAK,UAAU,CAAC,eAAe,YAAY,GAAG,WAAW,YAAY,CAAC,CAAC,CACzE,CAAC,CACA,OAAO,KAAK;AACjB;AAEA,eAAe,SAAS,MAA+B;CACrD,MAAM,OAAO,WAAW,QAAQ;CAChC,WAAW,MAAM,SAAS,iBAAiB,IAAI,GAC7C,KAAK,OAAO,KAAK;CAEnB,OAAO,KAAK,OAAO,KAAK;AAC1B;;AAGA,eAAsB,8BACpB,MACe;CACf,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG;CACnC,IAAI;EACF,MAAM,MAAM,OAAO,MAAM,EAAE;EAE3B,KACE,MAFkB,OAAO,KAAK,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAA,CAE7C,cAAc,IAAI,UACxB,IAAI,SAAS,SAAS,GAAG,CAAC,MAAM,MAEhC,MAAM,IAAI,MAAM,sDAAsD;EAExE,MAAM,SAAS,OAAO,MAAM,EAAE;EAO9B,KACE,MAPmB,OAAO,KAC1B,QACA,GACA,OAAO,QACP,IAAI,aAAa,EAAI,CACvB,EAAA,CAES,cAAc,OAAO,UAC5B,OAAO,SAAS,SAAS,GAAG,CAAC,MAAM,YACnC,OAAO,aAAa,CAAC,MAAM,SAC3B,OAAO,aAAa,EAAO,MAAM,GAEjC,MAAM,IAAI,MACR,qEACF;CAEJ,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;;;ACrLA,MAAa,2BAA2B,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DlD,MAAa,2BAA2B;AAKxC,MAAa,mCAAmC;;;;;;EAM9C,yBAAyB;;;;;;;;;;;;;;;;AC5C3B,MAAM,eAAe,OAAO,GAAG;;;;;;;;;;;;;iCAaE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4ClD,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEzC,SAAgB,wBAAgC;CAC9C,OAAO,6BAA6B;AACtC;AAEA,SAAgB,2BACd,OACQ;CAGR,MAAM,SAAS,4BAA4B,MAAM;EAC/C,YAAY,MAAM;EAClB,MAAM,MAAM;EACZ,KAAK,MAAM;EACX,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ;CAClE,MAAM,SAAS,OAAO,GAAG;;sFAE2D,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BzF,OAAO,0EAA0E,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,SAAS,QAAQ;AACnI;AAEA,MAAM,yBAAyB;AAC/B,MAAM,sBAAsB;AAE5B,SAAgB,sBAAsB,eAAuB;CAC3D,MAAM,SAAS,4BAA4B,aAAa;CACxD,IAAI,QACF,OAAO;CAET,MAAM,UAAU,cAAc,MAAM,sBAAsB,CAAC,GAAG;CAC9D,MAAM,OACJ,WACA,OAAO,KAAK,SAAS,QAAQ,CAAC,CAC3B,SAAS,SAAS,CAAC,CACnB,MAAM,mBAAmB,CAAC,GAAG;CAClC,IAAI,CAAC,MACH,MAAM,IAAI,MACR,2DACF;CAEF,MAAM,SAAS,kCAAkC,UAC/C,KAAK,MAAM,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CACzD;CACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MACR,2DACF;CAEF,OAAO,OAAO;AAChB;AAEA,eAAsB,mBACpB,SAOC;CACD,MAAM,OAAO,kCAAkC;CAC/C,IAAI,QAAQ,cAAc,aAAa,QAAQ,WAAW;EACxD,MAAM,SAAS,4BAA4B,QAAQ,SAAS;EAC5D,IAAI,QAAQ;GACV,IAAI,QAAQ,eAAe,OAAO,YAChC,MAAM,IAAI,MACR,iEACF;GAEF,MAAM,8BAA8B,OAAO,UAAU;EACvD;CACF;CACA,MAAM,UAAU,OAAO,KACrB,KAAK,UAAU,6BAA6B,MAAM,OAAO,CAAC,CAC5D,CAAC,CAAC,SAAS,QAAQ;CACnB,IAAI;CAIJ,MAAM,YAAY,IAAI,SAGlB,YAAY;EACd,SAAS;CACX,CAAC;CACD,MAAM,QAAQ,SACZ,sBAAsB,GACtB,2BAA2B,YAAY,GACvC;EACE,UAAU;EACV,aAAa;EACb,SAAS;EACT,WAAW,OAAO;EAClB,KAAK;GACH,GAAG,4BAA4B,QAAQ,GAAG;GAC1C,uBAAuB;GACvB,8BAA8B,OAAO,MAAM;EAC7C;CACF,IACC,OAAO,WAAW,OAAO;EAAE;EAAO;CAAO,CAAC,CAC7C;CAIA,MAAM,OAAO,GAAG,eAAe,KAAA,CAAS;CACxC,IAAI;CACJ,IAAI;EACF,IAAI,MAAM;GACR,IAAI,CAAC,MAAM,KACT,MAAM,IAAI,MAAM,mDAAmD;GAErE,cAAc,MAAM,kBAAkB,MAAM,MAAM,GAAG;EACvD;EACA,MAAM,OAAO,IAAI,OAAO,cAAc,KAAA,CAAS;EAC/C,MAAM,SAAS,MAAM;EACrB,IAAI,OAAO,OACT,MAAM,OAAO;EAEf,MAAM,SAAS,4BAA4B,UACzC,KAAK,MAAM,OAAO,OAAO,KAAK,CAAC,CACjC;EACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,mDAAmD;EAErE,OAAO,OAAO;CAChB,UAAU;EACR,MAAM,OAAO,QAAQ;EACrB,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,MAAM,KAAK;EAEb,MAAM;EACN,IAAI,aACF,MAAM,YAAY,WAAW;CAEjC;AACF"}
+{"version":3,"file":"windows-user-task-CTsMnmD4.js","names":[],"sources":["../src/local-service/lifecycle/windows-service-binary.ts","../src/local-service/lifecycle/windows-task-host.ts","../src/local-service/lifecycle/windows-user-task.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport {\n  copyFile,\n  mkdir,\n  mkdtemp,\n  open,\n  rename,\n  rm,\n  stat,\n} from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { pruneWindowsBinaryBundle } from \"@openmeld/adapter-core/windows-system\";\nimport { WINDOWS_PROCESS_HELPER_FILENAME } from \"@openmeld/schemas\";\nimport { daemonRuntimeBundlesPath } from \"../../config/daemon-state\";\nimport type { OpenMeldPathResolutionInput } from \"../../config/paths\";\nimport type { CliBinaryReleaseInfo } from \"../../config/version-state\";\nimport type { DaemonActiveBundleState } from \"./daemon-service-bundle\";\n\nconst FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/u;\n\nexport function windowsMaintenanceBinaryPath(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): string {\n  if (\n    !(\n      bundle.sourceDistFingerprint &&\n      FINGERPRINT_PATTERN.test(bundle.sourceDistFingerprint)\n    )\n  ) {\n    throw new Error(\n      \"OpenMeld maintenance needs a verified Windows Service bundle.\"\n    );\n  }\n  return join(\n    daemonRuntimeBundlesPath(pathInput),\n    `maintenance-${bundle.sourceDistFingerprint}`,\n    \"openmeld.exe\"\n  );\n}\n\nexport async function prepareWindowsMaintenanceBinary(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): Promise<string> {\n  const target = windowsMaintenanceBinaryPath(bundle, pathInput);\n  const expected = bundle.sourceDistFingerprint;\n  if (\n    (await hashBinaryServiceBundle(target, true).catch(() => null)) === expected\n  ) {\n    return target;\n  }\n  if (\n    (await hashBinaryServiceBundle(bundle.sourceEntryScriptPath, true)) !==\n    expected\n  ) {\n    throw new Error(\n      \"The Windows maintenance source no longer matches its verified bundle.\"\n    );\n  }\n  const directory = dirname(target);\n  if (\n    await stat(directory).catch((error: NodeJS.ErrnoException) => {\n      if (error.code === \"ENOENT\") {\n        return null;\n      }\n      throw error;\n    })\n  ) {\n    const result = await pruneWindowsBinaryBundle(directory);\n    if (result !== \"removed\" && result !== \"absent\") {\n      throw new Error(\n        \"The existing Windows maintenance copy is still in use or contains unrecognized files.\"\n      );\n    }\n  }\n  await mkdir(daemonRuntimeBundlesPath(pathInput), { recursive: true });\n  const temporary = await mkdtemp(\n    join(daemonRuntimeBundlesPath(pathInput), \".maintenance-\")\n  );\n  try {\n    for (const name of [\"openmeld.exe\", WINDOWS_PROCESS_HELPER_FILENAME]) {\n      await copyFile(\n        name === \"openmeld.exe\"\n          ? bundle.sourceEntryScriptPath\n          : join(dirname(bundle.sourceEntryScriptPath), name),\n        join(temporary, name)\n      );\n    }\n    if (\n      (await hashBinaryServiceBundle(join(temporary, \"openmeld.exe\"), true)) !==\n      expected\n    ) {\n      throw new Error(\n        \"The prepared Windows maintenance copy failed verification.\"\n      );\n    }\n    await rename(temporary, directory);\n  } finally {\n    await rm(temporary, { recursive: true, force: true });\n  }\n  return target;\n}\n\n// Windows binary_v1 bundles contain two indivisible, independently signed files.\n// Keep one bundle fingerprint for inventory, update jobs, and maintenance copies.\nexport function expectedBinaryServiceFingerprint(\n  release: CliBinaryReleaseInfo\n): string {\n  if (!release.platform.startsWith(\"windows-\")) {\n    return release.sha256.toLowerCase();\n  }\n  if (!release.windows) {\n    throw new Error(\n      \"The selected Windows Service has no native helper metadata.\"\n    );\n  }\n  return fingerprint(release.sha256, release.windows.processHelper.sha256);\n}\n\nexport async function hashBinaryServiceBundle(\n  executablePath: string,\n  windows: boolean = process.platform === \"win32\"\n): Promise<string> {\n  const executableHash = await hashFile(executablePath);\n  return windows\n    ? fingerprint(\n        executableHash,\n        await hashFile(\n          join(dirname(executablePath), WINDOWS_PROCESS_HELPER_FILENAME)\n        )\n      )\n    : executableHash;\n}\n\nfunction fingerprint(executableHash: string, helperHash: string): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify([executableHash.toLowerCase(), helperHash.toLowerCase()])\n    )\n    .digest(\"hex\");\n}\n\nasync function hashFile(file: string): Promise<string> {\n  const hash = createHash(\"sha256\");\n  for await (const chunk of createReadStream(file)) {\n    hash.update(chunk);\n  }\n  return hash.digest(\"hex\");\n}\n\n/** A valid signature does not establish the required console-free PE subsystem. */\nexport async function verifyWindowsServiceSubsystem(\n  file: string\n): Promise<void> {\n  const handle = await open(file, \"r\");\n  try {\n    const dos = Buffer.alloc(64);\n    const first = await handle.read(dos, 0, dos.length, 0);\n    if (\n      first.bytesRead !== dos.length ||\n      dos.toString(\"ascii\", 0, 2) !== \"MZ\"\n    ) {\n      throw new Error(\"The Windows Service artifact is not a PE executable.\");\n    }\n    const header = Buffer.alloc(94);\n    const second = await handle.read(\n      header,\n      0,\n      header.length,\n      dos.readUInt32LE(0x3c)\n    );\n    if (\n      second.bytesRead !== header.length ||\n      header.toString(\"ascii\", 0, 4) !== \"PE\\0\\0\" ||\n      header.readUInt16LE(4) !== 0x86_64 ||\n      header.readUInt16LE(24 + 68) !== 2\n    ) {\n      throw new Error(\n        \"The selected Windows Service must be a console-free x64 executable.\"\n      );\n    }\n  } finally {\n    await handle.close();\n  }\n}\n","// Task Scheduler must start a Windows-subsystem executable, not a console\n// executable that hides its window after startup. Keep the existing encoded\n// PowerShell action as the command/environment/logging owner.\n// Windows PowerShell 5.1 compiles this fixed source during guarded installation;\n// no SDK, downloaded executable, WSH/VBScript, or administrator access is needed.\nexport const WINDOWS_TASK_HOST_SOURCE = String.raw`\nusing System;\nusing System.Diagnostics;\nusing System.IO;\nusing System.Reflection;\nusing System.Text;\nusing System.Text.RegularExpressions;\n\npublic static class OpenMeldTaskHostV1 {\n  public static int Main(string[] args) {\n    string logPath = Assembly.GetExecutingAssembly().Location + \".log\";\n    try {\n      // Accept only the existing OpenMeld action, never an arbitrary executable\n      // or a shell-interpolated command line. Base64 contains no quoting syntax.\n      if (args.Length != 7 || args[0] != \"-NoLogo\" || args[1] != \"-NoProfile\" ||\n          args[2] != \"-NonInteractive\" || args[3] != \"-WindowStyle\" ||\n          args[4] != \"Hidden\" || args[5] != \"-EncodedCommand\" ||\n          !Regex.IsMatch(args[6], @\"\\A[A-Za-z0-9+/]+={0,2}\\z\"))\n        throw new ArgumentException(\"Invalid OpenMeld task arguments.\");\n      Convert.FromBase64String(args[6]);\n      var start = new ProcessStartInfo();\n      start.FileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System),\n        @\"WindowsPowerShell\\v1.0\\powershell.exe\");\n      start.Arguments = String.Join(\" \", args);\n      start.UseShellExecute = false;\n      start.CreateNoWindow = true;\n      start.RedirectStandardInput = true;\n      start.RedirectStandardOutput = true;\n      start.RedirectStandardError = true;\n      using (var log = Stream.Synchronized(new FileStream(logPath, FileMode.Append,\n          FileAccess.Write, FileShare.ReadWrite)))\n      using (var child = new Process()) {\n        child.StartInfo = start;\n        child.Start();\n        child.StandardInput.Close();\n        var stdout = child.StandardOutput.BaseStream.CopyToAsync(log);\n        var stderr = child.StandardError.BaseStream.CopyToAsync(log);\n        // Do not detach or break away from Task Scheduler's process ownership.\n        // The task remains running until the action completes, and restart-on-\n        // failure still receives the action's real exit code.\n        child.WaitForExit();\n        stdout.GetAwaiter().GetResult();\n        stderr.GetAwaiter().GetResult();\n        return child.ExitCode;\n      }\n    } catch (Exception error) {\n      try { File.AppendAllText(logPath, DateTime.UtcNow.ToString(\"o\") + \" \" +\n        error.GetType().Name + \": \" + error.Message + Environment.NewLine, Encoding.UTF8); }\n      catch { /* Task Scheduler still receives a nonzero result if logging fails. */ }\n      return 1;\n    }\n  }\n}\n`;\n\n// Per-task, lane-owned path: updating the maintenance host cannot replace the\n// executable of a running main Service, or vice versa. Keep v1 stable; a future\n// host format must explicitly support migration from this path.\nexport const WINDOWS_TASK_HOST_SUFFIX = \".task-host-v1.exe\";\n\n// The caller has already verified identity and acquired the lifecycle grant.\n// Build beside the target and replace atomically, never overwrite a running\n// host or fall back to a flashing console when compilation is unavailable.\nexport const WINDOWS_TASK_HOST_INSTALL_SCRIPT = `\n$hostDirectory = [IO.Path]::GetDirectoryName($hostPath)\n$null = [IO.Directory]::CreateDirectory($hostDirectory)\n$temporaryHost = Join-Path $hostDirectory ([Guid]::NewGuid().ToString('N') + '.exe')\ntry {\n  Add-Type -TypeDefinition @'\n${WINDOWS_TASK_HOST_SOURCE}\n'@ -OutputAssembly $temporaryHost -OutputType WindowsApplication -ErrorAction Stop\n  if ($task -and $task.State -eq 4) { throw 'OpenMeld cannot replace a background task while it is running.' }\n  if ([IO.File]::Exists($hostPath)) {\n    # PowerShell coerces bare $null to an empty string for this .NET parameter.\n    # Pass a real null backup path; an empty path breaks repeat setup/repair.\n    [IO.File]::Replace($temporaryHost, $hostPath, [NullString]::Value)\n  } else {\n    [IO.File]::Move($temporaryHost, $hostPath)\n  }\n} finally {\n  if ([IO.File]::Exists($temporaryHost)) { [IO.File]::Delete($temporaryHost) }\n}\n`;\n","import { type ExecFileException, execFile } from \"node:child_process\";\nimport { normalizeCommandEnvironment } from \"@openmeld/adapter-core/process-environment\";\nimport {\n  powerShellEncodedArguments,\n  resolveWindowsPowerShellPath,\n} from \"@openmeld/adapter-core/windows-system\";\nimport {\n  type WindowsUserTaskAction,\n  type WindowsUserTaskRequest,\n  windowsUserTaskActionSchema,\n  windowsUserTaskRequestSchema,\n  windowsUserTaskStatusSchema,\n  windowsUserTaskStoredActionSchema,\n} from \"@openmeld/schemas\";\nimport { currentDaemonServiceLifecycleLock } from \"../../config/daemon-state\";\nimport {\n  attachLockProcess,\n  type OpenMeldLock,\n  releaseLock,\n} from \"../../config/lock\";\nimport { verifyWindowsServiceSubsystem } from \"./windows-service-binary\";\nimport { readWindowsDirectTaskAction } from \"./windows-task-command\";\nimport {\n  WINDOWS_TASK_HOST_INSTALL_SCRIPT,\n  WINDOWS_TASK_HOST_SUFFIX,\n} from \"./windows-task-host\";\n\n// Task Scheduler runs in the signed-in user's session, with that user's tokens\n// and ordinary permissions. No password, elevation, or third-party service host.\n// Native COM contracts: learn.microsoft.com/windows/win32/taskschd/\nconst TASK_CONTROL = String.raw`\n$ErrorActionPreference = 'Stop'\n$ProgressPreference = 'SilentlyContinue'\n[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)\n$r = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:OPENMELD_TASK_REQUEST)))\nif ($env:OPENMELD_TASK_GRANT_REQUIRED -eq '1' -and [Console]::In.ReadLine() -ne 'execute') { exit 125 }\n$env:OPENMELD_TASK_GRANT_REQUIRED = $null\n$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value\nif ($sid -in @('S-1-5-18','S-1-5-19','S-1-5-20')) { throw 'Run OpenMeld setup from your own Windows account, not a system account.' }\n$scheduler = New-Object -ComObject 'Schedule.Service'\n$scheduler.Connect()\n$folder = $scheduler.GetFolder('\\')\n$name = $r.name + '-' + $sid\n$hostPath = $r.legacyScript + '${WINDOWS_TASK_HOST_SUFFIX}'\n$runtimeRoot = [IO.Path]::GetDirectoryName($r.legacyScript)\nfunction Read-OwnedDirectAction($path, $arguments) {\n  if ($arguments -notmatch '(?:^| )--openmeld-windows-task ([A-Za-z0-9+/=]+)$') { return $null }\n  $c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Matches[1])))\n  $bundles = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'bundles')) + '\\'\n  $fullPath = [IO.Path]::GetFullPath($path)\n  if ($c.executable -ne $path -or !$fullPath.StartsWith($bundles, [StringComparison]::OrdinalIgnoreCase) -or [IO.Path]::GetFileName($path) -ne 'openmeld.exe' -or !$c.env.OPENMELD_HOME -or [IO.Path]::GetFullPath((Join-Path $c.env.OPENMELD_HOME 'runtime\\daemon')) -ne [IO.Path]::GetFullPath($runtimeRoot)) {\n    throw 'The Windows task does not belong to this OpenMeld installation.'\n  }\n  return $c\n}\n$existingDirect = $null\n$task = $null\ntry { $task = $folder.GetTask($name) } catch {\n  if ($_.Exception.GetBaseException().HResult -ne -2147024894) { throw }\n}\nif ($task) {\n  $principal = $task.Definition.Principal\n  $taskSid = $principal.UserId\n  if ($taskSid -notmatch '^S-\\d-') { $taskSid = ([Security.Principal.NTAccount]$taskSid).Translate([Security.Principal.SecurityIdentifier]).Value }\n  $actionPath = $task.Definition.Actions.Item(1).Path\n  $existingDirect = Read-OwnedDirectAction $actionPath $task.Definition.Actions.Item(1).Arguments\n  if ($taskSid -ne $sid -or $principal.LogonType -ne 3 -or $principal.RunLevel -ne 0 -or $task.Definition.Actions.Count -ne 1 -or (!$existingDirect -and $actionPath -ne (Join-Path $PSHOME 'powershell.exe') -and $actionPath -ne $hostPath)) {\n    throw 'An existing OpenMeld task uses a different user or launch configuration. Resolve that installation before continuing.'\n  }\n}\n# Migration only owns the exact legacy script in this lane. Never stop another\n# user's or an administrator-customized service merely because its name matches.\n$legacy = Get-CimInstance Win32_Service -Filter (\"Name='\" + $r.name.Replace(\"'\",\"''\") + \"'\")\nif ($legacy -and $legacy.PathName.Trim('\"') -ne $r.legacyScript) {\n  throw 'An existing Windows service uses a different installation. Resolve that installation before continuing.'\n}\nswitch ($r.operation) {\n  'install' {\n    if ($legacy -and $legacy.State -ne 'Stopped') { throw 'The previous OpenMeld Service must finish stopping before migration.' }\n    $nextDirect = Read-OwnedDirectAction $r.executable $r.arguments\n    # A running maintenance invocation keeps its immutable copy and lease. Only\n    # subsequent invocations select the new copy. Main Service replacement still\n    # requires the existing drain and stopped-state proof.\n    $maintenanceUpdate = $r.periodic -and $existingDirect -and $nextDirect -and $existingDirect.args.Count -eq 2 -and $nextDirect.args.Count -eq 2 -and $existingDirect.args[0] -eq 'service' -and $existingDirect.args[1] -eq 'update-worker' -and $nextDirect.args[0] -eq 'service' -and $nextDirect.args[1] -eq 'update-worker'\n    if ($task -and $task.State -eq 4 -and !$maintenanceUpdate) { throw 'OpenMeld cannot replace a background task while it is running.' }\n    if (!$nextDirect) {\n      if ($r.executable -ne (Join-Path $PSHOME 'powershell.exe')) { throw 'OpenMeld tasks require a verified background executable.' }\n      ${WINDOWS_TASK_HOST_INSTALL_SCRIPT}\n    }\n    $definition = $scheduler.NewTask(0)\n    $definition.RegistrationInfo.Description = 'OpenMeld background process for the signed-in user.'\n    $definition.Principal.UserId = $sid\n    $definition.Principal.LogonType = 3\n    $definition.Principal.RunLevel = 0\n    $definition.Settings.Enabled = ($null -eq $legacy)\n    $definition.Settings.Hidden = $true\n    $definition.Settings.AllowDemandStart = $true\n    $definition.Settings.DisallowStartIfOnBatteries = $false\n    $definition.Settings.StopIfGoingOnBatteries = $false\n    $definition.Settings.RunOnlyIfNetworkAvailable = $false\n    $definition.Settings.StartWhenAvailable = $true\n    $definition.Settings.ExecutionTimeLimit = 'PT0S'\n    $definition.Settings.MultipleInstances = 2\n    $definition.Settings.RestartInterval = 'PT1M'\n    $definition.Settings.RestartCount = 999\n    $trigger = $definition.Triggers.Create(9)\n    $trigger.UserId = $sid\n    if ($r.periodic) {\n      $timer = $definition.Triggers.Create(1)\n      $timer.StartBoundary = (Get-Date).AddMinutes(1).ToString('yyyy-MM-ddTHH:mm:ss')\n      $timer.Repetition.Interval = 'PT1H'\n    }\n    $action = $definition.Actions.Create(0)\n    $action.Path = $(if ($nextDirect) { $r.executable } else { $hostPath })\n    $action.Arguments = $r.arguments\n    $action.WorkingDirectory = $r.workingDirectory\n    $task = $folder.RegisterTaskDefinition($name, $definition, 6, $sid, $null, 3, $null)\n    if ($legacy) {\n      try {\n        $deleted = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n        if ($deleted.ReturnValue -ne 0) { throw ('Cannot remove the old Windows Service (code ' + $deleted.ReturnValue + '). An administrator must remove the old registration before setup can continue.') }\n      } catch {\n        $folder.DeleteTask($name,0)\n        throw\n      }\n      $task.Enabled = $true\n    }\n    $legacy = $null\n  }\n  'start' { if (!$task) { throw 'OpenMeld background task is not installed. Run setup to repair it.' }; $null = $task.Run($null) }\n  'enable' { if ($task) { $task.Enabled = $true } }\n  'disable' { if ($task) { $task.Enabled = $false }; if ($legacy) { $result = Invoke-CimMethod -InputObject $legacy -MethodName ChangeStartMode -Arguments @{StartMode='Manual'}; if ($result.ReturnValue -ne 0) { throw 'Cannot disable the old Windows Service. Administrator assistance is required.' } } }\n  'stop' {\n    if ($task) { $task.Stop(0) }\n    if ($legacy -and $legacy.State -ne 'Stopped') {\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName StopService\n      if ($result.ReturnValue -notin @(0,6)) { throw 'Cannot stop the old Windows Service. Administrator assistance is required.' }\n    }\n  }\n  'uninstall' {\n    if ($task) { $task.Stop(0); $folder.DeleteTask($name,0); $task = $null }\n    if ($legacy) {\n      if ($legacy.State -ne 'Stopped') { throw 'The old OpenMeld Service is still running.' }\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n      if ($result.ReturnValue -ne 0) { throw 'Cannot remove the old Windows Service. Administrator assistance is required.' }\n      $legacy = $null\n    }\n  }\n  'status' { }\n  default { throw 'Unknown OpenMeld task operation.' }\n}\n@{ installed=($null -ne $task -or $null -ne $legacy); running=($(if ($task) { $task.State -eq 4 } else { $legacy -and $legacy.State -ne 'Stopped' })); enabled=($(if ($task) { [bool]$task.Enabled } else { $legacy -and $legacy.StartMode -eq 'Auto' })); legacy=($null -ne $legacy); actionArguments=($(if ($task) { $task.Definition.Actions.Item(1).Arguments } else { $null })) } | ConvertTo-Json -Compress\n`;\n\nexport function windowsPowerShellPath(): string {\n  return resolveWindowsPowerShellPath();\n}\n\nexport function windowsTaskActionArguments(\n  input: WindowsUserTaskAction\n): string {\n  // TypeScript's structural type does not strip fields from a spread spec.\n  // Project and validate the actual wire value before encoding it.\n  const action = windowsUserTaskActionSchema.parse({\n    executable: input.executable,\n    args: input.args,\n    env: input.env,\n    logPath: input.logPath,\n  });\n  const data = Buffer.from(JSON.stringify(action)).toString(\"base64\");\n  const script = String.raw`\n$ErrorActionPreference = 'Stop'\n$c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${data}')))\nfunction Quote-ProcessArgument([string]$value) {\n  '\"' + [regex]::Replace([regex]::Replace($value, '(\\\\*)\"', '$1$1\\\"'), '(\\\\+)$', '$1$1') + '\"'\n}\n$start = New-Object Diagnostics.ProcessStartInfo\n$start.FileName = $c.executable\n$start.Arguments = (@($c.args | ForEach-Object { Quote-ProcessArgument $_ }) -join ' ')\n$start.UseShellExecute = $false\n$start.CreateNoWindow = $true\n$start.RedirectStandardOutput = $true\n$start.RedirectStandardError = $true\nforeach ($property in $c.env.PSObject.Properties) { $start.EnvironmentVariables[$property.Name] = [string]$property.Value }\n$log = [IO.Stream]::Synchronized([IO.File]::Open($c.logPath, [IO.FileMode]::Append, [IO.FileAccess]::Write, [IO.FileShare]::ReadWrite))\n$process = New-Object Diagnostics.Process\n$process.StartInfo = $start\ntry {\n  $null = $process.Start()\n  $stdout = $process.StandardOutput.BaseStream.CopyToAsync($log)\n  $stderr = $process.StandardError.BaseStream.CopyToAsync($log)\n  $process.WaitForExit()\n  $stdout.GetAwaiter().GetResult()\n  $stderr.GetAwaiter().GetResult()\n  $exitCode = $process.ExitCode\n} finally {\n  $log.Dispose()\n  $process.Dispose()\n}\nexit $exitCode\n`;\n  return `-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(script, \"utf16le\").toString(\"base64\")}`;\n}\n\nconst ENCODED_ACTION_PATTERN = /-EncodedCommand ([A-Za-z0-9+/=]+)$/u;\nconst ACTION_DATA_PATTERN = /FromBase64String\\('([A-Za-z0-9+/=]+)'\\)/u;\n\nexport function readWindowsTaskAction(argumentsText: string) {\n  const direct = readWindowsDirectTaskAction(argumentsText);\n  if (direct) {\n    return direct;\n  }\n  const encoded = argumentsText.match(ENCODED_ACTION_PATTERN)?.[1];\n  const data =\n    encoded &&\n    Buffer.from(encoded, \"base64\")\n      .toString(\"utf16le\")\n      .match(ACTION_DATA_PATTERN)?.[1];\n  if (!data) {\n    throw new Error(\n      \"Windows task does not contain an OpenMeld launch command.\"\n    );\n  }\n  const action = windowsUserTaskStoredActionSchema.safeParse(\n    JSON.parse(Buffer.from(data, \"base64\").toString(\"utf8\"))\n  );\n  if (!action.success) {\n    throw new Error(\n      \"Windows task contains an invalid OpenMeld launch command.\"\n    );\n  }\n  return action.data;\n}\n\nexport async function runWindowsUserTask(\n  request: WindowsUserTaskRequest\n): Promise<{\n  installed: boolean;\n  running: boolean;\n  enabled: boolean;\n  legacy: boolean;\n  actionArguments: string | null;\n}> {\n  const lock = currentDaemonServiceLifecycleLock();\n  if (request.operation === \"install\" && request.arguments) {\n    const direct = readWindowsDirectTaskAction(request.arguments);\n    if (direct) {\n      if (request.executable !== direct.executable) {\n        throw new Error(\n          \"The Windows task executable does not match its launch envelope.\"\n        );\n      }\n      await verifyWindowsServiceSubsystem(direct.executable);\n    }\n  }\n  const payload = Buffer.from(\n    JSON.stringify(windowsUserTaskRequestSchema.parse(request))\n  ).toString(\"base64\");\n  let finish!: (value: {\n    error: ExecFileException | null;\n    stdout: string;\n  }) => void;\n  const completed = new Promise<{\n    error: ExecFileException | null;\n    stdout: string;\n  }>((resolve) => {\n    finish = resolve;\n  });\n  const child = execFile(\n    windowsPowerShellPath(),\n    powerShellEncodedArguments(TASK_CONTROL),\n    {\n      encoding: \"utf8\",\n      windowsHide: true,\n      timeout: 30_000,\n      maxBuffer: 1024 * 1024,\n      env: {\n        ...normalizeCommandEnvironment(process.env),\n        OPENMELD_TASK_REQUEST: payload,\n        OPENMELD_TASK_GRANT_REQUIRED: lock ? \"1\" : \"0\",\n      },\n    },\n    (error, stdout) => finish({ error, stdout })\n  );\n  // EOF before the grant prevents the COM operation. Once granted, this exact\n  // PowerShell instance retains the existing lifecycle fence if its CLI dies.\n  // This is not a Wake Job: the independently scheduled Service must survive it.\n  child.stdin?.on(\"error\", () => undefined);\n  let participant: OpenMeldLock | undefined;\n  try {\n    if (lock) {\n      if (!child.pid) {\n        throw new Error(\"Windows task control did not establish a process.\");\n      }\n      participant = await attachLockProcess(lock, child.pid);\n    }\n    child.stdin?.end(lock ? \"execute\\n\" : undefined);\n    const result = await completed;\n    if (result.error) {\n      throw result.error;\n    }\n    const status = windowsUserTaskStatusSchema.safeParse(\n      JSON.parse(result.stdout.trim())\n    );\n    if (!status.success) {\n      throw new Error(\"Windows returned an invalid OpenMeld task status.\");\n    }\n    return status.data;\n  } finally {\n    child.stdin?.destroy();\n    if (child.exitCode === null && child.signalCode === null) {\n      child.kill();\n    }\n    await completed;\n    if (participant) {\n      await releaseLock(participant);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAM,sBAAsB;AAE5B,SAAgB,6BACd,QACA,YAAyC,CAAC,GAClC;CACR,IACE,EACE,OAAO,yBACP,oBAAoB,KAAK,OAAO,qBAAqB,IAGvD,MAAM,IAAI,MACR,+DACF;CAEF,OAAO,KACL,yBAAyB,SAAS,GAClC,eAAe,OAAO,yBACtB,cACF;AACF;AAEA,eAAsB,gCACpB,QACA,YAAyC,CAAC,GACzB;CACjB,MAAM,SAAS,6BAA6B,QAAQ,SAAS;CAC7D,MAAM,WAAW,OAAO;CACxB,IACG,MAAM,wBAAwB,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,MAAO,UAEpE,OAAO;CAET,IACG,MAAM,wBAAwB,OAAO,uBAAuB,IAAI,MACjE,UAEA,MAAM,IAAI,MACR,uEACF;CAEF,MAAM,YAAY,QAAQ,MAAM;CAChC,IACE,MAAM,KAAK,SAAS,CAAC,CAAC,OAAO,UAAiC;EAC5D,IAAI,MAAM,SAAS,UACjB,OAAO;EAET,MAAM;CACR,CAAC,GACD;EACA,MAAM,SAAS,MAAM,yBAAyB,SAAS;EACvD,IAAI,WAAW,aAAa,WAAW,UACrC,MAAM,IAAI,MACR,uFACF;CAEJ;CACA,MAAM,MAAM,yBAAyB,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;CACpE,MAAM,YAAY,MAAM,QACtB,KAAK,yBAAyB,SAAS,GAAG,eAAe,CAC3D;CACA,IAAI;EACF,KAAK,MAAM,QAAQ,CAAC,gBAAgB,+BAA+B,GACjE,MAAM,SACJ,SAAS,iBACL,OAAO,wBACP,KAAK,QAAQ,OAAO,qBAAqB,GAAG,IAAI,GACpD,KAAK,WAAW,IAAI,CACtB;EAEF,IACG,MAAM,wBAAwB,KAAK,WAAW,cAAc,GAAG,IAAI,MACpE,UAEA,MAAM,IAAI,MACR,4DACF;EAEF,MAAM,OAAO,WAAW,SAAS;CACnC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;CACA,OAAO;AACT;AAIA,SAAgB,iCACd,SACQ;CACR,IAAI,CAAC,QAAQ,SAAS,WAAW,UAAU,GACzC,OAAO,QAAQ,OAAO,YAAY;CAEpC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,cAAc,MAAM;AACzE;AAEA,eAAsB,wBACpB,gBACA,UAAmB,QAAQ,aAAa,SACvB;CACjB,MAAM,iBAAiB,MAAM,SAAS,cAAc;CACpD,OAAO,UACH,YACE,gBACA,MAAM,SACJ,KAAK,QAAQ,cAAc,GAAG,+BAA+B,CAC/D,CACF,IACA;AACN;AAEA,SAAS,YAAY,gBAAwB,YAA4B;CACvE,OAAO,WAAW,QAAQ,CAAC,CACxB,OACC,KAAK,UAAU,CAAC,eAAe,YAAY,GAAG,WAAW,YAAY,CAAC,CAAC,CACzE,CAAC,CACA,OAAO,KAAK;AACjB;AAEA,eAAe,SAAS,MAA+B;CACrD,MAAM,OAAO,WAAW,QAAQ;CAChC,WAAW,MAAM,SAAS,iBAAiB,IAAI,GAC7C,KAAK,OAAO,KAAK;CAEnB,OAAO,KAAK,OAAO,KAAK;AAC1B;;AAGA,eAAsB,8BACpB,MACe;CACf,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG;CACnC,IAAI;EACF,MAAM,MAAM,OAAO,MAAM,EAAE;EAE3B,KACE,MAFkB,OAAO,KAAK,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAA,CAE7C,cAAc,IAAI,UACxB,IAAI,SAAS,SAAS,GAAG,CAAC,MAAM,MAEhC,MAAM,IAAI,MAAM,sDAAsD;EAExE,MAAM,SAAS,OAAO,MAAM,EAAE;EAO9B,KACE,MAPmB,OAAO,KAC1B,QACA,GACA,OAAO,QACP,IAAI,aAAa,EAAI,CACvB,EAAA,CAES,cAAc,OAAO,UAC5B,OAAO,SAAS,SAAS,GAAG,CAAC,MAAM,YACnC,OAAO,aAAa,CAAC,MAAM,SAC3B,OAAO,aAAa,EAAO,MAAM,GAEjC,MAAM,IAAI,MACR,qEACF;CAEJ,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;;;ACrLA,MAAa,2BAA2B,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DlD,MAAa,2BAA2B;AAKxC,MAAa,mCAAmC;;;;;;EAM9C,yBAAyB;;;;;;;;;;;;;;;;AC5C3B,MAAM,eAAe,OAAO,GAAG;;;;;;;;;;;;;iCAaE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4ClD,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEzC,SAAgB,wBAAgC;CAC9C,OAAO,6BAA6B;AACtC;AAEA,SAAgB,2BACd,OACQ;CAGR,MAAM,SAAS,4BAA4B,MAAM;EAC/C,YAAY,MAAM;EAClB,MAAM,MAAM;EACZ,KAAK,MAAM;EACX,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ;CAClE,MAAM,SAAS,OAAO,GAAG;;sFAE2D,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BzF,OAAO,0EAA0E,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,SAAS,QAAQ;AACnI;AAEA,MAAM,yBAAyB;AAC/B,MAAM,sBAAsB;AAE5B,SAAgB,sBAAsB,eAAuB;CAC3D,MAAM,SAAS,4BAA4B,aAAa;CACxD,IAAI,QACF,OAAO;CAET,MAAM,UAAU,cAAc,MAAM,sBAAsB,CAAC,GAAG;CAC9D,MAAM,OACJ,WACA,OAAO,KAAK,SAAS,QAAQ,CAAC,CAC3B,SAAS,SAAS,CAAC,CACnB,MAAM,mBAAmB,CAAC,GAAG;CAClC,IAAI,CAAC,MACH,MAAM,IAAI,MACR,2DACF;CAEF,MAAM,SAAS,kCAAkC,UAC/C,KAAK,MAAM,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CACzD;CACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MACR,2DACF;CAEF,OAAO,OAAO;AAChB;AAEA,eAAsB,mBACpB,SAOC;CACD,MAAM,OAAO,kCAAkC;CAC/C,IAAI,QAAQ,cAAc,aAAa,QAAQ,WAAW;EACxD,MAAM,SAAS,4BAA4B,QAAQ,SAAS;EAC5D,IAAI,QAAQ;GACV,IAAI,QAAQ,eAAe,OAAO,YAChC,MAAM,IAAI,MACR,iEACF;GAEF,MAAM,8BAA8B,OAAO,UAAU;EACvD;CACF;CACA,MAAM,UAAU,OAAO,KACrB,KAAK,UAAU,6BAA6B,MAAM,OAAO,CAAC,CAC5D,CAAC,CAAC,SAAS,QAAQ;CACnB,IAAI;CAIJ,MAAM,YAAY,IAAI,SAGlB,YAAY;EACd,SAAS;CACX,CAAC;CACD,MAAM,QAAQ,SACZ,sBAAsB,GACtB,2BAA2B,YAAY,GACvC;EACE,UAAU;EACV,aAAa;EACb,SAAS;EACT,WAAW,OAAO;EAClB,KAAK;GACH,GAAG,4BAA4B,QAAQ,GAAG;GAC1C,uBAAuB;GACvB,8BAA8B,OAAO,MAAM;EAC7C;CACF,IACC,OAAO,WAAW,OAAO;EAAE;EAAO;CAAO,CAAC,CAC7C;CAIA,MAAM,OAAO,GAAG,eAAe,KAAA,CAAS;CACxC,IAAI;CACJ,IAAI;EACF,IAAI,MAAM;GACR,IAAI,CAAC,MAAM,KACT,MAAM,IAAI,MAAM,mDAAmD;GAErE,cAAc,MAAM,kBAAkB,MAAM,MAAM,GAAG;EACvD;EACA,MAAM,OAAO,IAAI,OAAO,cAAc,KAAA,CAAS;EAC/C,MAAM,SAAS,MAAM;EACrB,IAAI,OAAO,OACT,MAAM,OAAO;EAEf,MAAM,SAAS,4BAA4B,UACzC,KAAK,MAAM,OAAO,OAAO,KAAK,CAAC,CACjC;EACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,mDAAmD;EAErE,OAAO,OAAO;CAChB,UAAU;EACR,MAAM,OAAO,QAAQ;EACrB,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,MAAM,KAAK;EAEb,MAAM;EACN,IAAI,aACF,MAAM,YAAY,WAAW;CAEjC;AACF"}

package/dist/{windows-user-task-m9eMEUEq.js → windows-user-task-DnxKO3oB.js}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { n as runWindowsUserTask, t as readWindowsTaskAction } from "./windows-user-task-BR-WB7hr.js";
+import { n as runWindowsUserTask, t as readWindowsTaskAction } from "./windows-user-task-CTsMnmD4.js";
 export { readWindowsTaskAction, runWindowsUserTask };

package/package.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "openmeld",
-  "version": "0.3.231",
-  "openMeldReleaseDate": "2026-09-28",
+  "version": "0.3.233",
+  "openMeldReleaseDate": "2026-10-01",
   "description": "OpenMeld CLI - https://openmeld.ai",
   "license": "MIT",
   "type": "module",
@@ -23,7 +23,7 @@
     "skills"
   ],
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.195",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.286",
     "@anthropic-ai/sdk": "^0.93.0",
     "@clack/prompts": "^1.0.1",
     "@mariozechner/pi-tui": "0.57.1",
@@ -49,25 +49,25 @@
     "vitest": "~3.2.0",
     "@openmeld/adapter-antigravity": "0.0.1",
     "@openmeld/adapter-claude-code": "0.0.1",
+    "@openmeld/adapter-core": "0.0.1",
     "@openmeld/adapter-codex": "0.0.1",
     "@openmeld/adapter-cursor": "0.0.1",
-    "@openmeld/adapter-core": "0.0.1",
     "@openmeld/adapter-grok-build": "0.0.1",
     "@openmeld/adapter-opencode": "0.0.1",
-    "@openmeld/agent-runtime": "0.0.1",
     "@openmeld/adapter-openclaw": "0.0.1",
     "@openmeld/api-client": "0.0.1",
+    "@openmeld/agent-runtime": "0.0.1",
     "@openmeld/gateway-contract": "0.0.1",
     "@openmeld/local-execution": "0.0.1",
     "@openmeld/local-service": "0.0.1",
-    "@openmeld/projects": "0.0.1",
     "@openmeld/protocol": "0.0.1",
-    "@openmeld/routine-schedule": "0.0.1",
     "@openmeld/schemas": "0.0.1",
-    "@openmeld/space-mesh": "0.0.1",
     "@openmeld/space": "0.0.1",
+    "@openmeld/space-mesh": "0.0.1",
+    "@openmeld/projects": "0.0.1",
     "@openmeld/utils": "0.0.1",
-    "@openmeld/start": "0.0.1"
+    "@openmeld/start": "0.0.1",
+    "@openmeld/routine-schedule": "0.0.1"
   },
   "openmeld": {
     "releaseLine": "openmeld-greenfield-2026-07",
@@ -85,5 +85,5 @@
     "test:local-service": "vitest run --config vitest.integration.config.ts tests/local-service-state.integration.test.ts tests/local-service-command.integration.test.ts tests/local-service-menu.integration.test.ts tests/local-service-run.integration.test.ts tests/local-service-bootstrap-recommendation.test.ts",
     "test:watch": "vitest"
   },
-  "gitHead": "c2772ed0d8665df1550ce64516535fc1507e4b29"
+  "gitHead": "e4454cf165b96c7f918e420f28205c2b2ed3c575"
 }

package/dist/auth-session-DExyUwLo.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-
-import { u as getAuthSessionMetadata } from "./auth-session-pLaN5cnC.js";
-export { getAuthSessionMetadata };

package/dist/channel-DppbHxHw.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"channel-DppbHxHw.js","names":[],"sources":["../../../packages/schemas/dist/service-execution-host.js","../src/local-service/execution-host/channel.ts"],"sourcesContent":["import { daemonServiceLaneSchema } from \"./schemas/daemon/service-contract.js\";\nimport { providerDispatchRuntimeContextSchema } from \"./schemas/daemon/provider-runtime-context.js\";\nimport { openMeldDaemonCancelPayloadSchema, openMeldDaemonCancelRequestPayloadSchema, openMeldDaemonConversationExecutionStatusPayloadSchema, openMeldDaemonConversationExecutionStatusRequestPayloadSchema, openMeldDaemonInterruptPayloadSchema, openMeldDaemonInterruptRequestPayloadSchema, openMeldDaemonSetLocalAgentEnabledPayloadSchema, openMeldDaemonSetLocalAgentEnabledRequestPayloadSchema, skippedDaemonProfileSchema } from \"./schemas/daemon/control-plane.js\";\nimport { daemonStreamFrameSchema, localWakeRouteWorkingFolderObservationSchema, runtimeTransportLeaseSchema } from \"./schemas/daemon/runtime-transport.js\";\nimport { cachedDaemonRouteConfigSchema } from \"./schemas/daemon/route-catalog-cache.js\";\nimport * as z$1 from \"zod/v4\";\n//#region src/service-execution-host.ts\nconst SERVICE_EXECUTION_HOST_PROTOCOL = \"service-execution-host-v1\";\nconst SERVICE_EXECUTION_HOST_MAX_FRAME_BYTES = 8 * 1024 * 1024;\nconst SERVICE_EXECUTION_HOST_MAX_PENDING_REQUESTS = 64;\nconst identityString = z$1.string().min(1).max(1024);\nconst count = z$1.number().int().nonnegative();\nconst empty = z$1.strictObject({});\nconst serviceExecutionHostIdentitySchema = z$1.strictObject({\n\townerUserId: identityString,\n\tdeviceId: identityString,\n\tlane: daemonServiceLaneSchema,\n\tdaemonSessionId: identityString,\n\tserviceContractGeneration: count,\n\tsessionIdentity: identityString,\n\tstateRoot: z$1.string().min(1).max(4096),\n\tauthBaseUrl: z$1.url(),\n\tgatewayBaseUrl: z$1.url(),\n\tparentPid: z$1.number().int().positive(),\n\tparentProcessStartedAt: identityString\n});\nconst serviceExecutionHostSnapshotSchema = z$1.strictObject({\n\tpid: z$1.number().int().positive(),\n\tadmission: z$1.enum([\"open\", \"draining\"]),\n\tactiveCount: count,\n\tpendingCount: count,\n\tlocalQuiescent: z$1.boolean(),\n\tunacknowledgedResultCount: count,\n\tstartupReplayPending: z$1.boolean(),\n\tadapterIds: z$1.array(identityString).max(256)\n});\nconst serviceExecutionHostOwnerSchema = z$1.strictObject({\n\tschema: z$1.literal(\"service-execution-host-owner-v1\"),\n\thostInstanceId: z$1.uuid(),\n\townerUserId: identityString,\n\tdeviceId: identityString,\n\tlane: daemonServiceLaneSchema,\n\tpid: z$1.number().int().positive(),\n\tbootIdentity: identityString.nullable(),\n\tlocalQuiescent: z$1.boolean()\n});\nconst profileWorkingFolderFactSchema = z$1.strictObject({\n\tdefaultProjectId: identityString.nullable(),\n\tlocalProjectBindingGeneration: identityString.nullable(),\n\tobservedAtMs: count,\n\treasonCode: z$1.enum([\n\t\t\"profile.workspace.invalid\",\n\t\t\"profile.workspace.missing\",\n\t\t\"project.local_connection.folder_missing\",\n\t\t\"project.local_connection.invalid\",\n\t\t\"project.local_connection.missing\"\n\t]).nullable(),\n\tsource: z$1.enum([\"default_project\", \"profile_workspace\"]),\n\tstatus: z$1.enum([\n\t\t\"invalid\",\n\t\t\"missing\",\n\t\t\"ready\"\n\t])\n});\nconst readyWorkingFolder = {\n\tconfiguredWorkspacePath: z$1.string().min(1),\n\teffectiveRuntimeWorkingDirectory: z$1.string().min(1),\n\truntimeContext: providerDispatchRuntimeContextSchema,\n\tstatus: z$1.literal(\"ready\"),\n\tworkingFolderFact: profileWorkingFolderFactSchema\n};\nconst serviceExecutionHostRouteSchema = cachedDaemonRouteConfigSchema.extend({\n\tagentControllerConversationId: identityString.nullable().optional(),\n\tworkingFolderRuntime: z$1.discriminatedUnion(\"workingFolderSource\", [z$1.strictObject({\n\t\t...readyWorkingFolder,\n\t\tconfigPath: z$1.string().min(1),\n\t\tworkspaceMode: z$1.enum([\"openmeld_managed\", \"custom\"]),\n\t\tworkingFolderSource: z$1.literal(\"profile_workspace\")\n\t}), z$1.strictObject({\n\t\t...readyWorkingFolder,\n\t\tconfigPath: z$1.null(),\n\t\tworkspaceMode: z$1.null(),\n\t\tdefaultProjectId: identityString,\n\t\tdefaultProjectBindingGeneration: identityString,\n\t\tworkingFolderSource: z$1.literal(\"default_project\")\n\t})]).optional()\n});\nconst serviceExecutionHostCatalogSchema = z$1.strictObject({\n\trevision: z$1.number().int().positive(),\n\texpectedRoutesContractVersion: z$1.literal(\"v4\").optional(),\n\tprofileIds: z$1.array(identityString).max(1e4),\n\troutes: z$1.array(serviceExecutionHostRouteSchema).max(1e4),\n\tskippedProfiles: z$1.array(skippedDaemonProfileSchema).max(1e4),\n\tworkingFolderExpectedProfileIds: z$1.array(identityString).max(1e4).optional(),\n\tworkingFolderObservations: z$1.array(localWakeRouteWorkingFolderObservationSchema).max(1e4).optional()\n}).superRefine((catalog, context) => {\n\tconst ids = new Set(catalog.profileIds);\n\tconst routes = new Set(catalog.routes.map((route) => route.profileId));\n\tif (ids.size !== catalog.profileIds.length || routes.size !== catalog.routes.length || ids.size !== routes.size || catalog.profileIds.some((id) => !routes.has(id))) context.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"Host catalog must contain exactly one route per profile.\"\n\t});\n});\nconst reportResult = z$1.strictObject({\n\tstatus: z$1.enum([\"skipped\", \"submitted\"]),\n\treasonCodes: z$1.array(z$1.string().max(256)).max(1024),\n\tsubmittedCount: count,\n\tfailedCount: count\n});\nconst executionFrameCodes = /* @__PURE__ */ new Set([\n\t\"daemon.dispatch.deliver\",\n\t\"daemon.dispatch.lifecycle_acknowledged\",\n\t\"daemon.dispatch.accepted\",\n\t\"daemon.dispatch.interaction_response\",\n\t\"daemon.reasoning.preferences\",\n\t\"daemon.local_agent_control.cancel\",\n\t\"daemon.local_agent_control.interrupt\",\n\t\"daemon.local_agent_control.fork_session\",\n\t\"daemon.local_agent_control.manage_installation\",\n\t\"daemon.local_agent_control.set_enabled\",\n\t\"daemon.execution_recovery.resume_controller_conversation\"\n]);\nconst executionOutputFrameCodes = /* @__PURE__ */ new Set([\n\t\"daemon.dispatch.result\",\n\t\"daemon.dispatch.lifecycle\",\n\t\"daemon.dispatch.runtime_evidence\",\n\t\"daemon.dispatch.reasoning\",\n\t\"daemon.dispatch.tool_activity\",\n\t\"daemon.dispatch.interaction_request\",\n\t\"daemon.dispatch.interaction_delivered\",\n\t\"daemon.dispatch.preview\",\n\t\"daemon.dispatch.preview_end\",\n\t\"daemon.local_agent_control.result\",\n\t\"daemon.execution_recovery.resume_controller_conversation_result\"\n]);\nconst serviceExecutionHostMethods = {\n\tinitialize: {\n\t\tinput: serviceExecutionHostIdentitySchema,\n\t\toutput: serviceExecutionHostSnapshotSchema\n\t},\n\thealth: {\n\t\tinput: empty,\n\t\toutput: serviceExecutionHostSnapshotSchema\n\t},\n\tloadCatalog: {\n\t\tinput: z$1.strictObject({ initial: z$1.boolean() }),\n\t\toutput: serviceExecutionHostCatalogSchema\n\t},\n\tconfigureConnection: {\n\t\tinput: z$1.strictObject({\n\t\t\texecutionAdmissionConfirmation: z$1.boolean().optional(),\n\t\t\tconnectionGeneration: z$1.number().int().positive(),\n\t\t\tcatalogRevision: count,\n\t\t\tleases: z$1.array(runtimeTransportLeaseSchema).max(1e4)\n\t\t}),\n\t\toutput: serviceExecutionHostSnapshotSchema\n\t},\n\tdetachConnection: {\n\t\tinput: z$1.strictObject({ connectionGeneration: z$1.number().int().positive() }),\n\t\toutput: serviceExecutionHostSnapshotSchema\n\t},\n\theartbeat: {\n\t\tinput: z$1.strictObject({\n\t\t\tconnectionGeneration: z$1.number().int().positive(),\n\t\t\tstaleProfileIds: z$1.array(identityString).max(1e4)\n\t\t}),\n\t\toutput: serviceExecutionHostSnapshotSchema\n\t},\n\thandleFrame: {\n\t\tinput: z$1.strictObject({\n\t\t\tconnectionGeneration: z$1.number().int().positive(),\n\t\t\tframe: daemonStreamFrameSchema.refine((frame) => executionFrameCodes.has(frame.code), \"This frame belongs to the connector, not the execution host.\")\n\t\t}),\n\t\toutput: empty\n\t},\n\tcancel: {\n\t\tinput: openMeldDaemonCancelRequestPayloadSchema,\n\t\toutput: openMeldDaemonCancelPayloadSchema\n\t},\n\tinterrupt: {\n\t\tinput: openMeldDaemonInterruptRequestPayloadSchema,\n\t\toutput: openMeldDaemonInterruptPayloadSchema\n\t},\n\tconversationStatus: {\n\t\tinput: openMeldDaemonConversationExecutionStatusRequestPayloadSchema,\n\t\toutput: openMeldDaemonConversationExecutionStatusPayloadSchema\n\t},\n\tsetEnabled: {\n\t\tinput: openMeldDaemonSetLocalAgentEnabledRequestPayloadSchema,\n\t\toutput: openMeldDaemonSetLocalAgentEnabledPayloadSchema\n\t},\n\treportControllers: {\n\t\tinput: z$1.strictObject({ probePolicy: z$1.enum([\"background\", \"fresh\"]) }),\n\t\toutput: reportResult.extend({\n\t\t\treportCount: count,\n\t\t\thasArmedReprobe: z$1.boolean()\n\t\t})\n\t},\n\treportConversations: {\n\t\tinput: empty,\n\t\toutput: reportResult.extend({ proofCount: count })\n\t},\n\tpersistCatalog: {\n\t\tinput: z$1.strictObject({ revision: z$1.number().int().positive() }),\n\t\toutput: empty\n\t},\n\tsyncActivity: {\n\t\tinput: z$1.strictObject({ refreshIntegrations: z$1.boolean().optional() }),\n\t\toutput: empty\n\t},\n\tbeginDrain: {\n\t\tinput: empty,\n\t\toutput: serviceExecutionHostSnapshotSchema\n\t},\n\tdrain: {\n\t\tinput: empty,\n\t\toutput: serviceExecutionHostSnapshotSchema\n\t},\n\tsettleResults: {\n\t\tinput: empty,\n\t\toutput: z$1.strictObject({ status: z$1.enum([\n\t\t\t\"acknowledged\",\n\t\t\t\"connection_closed\",\n\t\t\t\"timeout\"\n\t\t]) })\n\t},\n\tstop: {\n\t\tinput: empty,\n\t\toutput: serviceExecutionHostSnapshotSchema\n\t}\n};\nconst method = z$1.enum(Object.keys(serviceExecutionHostMethods));\nconst envelope = {\n\tprotocol: z$1.literal(SERVICE_EXECUTION_HOST_PROTOCOL),\n\thostInstanceId: z$1.uuid()\n};\nconst serviceExecutionHostRequestSchema = z$1.strictObject({\n\t...envelope,\n\trequestId: z$1.uuid(),\n\tmethod,\n\tpayload: z$1.unknown()\n});\nconst serviceExecutionHostMessageSchema = z$1.discriminatedUnion(\"type\", [\n\tz$1.strictObject({\n\t\t...envelope,\n\t\ttype: z$1.literal(\"reply\"),\n\t\trequestId: z$1.uuid(),\n\t\tmethod,\n\t\tresult: z$1.discriminatedUnion(\"ok\", [z$1.strictObject({\n\t\t\tok: z$1.literal(true),\n\t\t\tpayload: z$1.unknown()\n\t\t}), z$1.strictObject({\n\t\t\tok: z$1.literal(false),\n\t\t\terror: z$1.strictObject({\n\t\t\t\tcode: z$1.string().min(1).max(256),\n\t\t\t\tmessage: z$1.string().min(1).max(4096)\n\t\t\t})\n\t\t})])\n\t}),\n\tz$1.strictObject({\n\t\t...envelope,\n\t\ttype: z$1.literal(\"frame\"),\n\t\tconnectionGeneration: z$1.number().int().positive(),\n\t\tframe: daemonStreamFrameSchema.refine((frame) => executionOutputFrameCodes.has(frame.code), \"The execution host cannot emit connector-owned frames.\")\n\t}),\n\tz$1.strictObject({\n\t\t...envelope,\n\t\ttype: z$1.literal(\"invalidate\"),\n\t\tscope: z$1.enum([\n\t\t\t\"routes\",\n\t\t\t\"activity\",\n\t\t\t\"execution\"\n\t\t])\n\t}),\n\tz$1.strictObject({\n\t\t...envelope,\n\t\ttype: z$1.literal(\"authentication_failure\"),\n\t\tconnectionGeneration: z$1.number().int().positive().nullable(),\n\t\tfailure: z$1.strictObject({\n\t\t\tcredentialFingerprint: z$1.string().min(1).max(256).optional(),\n\t\t\tmessage: z$1.string().min(1).max(4096),\n\t\t\treasonCode: z$1.string().min(1).max(256)\n\t\t})\n\t})\n]);\n//#endregion\nexport { SERVICE_EXECUTION_HOST_MAX_FRAME_BYTES, SERVICE_EXECUTION_HOST_MAX_PENDING_REQUESTS, SERVICE_EXECUTION_HOST_PROTOCOL, profileWorkingFolderFactSchema, serviceExecutionHostCatalogSchema, serviceExecutionHostIdentitySchema, serviceExecutionHostMessageSchema, serviceExecutionHostMethods, serviceExecutionHostOwnerSchema, serviceExecutionHostRequestSchema, serviceExecutionHostRouteSchema, serviceExecutionHostSnapshotSchema };\n\n//# sourceMappingURL=service-execution-host.js.map","import { randomUUID } from \"node:crypto\";\nimport {\n  SERVICE_EXECUTION_HOST_MAX_FRAME_BYTES,\n  SERVICE_EXECUTION_HOST_MAX_PENDING_REQUESTS,\n  SERVICE_EXECUTION_HOST_PROTOCOL,\n  type ServiceExecutionHostArguments,\n  type ServiceExecutionHostInput,\n  type ServiceExecutionHostMessage,\n  type ServiceExecutionHostMethod,\n  type ServiceExecutionHostOutput,\n  serviceExecutionHostMessageSchema,\n  serviceExecutionHostMethods,\n  serviceExecutionHostRequestSchema,\n} from \"@openmeld/schemas\";\n\nexport type ExecutionHostChannel = {\n  connected(): boolean;\n  send(message: object, completed: (error: Error | null) => void): void;\n  onMessage(listener: (message: unknown) => void): () => void;\n  onDisconnect(listener: (error?: Error) => void): () => void;\n};\n\nexport class ExecutionHostError extends Error {\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(message);\n    this.name = \"ExecutionHostError\";\n    this.code = code;\n  }\n}\n\nconst RESERVED_CONTROL_REQUESTS = 4;\nconst controlMethods = new Set<ServiceExecutionHostMethod>([\n  \"health\",\n  \"beginDrain\",\n  \"detachConnection\",\n  \"stop\",\n]);\n\nfunction assertFrameSize(message: unknown): number {\n  const serialized = JSON.stringify(message);\n  if (serialized === undefined) {\n    throw new ExecutionHostError(\n      \"host.invalid_frame\",\n      \"Host IPC requires JSON.\"\n    );\n  }\n  const size = Buffer.byteLength(serialized);\n  if (size > SERVICE_EXECUTION_HOST_MAX_FRAME_BYTES) {\n    throw new ExecutionHostError(\n      \"host.frame_too_large\",\n      \"The local execution message exceeds the IPC limit.\"\n    );\n  }\n  return size;\n}\n\nfunction createSender(channel: ExecutionHostChannel) {\n  let queuedBytes = 0;\n  return (message: object, completed: (error: Error | null) => void): void => {\n    const size = assertFrameSize(message);\n    if (!channel.connected()) {\n      throw new ExecutionHostError(\n        \"host.disconnected\",\n        \"The Host IPC channel is closed.\"\n      );\n    }\n    if (queuedBytes + size > SERVICE_EXECUTION_HOST_MAX_FRAME_BYTES * 2) {\n      throw new ExecutionHostError(\n        \"host.backpressure\",\n        \"Host IPC is full; no new message was queued.\"\n      );\n    }\n    queuedBytes += size;\n    let settled = false;\n    const settle = (error: Error | null) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      queuedBytes -= size;\n      completed(error);\n    };\n    try {\n      channel.send(message, settle);\n    } catch (error) {\n      settle(error instanceof Error ? error : new Error(String(error)));\n    }\n  };\n}\n\ntype PendingRequest = {\n  method: ServiceExecutionHostMethod;\n  resolve(value: unknown): void;\n  reject(error: Error): void;\n  timer: ReturnType<typeof setTimeout> | null;\n};\n\nfunction resolveReply(\n  request: PendingRequest,\n  message: Extract<ServiceExecutionHostMessage, { type: \"reply\" }>\n): void {\n  if (!message.result.ok) {\n    request.reject(\n      new ExecutionHostError(\n        message.result.error.code,\n        message.result.error.message\n      )\n    );\n    return;\n  }\n  const result = serviceExecutionHostMethods[request.method].output.safeParse(\n    message.result.payload\n  );\n  if (!result.success) {\n    const error = new ExecutionHostError(\n      \"host.invalid_response\",\n      `Invalid ${request.method} response from the execution host.`\n    );\n    request.reject(error);\n    throw error;\n  }\n  request.resolve(result.data);\n}\n\nexport function createExecutionHostClient(input: {\n  channel: ExecutionHostChannel;\n  hostInstanceId: string;\n  onEvent?(\n    event: Exclude<ServiceExecutionHostMessage, { type: \"reply\" }>\n  ): void;\n  onFailure?(error: Error): void;\n}) {\n  const pending = new Map<string, PendingRequest>();\n  const send = createSender(input.channel);\n  let failure: Error | null = null;\n\n  const fail = (error: Error) => {\n    if (failure) {\n      return;\n    }\n    failure = error;\n    for (const request of pending.values()) {\n      if (request.timer) {\n        clearTimeout(request.timer);\n      }\n      request.reject(error);\n    }\n    pending.clear();\n    input.onFailure?.(error);\n  };\n\n  const stopMessages = input.channel.onMessage((raw) => {\n    if (failure) {\n      return;\n    }\n    try {\n      assertFrameSize(raw);\n      const parsed = serviceExecutionHostMessageSchema.safeParse(raw);\n      if (\n        !parsed.success ||\n        parsed.data.hostInstanceId !== input.hostInstanceId\n      ) {\n        throw new ExecutionHostError(\n          \"host.invalid_response\",\n          \"Host response does not match this process incarnation.\"\n        );\n      }\n      const message = parsed.data;\n      if (message.type !== \"reply\") {\n        input.onEvent?.(message);\n        return;\n      }\n      const request = pending.get(message.requestId);\n      // A timed-out observer is gone, not the accepted operation. Do not retry it\n      // or turn its late result into the outcome of a newer request.\n      if (!request) {\n        return;\n      }\n      if (request.method !== message.method) {\n        throw new ExecutionHostError(\n          \"host.invalid_response\",\n          \"Host response method does not match its request.\"\n        );\n      }\n      pending.delete(message.requestId);\n      if (request.timer) {\n        clearTimeout(request.timer);\n      }\n      resolveReply(request, message);\n    } catch (error) {\n      fail(error instanceof Error ? error : new Error(String(error)));\n    }\n  });\n  const stopDisconnect = input.channel.onDisconnect((cause) => {\n    fail(\n      new ExecutionHostError(\n        \"host.disconnected\",\n        cause\n          ? `The execution host disconnected: ${cause.message}. In-flight outcomes are unconfirmed.`\n          : \"The execution host disconnected; in-flight outcomes are unconfirmed.\"\n      )\n    );\n  });\n\n  return {\n    call<M extends ServiceExecutionHostMethod>(\n      method: M,\n      value: ServiceExecutionHostInput<M>,\n      options: { timeoutMs?: number | null } = {}\n    ): Promise<ServiceExecutionHostOutput<M>> {\n      if (failure) {\n        return Promise.reject(failure);\n      }\n      const limit =\n        SERVICE_EXECUTION_HOST_MAX_PENDING_REQUESTS -\n        (controlMethods.has(method) ? 0 : RESERVED_CONTROL_REQUESTS);\n      if (pending.size >= limit) {\n        return Promise.reject(\n          new ExecutionHostError(\n            \"host.busy\",\n            \"Too many outstanding Host requests; no new request was sent.\"\n          )\n        );\n      }\n      const payload =\n        serviceExecutionHostMethods[method].input.safeParse(value);\n      if (!payload.success) {\n        return Promise.reject(\n          new ExecutionHostError(\n            \"host.invalid_request\",\n            `Invalid ${method} request.`\n          )\n        );\n      }\n      const requestId = randomUUID();\n      const timeoutMs =\n        options.timeoutMs === undefined ? 30_000 : options.timeoutMs;\n      if (\n        timeoutMs !== null &&\n        (!Number.isFinite(timeoutMs) || timeoutMs <= 0)\n      ) {\n        return Promise.reject(\n          new ExecutionHostError(\n            \"host.invalid_timeout\",\n            \"The observer deadline must be positive or absent.\"\n          )\n        );\n      }\n      return new Promise<ServiceExecutionHostOutput<M>>((resolve, reject) => {\n        const request: PendingRequest = {\n          method,\n          resolve: (result) => resolve(result as ServiceExecutionHostOutput<M>),\n          reject,\n          timer: null,\n        };\n        if (timeoutMs !== null) {\n          request.timer = setTimeout(() => {\n            pending.delete(requestId);\n            reject(\n              new ExecutionHostError(\n                \"host.observation_timeout\",\n                `The ${method} response is unconfirmed. No operation was cancelled or retried.`\n              )\n            );\n          }, timeoutMs);\n          request.timer.unref?.();\n        }\n        pending.set(requestId, request);\n        try {\n          send(\n            {\n              protocol: SERVICE_EXECUTION_HOST_PROTOCOL,\n              hostInstanceId: input.hostInstanceId,\n              requestId,\n              method,\n              payload: payload.data,\n            },\n            (error) => {\n              if (error) {\n                fail(error);\n              }\n            }\n          );\n        } catch (error) {\n          pending.delete(requestId);\n          if (request.timer) {\n            clearTimeout(request.timer);\n          }\n          reject(error);\n        }\n      });\n    },\n    pendingCount: () => pending.size,\n    dispose(): void {\n      stopMessages();\n      stopDisconnect();\n      fail(\n        new ExecutionHostError(\n          \"host.observer_closed\",\n          \"The Host observer closed; accepted work was not cancelled.\"\n        )\n      );\n    },\n  };\n}\n\nexport type ExecutionHostHandlers = {\n  [M in ServiceExecutionHostMethod]: (\n    input: ServiceExecutionHostArguments<M>\n  ) => Promise<ServiceExecutionHostOutput<M>> | ServiceExecutionHostOutput<M>;\n};\n\nexport function serveExecutionHost(input: {\n  channel: ExecutionHostChannel;\n  hostInstanceId: string;\n  handlers: ExecutionHostHandlers;\n  onFailure(error: Error): void;\n  onDisconnect(): void;\n}) {\n  const activeIds = new Set<string>();\n  const send = createSender(input.channel);\n  let closed = false;\n\n  const sendMessage = (message: ServiceExecutionHostMessage) => {\n    if (closed) {\n      throw new ExecutionHostError(\n        \"host.disconnected\",\n        \"The connector is no longer observing this Host.\"\n      );\n    }\n    send(message, (error) => {\n      if (error) {\n        input.onFailure(error);\n      }\n    });\n  };\n\n  const stopMessages = input.channel.onMessage((raw) => {\n    if (closed) {\n      return;\n    }\n    let request: ReturnType<typeof serviceExecutionHostRequestSchema.parse>;\n    try {\n      assertFrameSize(raw);\n      const parsed = serviceExecutionHostRequestSchema.safeParse(raw);\n      if (\n        !parsed.success ||\n        parsed.data.hostInstanceId !== input.hostInstanceId\n      ) {\n        throw new ExecutionHostError(\n          \"host.invalid_request\",\n          \"Host request does not match this process incarnation.\"\n        );\n      }\n      request = parsed.data;\n    } catch (error) {\n      input.onFailure(\n        error instanceof Error ? error : new Error(String(error))\n      );\n      return;\n    }\n\n    const respond = (\n      result: Extract<ServiceExecutionHostMessage, { type: \"reply\" }>[\"result\"]\n    ) => {\n      if (!closed) {\n        sendMessage({\n          protocol: SERVICE_EXECUTION_HOST_PROTOCOL,\n          hostInstanceId: input.hostInstanceId,\n          type: \"reply\",\n          requestId: request.requestId,\n          method: request.method,\n          result,\n        });\n      }\n    };\n    const reject = (error: unknown) => {\n      try {\n        respond({\n          ok: false,\n          error: {\n            code:\n              error instanceof ExecutionHostError\n                ? error.code\n                : \"host.operation_failed\",\n            message:\n              (error instanceof Error ? error.message : String(error)).slice(\n                0,\n                4096\n              ) || \"Host operation failed.\",\n          },\n        });\n      } catch (sendError) {\n        input.onFailure(\n          sendError instanceof Error ? sendError : new Error(String(sendError))\n        );\n      }\n    };\n\n    const limit =\n      SERVICE_EXECUTION_HOST_MAX_PENDING_REQUESTS -\n      (controlMethods.has(request.method) ? 0 : RESERVED_CONTROL_REQUESTS);\n    if (activeIds.has(request.requestId) || activeIds.size >= limit) {\n      reject(\n        new ExecutionHostError(\n          \"host.busy\",\n          \"Host request is duplicate or capacity is exhausted; it was not admitted again.\"\n        )\n      );\n      return;\n    }\n    const method = serviceExecutionHostMethods[request.method];\n    const payload = method.input.safeParse(request.payload);\n    if (!payload.success) {\n      reject(\n        new ExecutionHostError(\n          \"host.invalid_request\",\n          `Invalid ${request.method} payload.`\n        )\n      );\n      return;\n    }\n    activeIds.add(request.requestId);\n    // This cast connects the fixed schema table to its corresponding handler.\n    // Both request and response are runtime-validated, including local callers.\n    const handler = input.handlers[request.method] as (\n      value: unknown\n    ) => unknown;\n    Promise.resolve()\n      .then(() => handler(payload.data))\n      .then((result) => {\n        const parsed = method.output.safeParse(result);\n        if (!parsed.success) {\n          throw new ExecutionHostError(\n            \"host.invalid_response\",\n            `The ${request.method} owner returned an invalid response.`\n          );\n        }\n        respond({ ok: true, payload: parsed.data });\n      })\n      .catch(reject)\n      .finally(() => activeIds.delete(request.requestId));\n  });\n  const stopDisconnect = input.channel.onDisconnect(() => {\n    if (closed) {\n      return;\n    }\n    closed = true;\n    input.onDisconnect();\n  });\n  return {\n    emit(event: Exclude<ServiceExecutionHostMessage, { type: \"reply\" }>): void {\n      const parsed = serviceExecutionHostMessageSchema.safeParse(event);\n      if (!parsed.success || event.hostInstanceId !== input.hostInstanceId) {\n        throw new ExecutionHostError(\n          \"host.invalid_event\",\n          \"Invalid execution-host event.\"\n        );\n      }\n      sendMessage(parsed.data);\n    },\n    dispose(): void {\n      closed = true;\n      stopMessages();\n      stopDisconnect();\n    },\n  };\n}\n"],"mappings":";;;;;;;;;AAOA,MAAM,kCAAkC;AAGxC,MAAM,iBAAiB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AACnD,MAAM,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;AAC7C,MAAM,QAAQ,IAAI,aAAa,CAAC,CAAC;AACjC,MAAM,qCAAqC,IAAI,aAAa;CAC3D,aAAa;CACb,UAAU;CACV,MAAM;CACN,iBAAiB;CACjB,2BAA2B;CAC3B,iBAAiB;CACjB,WAAW,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;CACvC,aAAa,IAAI,IAAI;CACrB,gBAAgB,IAAI,IAAI;CACxB,WAAW,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,wBAAwB;AACzB,CAAC;AACD,MAAM,qCAAqC,IAAI,aAAa;CAC3D,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACjC,WAAW,IAAI,KAAK,CAAC,QAAQ,UAAU,CAAC;CACxC,aAAa;CACb,cAAc;CACd,gBAAgB,IAAI,QAAQ;CAC5B,2BAA2B;CAC3B,sBAAsB,IAAI,QAAQ;CAClC,YAAY,IAAI,MAAM,cAAc,CAAC,CAAC,IAAI,GAAG;AAC9C,CAAC;AACD,MAAM,kCAAkC,IAAI,aAAa;CACxD,QAAQ,IAAI,QAAQ,iCAAiC;CACrD,gBAAgB,IAAI,KAAK;CACzB,aAAa;CACb,UAAU;CACV,MAAM;CACN,KAAK,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACjC,cAAc,eAAe,SAAS;CACtC,gBAAgB,IAAI,QAAQ;AAC7B,CAAC;AACD,MAAM,iCAAiC,IAAI,aAAa;CACvD,kBAAkB,eAAe,SAAS;CAC1C,+BAA+B,eAAe,SAAS;CACvD,cAAc;CACd,YAAY,IAAI,KAAK;EACpB;EACA;EACA;EACA;EACA;CACD,CAAC,CAAC,CAAC,SAAS;CACZ,QAAQ,IAAI,KAAK,CAAC,mBAAmB,mBAAmB,CAAC;CACzD,QAAQ,IAAI,KAAK;EAChB;EACA;EACA;CACD,CAAC;AACF,CAAC;AACD,MAAM,qBAAqB;CAC1B,yBAAyB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CAC3C,kCAAkC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CACpD,gBAAgB;CAChB,QAAQ,IAAI,QAAQ,OAAO;CAC3B,mBAAmB;AACpB;AACA,MAAM,kCAAkC,8BAA8B,OAAO;CAC5E,+BAA+B,eAAe,SAAS,CAAC,CAAC,SAAS;CAClE,sBAAsB,IAAI,mBAAmB,uBAAuB,CAAC,IAAI,aAAa;EACrF,GAAG;EACH,YAAY,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;EAC9B,eAAe,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC;EACtD,qBAAqB,IAAI,QAAQ,mBAAmB;CACrD,CAAC,GAAG,IAAI,aAAa;EACpB,GAAG;EACH,YAAY,IAAI,KAAK;EACrB,eAAe,IAAI,KAAK;EACxB,kBAAkB;EAClB,iCAAiC;EACjC,qBAAqB,IAAI,QAAQ,iBAAiB;CACnD,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;AACf,CAAC;AACD,MAAM,oCAAoC,IAAI,aAAa;CAC1D,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACtC,+BAA+B,IAAI,QAAQ,IAAI,CAAC,CAAC,SAAS;CAC1D,YAAY,IAAI,MAAM,cAAc,CAAC,CAAC,IAAI,GAAG;CAC7C,QAAQ,IAAI,MAAM,+BAA+B,CAAC,CAAC,IAAI,GAAG;CAC1D,iBAAiB,IAAI,MAAM,0BAA0B,CAAC,CAAC,IAAI,GAAG;CAC9D,iCAAiC,IAAI,MAAM,cAAc,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CAC7E,2BAA2B,IAAI,MAAM,4CAA4C,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;AACtG,CAAC,CAAC,CAAC,aAAa,SAAS,YAAY;CACpC,MAAM,MAAM,IAAI,IAAI,QAAQ,UAAU;CACtC,MAAM,SAAS,IAAI,IAAI,QAAQ,OAAO,KAAK,UAAU,MAAM,SAAS,CAAC;CACrE,IAAI,IAAI,SAAS,QAAQ,WAAW,UAAU,OAAO,SAAS,QAAQ,OAAO,UAAU,IAAI,SAAS,OAAO,QAAQ,QAAQ,WAAW,MAAM,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,QAAQ,SAAS;EACrL,MAAM;EACN,SAAS;CACV,CAAC;AACF,CAAC;AACD,MAAM,eAAe,IAAI,aAAa;CACrC,QAAQ,IAAI,KAAK,CAAC,WAAW,WAAW,CAAC;CACzC,aAAa,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI;CACtD,gBAAgB;CAChB,aAAa;AACd,CAAC;AACD,MAAM,sCAAsC,IAAI,IAAI;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,4CAA4C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,8BAA8B;CACnC,YAAY;EACX,OAAO;EACP,QAAQ;CACT;CACA,QAAQ;EACP,OAAO;EACP,QAAQ;CACT;CACA,aAAa;EACZ,OAAO,IAAI,aAAa,EAAE,SAAS,IAAI,QAAQ,EAAE,CAAC;EAClD,QAAQ;CACT;CACA,qBAAqB;EACpB,OAAO,IAAI,aAAa;GACvB,gCAAgC,IAAI,QAAQ,CAAC,CAAC,SAAS;GACvD,sBAAsB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;GAClD,iBAAiB;GACjB,QAAQ,IAAI,MAAM,2BAA2B,CAAC,CAAC,IAAI,GAAG;EACvD,CAAC;EACD,QAAQ;CACT;CACA,kBAAkB;EACjB,OAAO,IAAI,aAAa,EAAE,sBAAsB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;EAC/E,QAAQ;CACT;CACA,WAAW;EACV,OAAO,IAAI,aAAa;GACvB,sBAAsB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;GAClD,iBAAiB,IAAI,MAAM,cAAc,CAAC,CAAC,IAAI,GAAG;EACnD,CAAC;EACD,QAAQ;CACT;CACA,aAAa;EACZ,OAAO,IAAI,aAAa;GACvB,sBAAsB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;GAClD,OAAO,wBAAwB,QAAQ,UAAU,oBAAoB,IAAI,MAAM,IAAI,GAAG,8DAA8D;EACrJ,CAAC;EACD,QAAQ;CACT;CACA,QAAQ;EACP,OAAO;EACP,QAAQ;CACT;CACA,WAAW;EACV,OAAO;EACP,QAAQ;CACT;CACA,oBAAoB;EACnB,OAAO;EACP,QAAQ;CACT;CACA,YAAY;EACX,OAAO;EACP,QAAQ;CACT;CACA,mBAAmB;EAClB,OAAO,IAAI,aAAa,EAAE,aAAa,IAAI,KAAK,CAAC,cAAc,OAAO,CAAC,EAAE,CAAC;EAC1E,QAAQ,aAAa,OAAO;GAC3B,aAAa;GACb,iBAAiB,IAAI,QAAQ;EAC9B,CAAC;CACF;CACA,qBAAqB;EACpB,OAAO;EACP,QAAQ,aAAa,OAAO,EAAE,YAAY,MAAM,CAAC;CAClD;CACA,gBAAgB;EACf,OAAO,IAAI,aAAa,EAAE,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;EACnE,QAAQ;CACT;CACA,cAAc;EACb,OAAO,IAAI,aAAa,EAAE,qBAAqB,IAAI,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;EACzE,QAAQ;CACT;CACA,YAAY;EACX,OAAO;EACP,QAAQ;CACT;CACA,OAAO;EACN,OAAO;EACP,QAAQ;CACT;CACA,eAAe;EACd,OAAO;EACP,QAAQ,IAAI,aAAa,EAAE,QAAQ,IAAI,KAAK;GAC3C;GACA;GACA;EACD,CAAC,EAAE,CAAC;CACL;CACA,MAAM;EACL,OAAO;EACP,QAAQ;CACT;AACD;AACA,MAAM,SAAS,IAAI,KAAK,OAAO,KAAK,2BAA2B,CAAC;AAChE,MAAM,WAAW;CAChB,UAAU,IAAI,QAAQ,+BAA+B;CACrD,gBAAgB,IAAI,KAAK;AAC1B;AACA,MAAM,oCAAoC,IAAI,aAAa;CAC1D,GAAG;CACH,WAAW,IAAI,KAAK;CACpB;CACA,SAAS,IAAI,QAAQ;AACtB,CAAC;AACD,MAAM,oCAAoC,IAAI,mBAAmB,QAAQ;CACxE,IAAI,aAAa;EAChB,GAAG;EACH,MAAM,IAAI,QAAQ,OAAO;EACzB,WAAW,IAAI,KAAK;EACpB;EACA,QAAQ,IAAI,mBAAmB,MAAM,CAAC,IAAI,aAAa;GACtD,IAAI,IAAI,QAAQ,IAAI;GACpB,SAAS,IAAI,QAAQ;EACtB,CAAC,GAAG,IAAI,aAAa;GACpB,IAAI,IAAI,QAAQ,KAAK;GACrB,OAAO,IAAI,aAAa;IACvB,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;IACjC,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;GACtC,CAAC;EACF,CAAC,CAAC,CAAC;CACJ,CAAC;CACD,IAAI,aAAa;EAChB,GAAG;EACH,MAAM,IAAI,QAAQ,OAAO;EACzB,sBAAsB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;EAClD,OAAO,wBAAwB,QAAQ,UAAU,0BAA0B,IAAI,MAAM,IAAI,GAAG,wDAAwD;CACrJ,CAAC;CACD,IAAI,aAAa;EAChB,GAAG;EACH,MAAM,IAAI,QAAQ,YAAY;EAC9B,OAAO,IAAI,KAAK;GACf;GACA;GACA;EACD,CAAC;CACF,CAAC;CACD,IAAI,aAAa;EAChB,GAAG;EACH,MAAM,IAAI,QAAQ,wBAAwB;EAC1C,sBAAsB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EAC7D,SAAS,IAAI,aAAa;GACzB,uBAAuB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;GAC7D,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;GACrC,YAAY,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;EACxC,CAAC;CACF,CAAC;AACF,CAAC;;;ACtQD,IAAa,qBAAb,cAAwC,MAAM;CAC5C;CAEA,YAAY,MAAc,SAAiB;EACzC,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;AAEA,MAAM,4BAA4B;AAClC,MAAM,iCAAiB,IAAI,IAAgC;CACzD;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,gBAAgB,SAA0B;CACjD,MAAM,aAAa,KAAK,UAAU,OAAO;CACzC,IAAI,eAAe,KAAA,GACjB,MAAM,IAAI,mBACR,sBACA,yBACF;CAEF,MAAM,OAAO,OAAO,WAAW,UAAU;CACzC,IAAI,OAAA,SACF,MAAM,IAAI,mBACR,wBACA,oDACF;CAEF,OAAO;AACT;AAEA,SAAS,aAAa,SAA+B;CACnD,IAAI,cAAc;CAClB,QAAQ,SAAiB,cAAmD;EAC1E,MAAM,OAAO,gBAAgB,OAAO;EACpC,IAAI,CAAC,QAAQ,UAAU,GACrB,MAAM,IAAI,mBACR,qBACA,iCACF;EAEF,IAAI,cAAc,OAAA,UAAgD,GAChE,MAAM,IAAI,mBACR,qBACA,8CACF;EAEF,eAAe;EACf,IAAI,UAAU;EACd,MAAM,UAAU,UAAwB;GACtC,IAAI,SACF;GAEF,UAAU;GACV,eAAe;GACf,UAAU,KAAK;EACjB;EACA,IAAI;GACF,QAAQ,KAAK,SAAS,MAAM;EAC9B,SAAS,OAAO;GACd,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EAClE;CACF;AACF;AASA,SAAS,aACP,SACA,SACM;CACN,IAAI,CAAC,QAAQ,OAAO,IAAI;EACtB,QAAQ,OACN,IAAI,mBACF,QAAQ,OAAO,MAAM,MACrB,QAAQ,OAAO,MAAM,OACvB,CACF;EACA;CACF;CACA,MAAM,SAAS,4BAA4B,QAAQ,OAAO,CAAC,OAAO,UAChE,QAAQ,OAAO,OACjB;CACA,IAAI,CAAC,OAAO,SAAS;EACnB,MAAM,QAAQ,IAAI,mBAChB,yBACA,WAAW,QAAQ,OAAO,mCAC5B;EACA,QAAQ,OAAO,KAAK;EACpB,MAAM;CACR;CACA,QAAQ,QAAQ,OAAO,IAAI;AAC7B;AAEA,SAAgB,0BAA0B,OAOvC;CACD,MAAM,0BAAU,IAAI,IAA4B;CAChD,MAAM,OAAO,aAAa,MAAM,OAAO;CACvC,IAAI,UAAwB;CAE5B,MAAM,QAAQ,UAAiB;EAC7B,IAAI,SACF;EAEF,UAAU;EACV,KAAK,MAAM,WAAW,QAAQ,OAAO,GAAG;GACtC,IAAI,QAAQ,OACV,aAAa,QAAQ,KAAK;GAE5B,QAAQ,OAAO,KAAK;EACtB;EACA,QAAQ,MAAM;EACd,MAAM,YAAY,KAAK;CACzB;CAEA,MAAM,eAAe,MAAM,QAAQ,WAAW,QAAQ;EACpD,IAAI,SACF;EAEF,IAAI;GACF,gBAAgB,GAAG;GACnB,MAAM,SAAS,kCAAkC,UAAU,GAAG;GAC9D,IACE,CAAC,OAAO,WACR,OAAO,KAAK,mBAAmB,MAAM,gBAErC,MAAM,IAAI,mBACR,yBACA,wDACF;GAEF,MAAM,UAAU,OAAO;GACvB,IAAI,QAAQ,SAAS,SAAS;IAC5B,MAAM,UAAU,OAAO;IACvB;GACF;GACA,MAAM,UAAU,QAAQ,IAAI,QAAQ,SAAS;GAG7C,IAAI,CAAC,SACH;GAEF,IAAI,QAAQ,WAAW,QAAQ,QAC7B,MAAM,IAAI,mBACR,yBACA,kDACF;GAEF,QAAQ,OAAO,QAAQ,SAAS;GAChC,IAAI,QAAQ,OACV,aAAa,QAAQ,KAAK;GAE5B,aAAa,SAAS,OAAO;EAC/B,SAAS,OAAO;GACd,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EAChE;CACF,CAAC;CACD,MAAM,iBAAiB,MAAM,QAAQ,cAAc,UAAU;EAC3D,KACE,IAAI,mBACF,qBACA,QACI,oCAAoC,MAAM,QAAQ,yCAClD,sEACN,CACF;CACF,CAAC;CAED,OAAO;EACL,KACE,QACA,OACA,UAAyC,CAAC,GACF;GACxC,IAAI,SACF,OAAO,QAAQ,OAAO,OAAO;GAE/B,MAAM,QAAA,MAEH,eAAe,IAAI,MAAM,IAAI,IAAI;GACpC,IAAI,QAAQ,QAAQ,OAClB,OAAO,QAAQ,OACb,IAAI,mBACF,aACA,8DACF,CACF;GAEF,MAAM,UACJ,4BAA4B,OAAO,CAAC,MAAM,UAAU,KAAK;GAC3D,IAAI,CAAC,QAAQ,SACX,OAAO,QAAQ,OACb,IAAI,mBACF,wBACA,WAAW,OAAO,UACpB,CACF;GAEF,MAAM,YAAY,WAAW;GAC7B,MAAM,YACJ,QAAQ,cAAc,KAAA,IAAY,MAAS,QAAQ;GACrD,IACE,cAAc,SACb,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,IAE7C,OAAO,QAAQ,OACb,IAAI,mBACF,wBACA,mDACF,CACF;GAEF,OAAO,IAAI,SAAwC,SAAS,WAAW;IACrE,MAAM,UAA0B;KAC9B;KACA,UAAU,WAAW,QAAQ,MAAuC;KACpE;KACA,OAAO;IACT;IACA,IAAI,cAAc,MAAM;KACtB,QAAQ,QAAQ,iBAAiB;MAC/B,QAAQ,OAAO,SAAS;MACxB,OACE,IAAI,mBACF,4BACA,OAAO,OAAO,iEAChB,CACF;KACF,GAAG,SAAS;KACZ,QAAQ,MAAM,QAAQ;IACxB;IACA,QAAQ,IAAI,WAAW,OAAO;IAC9B,IAAI;KACF,KACE;MACE,UAAU;MACV,gBAAgB,MAAM;MACtB;MACA;MACA,SAAS,QAAQ;KACnB,IACC,UAAU;MACT,IAAI,OACF,KAAK,KAAK;KAEd,CACF;IACF,SAAS,OAAO;KACd,QAAQ,OAAO,SAAS;KACxB,IAAI,QAAQ,OACV,aAAa,QAAQ,KAAK;KAE5B,OAAO,KAAK;IACd;GACF,CAAC;EACH;EACA,oBAAoB,QAAQ;EAC5B,UAAgB;GACd,aAAa;GACb,eAAe;GACf,KACE,IAAI,mBACF,wBACA,4DACF,CACF;EACF;CACF;AACF;AAQA,SAAgB,mBAAmB,OAMhC;CACD,MAAM,4BAAY,IAAI,IAAY;CAClC,MAAM,OAAO,aAAa,MAAM,OAAO;CACvC,IAAI,SAAS;CAEb,MAAM,eAAe,YAAyC;EAC5D,IAAI,QACF,MAAM,IAAI,mBACR,qBACA,iDACF;EAEF,KAAK,UAAU,UAAU;GACvB,IAAI,OACF,MAAM,UAAU,KAAK;EAEzB,CAAC;CACH;CAEA,MAAM,eAAe,MAAM,QAAQ,WAAW,QAAQ;EACpD,IAAI,QACF;EAEF,IAAI;EACJ,IAAI;GACF,gBAAgB,GAAG;GACnB,MAAM,SAAS,kCAAkC,UAAU,GAAG;GAC9D,IACE,CAAC,OAAO,WACR,OAAO,KAAK,mBAAmB,MAAM,gBAErC,MAAM,IAAI,mBACR,wBACA,uDACF;GAEF,UAAU,OAAO;EACnB,SAAS,OAAO;GACd,MAAM,UACJ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAC1D;GACA;EACF;EAEA,MAAM,WACJ,WACG;GACH,IAAI,CAAC,QACH,YAAY;IACV,UAAU;IACV,gBAAgB,MAAM;IACtB,MAAM;IACN,WAAW,QAAQ;IACnB,QAAQ,QAAQ;IAChB;GACF,CAAC;EAEL;EACA,MAAM,UAAU,UAAmB;GACjC,IAAI;IACF,QAAQ;KACN,IAAI;KACJ,OAAO;MACL,MACE,iBAAiB,qBACb,MAAM,OACN;MACN,UACG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAA,CAAG,MACvD,GACA,IACF,KAAK;KACT;IACF,CAAC;GACH,SAAS,WAAW;IAClB,MAAM,UACJ,qBAAqB,QAAQ,YAAY,IAAI,MAAM,OAAO,SAAS,CAAC,CACtE;GACF;EACF;EAEA,MAAM,QAAA,MAEH,eAAe,IAAI,QAAQ,MAAM,IAAI,IAAI;EAC5C,IAAI,UAAU,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ,OAAO;GAC/D,OACE,IAAI,mBACF,aACA,gFACF,CACF;GACA;EACF;EACA,MAAM,SAAS,4BAA4B,QAAQ;EACnD,MAAM,UAAU,OAAO,MAAM,UAAU,QAAQ,OAAO;EACtD,IAAI,CAAC,QAAQ,SAAS;GACpB,OACE,IAAI,mBACF,wBACA,WAAW,QAAQ,OAAO,UAC5B,CACF;GACA;EACF;EACA,UAAU,IAAI,QAAQ,SAAS;EAG/B,MAAM,UAAU,MAAM,SAAS,QAAQ;EAGvC,QAAQ,QAAQ,CAAC,CACd,WAAW,QAAQ,QAAQ,IAAI,CAAC,CAAC,CACjC,MAAM,WAAW;GAChB,MAAM,SAAS,OAAO,OAAO,UAAU,MAAM;GAC7C,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,mBACR,yBACA,OAAO,QAAQ,OAAO,qCACxB;GAEF,QAAQ;IAAE,IAAI;IAAM,SAAS,OAAO;GAAK,CAAC;EAC5C,CAAC,CAAC,CACD,MAAM,MAAM,CAAC,CACb,cAAc,UAAU,OAAO,QAAQ,SAAS,CAAC;CACtD,CAAC;CACD,MAAM,iBAAiB,MAAM,QAAQ,mBAAmB;EACtD,IAAI,QACF;EAEF,SAAS;EACT,MAAM,aAAa;CACrB,CAAC;CACD,OAAO;EACL,KAAK,OAAsE;GACzE,MAAM,SAAS,kCAAkC,UAAU,KAAK;GAChE,IAAI,CAAC,OAAO,WAAW,MAAM,mBAAmB,MAAM,gBACpD,MAAM,IAAI,mBACR,sBACA,+BACF;GAEF,YAAY,OAAO,IAAI;EACzB;EACA,UAAgB;GACd,SAAS;GACT,aAAa;GACb,eAAe;EACjB;CACF;AACF"}

package/dist/cli-binary-manifest-Bjf6T7Ef.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-binary-manifest-Bjf6T7Ef.js","names":[],"sources":["../../../packages/schemas/dist/schemas/http/cli-binary-manifest.js"],"sourcesContent":["import { windowsPublisherNameSchema } from \"../../windows-artifact.js\";\nimport * as z$1 from \"zod/v4\";\n//#region src/schemas/http/cli-binary-manifest.ts\nconst SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/u;\nfunction resolveCliBinaryPlatform(os, arch) {\n\treturn `${os === \"win32\" ? \"windows\" : os}-${arch}`;\n}\nconst OPENMELD_MACOS_CLI_SIGNING_IDENTITY = {\n\tcodeIdentifier: \"sh.openmeld.cli\",\n\tteamIdentifier: \"38FFHDPA3B\"\n};\nconst OPENMELD_MACOS_CLI_SIGNING_REQUIREMENT = `anchor apple generic and identifier \"${OPENMELD_MACOS_CLI_SIGNING_IDENTITY.codeIdentifier}\" and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = \"${OPENMELD_MACOS_CLI_SIGNING_IDENTITY.teamIdentifier}\"`;\nfunction isBase64(value) {\n\tif (value.length === 0 || value.length % 4 !== 0) return false;\n\tlet contentEnd = value.length;\n\tif (value.endsWith(\"==\")) contentEnd -= 2;\n\telse if (value.endsWith(\"=\")) contentEnd -= 1;\n\tfor (let index = 0; index < contentEnd; index += 1) {\n\t\tconst code = value.charCodeAt(index);\n\t\tif (!(code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47)) return false;\n\t}\n\treturn true;\n}\nconst cliBinaryArtifactSchema = z$1.object({\n\tsha256: z$1.string().regex(SHA256_HEX_PATTERN),\n\tsizeBytes: z$1.number().int().positive(),\n\turl: z$1.url()\n});\nconst cliBinaryArchiveTransportSchema = z$1.object({\n\tarchiveFormat: z$1.literal(\"gzip\"),\n\tarchiveSha256: z$1.string().regex(SHA256_HEX_PATTERN),\n\tarchiveSizeBytes: z$1.number().int().positive(),\n\tarchiveUrl: z$1.url()\n});\nconst cliBinaryCompressedReleaseSchema = cliBinaryArtifactSchema.extend(cliBinaryArchiveTransportSchema.shape);\nconst cliBinaryDeltaPatchSchema = z$1.object({\n\tbaseSha256: z$1.string().regex(SHA256_HEX_PATTERN),\n\tbaseSizeBytes: z$1.number().int().positive(),\n\tblockSizeBytes: z$1.literal(4096),\n\tpatchFormat: z$1.literal(\"block-ranges-v1\"),\n\tschemaVersion: z$1.literal(1),\n\tsegments: z$1.array(z$1.object({\n\t\tdataBase64: z$1.string().min(4).refine(isBase64, \"invalid base64\"),\n\t\toffset: z$1.number().int().nonnegative()\n\t})).max(1e5),\n\ttargetSha256: z$1.string().regex(SHA256_HEX_PATTERN),\n\ttargetSizeBytes: z$1.number().int().positive()\n});\nconst cliBinaryDeltaTransportSchema = z$1.object({\n\tfromSha256: z$1.string().regex(SHA256_HEX_PATTERN),\n\tfromSizeBytes: z$1.number().int().positive(),\n\tfromVersion: z$1.string().trim().min(1),\n\tpatchCompression: z$1.literal(\"gzip\"),\n\tpatchFormat: z$1.literal(\"block-ranges-v1\"),\n\tpatchPayloadSizeBytes: z$1.number().int().positive(),\n\tpatchSha256: z$1.string().regex(SHA256_HEX_PATTERN),\n\tpatchSizeBytes: z$1.number().int().positive(),\n\tpatchUrl: z$1.url()\n});\nconst cliBinaryReleaseSchema = cliBinaryArtifactSchema.extend({\n\tarchiveFormat: cliBinaryArchiveTransportSchema.shape.archiveFormat.optional(),\n\tarchiveSha256: cliBinaryArchiveTransportSchema.shape.archiveSha256.optional(),\n\tarchiveSizeBytes: cliBinaryArchiveTransportSchema.shape.archiveSizeBytes.optional(),\n\tarchiveUrl: cliBinaryArchiveTransportSchema.shape.archiveUrl.optional(),\n\tcodeIdentifier: z$1.string().trim().min(1).optional(),\n\tdeltas: z$1.array(cliBinaryDeltaTransportSchema).max(8).optional(),\n\tteamIdentifier: z$1.string().trim().min(1).optional(),\n\twindows: z$1.union([z$1.strictObject({\n\t\tpublisherName: windowsPublisherNameSchema,\n\t\tprocessHelper: cliBinaryArtifactSchema\n\t}), z$1.strictObject({\n\t\tmode: z$1.literal(\"internal-unsigned-preview\"),\n\t\tprocessHelper: cliBinaryArtifactSchema\n\t})]).optional()\n}).superRefine((release, context) => {\n\tif (release.windows && (release.codeIdentifier || release.teamIdentifier)) context.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"Windows and macOS signature identities cannot be combined\"\n\t});\n\tconst archiveFields = [\n\t\trelease.archiveFormat,\n\t\trelease.archiveSha256,\n\t\trelease.archiveSizeBytes,\n\t\trelease.archiveUrl\n\t];\n\tif (!(archiveFields.every((value) => value === void 0) || archiveFields.every((value) => value !== void 0))) context.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"compressed transport fields must be provided together\"\n\t});\n\tif (release.codeIdentifier === void 0 !== (release.teamIdentifier === void 0)) context.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"signature identity fields must be provided together\"\n\t});\n\tconst deltaBases = /* @__PURE__ */ new Set();\n\tfor (const delta of release.deltas ?? []) {\n\t\tconst baseKey = `${delta.fromVersion}:${delta.fromSha256}`;\n\t\tif (deltaBases.has(baseKey)) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tmessage: \"delta base records must be unique\"\n\t\t\t});\n\t\t\tbreak;\n\t\t}\n\t\tdeltaBases.add(baseKey);\n\t}\n});\nconst binaryPlatformsSchema = z$1.record(z$1.string().trim().min(1), cliBinaryReleaseSchema).refine((platforms) => Object.keys(platforms).length > 0, { message: \"at least one platform is required\" }).superRefine((platforms, context) => {\n\tfor (const [platform, release] of Object.entries(platforms)) if (platform.startsWith(\"windows-\") !== Boolean(release.windows)) context.addIssue({\n\t\tcode: \"custom\",\n\t\tpath: [platform, \"windows\"],\n\t\tmessage: \"Windows artifact metadata must match its platform\"\n\t});\n});\nconst cliBinaryServiceReleaseSchema = z$1.object({\n\tplatforms: binaryPlatformsSchema,\n\tversion: z$1.string().trim().min(1)\n});\nconst cliBinaryManifestSchema = z$1.object({\n\tchannels: z$1.object({ stable: z$1.object({\n\t\tminRequiredCliVersion: z$1.string().trim().min(1).nullable().optional(),\n\t\tplatforms: binaryPlatformsSchema,\n\t\tservice: cliBinaryServiceReleaseSchema.optional(),\n\t\tversion: z$1.string().trim().min(1)\n\t}).superRefine((stable, context) => {\n\t\tif (!stable.service) return;\n\t\tfor (const platform of Object.keys(stable.platforms)) if (!stable.service.platforms[platform]) context.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tpath: [\n\t\t\t\t\"service\",\n\t\t\t\t\"platforms\",\n\t\t\t\tplatform\n\t\t\t],\n\t\t\tmessage: \"a Service artifact is required for every CLI platform\"\n\t\t});\n\t}) }),\n\tschemaVersion: z$1.literal(1)\n});\n//#endregion\nexport { OPENMELD_MACOS_CLI_SIGNING_IDENTITY, OPENMELD_MACOS_CLI_SIGNING_REQUIREMENT, cliBinaryCompressedReleaseSchema, cliBinaryDeltaPatchSchema, cliBinaryDeltaTransportSchema, cliBinaryManifestSchema, cliBinaryReleaseSchema, cliBinaryServiceReleaseSchema, resolveCliBinaryPlatform };\n\n//# sourceMappingURL=cli-binary-manifest.js.map"],"mappings":";;;;;AAGA,MAAM,qBAAqB;AAC3B,SAAS,yBAAyB,IAAI,MAAM;CAC3C,OAAO,GAAG,OAAO,UAAU,YAAY,GAAG,GAAG;AAC9C;AACA,MAAM,sCAAsC;CAC3C,gBAAgB;CAChB,gBAAgB;AACjB;AACA,MAAM,yCAAyC,wCAAwC,oCAAoC,eAAe,8JAA8J,oCAAoC,eAAe;AAC3V,SAAS,SAAS,OAAO;CACxB,IAAI,MAAM,WAAW,KAAK,MAAM,SAAS,MAAM,GAAG,OAAO;CACzD,IAAI,aAAa,MAAM;CACvB,IAAI,MAAM,SAAS,IAAI,GAAG,cAAc;MACnC,IAAI,MAAM,SAAS,GAAG,GAAG,cAAc;CAC5C,KAAK,IAAI,QAAQ,GAAG,QAAQ,YAAY,SAAS,GAAG;EACnD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,EAAE,QAAQ,MAAM,QAAQ,MAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM,QAAQ,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO;CAChI;CACA,OAAO;AACR;AACA,MAAM,0BAA0B,IAAI,OAAO;CAC1C,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,kBAAkB;CAC7C,WAAW,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,KAAK,IAAI,IAAI;AACd,CAAC;AACD,MAAM,kCAAkC,IAAI,OAAO;CAClD,eAAe,IAAI,QAAQ,MAAM;CACjC,eAAe,IAAI,OAAO,CAAC,CAAC,MAAM,kBAAkB;CACpD,kBAAkB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC9C,YAAY,IAAI,IAAI;AACrB,CAAC;AACwC,wBAAwB,OAAO,gCAAgC,KAAK;AAC7G,MAAM,4BAA4B,IAAI,OAAO;CAC5C,YAAY,IAAI,OAAO,CAAC,CAAC,MAAM,kBAAkB;CACjD,eAAe,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC3C,gBAAgB,IAAI,QAAQ,IAAI;CAChC,aAAa,IAAI,QAAQ,iBAAiB;CAC1C,eAAe,IAAI,QAAQ,CAAC;CAC5B,UAAU,IAAI,MAAM,IAAI,OAAO;EAC9B,YAAY,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,UAAU,gBAAgB;EACjE,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACxC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG;CACX,cAAc,IAAI,OAAO,CAAC,CAAC,MAAM,kBAAkB;CACnD,iBAAiB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;AAC9C,CAAC;AACD,MAAM,gCAAgC,IAAI,OAAO;CAChD,YAAY,IAAI,OAAO,CAAC,CAAC,MAAM,kBAAkB;CACjD,eAAe,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC3C,aAAa,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;CACtC,kBAAkB,IAAI,QAAQ,MAAM;CACpC,aAAa,IAAI,QAAQ,iBAAiB;CAC1C,uBAAuB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACnD,aAAa,IAAI,OAAO,CAAC,CAAC,MAAM,kBAAkB;CAClD,gBAAgB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC5C,UAAU,IAAI,IAAI;AACnB,CAAC;AACD,MAAM,yBAAyB,wBAAwB,OAAO;CAC7D,eAAe,gCAAgC,MAAM,cAAc,SAAS;CAC5E,eAAe,gCAAgC,MAAM,cAAc,SAAS;CAC5E,kBAAkB,gCAAgC,MAAM,iBAAiB,SAAS;CAClF,YAAY,gCAAgC,MAAM,WAAW,SAAS;CACtE,gBAAgB,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACpD,QAAQ,IAAI,MAAM,6BAA6B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACjE,gBAAgB,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACpD,SAAS,IAAI,MAAM,CAAC,IAAI,aAAa;EACpC,eAAe;EACf,eAAe;CAChB,CAAC,GAAG,IAAI,aAAa;EACpB,MAAM,IAAI,QAAQ,2BAA2B;EAC7C,eAAe;CAChB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;AACf,CAAC,CAAC,CAAC,aAAa,SAAS,YAAY;CACpC,IAAI,QAAQ,YAAY,QAAQ,kBAAkB,QAAQ,iBAAiB,QAAQ,SAAS;EAC3F,MAAM;EACN,SAAS;CACV,CAAC;CACD,MAAM,gBAAgB;EACrB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;CACT;CACA,IAAI,EAAE,cAAc,OAAO,UAAU,UAAU,KAAK,CAAC,KAAK,cAAc,OAAO,UAAU,UAAU,KAAK,CAAC,IAAI,QAAQ,SAAS;EAC7H,MAAM;EACN,SAAS;CACV,CAAC;CACD,IAAI,QAAQ,mBAAmB,KAAK,OAAO,QAAQ,mBAAmB,KAAK,IAAI,QAAQ,SAAS;EAC/F,MAAM;EACN,SAAS;CACV,CAAC;CACD,MAAM,6BAA6B,IAAI,IAAI;CAC3C,KAAK,MAAM,SAAS,QAAQ,UAAU,CAAC,GAAG;EACzC,MAAM,UAAU,GAAG,MAAM,YAAY,GAAG,MAAM;EAC9C,IAAI,WAAW,IAAI,OAAO,GAAG;GAC5B,QAAQ,SAAS;IAChB,MAAM;IACN,SAAS;GACV,CAAC;GACD;EACD;EACA,WAAW,IAAI,OAAO;CACvB;AACD,CAAC;AACD,MAAM,wBAAwB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC,QAAQ,cAAc,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,GAAG,EAAE,SAAS,oCAAoC,CAAC,CAAC,CAAC,aAAa,WAAW,YAAY;CAC3O,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,SAAS,GAAG,IAAI,SAAS,WAAW,UAAU,MAAM,QAAQ,QAAQ,OAAO,GAAG,QAAQ,SAAS;EAC/I,MAAM;EACN,MAAM,CAAC,UAAU,SAAS;EAC1B,SAAS;CACV,CAAC;AACF,CAAC;AACD,MAAM,gCAAgC,IAAI,OAAO;CAChD,WAAW;CACX,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AACD,MAAM,0BAA0B,IAAI,OAAO;CAC1C,UAAU,IAAI,OAAO,EAAE,QAAQ,IAAI,OAAO;EACzC,uBAAuB,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACtE,WAAW;EACX,SAAS,8BAA8B,SAAS;EAChD,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC,CAAC,aAAa,QAAQ,YAAY;EACnC,IAAI,CAAC,OAAO,SAAS;EACrB,KAAK,MAAM,YAAY,OAAO,KAAK,OAAO,SAAS,GAAG,IAAI,CAAC,OAAO,QAAQ,UAAU,WAAW,QAAQ,SAAS;GAC/G,MAAM;GACN,MAAM;IACL;IACA;IACA;GACD;GACA,SAAS;EACV,CAAC;CACF,CAAC,EAAE,CAAC;CACJ,eAAe,IAAI,QAAQ,CAAC;AAC7B,CAAC"}